alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaviruspandemic.com"; sid:512000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcoronavirus.com"; sid:512001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-coronavirus.com"; sid:512002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona19.com"; sid:512003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.club"; sid:512004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19virus.com"; sid:512005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid19.com"; sid:512006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcoronavirus.com"; sid:512007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awesome-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awesome-coronavirus.com"; sid:512008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid-19.com"; sid:512009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.com"; sid:512010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronaready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronaready.com"; sid:512011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamap.com"; sid:512012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecorona.com"; sid:512013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecovid.com"; sid:512014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concoronavirus.com"; sid:512015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19korea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19korea.com"; sid:512016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19.net"; sid:512017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19shot.com"; sid:512018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa.club"; sid:512019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alert.com"; sid:512020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alerte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alerte.com"; sid:512021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarmor.com"; sid:512022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababes.com"; sid:512023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies.com"; sid:512024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies.net"; sid:512025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy.com"; sid:512026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabee.com"; sid:512027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabit.com"; sid:512028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreak.com"; sid:512029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabump.com"; sid:512030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabump.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabump.net"; sid:512031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabunker.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabunker.biz"; sid:512032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.co.uk"; sid:512033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.uk"; sid:512034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachain.com"; sid:512035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachella.com"; sid:512036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaim.com"; sid:512037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclear.com"; sid:512038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloak.com"; sid:512039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainment.com"; sid:512040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacop.com"; sid:512041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorona.today"; sid:512042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrate.com"; sid:512043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.net"; sid:512044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacut.com"; sid:512045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadancefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadancefestival.com"; sid:512046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfektion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfektion.net"; sid:512047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfektion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfektion.net"; sid:512048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestroyer.com"; sid:512049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasemask.com"; sid:512050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoheightsseniorliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoheightsseniorliving.com"; sid:512051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadude.com"; sid:512052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafestival.com"; sid:512053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafever.com"; sid:512054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.com"; sid:512055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguards.com"; sid:512056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoax.com"; sid:512057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainamerica.com"; sid:512058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectioncare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectioncare.com"; sid:512059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfection.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfection.report"; sid:512060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-japan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-japan.net"; sid:512061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakey.com"; sid:512062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.com"; sid:512063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.net"; sid:512064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.net"; sid:512065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuits.com"; sid:512066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamap.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamap.life"; sid:512067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasck.com"; sid:512068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskus.com"; sid:512069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameme.com"; sid:512070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamen.com"; sid:512071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamvirus.com"; sid:512072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanegative.com"; sid:512073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanerd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanerd.com"; sid:512074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficialgovernmentwebsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficialgovernmentwebsites.com"; sid:512075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaon.com"; sid:512076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakworldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakworldmap.com"; sid:512077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaniek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaniek.com"; sid:512078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepp.com"; sid:512079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotec.fr - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotec.fr"; sid:512080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiveequipment.com"; sid:512081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quarantine.com"; sid:512082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ready.com"; sid:512083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafemasks.com"; sid:512084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysolutions.com"; sid:512085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysolutions.net"; sid:512086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasave.com"; sid:512087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzmaske.com"; sid:512088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascript.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascript.com"; sid:512089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascriptjs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascriptjs.com"; sid:512090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascuba.com"; sid:512091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfassessment.com"; sid:512092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashirt.com"; sid:512093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas-prevention.com"; sid:512094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprevention.com"; sid:512095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalplayingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalplayingcards.com"; sid:512096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatester.com"; sid:512097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingkits.com"; sid:512098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracker.com"; sid:512099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateapp.com"; sid:512100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineus.com"; sid:512101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavandaag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavandaag.com"; sid:512102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral.fyi"; sid:512103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisadvice.com"; sid:512104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19spray.com"; sid:512105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19spray.com"; sid:512106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-20.com"; sid:512107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairmask.com"; sid:512108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisoftware.com"; sid:512109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisoftware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisoftware.net"; sid:512110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-area.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-area.com"; sid:512111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusau.com"; sid:512112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-awareness.com"; sid:512113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawarenesss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawarenesss.com"; sid:512114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusban.com"; sid:512115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakingnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakingnewsnow.com"; sid:512116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabiscbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabiscbdoil.com"; sid:512117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabisoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabisoil.com"; sid:512118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapecod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapecod.com"; sid:512119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscards.com"; sid:512120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareclinic.com"; sid:512121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarestore.com"; sid:512122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaribbean.com"; sid:512123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbdoil.com"; sid:512124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbgaoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbgaoil.com"; sid:512125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbgoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbgoil.com"; sid:512126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-check.com"; sid:512127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-check.com"; sid:512128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.cleaning"; sid:512129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean-up.com"; sid:512130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensation.com"; sid:512131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongress.com"; sid:512132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisismanagementplan.com"; sid:512133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisisplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisisplan.com"; sid:512134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusd-19antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusd-19antidote.com"; sid:512135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusde.com"; sid:512136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefencepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefencepack.com"; sid:512137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenders.com"; sid:512138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiaries.com"; sid:512139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomainer.com"; sid:512140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyplans.com"; sid:512141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyresponseplan.com"; sid:512142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespandemic.com"; sid:512143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestrends.com"; sid:512144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexchange.com"; sid:512145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-export.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-export.com"; sid:512146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexport.com"; sid:512147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasks.net"; sid:512148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusfacialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusfacialmask.com"; sid:512149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacialmask.com"; sid:512150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacialmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacialmasks.com"; sid:512151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactcheck.com"; sid:512152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaq.net"; sid:512153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfear.com"; sid:512154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfun.com"; sid:512155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunds.com"; sid:512156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgift.com"; sid:512157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.graphics"; sid:512158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanitiser.com"; sid:512159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandwashing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandwashing.com"; sid:512160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-health.com"; sid:512161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthkit.com"; sid:512162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthkits.com"; sid:512163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthpack.com"; sid:512164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthpacks.com"; sid:512165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthstore.com"; sid:512166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpus.com"; sid:512167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomekit.com"; sid:512168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeprotection.com"; sid:512169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpact.com"; sid:512170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfection.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfection.report"; sid:512171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinnews.com"; sid:512172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinternet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinternet.com"; sid:512173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.kitchen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.kitchen"; sid:512174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleakedinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleakedinfo.com"; sid:512175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-locations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-locations.com"; sid:512176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-losangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-losangeles.com"; sid:512177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaplive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaplive.com"; sid:512178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketplace.com"; sid:512179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmart.com"; sid:512180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasck.com"; sid:512181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskco.com"; sid:512182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskhelp.com"; sid:512183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mask-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mask-n95.com"; sid:512184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskpro.com"; sid:512185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmath.com"; sid:512186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalstore.com"; sid:512187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedstore.com"; sid:512188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiracle.com"; sid:512189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusictherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusictherapist.com"; sid:512190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalcures.com"; sid:512191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalcures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalcures.net"; sid:512192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalremedies.com"; sid:512193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalremedies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalremedies.net"; sid:512194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewengland.com"; sid:512195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nhs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nhs.com"; sid:512196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoticias.com"; sid:512197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-novosti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-novosti.com"; sid:512198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nyc.com"; sid:512199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspac.com"; sid:512200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspacs.com"; sid:512201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmap.com"; sid:512202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspizza.com"; sid:512203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanforschools.com"; sid:512204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-poll.com"; sid:512205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-poll.com"; sid:512206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prep.com"; sid:512207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusprep.com"; sid:512208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prep.com"; sid:512209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprophecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprophecy.com"; sid:512210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionnow.com"; sid:512211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.net"; sid:512212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rus.com"; sid:512213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscams.com"; sid:512214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussf.com"; sid:512215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussia.com"; sid:512216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-simptomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-simptomy.com"; sid:512217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussimulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussimulator.com"; sid:512218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmasks.com"; sid:512219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-statistic.com"; sid:512220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussteps.com"; sid:512221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrategies.com"; sid:512222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvey.net"; sid:512223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustech.com"; sid:512224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test.net"; sid:512225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrends.com"; sid:512226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-uk.com"; sid:512227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunitedstates.com"; sid:512228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusupdates.com"; sid:512229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateslive.com"; sid:512230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateslive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateslive.net"; sid:512231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates.world"; sid:512232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatetoday.com"; sid:512233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacuna.com"; sid:512234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswa.com"; sid:512235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashington.com"; sid:512236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebsite.com"; sid:512237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellness.com"; sid:512238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweltweit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweltweit.com"; sid:512239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world.com"; sid:512240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszine.com"; sid:512241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.zone"; sid:512242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavpn.com"; sid:512243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawell.com"; sid:512244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldwide.com"; sid:512245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19care.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19care.net"; sid:512246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbd.com"; sid:512247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbdoil.com"; sid:512248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centers.com"; sid:512249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinic.com"; sid:512250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closures.com"; sid:512251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensation.com"; sid:512252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisismanagementplan.com"; sid:512253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontamination.com"; sid:512254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19domains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19domains.com"; sid:512255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyresponseplan.com"; sid:512256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.com"; sid:512257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19everything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19everything.com"; sid:512258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faceguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faceguard.com"; sid:512259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-free.com"; sid:512260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.com"; sid:512261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19global.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19global.net"; sid:512262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcare.com"; sid:512263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthkit.com"; sid:512264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthstore.com"; sid:512265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoax.com"; sid:512266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homekit.com"; sid:512267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.life"; sid:512268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19initiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19initiative.com"; sid:512269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killer.com"; sid:512270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killer.com"; sid:512271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kit.com"; sid:512272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kr.com"; sid:512273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latest.com"; sid:512274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mail.com"; sid:512275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-masks.com"; sid:512276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meds.com"; sid:512277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalcures.com"; sid:512278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalremedies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalremedies.net"; sid:512279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nearme.com"; sid:512280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nearme.com"; sid:512281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pharmacy.com"; sid:512282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19playingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19playingcards.com"; sid:512283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19playingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19playingcards.com"; sid:512284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventkit.com"; sid:512285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protect.com"; sid:512286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidresponse.com"; sid:512287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescue.com"; sid:512288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymask.com"; sid:512289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.com"; sid:512290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stat.com"; sid:512291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stop.com"; sid:512292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supply.com"; sid:512293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survival.net"; sid:512294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taskforce.com"; sid:512295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taskforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taskforce.net"; sid:512296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.com"; sid:512297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19themovie.com"; sid:512298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-treatments.com"; sid:512299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccines.com"; sid:512300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacine.com"; sid:512301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruskit.com"; sid:512302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusnearme.com"; sid:512303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusnearme.com"; sid:512304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washington.com"; sid:512305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019-2020.com"; sid:512306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9survivor.com"; sid:512307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapital.com"; sid:512308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.center"; sid:512309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-corona.com"; sid:512310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-corona.net"; sid:512311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona.net"; sid:512312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemask.com"; sid:512313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree19.com"; sid:512314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree2019.com"; sid:512315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-l9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-l9.com"; sid:512316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.net"; sid:512317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidologist.com"; sid:512318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidology.com"; sid:512319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprev.com"; sid:512320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpro.com"; sid:512321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protect.com"; sid:512322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.life"; sid:512323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.net"; sid:512324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantine.com"; sid:512325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.com"; sid:512326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaskforce.com"; sid:512327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrends.com"; sid:512328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtv.com"; sid:512329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizer.com"; sid:512330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcorona.com"; sid:512331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcoronavirus.com"; sid:512332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daiyunwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daiyunwuhan.com"; sid:512333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dirittidifesatutelacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dirittidifesatutelacoronavirus.com"; sid:512334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dodoca-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dodoca-covid19.com"; sid:512335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouwantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouwantcoronavirus.com"; sid:512336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easthamptoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easthamptoncovid-19.com"; sid:512337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccrisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccrisismanagement.com"; sid:512338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccrisismanagementplan.com"; sid:512339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsupply.com"; sid:512340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espandemic.com"; sid:512341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingcoronavirus.com"; sid:512342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcoronaviruses.com"; sid:512343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsoncovid19.com"; sid:512344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19.com"; sid:512345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencorona.com"; sid:512346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haicorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haicorona.club"; sid:512347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcorona.com"; sid:512348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hetcoronavirus.com"; sid:512349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecoronavirus.com"; sid:512350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecoronavirus.com"; sid:512351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancoronavirus.com"; sid:512352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancovidcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancovidcount.com"; sid:512353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancovid19free.com"; sid:512354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kalya-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kalya-pandemic.com"; sid:512355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kalya-pandemic-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kalya-pandemic-protect.com"; sid:512356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercorona.com"; sid:512357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercorona.net"; sid:512358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticoronavirus.com"; sid:512359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcorona.com"; sid:512360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcoronavirus.com"; sid:512361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirus.com"; sid:512362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeintalycovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeintalycovid19free.com"; sid:512363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronaabeeragain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronaabeeragain.com"; sid:512364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronabeeragain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronabeeragain.com"; sid:512365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascacoronavirus.com"; sid:512366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaraviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaraviruscorona.com"; sid:512367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascovid.com"; sid:512368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid19.com"; sid:512369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababies.com"; sid:512370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababy.com"; sid:512371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahurts.com"; sid:512372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushurts.com"; sid:512373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.wtf"; sid:512374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19news.com"; sid:512375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19story.com"; sid:512376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcoronavirus.com"; sid:512377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-corona.com"; sid:512378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsoncovid19.com"; sid:512379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirus.com"; sid:512380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronatest.com"; sid:512381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packcoronavirus.com"; sid:512382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2021.com"; sid:512383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaftermath.com"; sid:512384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicattack.com"; sid:512385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrisismanagementplan.com"; sid:512386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergency.com"; sid:512387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyplan.com"; sid:512388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyresponseplan.com"; sid:512389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichunter.com"; sid:512390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjobs.com"; sid:512391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclab.com"; sid:512392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeds.com"; sid:512393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutpost.com"; sid:512394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanet.com"; sid:512395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotect.com"; sid:512396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionplan.com"; sid:512397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionpolicy.com"; sid:512398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreport.net"; sid:512399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreports.com"; sid:512400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreports.net"; sid:512401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshop.com"; sid:512402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.international"; sid:512403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspray.com"; sid:512404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stop.com"; sid:512405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstop.com"; sid:512406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.world"; sid:512407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicupdates.com"; sid:512408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicepidemic.com"; sid:512409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paraelcoronavirus.com"; sid:512410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepare4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepare4coronavirus.com"; sid:512411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaviruses.com"; sid:512412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecovid-19.com"; sid:512413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecovid.com"; sid:512414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectingyourselffromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectingyourselffromcoronavirus.com"; sid:512415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectingyourselffromcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectingyourselffromcoronavirusnaturally.com"; sid:512416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection4coronavirus.com"; sid:512417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection4coronavrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection4coronavrus.com"; sid:512418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourselffromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourselffromcoronavirus.com"; sid:512419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourselffromcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourselffromcoronavirusnaturally.com"; sid:512420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purchasecoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purchasecoronavaccine.com"; sid:512421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcoronavirus.com"; sid:512422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-coronavirus-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-coronavirus-2.com"; sid:512423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscoronavirus2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscoronavirus2.com"; sid:512424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronavirusmask.com"; sid:512425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscoronamask.com"; sid:512426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spotcoronavirus.com"; sid:512427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus2020.com"; sid:512428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus-covid19.com"; sid:512429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona.com"; sid:512430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19.com"; sid:512431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teebrasilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teebrasilcorona.com"; sid:512432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababies.com"; sid:512433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababy.com"; sid:512434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus19.com"; sid:512435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbook.com"; sid:512436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscrash.com"; sid:512437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscure.net"; sid:512438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruskit.com"; sid:512439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.wtf"; sid:512440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicbox.com"; sid:512441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanvitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanvitus.com"; sid:512442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcorona.com"; sid:512443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumphascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumphascoronavirus.com"; sid:512444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontracoronavirus.com"; sid:512445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporcoronavirus.com"; sid:512446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirus.com"; sid:512447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-covid-19.com"; sid:512448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehavecoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehavecoronavirusmasks.com"; sid:512449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlemon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlemon.com"; sid:512450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-rent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-rent.com"; sid:512451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirs-iebb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirs-iebb.com"; sid:512452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcoronavirus.com"; sid:512453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcoronavirus.com"; sid:512454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapthecoronavirus.com"; sid:512455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019-covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019-covidtest.com"; sid:512456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacoronavirus.com"; sid:512457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidthecoronavirus.com"; sid:512458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona.net"; sid:512459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthecoronavirus.com"; sid:512460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamaskofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamaskofficial.com"; sid:512461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestfacemaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestfacemaskforcoronavirus.com"; sid:512462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcoinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcoinpandemic.com"; sid:512463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruspill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruspill.com"; sid:512464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19masks.com"; sid:512465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19pill.com"; sid:512466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecoronavirus.com"; sid:512467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.club"; sid:512468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.life"; sid:512469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-coronavirus.com"; sid:512470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronavirus.com"; sid:512471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona123.com"; sid:512472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aid.com"; sid:512473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalertservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalertservice.com"; sid:512474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandsun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandsun.com"; sid:512475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanswers.com"; sid:512476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattack.com"; sid:512477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioguard.com"; sid:512478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabust.com"; sid:512479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareproducts.com"; sid:512480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarrier.com"; sid:512481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaution.com"; sid:512482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckup.com"; sid:512483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacities.com"; sid:512484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoin.net"; sid:512485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsultant.com"; sid:512486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorona.com"; sid:512487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountries.com"; sid:512488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19worldmap.com"; sid:512489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis.com"; sid:512490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.biz"; sid:512491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.life"; sid:512492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfektionsmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfektionsmittel.com"; sid:512493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocapitalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocapitalgroup.com"; sid:512494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-explained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-explained.com"; sid:512495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafieber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafieber.com"; sid:512496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilung.com"; sid:512497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilung.net"; sid:512498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpline.com"; sid:512499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-iran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-iran.com"; sid:512500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaart.com"; sid:512501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarma.com"; sid:512502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivenews.com"; sid:512503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live-ticker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live-ticker.club"; sid:512504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskmap.com"; sid:512505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medikament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medikament.com"; sid:512506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminus.com"; sid:512507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mittel.com"; sid:512508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamobile.com"; sid:512509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews-online.com"; sid:512510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapath.com"; sid:512511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapink.com"; sid:512512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapowerrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapowerrx.com"; sid:512513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepbox.com"; sid:512514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectivesuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectivesuits.com"; sid:512515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieffund.com"; sid:512516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rescue.com"; sid:512517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsesolutions.com"; sid:512518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreening.com"; sid:512519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasheild.com"; sid:512520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmart.com"; sid:512521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stocks.com"; sid:512522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.biz"; sid:512523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.supply"; sid:512524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation.ventures"; sid:512525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizer.com"; sid:512526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoken.com"; sid:512527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacuna.com"; sid:512528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavhandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavhandwash.com"; sid:512529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviro.com"; sid:512530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus18.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus18.com"; sid:512531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.biz"; sid:512532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19covid19.com"; sid:512533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccreditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccreditation.com"; sid:512534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaction.com"; sid:512535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaldia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaldia.com"; sid:512536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalerts.net"; sid:512537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalliance.com"; sid:512538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-answers.com"; sid:512539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneys.com"; sid:512540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbox.com"; sid:512541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrief.com"; sid:512542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbriefing.com"; sid:512543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusiness.com"; sid:512544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalculator.com"; sid:512545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalculators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalculators.com"; sid:512546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaution.com"; sid:512547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-china.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-china.net"; sid:512548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaneval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaneval.com"; sid:512549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanplan.com"; sid:512550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcerns.com"; sid:512551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnect.com"; sid:512552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19.today"; sid:512553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailybrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailybrief.com"; sid:512554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dans-le-monde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dans-le-monde.com"; sid:512555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeal.com"; sid:512556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeals.com"; sid:512557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirect.com"; sid:512558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019covid-19.com"; sid:512559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasepandemic.com"; sid:512560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease.today"; sid:512561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfecting.com"; sid:512562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.email"; sid:512563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-en-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-en-france.com"; sid:512564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescape.com"; sid:512565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesfacemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesfacemask.net"; sid:512566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseu.com"; sid:512567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevaluation.com"; sid:512568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-facemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-facemask.net"; sid:512569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarce.com"; sid:512570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoods.com"; sid:512571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcemajeure.com"; sid:512572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgermany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgermany.com"; sid:512573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgt.com"; sid:512574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguate.com"; sid:512575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguatemala.com"; sid:512576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandwash.com"; sid:512577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbs.com"; sid:512578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.directory"; sid:512579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinservice.com"; sid:512580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitaly.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitaly.net"; sid:512581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusit.net"; sid:512582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjapan.com"; sid:512583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-karma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-karma.com"; sid:512584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskarma.com"; sid:512585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruskit.com"; sid:512586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskorea.com"; sid:512587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirm.com"; sid:512588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarkets.com"; sid:512589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketwatch.com"; sid:512590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskforsale.com"; sid:512591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.fyi"; sid:512592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.mobi"; sid:512593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news-and-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news-and-updates.com"; sid:512594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.net"; sid:512595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnutrients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnutrients.com"; sid:512596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanic.com"; sid:512597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreparednessgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreparednessgroup.com"; sid:512598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepbox.com"; sid:512599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepplan.com"; sid:512600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention911.com"; sid:512601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.club"; sid:512602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevents.com"; sid:512603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadiness.com"; sid:512604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-report.com"; sid:512605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscarf.com"; sid:512606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschutz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschutz.net"; sid:512607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirt.com"; sid:512608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirts.com"; sid:512609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshop.net"; sid:512610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoftware.com"; sid:512611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthkorea.com"; sid:512612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstupidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstupidity.com"; sid:512613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuisse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuisse.com"; sid:512614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplier.com"; sid:512615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliers.com"; sid:512616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.supply"; sid:512617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalgear.com"; sid:512618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivordiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivordiaries.com"; sid:512619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorsdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorsdiaries.com"; sid:512620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdater.com"; sid:512621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupd.com"; sid:512622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virususa.com"; sid:512623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusus.net"; sid:512624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.ventures"; sid:512625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisit.com"; sid:512626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswatch.net"; sid:512627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldoutbreak.com"; sid:512628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxout.com"; sid:512629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavishop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavishop.com"; sid:512630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisit.com"; sid:512631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavit.com"; sid:512632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavmasks.com"; sid:512633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsoap.com"; sid:512634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldnews.com"; sid:512635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2020.com"; sid:512636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020.com"; sid:512637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-20.com"; sid:512638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alberta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alberta.com"; sid:512639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19answers.com"; sid:512640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19answers.com"; sid:512641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-antivirus.com"; sid:512642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bc.com"; sid:512643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ca.com"; sid:512644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canada.com"; sid:512645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ca.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ca.net"; sid:512646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19central.com"; sid:512647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-check.com"; sid:512648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19check.com"; sid:512649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checklist.com"; sid:512650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicago.com"; sid:512651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cities.com"; sid:512652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19countries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19countries.com"; sid:512653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dc.com"; sid:512654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deaths.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deaths.world"; sid:512655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detection.com"; sid:512656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosis.com"; sid:512657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diaries.com"; sid:512658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diaries.com"; sid:512659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfect.com"; sid:512660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfected.com"; sid:512661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19domains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19domains.com"; sid:512662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19education.com"; sid:512663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.enterprises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.enterprises"; sid:512664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epidemia.com"; sid:512665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemia.com"; sid:512666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epidemic.com"; sid:512667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemic.com"; sid:512668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familyguide.com"; sid:512669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forgps.com"; sid:512670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-help.com"; sid:512671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help-line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help-line.com"; sid:512672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecare.com"; sid:512673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometreatment.com"; sid:512674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hq.com"; sid:512675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19illness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19illness.com"; sid:512676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infolinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infolinks.com"; sid:512677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-japan.com"; sid:512678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lab.com"; sid:512679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19la.com"; sid:512680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveworldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveworldmap.com"; sid:512681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mexico.com"; sid:512682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ny.com"; sid:512683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ontario.com"; sid:512684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-report.com"; sid:512685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rescue.com"; sid:512686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rescue.com"; sid:512687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safezones.com"; sid:512688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screen.com"; sid:512689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sos.com"; sid:512690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistics.com"; sid:512691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivors.com"; sid:512692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors.com"; sid:512693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptom.com"; sid:512694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomrelief.com"; sid:512695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tester.com"; sid:512696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkits.com"; sid:512697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapy.com"; sid:512698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ticker.com"; sid:512699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toronto.com"; sid:512700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.com"; sid:512701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracker.com"; sid:512702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelguide.com"; sid:512703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdate.com"; sid:512704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsflu.com"; sid:512705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldmap.com"; sid:512706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019cure.com"; sid:512707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019test.com"; sid:512708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019test.com"; sid:512709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid247.com"; sid:512710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid25.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid25.com"; sid:512711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid360.com"; sid:512712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid45.com"; sid:512713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alert.com"; sid:512714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantiviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantiviral.com"; sid:512715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblocker.com"; sid:512716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbulletin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbulletin.com"; sid:512717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentral.com"; sid:512718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck.com"; sid:512719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.community"; sid:512720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultant.com"; sid:512721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultants.com"; sid:512722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcures.com"; sid:512723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfact.com"; sid:512724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax.com"; sid:512725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.com"; sid:512726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-japan.com"; sid:512727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedi.com"; sid:512728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovie.com"; sid:512729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomics.com"; sid:512730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpay.com"; sid:512731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanning.com"; sid:512732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpurse.com"; sid:512733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-s.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-s.email"; sid:512734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupply.com"; sid:512735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor.com"; sid:512736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.watch"; sid:512737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.win"; sid:512738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronastudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronastudy.com"; sid:512739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirusnow.com"; sid:512740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvpandemic.com"; sid:512741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designercoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designercoronavirusmasks.com"; sid:512742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dichbenhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dichbenhcorona.com"; sid:512743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcoronavirus.com"; sid:512744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecoronavirus.com"; sid:512745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronavirus.net"; sid:512746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiacorona.com"; sid:512747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceurope.com"; sid:512748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-masks.com"; sid:512749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsituation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsituation.com"; sid:512750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecovid19.com"; sid:512751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europeepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europeepidemic.com"; sid:512752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyecoronaandson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyecoronaandson.com"; sid:512753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyecoronaandsun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyecoronaandsun.com"; sid:512754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecoronavirusmasks.com"; sid:512755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsoncovid-19.com"; sid:512756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsonpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsonpandemic.com"; sid:512757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followthecorona.com"; sid:512758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcemajeurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcemajeurecoronavirus.com"; sid:512759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusalert.com"; sid:512760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid.com"; sid:512761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid-19.com"; sid:512762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hkcovid19.com"; sid:512763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprepareforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprepareforcoronavirus.com"; sid:512764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.net"; sid:512765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletracovid19.com"; sid:512766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for king-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"king-corona.com"; sid:512767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcoronavirus.com"; sid:512768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerscoronavirus.com"; sid:512769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronaupdate.com"; sid:512770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronaupdates.com"; sid:512771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manmadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manmadecoronavirus.com"; sid:512772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapcovid19.com"; sid:512773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid-19.com"; sid:512774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid19.com"; sid:512775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid-19.com"; sid:512776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid19.com"; sid:512777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid.com"; sid:512778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalog.com"; sid:512779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmask.com"; sid:512780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemic.com"; sid:512781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2covid19.com"; sid:512782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2covid19.net"; sid:512783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronausa.com"; sid:512784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nonocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nonocovid.com"; sid:512785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notocovid-19.com"; sid:512786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notodaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notodaycorona.com"; sid:512787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid.com"; sid:512788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid19.com"; sid:512789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.agency"; sid:512790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboard.com"; sid:512791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbonds.com"; sid:512792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-dot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-dot.com"; sid:512793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfree.com"; sid:512794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-mask.com"; sid:512795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-masking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-masking.com"; sid:512796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmasking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmasking.com"; sid:512797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-masks.net"; sid:512798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmasks.net"; sid:512799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpage.com"; sid:512800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparty.com"; sid:512801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicservices.com"; sid:512802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.supplies"; sid:512803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pillforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pillforcoronavirus.com"; sid:512804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinkcorona.com"; sid:512805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pkcovid-19.com"; sid:512806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycoronavirus.com"; sid:512807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precorona.com"; sid:512808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusnow.com"; sid:512809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19now.com"; sid:512810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcoronavirus.world"; sid:512811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionagainstcoronavirus.com"; sid:512812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionandcoronavirus.com"; sid:512813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionscoronavirus.com"; sid:512814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmaskcorona.com"; sid:512815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcovid-19.com"; sid:512816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefforcovid-19.com"; sid:512817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid.com"; sid:512818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorcoronafight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorcoronafight.com"; sid:512819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecoronavirus.com"; sid:512820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscovid.com"; sid:512821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaspread.com"; sid:512822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirusoutbreak.com"; sid:512823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirusoutbreak.com"; sid:512824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecovid19pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecovid19pill.com"; sid:512825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatracker.com"; sid:512826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdaily.com"; sid:512827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiaries.com"; sid:512828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnow.com"; sid:512829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivordiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivordiaries.com"; sid:512830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivors.com"; sid:512831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivorsdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivorsdiaries.com"; sid:512832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19diaries.com"; sid:512833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19survivors.com"; sid:512834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcoronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcoronavirusdisease.com"; sid:512835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusoutbreak.com"; sid:512836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-coronavirus.com"; sid:512837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronamap.com"; sid:512838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viviannincoronato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viviannincoronato.com"; sid:512839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereiscorona.com"; sid:512840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willyousurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willyousurvivecovid19.com"; sid:512841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for win-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"win-covid-19.net"; sid:512842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcorona.com"; sid:512843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusupdate.com"; sid:512844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanboxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanboxes.com"; sid:512845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfacemask.com"; sid:512846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantoutiao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantoutiao.com"; sid:512847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusrx.com"; sid:512848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronakill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronakill.com"; sid:512849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronakiller.com"; sid:512850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiecoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiecoronapocalypse.com"; sid:512851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123corona.com"; sid:512852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19.com"; sid:512853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.net"; sid:512854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.today"; sid:512855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 88peopleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"88peopleofwuhan.com"; sid:512856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acespandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acespandemic.net"; sid:512857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecoronavirus.com"; sid:512858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovid19.com"; sid:512859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alphacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alphacoronavirusvaccine.com"; sid:512860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaproducts.com"; sid:512861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronax.com"; sid:512862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotecovid19.com"; sid:512863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotocoronavirus.com"; sid:512864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotocovid19.com"; sid:512865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiseptic-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiseptic-corona.com"; sid:512866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivirus-covid19.com"; sid:512867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiancorona.com"; sid:512868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcorona.com"; sid:512869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcoronavirus.com"; sid:512870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirusfree.com"; sid:512871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcorona.com"; sid:512872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betacoronavirusvaccine.com"; sid:512873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcoronavirus.com"; sid:512874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusfacemasks.com"; sid:512875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.net"; sid:512876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cegahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cegahcorona.com"; sid:512877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona.com"; sid:512878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19.com"; sid:512879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid.com"; sid:512880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contra-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contra-coronavirus.com"; sid:512881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.biz"; sid:512882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.club"; sid:512883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirusapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirusapocalypse.com"; sid:512884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus.world"; sid:512885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apparel.com"; sid:512886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabasics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabasics.com"; sid:512887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablaster.com"; sid:512888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabootcamp.com"; sid:512889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuckle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuckle.com"; sid:512890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.com"; sid:512891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.net"; sid:512892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamp.com"; sid:512893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-care24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-care24.com"; sid:512894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare24.com"; sid:512895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepackage.com"; sid:512896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacase.com"; sid:512897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatch.com"; sid:512898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacautious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacautious.com"; sid:512899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacave.com"; sid:512900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclues.com"; sid:512901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollapse.com"; sid:512902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoping.com"; sid:512903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorner.com"; sid:512904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19virus.net"; sid:512905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrew.com"; sid:512906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadailyupdates.com"; sid:512907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathpool.com"; sid:512908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetect.com"; sid:512909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetection.com"; sid:512910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diagnostics.com"; sid:512911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries.com"; sid:512912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-discount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-discount.com"; sid:512913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocreatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocreatives.com"; sid:512914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeg.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeg.club"; sid:512915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaegy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaegy.com"; sid:512916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforfuture.com"; sid:512917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebusiness.com"; sid:512918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebusiness.net"; sid:512919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth-news.com"; sid:512920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbal.com"; sid:512921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpact.com"; sid:512922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainisrael.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainisrael.com"; sid:512923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspected.com"; sid:512924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakit.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakit.care"; sid:512925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise.com"; sid:512926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdates.com"; sid:512927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask-shop.com"; sid:512928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamd.com"; sid:512929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameeting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameeting.biz"; sid:512930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronan95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronan95.com"; sid:512931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanurse.com"; sid:512932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicapp.com"; sid:512933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplace.com"; sid:512934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalipsis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalipsis.com"; sid:512935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapool.com"; sid:512936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapractical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapractical.com"; sid:512937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepare.com"; sid:512938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprescriptions.com"; sid:512939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapresident.com"; sid:512940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotection.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotection.care"; sid:512941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ratgeber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ratgeber.com"; sid:512942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecover.com"; sid:512943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeway.com"; sid:512944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizer.com"; sid:512945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizers.com"; sid:512946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasentry.com"; sid:512947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashots.com"; sid:512948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastat.com"; sid:512949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastuff.com"; sid:512950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivor.com"; sid:512951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemp.com"; sid:512952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronater.com"; sid:512953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesti.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesti.net"; sid:512954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlab.com"; sid:512955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatests.com"; sid:512956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathcfreecbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathcfreecbd.com"; sid:512957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronator.com"; sid:512958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-track.com"; sid:512959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatweets.com"; sid:512960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-updates.com"; sid:512961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaksin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaksin.com"; sid:512962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavanish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavanish.com"; sid:512963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirenschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirenschutz.com"; sid:512964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisories.com"; sid:512965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisory.com"; sid:512966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-alerts.com"; sid:512967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalysis.com"; sid:512968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusa.net"; sid:512969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusannouncement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusannouncement.com"; sid:512970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibiotic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibiotic.com"; sid:512971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantidoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantidoto.com"; sid:512972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapprovedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapprovedmasks.com"; sid:512973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapprovedproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapprovedproducts.com"; sid:512974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarrier.com"; sid:512975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbcp.com"; sid:512976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtest.com"; sid:512977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessplan.com"; sid:512978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessplans.com"; sid:512979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalm.com"; sid:512980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalm.net"; sid:512981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscare.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscare.today"; sid:512982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscase.com"; sid:512983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheckup.com"; sid:512984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscities.com"; sid:512985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningproducts.com"; sid:512986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollege.com"; sid:512987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultations.com"; sid:512988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscount.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscount.net"; sid:512989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-data.com"; sid:512990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesignermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesignermask.com"; sid:512991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirections.com"; sid:512992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirectory.com"; sid:512993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterplan.com"; sid:512994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterplans.com"; sid:512995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectants.com"; sid:512996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectants.com"; sid:512997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantsoap.com"; sid:512998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectionservice.com"; sid:512999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctores.com"; sid:513000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctorforfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctorforfree.com"; sid:513001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdr.com"; sid:513002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecuador.com"; sid:513003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencykit.com"; sid:513004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespana.com"; sid:513005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesreadyeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesreadyeducation.com"; sid:513006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvaccine.com"; sid:513007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevolution.com"; sid:513008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexam.com"; sid:513009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexams.com"; sid:513010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseyeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseyeprotection.com"; sid:513011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-facemask.com"; sid:513012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasksforsale.com"; sid:513013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighter.com"; sid:513014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfight.net"; sid:513015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfl.com"; sid:513016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguard.net"; sid:513017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheadlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheadlines.com"; sid:513018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.healthcare"; sid:513019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthspray.com"; sid:513020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.today"; sid:513021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelponline.com"; sid:513022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotspot.com"; sid:513023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusillinois.com"; sid:513024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.center"; sid:513025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.tips"; sid:513026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinstructions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinstructions.com"; sid:513027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintel.com"; sid:513028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinunitedninestates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinunitedninestates.com"; sid:513029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvesting.com"; sid:513030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestments.com"; sid:513031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusireland.com"; sid:513032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12.com"; sid:513033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12.net"; sid:513034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12prep.com"; sid:513035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12safety.com"; sid:513036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-update.com"; sid:513037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-location.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-location.com"; sid:513038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisiana.com"; sid:513039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasken.com"; sid:513040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaske.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaske.net"; sid:513041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskpeople.com"; sid:513042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksupplier.com"; sid:513043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksupply.com"; sid:513044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusme.com"; sid:513045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalcare.com"; sid:513046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalexam.com"; sid:513047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalexams.com"; sid:513048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalinfo.com"; sid:513049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichigan.com"; sid:513050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmissouri.com"; sid:513051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95facemasks.com"; sid:513052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnearby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnearby.com"; sid:513053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnear.com"; sid:513054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsbreifing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsbreifing.com"; sid:513055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.today"; sid:513056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnineteen.com"; sid:513057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnumber.com"; sid:513058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorg.com"; sid:513059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicapp.com"; sid:513060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.world"; sid:513061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphysician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphysician.com"; sid:513062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphysicians.com"; sid:513063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplan.net"; sid:513064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppesupply.com"; sid:513065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prepare.com"; sid:513066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepk12.com"; sid:513067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepschools.com"; sid:513068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprescriptions.com"; sid:513069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspress.com"; sid:513070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionclinic.com"; sid:513071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionproducts.com"; sid:513072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-silver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-silver.com"; sid:513073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.productions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.productions"; sid:513074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofhome.com"; sid:513075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protective-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protective-mask.com"; sid:513076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrd.com"; sid:513077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadyk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadyk12.com"; sid:513078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusready.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusready.net"; sid:513079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreceipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreceipe.com"; sid:513080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcecenter.com"; sid:513081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresource.net"; sid:513082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrn.com"; sid:513083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaftey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaftey.com"; sid:513084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-scandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-scandal.com"; sid:513085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschoolreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschoolreadiness.com"; sid:513086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusschutz.com"; sid:513087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruss-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruss-covid-19.com"; sid:513088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-secure.com"; sid:513089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-shield.com"; sid:513090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-shirts.com"; sid:513091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoppinglist.com"; sid:513092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussite.com"; sid:513093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-skandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-skandal.com"; sid:513094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-skandal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-skandal.net"; sid:513095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialist.com"; sid:513096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialreport.com"; sid:513097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstates.com"; sid:513098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussummary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussummary.com"; sid:513099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplykit.com"; sid:513100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorkit.com"; sid:513101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomtest.com"; sid:513102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteam.com"; sid:513103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustees.com"; sid:513104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestgear.com"; sid:513105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestpack.com"; sid:513106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestskits.com"; sid:513107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustldr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustldr.com"; sid:513108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-track.com"; sid:513109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrainer.com"; sid:513110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelkit.com"; sid:513111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentcenters.com"; sid:513112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustx.net"; sid:513113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-united-states.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-united-states.com"; sid:513114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniversity.com"; sid:513115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.net"; sid:513116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurlsforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurlsforsale.com"; sid:513117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususnews.com"; sid:513118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirginia.com"; sid:513119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteers.com"; sid:513120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld.world"; sid:513121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirz.com"; sid:513122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawar.com"; sid:513123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawars.com"; sid:513124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couturecoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couturecoronation.com"; sid:513125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19advisories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19advisories.com"; sid:513126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antidoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antidoto.com"; sid:513127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antivirus.com"; sid:513128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirus.com"; sid:513129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canada.com"; sid:513130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carebasket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carebasket.com"; sid:513131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cbd.com"; sid:513132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cbdoil.com"; sid:513133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-crisis.com"; sid:513134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cura.com"; sid:513135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19data.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19data.net"; sid:513136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dk.com"; sid:513137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19feverguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19feverguard.com"; sid:513138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herbs.com"; sid:513139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotline.com"; sid:513140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-impfung.com"; sid:513141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-impfung.com"; sid:513142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impfung.com"; sid:513143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infections.com"; sid:513144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insight.com"; sid:513145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19list.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19list.com"; sid:513146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masks.net"; sid:513147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks.net"; sid:513148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicines.com"; sid:513149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitor.com"; sid:513150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19numbers.com"; sid:513151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oil.com"; sid:513152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prep.com"; sid:513153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepping.com"; sid:513154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocol.com"; sid:513155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.school - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.school"; sid:513156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screening.com"; sid:513157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stack.com"; sid:513158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stocks.com"; sid:513159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivor.com"; sid:513160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tent.com"; sid:513161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testgear.com"; sid:513162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapeutics.com"; sid:513163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-therapy.com"; sid:513164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapy.com"; sid:513165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermoscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermoscan.com"; sid:513166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19videos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19videos.com"; sid:513167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusprotection.com"; sid:513168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldpandemic.com"; sid:513169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20guide.com"; sid:513170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20info.com"; sid:513171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20preparation.com"; sid:513172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauthority.com"; sid:513173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.com"; sid:513174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombat.com"; sid:513175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontroversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontroversy.com"; sid:513176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.com"; sid:513177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoesnotcausedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoesnotcausedeath.com"; sid:513178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunding.com"; sid:513179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgame.com"; sid:513180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguide.com"; sid:513181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincome.com"; sid:513182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs.com"; sid:513183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.net"; sid:513184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascarillas.com"; sid:513185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicines.com"; sid:513186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsupplies.com"; sid:513187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoney.com"; sid:513188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidome.com"; sid:513189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreparation.com"; sid:513190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistance.com"; sid:513191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistancemovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistancemovement.com"; sid:513192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-s.com"; sid:513193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstar.com"; sid:513194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.com"; sid:513195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtent.com"; sid:513196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.com"; sid:513197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.tips"; sid:513198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusalerts.com"; sid:513199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusnews.com"; sid:513200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacovid19.com"; sid:513201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curewuhanvirus.com"; sid:513202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19.com"; sid:513203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-coronavirus.com"; sid:513204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfection-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfection-corona.com"; sid:513205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorforcoronavirus.com"; sid:513206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugcorona.com"; sid:513207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcovid19.com"; sid:513208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-coronavirus.com"; sid:513209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-coronavirus.net"; sid:513210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirus.net"; sid:513211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiacovid19.com"; sid:513212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicalerts.com"; sid:513213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccentral.com"; sid:513214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicclaims.com"; sid:513215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccoverageclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccoverageclaims.com"; sid:513216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemichq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemichq.com"; sid:513217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicupdates.com"; sid:513218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask-coronavirus.com"; sid:513219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskforcoronavirus.com"; sid:513220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecoronavirus.com"; sid:513221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearcorona.com"; sid:513222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronasafe.com"; sid:513223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcovid19.com"; sid:513224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid19.com"; sid:513225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcorona.com"; sid:513226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcoronavirus.com"; sid:513227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbalcorona.com"; sid:513228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hey-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hey-covid.com"; sid:513229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycovid.com"; sid:513230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventthecoronavirus.com"; sid:513231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprotectagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprotectagainstcoronavirus.com"; sid:513232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronavirusfree.com"; sid:513233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovid19free.com"; sid:513234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronaclean.com"; sid:513235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid.com"; sid:513236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intowuhan.com"; sid:513237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthecoronavirusinflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthecoronavirusinflorida.com"; sid:513238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancoronavirus.com"; sid:513239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jorcorona.com"; sid:513240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirus.com"; sid:513241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirusprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirusprep.com"; sid:513242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirusreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirusreadiness.com"; sid:513243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirussafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirussafety.com"; sid:513244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-pandemic.com"; sid:513245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronadela11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronadela11.com"; sid:513246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for littlecoronaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"littlecoronaking.com"; sid:513247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirusupdates.com"; sid:513248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcoronavirus.com"; sid:513249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.com"; sid:513250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.com"; sid:513251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-covid.com"; sid:513252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-corona-virus.com"; sid:513253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-coronavirus.com"; sid:513254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillas-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillas-coronavirus.net"; sid:513255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-ffp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-ffp-coronavirus.com"; sid:513256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcovid19.com"; sid:513257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskofcorona.com"; sid:513258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-ffp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-ffp-coronavirus.com"; sid:513259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchcorona.com"; sid:513260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegahcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegahcoronavirus.com"; sid:513261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegahviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegahviruscorona.com"; sid:513262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosaicovidal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosaicovidal.com"; sid:513263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacure.com"; sid:513264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakit.biz"; sid:513265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirusdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirusdefense.com"; sid:513266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirussolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirussolution.com"; sid:513267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.business"; sid:513268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-more-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-more-corona.com"; sid:513269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatantiviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatantiviruscorona.com"; sid:513270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcorona.com"; sid:513271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcoronavirus.com"; sid:513272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcovid19.com"; sid:513273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatherbalviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatherbalviruscorona.com"; sid:513274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatviruscorona.com"; sid:513275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcorona.com"; sid:513276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcoronavirus.com"; sid:513277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcovid19.com"; sid:513278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapp.com"; sid:513279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplan.com"; sid:513280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplans.com"; sid:513281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccalm.com"; sid:513282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccalm.net"; sid:513283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdays.com"; sid:513284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdisasterplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdisasterplan.com"; sid:513285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichideaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichideaway.com"; sid:513286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiciq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiciq.com"; sid:513287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmap.net"; sid:513288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconsultants.com"; sid:513289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotocol.com"; sid:513290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresourcecenter.com"; sid:513291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponses.com"; sid:513292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivors.com"; sid:513293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pencegahancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pencegahancorona.com"; sid:513294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofwuhan.com"; sid:513295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prep4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prep4pandemic.com"; sid:513296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcorona.net"; sid:513297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatesouthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatesouthcorona.com"; sid:513298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resist-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resist-corona.com"; sid:513299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reycorona.com"; sid:513300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridcovid19.com"; sid:513301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roomingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roomingwithcovid19.com"; sid:513302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safety-precautions-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safety-precautions-coronavirus.com"; sid:513303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscoronavirus19.com"; sid:513304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19.com"; sid:513305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolsafecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolsafecoronavirus.com"; sid:513306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siagacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siagacorona.com"; sid:513307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solusicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solusicoronavirus.com"; sid:513308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solusiviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solusiviruscorona.com"; sid:513309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona-virus.com"; sid:513310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus.net"; sid:513311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.com"; sid:513312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t9coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t9coronavirus.com"; sid:513313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthforthecoronavirus.com"; sid:513314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicineforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicineforthecoronavirus.com"; sid:513315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid19.com"; sid:513316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid19.com"; sid:513317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries.com"; sid:513318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.network"; sid:513319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusplague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusplague.com"; sid:513320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustips.com"; sid:513321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresistance.com"; sid:513322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresistancemovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresistancemovement.com"; sid:513323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegruppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegruppandemic.com"; sid:513324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpantry.com"; sid:513325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicreport.com"; sid:513326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicreports.com"; sid:513327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcorona.com"; sid:513328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tolakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tolakcorona.com"; sid:513329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcorona.com"; sid:513330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronamask.com"; sid:513331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcoronanow.com"; sid:513332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentforcovid-19.com"; sid:513333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for umsatz-trotz-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"umsatz-trotz-coronavirus.com"; sid:513334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatescoronavirus.com"; sid:513335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaksincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaksincorona.com"; sid:513336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virucorona.com"; sid:513337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-coronamask.com"; sid:513338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronacure.com"; sid:513339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronaviruscure.com"; sid:513340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcoronaviruskillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcoronaviruskillme.com"; sid:513341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemiccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemiccovid-19.com"; sid:513342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemiccovid.com"; sid:513343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid-19.com"; sid:513344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid.com"; sid:513345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovidpandemic.com"; sid:513346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwideepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwideepidemic.com"; sid:513347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwideepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwideepidemics.com"; sid:513348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancunluo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancunluo.club"; sid:513349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfp163.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfp163.com"; sid:513350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviral.com"; sid:513351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronavirus.com"; sid:513352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019coronavirusinfo.com"; sid:513353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020corona.com"; sid:513354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcorona.com"; sid:513355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcorona.com"; sid:513356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaherbs.com"; sid:513357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronameds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronameds.com"; sid:513358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronashop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronashop.net"; sid:513359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaspray.com"; sid:513360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusdiet.com"; sid:513361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusplan.com"; sid:513362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusproductions.com"; sid:513363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusspray.com"; sid:513364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid19.com"; sid:513365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid.com"; sid:513366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arwuhan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arwuhan.club"; sid:513367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronavirus.net"; sid:513368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronasanitizer.com"; sid:513369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncorona.com"; sid:513370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotecoronavirus.com"; sid:513371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotecovid19.com"; sid:513372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carte-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carte-coronavirus.com"; sid:513373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid.com"; sid:513374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cokecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cokecorona.com"; sid:513375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advice.com"; sid:513376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaids.com"; sid:513377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alertz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alertz.com"; sid:513378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarmageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarmageddon.com"; sid:513379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabase.com"; sid:513380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeskyttelse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeskyttelse.com"; sid:513381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabets.com"; sid:513382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabetting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabetting.com"; sid:513383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinoid.com"; sid:513384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinoid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinoid.net"; sid:513385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabracelets.com"; sid:513386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrain.com"; sid:513387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrains.com"; sid:513388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabugs.com"; sid:513389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacar.com"; sid:513390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareful.com"; sid:513391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacat.com"; sid:513392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacats.com"; sid:513393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronace.com"; sid:513394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacell.com"; sid:513395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacells.com"; sid:513396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacenters.com"; sid:513397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecks.com"; sid:513398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckups.com"; sid:513399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffees.com"; sid:513400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoke.com"; sid:513401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoms.com"; sid:513402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consultancy.com"; sid:513403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontact.com"; sid:513404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontact.net"; sid:513405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacts.com"; sid:513406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacough.com"; sid:513407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoughs.com"; sid:513408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrusher.com"; sid:513409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacryptos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacryptos.com"; sid:513410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrystals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrystals.com"; sid:513411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurb.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurb.club"; sid:513412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaddy.com"; sid:513413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaddicted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaddicted.com"; sid:513414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefenceminerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefenceminerals.com"; sid:513415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadie.com"; sid:513416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadies.com"; sid:513417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfecting.com"; sid:513418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobros.com"; sid:513419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohandymanllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohandymanllc.com"; sid:513420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomain.com"; sid:513421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrinks.com"; sid:513422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaearth.com"; sid:513423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencykit.com"; sid:513424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenergies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenergies.com"; sid:513425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaface.com"; sid:513426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-facts.com"; sid:513427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafevers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafevers.com"; sid:513428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiles.com"; sid:513429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forum.com"; sid:513430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetravel.com"; sid:513431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronah2o.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronah2o.com"; sid:513432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandwash.com"; sid:513433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth.club"; sid:513434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.center"; sid:513435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahospitals.com"; sid:513436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahub.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahub.club"; sid:513437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaids.com"; sid:513438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunedefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunedefence.com"; sid:513439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunehealth.com"; sid:513440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunisation.com"; sid:513441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infections.com"; sid:513442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobza.com"; sid:513443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoke.com"; sid:513444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajokes.com"; sid:513445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakid.com"; sid:513446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakil.com"; sid:513447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiss.com"; sid:513448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakisses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakisses.com"; sid:513449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitten.com"; sid:513450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakittens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakittens.com"; sid:513451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise.com"; sid:513452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrypto.com"; sid:513453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalinks.com"; sid:513454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalives.com"; sid:513455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-map.net"; sid:513456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskdirect.com"; sid:513457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksdirect.com"; sid:513458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamind.com"; sid:513459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminds.com"; sid:513460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamineral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamineral.com"; sid:513461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneedle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneedle.com"; sid:513462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneedles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneedles.com"; sid:513463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.today"; sid:513464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanomics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanomics.net"; sid:513465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanuclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanuclear.com"; sid:513466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutrient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutrient.com"; sid:513467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutrients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutrients.com"; sid:513468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorfashion.com"; sid:513469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoxygen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoxygen.com"; sid:513470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatches.com"; sid:513471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapedia.com"; sid:513472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphona.com"; sid:513473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanet.com"; sid:513474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapowers.com"; sid:513475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprediction.com"; sid:513476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotein.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotein.com"; sid:513477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproteins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproteins.com"; sid:513478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquil.com"; sid:513479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarace.com"; sid:513480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraces.com"; sid:513481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabs.com"; sid:513482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepair.com"; sid:513483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepairs.com"; sid:513484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarmageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarmageddon.com"; sid:513485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartvirus.com"; sid:513486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaglikkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaglikkiti.com"; sid:513487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzvirus.com"; sid:513488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseal.com"; sid:513489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashake.com"; sid:513490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashakes.com"; sid:513491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasick.com"; sid:513492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasirup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasirup.com"; sid:513493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasirups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasirups.com"; sid:513494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasites.com"; sid:513495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslayer.com"; sid:513496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoaps.com"; sid:513497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspirit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspirit.com"; sid:513498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspirits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspirits.com"; sid:513499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprays.com"; sid:513500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspring.com"; sid:513501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprings.com"; sid:513502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastations.com"; sid:513503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastl.com"; sid:513504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucks.com"; sid:513505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplements.com"; sid:513506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-supplies.com"; sid:513507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplykit.com"; sid:513508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvival.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvival.guide"; sid:513509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasyrup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasyrup.com"; sid:513510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasyrups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasyrups.com"; sid:513511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatab.com"; sid:513512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatablets.com"; sid:513513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatabs.com"; sid:513514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatea.com"; sid:513515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelegraph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelegraph.com"; sid:513516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatragedy.com"; sid:513517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatmentinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatmentinfo.com"; sid:513518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrial.com"; sid:513519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrials.com"; sid:513520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunits.com"; sid:513521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid19.net"; sid:513522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinus.com"; sid:513523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirals.com"; sid:513524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviras.com"; sid:513525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirdata.com"; sid:513526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirous.com"; sid:513527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020areyouprepared.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020areyouprepared.club"; sid:513528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus7.com"; sid:513529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafrica.com"; sid:513530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusaid.com"; sid:513531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalgeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalgeria.com"; sid:513532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandtrump.com"; sid:513533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-api.com"; sid:513534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblockers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblockers.com"; sid:513535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbugoutkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbugoutkit.com"; sid:513536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuster.com"; sid:513537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalifornia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalifornia.net"; sid:513538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareful.com"; sid:513539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschampion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschampion.com"; sid:513540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschat.com"; sid:513541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninganddisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninganddisinfecting.com"; sid:513542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnewyork.com"; sid:513543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservice.com"; sid:513544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanups.com"; sid:513545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinic.net"; sid:513546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscme.com"; sid:513547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommercialcleaning.com"; sid:513548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consultancy.com"; sid:513549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultancy.com"; sid:513550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consulting.com"; sid:513551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoping.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoping.solutions"; sid:513552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19test.com"; sid:513553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovidadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovidadvisors.com"; sid:513554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruise.com"; sid:513555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscures.net"; sid:513556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailyupdates.com"; sid:513557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdata.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdata.world"; sid:513558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdays.com"; sid:513559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-db.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-db.com"; sid:513560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdb.com"; sid:513561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseplan.com"; sid:513562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensesystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensesystem.com"; sid:513563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisenfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisenfectant.com"; sid:513564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectant.net"; sid:513565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectors.com"; sid:513566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectors.com"; sid:513567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiy.com"; sid:513568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctoronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctoronline.com"; sid:513569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusengland.com"; sid:513570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses.world"; sid:513571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoundations.com"; sid:513572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-france.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-france.net"; sid:513573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfyi.com"; sid:513574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusga.com"; sid:513575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgel.com"; sid:513576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeorgia.com"; sid:513577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguidance.com"; sid:513578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandgel.com"; sid:513579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanatiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanatiser.com"; sid:513580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanatizer.com"; sid:513581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazmatsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazmatsuit.com"; sid:513582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcenter.com"; sid:513583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushk.com"; sid:513584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoppinglist.com"; sid:513585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindia.net"; sid:513586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiran.com"; sid:513587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusissue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusissue.com"; sid:513588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusissues.com"; sid:513589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-italy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-italy.net"; sid:513590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-latest.com"; sid:513591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-latest-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-latest-update.com"; sid:513592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-law.com"; sid:513593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaws.com"; sid:513594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-litigation.com"; sid:513595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmainpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmainpage.com"; sid:513596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalpractice.com"; sid:513597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskshop.net"; sid:513598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.international"; sid:513599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.solutions"; sid:513600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskss.com"; sid:513601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksstore.com"; sid:513602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitoring.com"; sid:513603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmx.com"; sid:513604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95ppe.com"; sid:513605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnederland.com"; sid:513606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnedir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnedir.com"; sid:513607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneeds.com"; sid:513608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnj.com"; sid:513609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursing.com"; sid:513610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspa.com"; sid:513611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ppe.com"; sid:513612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspress.net"; sid:513613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevencion.com"; sid:513614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproguard.com"; sid:513615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectioninformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectioninformation.com"; sid:513616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregulations.com"; sid:513617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remedies.com"; sid:513618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusri.com"; sid:513619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrussia.com"; sid:513620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussa.com"; sid:513621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyguide.com"; sid:513622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.net"; sid:513623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseattle.com"; sid:513624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-security.com"; sid:513625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenegal.com"; sid:513626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopping.com"; sid:513627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspain.com"; sid:513628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussponge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussponge.com"; sid:513629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstock.com"; sid:513630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.style"; sid:513631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyshop.com"; sid:513632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivalkit.com"; sid:513633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.net"; sid:513634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackers.com"; sid:513635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrips.com"; sid:513636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustt.com"; sid:513637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniverse.com"; sid:513638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.biz"; sid:513639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatesindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatesindia.com"; sid:513640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususworldwide.com"; sid:513641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccino.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccino.net"; sid:513642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebapp.com"; sid:513643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-status.com"; sid:513644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeath.com"; sid:513645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.xn--9dbq2a - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.xn--9dbq2a"; sid:513646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.xn--tckwe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.xn--tckwe"; sid:513647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirys.com"; sid:513648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisionrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisionrx.com"; sid:513649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamin.com"; sid:513650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamins.com"; sid:513651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsflu.com"; sid:513652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarrior.com"; sid:513653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriors.com"; sid:513654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawash.com"; sid:513655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid.com"; sid:513656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blog.com"; sid:513657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checklist.com"; sid:513658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-china.com"; sid:513659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clean.com"; sid:513660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comedy.com"; sid:513661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coping.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coping.solutions"; sid:513662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cure.net"; sid:513663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dailyupdates.com"; sid:513664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-data.com"; sid:513665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deepclean.com"; sid:513666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dr.com"; sid:513667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eval.com"; sid:513668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evaluation.com"; sid:513669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evolution.com"; sid:513670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-forum.com"; sid:513671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fr.com"; sid:513672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.graphics"; sid:513673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazmatsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazmatsuit.com"; sid:513674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest.com"; sid:513675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-immunity.com"; sid:513676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.com"; sid:513677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19llc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19llc.net"; sid:513678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19llc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19llc.net"; sid:513679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-monitoring.com"; sid:513680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nyc.com"; sid:513681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemic.com"; sid:513682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.life"; sid:513683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.net"; sid:513684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19party.com"; sid:513685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharma.com"; sid:513686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physician.com"; sid:513687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicians.com"; sid:513688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19questions.com"; sid:513689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relief.com"; sid:513690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s.com"; sid:513691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialists.com"; sid:513692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survivalkit.com"; sid:513693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalsquad.com"; sid:513694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telehealth.com"; sid:513695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicine.com"; sid:513696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19th.com"; sid:513697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19times.com"; sid:513698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tip.com"; sid:513699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.solutions"; sid:513700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warnings.com"; sid:513701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warnings.com"; sid:513702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19x.com"; sid:513703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanddead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanddead.com"; sid:513704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consultancy.com"; sid:513705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultancy.com"; sid:513706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consulting.com"; sid:513707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.com"; sid:513708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrol.com"; sid:513709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.com"; sid:513710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-epidemic.com"; sid:513711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideumap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideumap.com"; sid:513712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidineu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidineu.com"; sid:513713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-information.com"; sid:513714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinworld.com"; sid:513715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocator.com"; sid:513716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masque.com"; sid:513717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpack.com"; sid:513718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pandemic.com"; sid:513719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prevention.com"; sid:513720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductions.com"; sid:513721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.biz"; sid:513722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.report"; sid:513723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.com"; sid:513724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsos.com"; sid:513725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstat.com"; sid:513726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstores.com"; sid:513727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtester.com"; sid:513728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tests.com"; sid:513729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.com"; sid:513730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.net"; sid:513731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidus.com"; sid:513732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld.com"; sid:513733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocoronas.com"; sid:513734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcoronavirus.com"; sid:513735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathcovid19.com"; sid:513736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantecoronavirus.com"; sid:513737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecovid19.com"; sid:513738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcoronavirus.com"; sid:513739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19.com"; sid:513740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emdadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emdadcorona.com"; sid:513741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcoronavirus.com"; sid:513742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fatalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fatalcoronavirus.com"; sid:513743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacoronavirustestkit.com"; sid:513744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.com"; sid:513745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcorona.com"; sid:513746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flucovid19.com"; sid:513747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flucovid.com"; sid:513748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid19.com"; sid:513749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgecoronadomortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgecoronadomortgage.com"; sid:513750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronamask.com"; sid:513751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreadycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreadycovid19.com"; sid:513752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusalliance.com"; sid:513753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19alliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19alliance.com"; sid:513754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicorganization.com"; sid:513755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-status-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-status-of-coronavirus.com"; sid:513756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcovid19.com"; sid:513757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcorona.com"; sid:513758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronavirus.com"; sid:513759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcorona.com"; sid:513760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotreatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotreatcorona.com"; sid:513761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huiwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huiwuhan.com"; sid:513762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirusprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirusprotectionkit.com"; sid:513763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirusprotectionkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirusprotectionkit.net"; sid:513764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronasurvivor.com"; sid:513765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectionscoronavirus.com"; sid:513766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-covid-19.com"; sid:513767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informationcoronavirus.com"; sid:513768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthiscovid19.com"; sid:513769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuscoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuscoronado.com"; sid:513770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killscoronavirus.com"; sid:513771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirus.com"; sid:513772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirusupdates.com"; sid:513773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lethalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lethalcoronavirus.com"; sid:513774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecoronavirus.com"; sid:513775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingcoronavirusfree.com"; sid:513776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecorona.com"; sid:513777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.com"; sid:513778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luojiashanhotelwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luojiashanhotelwuhan.com"; sid:513779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macorona.com"; sid:513780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4coronavirus.com"; sid:513781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-pour-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-pour-coronavirus.com"; sid:513782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicprep.com"; sid:513783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcovid19.com"; sid:513784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcovid.com"; sid:513785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsaboutcovid19.com"; sid:513786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-corona.com"; sid:513787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencoronavirusapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencoronavirusapi.com"; sid:513788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactionplan.com"; sid:513789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbarrier.com"; sid:513790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicblueprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicblueprint.com"; sid:513791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.care"; sid:513792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccv.com"; sid:513793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfence.com"; sid:513794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimmunedefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimmunedefence.com"; sid:513795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaybook.com"; sid:513796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparationbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparationbook.com"; sid:513797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-preparation.com"; sid:513798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesssurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesssurvivalkit.com"; sid:513799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupermarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupermarket.com"; sid:513800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliers.com"; sid:513801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvaccines.com"; sid:513802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarnings.com"; sid:513803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patentedcoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patentedcoronaviruscleaner.com"; sid:513804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycovid19.com"; sid:513805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productosparaprevenirelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productosparaprevenirelcoronavirus.com"; sid:513806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productsforcoronavirus.com"; sid:513807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productstopreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productstopreventcoronavirus.com"; sid:513808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcovid-19.com"; sid:513809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegerse-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegerse-coronavirus.com"; sid:513810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovid-19.com"; sid:513811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovid19.com"; sid:513812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcorona.com"; sid:513813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redcovid19.com"; sid:513814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcorona.com"; sid:513815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for security-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"security-coronavirus.com"; sid:513816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawaycoronavirus.com"; sid:513817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcorona.com"; sid:513818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.solutions"; sid:513819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.world"; sid:513820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirus.net"; sid:513821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcorona2020.com"; sid:513822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techagainstcoronavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techagainstcoronavir.com"; sid:513823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19.com"; sid:513824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcoronamask.com"; sid:513825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaantivirus.com"; sid:513826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanetwork.com"; sid:513827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanetwork.net"; sid:513828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaradar.com"; sid:513829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronareport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronareport.com"; sid:513830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus.com"; sid:513831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussymptoms.com"; sid:513832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronayouwant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronayouwant.com"; sid:513833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19times.com"; sid:513834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidvirus.com"; sid:513835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanshake.com"; sid:513836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanshake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanshake.net"; sid:513837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tieqiaojianguowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tieqiaojianguowuhan.com"; sid:513838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turmericforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turmericforcoronavirus.com"; sid:513839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid-19.com"; sid:513840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusdeaths.com"; sid:513841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusupdate.com"; sid:513842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcorona.com"; sid:513843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veganpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veganpandemic.com"; sid:513844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitaminsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitaminsforcoronavirus.com"; sid:513845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wahkiakumcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wahkiakumcovid19.com"; sid:513846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warroompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warroompandemic.com"; sid:513847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westopcoronavirus.com"; sid:513848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid.com"; sid:513849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanganmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanganmo.com"; sid:513850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlotto.com"; sid:513851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-shake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-shake.com"; sid:513852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshake.com"; sid:513853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmasks.com"; sid:513854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crash.com"; sid:513855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrink.com"; sid:513856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabilitation.com"; sid:513857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplement.com"; sid:513858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirs.com"; sid:513859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapper.com"; sid:513860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusperu.com"; sid:513861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.com"; sid:513862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19llc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19llc.com"; sid:513863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19llc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19llc.com"; sid:513864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideu.com"; sid:513865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskshop.com"; sid:513866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juliacoronadoking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juliacoronadoking.com"; sid:513867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logosunhotelwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logosunhotelwuhan.com"; sid:513868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-coronavirus.com"; sid:513869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhuachengedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhuachengedu.com"; sid:513870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidmask.com"; sid:513871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocounselingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocounselingca.com"; sid:513872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetypack.com"; sid:513873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrategy.com"; sid:513874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechhandbook.com"; sid:513875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-shop.com"; sid:513876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashit.com"; sid:513877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020.com"; sid:513878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid-19.com"; sid:513879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorial.com"; sid:513880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.com"; sid:513881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-numbers.com"; sid:513882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinedr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinedr.com"; sid:513883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppe.com"; sid:513884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecoronavirus.com"; sid:513885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronalight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronalight.com"; sid:513886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-coronavirus.com"; sid:513887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-covid-19.com"; sid:513888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanavirus.com"; sid:513889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyproduct.com"; sid:513890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivals.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivals.bid"; sid:513891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covid19.com"; sid:513892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1coronavirus.com"; sid:513893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411coronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411coronacash.com"; sid:513894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411corona.com"; sid:513895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4anticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4anticoronavirus.com"; sid:513896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 87corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"87corona.com"; sid:513897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 88covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"88covid19.com"; sid:513898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronacash.com"; sid:513899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911corona.com"; sid:513900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronaoutbreak.com"; sid:513901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadodecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadodecoronavirus.com"; sid:513902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-coronavirus.com"; sid:513903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid.com"; sid:513904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid19.com"; sid:513905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscorona.com"; sid:513906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghanistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghanistancoronavirus.com"; sid:513907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacoronavirus.com"; sid:513908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidecoronavirus.com"; sid:513909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akcoronavirus.com"; sid:513910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronavirus.com"; sid:513911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacoronavirus.com"; sid:513912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albuquerquecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albuquerquecoronavirus.com"; sid:513913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcoronavirus.com"; sid:513914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertcovid-19.com"; sid:513915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for algeriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"algeriacoronavirus.com"; sid:513916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid-19.com"; sid:513917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancorona.com"; sid:513918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amiacovidzombieyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amiacovidzombieyet.com"; sid:513919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amigoingtodiefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amigoingtodiefromcoronavirus.com"; sid:513920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for am-i-infected-with-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"am-i-infected-with-corona.com"; sid:513921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amiinfectedwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amiinfectedwithcorona.com"; sid:513922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angolacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angolacoronavirus.com"; sid:513923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antcorona.com"; sid:513924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antcovid19.com"; sid:513925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaconsulting.com"; sid:513926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamed.com"; sid:513927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamedorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamedorg.com"; sid:513928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronanet.com"; sid:513929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaviruses.com"; sid:513930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusfacemasks.com"; sid:513931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruskits.com"; sid:513932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus-masks.com"; sid:513933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspackage.com"; sid:513934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspackages.com"; sid:513935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirussell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirussell.com"; sid:513936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.net"; sid:513937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidarmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidarmor.com"; sid:513938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemicer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemicer.com"; sid:513939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arabiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arabiacoronavirus.com"; sid:513940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbidolcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbidolcoronavirus.com"; sid:513941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcoronavirus.com"; sid:513942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argentinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argentinacoronavirus.com"; sid:513943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronavirus.com"; sid:513944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronaviruslawyer.com"; sid:513945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascoronavirus.com"; sid:513946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arlingtoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arlingtoncoronavirus.com"; sid:513947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronatest.com"; sid:513948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustest.com"; sid:513949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyforcoronavirus.com"; sid:513950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacoronavirus.com"; sid:513951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austriacoronavirus.com"; sid:513952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avellinocoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avellinocoronatest.com"; sid:513953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcoronavirus.com"; sid:513954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronaviruscontagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronaviruscontagion.com"; sid:513955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronavirus.net"; sid:513956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoid-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoid-covid19.com"; sid:513957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirus.com"; sid:513958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19.com"; sid:513959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azerbaijancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azerbaijancoronavirus.com"; sid:513960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b4coronavirus.com"; sid:513961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecoronavirus.com"; sid:513962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangladeshcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangladeshcoronavirus.com"; sid:513963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecorona.com"; sid:513964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbqcoronavirus.com"; sid:513965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardsagainstcoronavirus.com"; sid:513966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona.biz"; sid:513967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-corona.com"; sid:513968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19.com"; sid:513969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidready.com"; sid:513970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecoronavirus.com"; sid:513971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belaruscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belaruscoronavirus.com"; sid:513972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belgiumcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belgiumcoronavirus.com"; sid:513973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benincoronavirus.com"; sid:513974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepreparedforcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepreparedforcoronaviruses.com"; sid:513975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beready4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beready4covid19.com"; sid:513976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berlincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berlincoronavirus.com"; sid:513977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafefromcorona.com"; sid:513978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirus.com"; sid:513979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcorona.com"; sid:513980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocleancorona.com"; sid:513981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohackingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohackingcoronavirus.com"; sid:513982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogfeedbackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogfeedbackcoronavirus.com"; sid:513983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boliviacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boliviacoronavirus.com"; sid:513984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boostimmunesystemforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boostimmunesystemforcoronavirus.com"; sid:513985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncoronavirus.com"; sid:513986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brazilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brazilcoronavirus.com"; sid:513987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcorona.com"; sid:513988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcoronavirusnews.com"; sid:513989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncoronavirus.com"; sid:513990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulgariacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulgariacoronavirus.com"; sid:513991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bumpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bumpcovid.com"; sid:513992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burkinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burkinacoronavirus.com"; sid:513993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burundicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burundicoronavirus.com"; sid:513994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bustcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bustcovid19.com"; sid:513995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyanticovid.com"; sid:513996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusfacemask.com"; sid:513997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruspills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruspills.com"; sid:513998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19testkit.com"; sid:513999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirus.com"; sid:514000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacorona.com"; sid:514001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19.com"; sid:514002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambodiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambodiacoronavirus.com"; sid:514003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camerooncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camerooncoronavirus.com"; sid:514004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcorona.com"; sid:514005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcorona.com"; sid:514006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcoronavirus.com"; sid:514007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovid19.com"; sid:514008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovid.com"; sid:514009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelledbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelledbycorona.com"; sid:514010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcoronavirus.com"; sid:514011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcorona.com"; sid:514012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdkillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdkillscoronavirus.com"; sid:514013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid19.com"; sid:514014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid.com"; sid:514015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccheckforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccheckforcorona.com"; sid:514016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19.com"; sid:514017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcoronacontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcoronacontrol.com"; sid:514018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcoronavirus.com"; sid:514019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforpandemics.com"; sid:514020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirusfree.com"; sid:514021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirusmasks.com"; sid:514022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19safedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19safedelivery.com"; sid:514023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chadcoronavirus.com"; sid:514024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check4corona.com"; sid:514025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid.com"; sid:514026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcoronacdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcoronacdc.com"; sid:514027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcorona.com"; sid:514028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronaviruslawyer.com"; sid:514029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chilecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chilecoronavirus.com"; sid:514030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecorona.com"; sid:514031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcoronavirus.com"; sid:514032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closingthedoortocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closingthedoortocorona.com"; sid:514033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid19.com"; sid:514034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnnbreakingcovid19illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnnbreakingcovid19illinois.com"; sid:514035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirus.com"; sid:514036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colloidalsilvercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colloidalsilvercoronavirus.com"; sid:514037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colombiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colombiacoronavirus.com"; sid:514038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscoronavirus.com"; sid:514039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronaviruses.com"; sid:514040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcorona.com"; sid:514041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecoronavirus.com"; sid:514042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovid.com"; sid:514043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congocoronavirus.com"; sid:514044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcoronavirus.com"; sid:514045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consejoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consejoscoronavirus.com"; sid:514046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcorona.com"; sid:514047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcorona.com"; sid:514048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingincovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingincovidtimes.com"; sid:514049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcorona.com"; sid:514050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.com"; sid:514051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1004.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1004.com"; sid:514052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19comedy.com"; sid:514053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19now.com"; sid:514054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-2019.com"; sid:514055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020mask.com"; sid:514056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020masks.com"; sid:514057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020survivor.com"; sid:514058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona247.com"; sid:514059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2go.com"; sid:514060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona911virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona911virus.com"; sid:514061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactivity.com"; sid:514062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvicegivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvicegivers.com"; sid:514063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaambulance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaambulance.com"; sid:514064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamerica.com"; sid:514065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibacterium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibacterium.com"; sid:514066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodies.com"; sid:514067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanti.com"; sid:514068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantigen.com"; sid:514069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antivirus.com"; sid:514070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantiviruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantiviruz.com"; sid:514071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanxiety.com"; sid:514072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapparel.com"; sid:514073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassistance.com"; sid:514074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaathometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaathometest.com"; sid:514075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaware.com"; sid:514076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawareness.com"; sid:514077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboom.com"; sid:514078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabalona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabalona.com"; sid:514079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankrx.com"; sid:514080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabans.com"; sid:514081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabat.com"; sid:514082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeerrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeerrx.com"; sid:514083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeers.com"; sid:514084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegone.com"; sid:514085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabest.com"; sid:514086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabgone.com"; sid:514087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabharat.com"; sid:514088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabias.com"; sid:514089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabingo.com"; sid:514090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablocks.com"; sid:514091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboodschappen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboodschappen.com"; sid:514092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-box.com"; sid:514093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabracelet.com"; sid:514094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreaks.com"; sid:514095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrief.com"; sid:514096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabriefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabriefs.com"; sid:514097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuffer.com"; sid:514098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business.com"; sid:514099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-busters.com"; sid:514100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabutiken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabutiken.com"; sid:514101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabutton.com"; sid:514102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaddy.com"; sid:514103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanada.com"; sid:514104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanceled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanceled.com"; sid:514105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancellations.com"; sid:514106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannon.com"; sid:514107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalism.com"; sid:514108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepacks.com"; sid:514109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashrx.com"; sid:514110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentre.com"; sid:514111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertificate.com"; sid:514112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachans.com"; sid:514113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharts.com"; sid:514114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckpoint.com"; sid:514115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckr.com"; sid:514116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles.com"; sid:514117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacircle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacircle.com"; sid:514118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclause.com"; sid:514119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanco.com"; sid:514120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanest.com"; sid:514121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanhub.com"; sid:514122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcompany.com"; sid:514123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningnyc.com"; sid:514124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningsupplies.com"; sid:514125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannow.com"; sid:514126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleans.com"; sid:514127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanser.com"; sid:514128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupbayarea.com"; sid:514129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupca.com"; sid:514130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanusa.com"; sid:514131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacles.com"; sid:514132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacliffnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacliffnotes.com"; sid:514133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloset.com"; sid:514134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubdj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubdj.com"; sid:514135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubs.com"; sid:514136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoach.com"; sid:514137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoalition.com"; sid:514138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktail.com"; sid:514139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktails.com"; sid:514140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacold.com"; sid:514141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedy.com"; sid:514142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanion.com"; sid:514143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensation.com"; sid:514144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacon2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacon2020.com"; sid:514145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcierge.com"; sid:514146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-con.com"; sid:514147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondom.com"; sid:514148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondoms.com"; sid:514149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacones.com"; sid:514150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconf.com"; sid:514151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontain.com"; sid:514152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontained.com"; sid:514153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoronaleavemealona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoronaleavemealona.com"; sid:514154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoronaleavemealone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoronaleavemealone.com"; sid:514155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorrection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorrection.com"; sid:514156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacost.com"; sid:514157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacostume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacostume.com"; sid:514158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacostumes.com"; sid:514159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountdown.com"; sid:514160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountriesrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountriesrx.com"; sid:514161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountryrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountryrx.com"; sid:514162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounts.com"; sid:514163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19mutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19mutation.com"; sid:514164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19pump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19pump.com"; sid:514165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19screen.com"; sid:514166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19sex.com"; sid:514167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19shield.com"; sid:514168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazed.com"; sid:514169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazies.com"; sid:514170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazy.com"; sid:514171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacremation.com"; sid:514172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisbigbrainstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisbigbrainstorm.com"; sid:514173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseship.com"; sid:514174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrusade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrusade.com"; sid:514175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuba.com"; sid:514176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacumming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacumming.com"; sid:514177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacunts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacunts.com"; sid:514178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurb.com"; sid:514179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureco.com"; sid:514180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurehub.com"; sid:514181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurenyc.com"; sid:514182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretherapy.com"; sid:514183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretoday.com"; sid:514184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureusa.com"; sid:514185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurrency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurrency.com"; sid:514186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadb.net"; sid:514187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathtracker.com"; sid:514188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecontamination.com"; sid:514189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-defenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-defenders.com"; sid:514190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeliver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeliver.com"; sid:514191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesk.com"; sid:514192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesktop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesktop.com"; sid:514193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetails.com"; sid:514194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detector.com"; sid:514195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeutschland.com"; sid:514196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevil.com"; sid:514197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnose.com"; sid:514198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnosis.com"; sid:514199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiary.net"; sid:514200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diet.com"; sid:514201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiets.com"; sid:514202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease-free.com"; sid:514203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfect.com"; sid:514204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadjvictoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadjvictoria.com"; sid:514205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadkillerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadkillerpro.com"; sid:514206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-pacific.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-pacific.com"; sid:514207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopacificcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopacificcompany.com"; sid:514208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopacificusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopacificusa.com"; sid:514209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopreservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopreservation.com"; sid:514210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopreservationsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopreservationsociety.com"; sid:514211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadorent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadorent.com"; sid:514212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivethru.com"; sid:514213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadvirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadvirusupdate.com"; sid:514214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadx.com"; sid:514215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaed.com"; sid:514216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-effect.com"; sid:514217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaera.com"; sid:514218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaescorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaescorts.com"; sid:514219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevil.com"; sid:514220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeye.com"; sid:514221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeyes.com"; sid:514222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacecover19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacecover19.com"; sid:514223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacts.biz"; sid:514224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsusa.com"; sid:514225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafam.com"; sid:514226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-festival.com"; sid:514227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fight.com"; sid:514228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighter.net"; sid:514229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fighters.com"; sid:514230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirefighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirefighter.com"; sid:514231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflew.com"; sid:514232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflightalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflightalert.com"; sid:514233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflight.com"; sid:514234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflights.com"; sid:514235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafluke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafluke.com"; sid:514236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafootsie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafootsie.com"; sid:514237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforcemajeure.com"; sid:514238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforces.com"; sid:514239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforecast.com"; sid:514240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforecasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforecasts.com"; sid:514241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafornia.com"; sid:514242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree2020.com"; sid:514243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.biz"; sid:514244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebuilders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebuilders.com"; sid:514245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecamsex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecamsex.com"; sid:514246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.delivery"; sid:514247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedelivery.com"; sid:514248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevirus.com"; sid:514249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriends.com"; sid:514250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunds.com"; sid:514251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-game.com"; sid:514252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagard.com"; sid:514253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagaurd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagaurd.com"; sid:514254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagekitaihou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagekitaihou.com"; sid:514255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-germany.com"; sid:514256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagg.com"; sid:514257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaginus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaginus.com"; sid:514258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalupdates.com"; sid:514259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagod.com"; sid:514260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagods.com"; sid:514261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoods.com"; sid:514262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-grants.com"; sid:514263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrants.com"; sid:514264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guard.com"; sid:514265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardian.com"; sid:514266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguidance.com"; sid:514267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagurd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagurd.com"; sid:514268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguru.com"; sid:514269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalt.com"; sid:514270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-handsanitizer.com"; sid:514271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsanitizer.com"; sid:514272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahands.com"; sid:514273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealer.com"; sid:514274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-health.com"; sid:514275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthkit.com"; sid:514276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthremedy.com"; sid:514277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupplies.com"; sid:514278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilen.com"; sid:514279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahell.com"; sid:514280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelmet.com"; sid:514281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpers.com"; sid:514282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpfund.com"; sid:514283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helpstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helpstore.com"; sid:514284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbs.com"; sid:514285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroes.com"; sid:514286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahideout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahideout.com"; sid:514287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.com"; sid:514288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahiring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahiring.com"; sid:514289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeopathy.com"; sid:514290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahosts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahosts.com"; sid:514291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hotspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hotspots.com"; sid:514292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotties.com"; sid:514293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hq.com"; sid:514294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahq.com"; sid:514295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahype.com"; sid:514296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidea.com"; sid:514297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-import.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-import.com"; sid:514298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimport.com"; sid:514299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infos.com"; sid:514300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainitiative.com"; sid:514301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainstitutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainstitutes.com"; sid:514302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancegrouppr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancegrouppr.com"; sid:514303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainus.com"; sid:514304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisfahan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisfahan.com"; sid:514305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaita24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaita24.com"; sid:514306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaita24.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaita24.net"; sid:514307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoe.com"; sid:514308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeno.com"; sid:514309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillercom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillercom.com"; sid:514310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killers.com"; sid:514311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilling.com"; sid:514312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoruma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoruma.com"; sid:514313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabco.com"; sid:514314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratories.com"; sid:514315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratory.com"; sid:514316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratorytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratorytesting.com"; sid:514317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabstesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabstesting.com"; sid:514318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtestingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtestingco.com"; sid:514319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalab-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalab-testing.com"; sid:514320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtesting.com"; sid:514321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtestings.com"; sid:514322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabusa.com"; sid:514323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-latest.com"; sid:514324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalies.com"; sid:514325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifesaverkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifesaverkit.com"; sid:514326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalisa.com"; sid:514327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivebd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivebd.com"; sid:514328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivechat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivechat.com"; sid:514329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivehelp.com"; sid:514330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivestatus.com"; sid:514331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdate.com"; sid:514332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocations.com"; sid:514333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdowns.com"; sid:514334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalotteries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalotteries.com"; sid:514335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalp.com"; sid:514336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalympics2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalympics2020.com"; sid:514337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagvonim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagvonim.com"; sid:514338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaloney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaloney.com"; sid:514339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamania.com"; sid:514340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaps.net"; sid:514341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarkets.com"; sid:514342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascara.com"; sid:514343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascarillas.com"; sid:514344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask19.com"; sid:514345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask360.com"; sid:514346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskil.com"; sid:514347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskitalia.com"; sid:514348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasknow.com"; sid:514349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask-protection.com"; sid:514350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskstrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskstrade.com"; sid:514351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameals.com"; sid:514352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-med.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-med.com"; sid:514353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorial.com"; sid:514354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameters.com"; sid:514355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametrics.com"; sid:514356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiyim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiyim.com"; sid:514357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamona.com"; sid:514358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamondkap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamondkap.com"; sid:514359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-monitor.com"; sid:514360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonitorworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonitorworldwide.com"; sid:514361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonkey.com"; sid:514362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonster.com"; sid:514363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonsters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonsters.com"; sid:514364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamos.com"; sid:514365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamouth.com"; sid:514366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-movie.com"; sid:514367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusicfestival.com"; sid:514368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamustgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamustgo.com"; sid:514369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamutation.com"; sid:514370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-n95.com"; sid:514371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanalysis.com"; sid:514372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanames.com"; sid:514373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-naturalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-naturalhealth.com"; sid:514374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanearyou.com"; sid:514375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanecklace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanecklace.com"; sid:514376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanederland.com"; sid:514377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneverdies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneverdies.com"; sid:514378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.biz"; sid:514379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewshealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewshealth.com"; sid:514380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsnow.com"; sid:514381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsrx.com"; sid:514382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewssupport.com"; sid:514383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewz.com"; sid:514384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanightmare.com"; sid:514385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanime.com"; sid:514386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanose.com"; sid:514387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronantibodies.com"; sid:514388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanxiety.com"; sid:514389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaolympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaolympics.com"; sid:514390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoracle.com"; sid:514391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorhangover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorhangover.com"; sid:514392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaornot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaornot.com"; sid:514393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaowner.com"; sid:514394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapackage.com"; sid:514395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapal.com"; sid:514396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemics.com"; sid:514397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-paranoia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-paranoia.com"; sid:514398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatient.com"; sid:514399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatients.com"; sid:514400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapcr.com"; sid:514401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapin.com"; sid:514402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanets.com"; sid:514403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapledge.com"; sid:514404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecaution.com"; sid:514405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecautions.com"; sid:514406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-preppers.com"; sid:514407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprescription.com"; sid:514408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionmasks.com"; sid:514409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionplan.com"; sid:514410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofits.com"; sid:514411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-proof.com"; sid:514412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotection.biz"; sid:514413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-kit.com"; sid:514414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-mask.com"; sid:514415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproxi.com"; sid:514416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurified.com"; sid:514417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapussy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapussy.com"; sid:514418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapyaarhai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapyaarhai.com"; sid:514419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinekit.com"; sid:514420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquickcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquickcheck.com"; sid:514421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtests.com"; sid:514422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredemption.com"; sid:514423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefund.com"; sid:514424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-relief.com"; sid:514425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepeller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepeller.com"; sid:514426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresistance.com"; sid:514427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareview.com"; sid:514428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariskcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariskcalculator.com"; sid:514429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroller.com"; sid:514430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarub.com"; sid:514431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safe-case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safe-case.com"; sid:514432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyadvice.com"; sid:514433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyproducts.com"; sid:514434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetytips.com"; sid:514435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaves.com"; sid:514436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascare.com"; sid:514437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascares.com"; sid:514438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschumer.com"; sid:514439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasciences.com"; sid:514440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascope.com"; sid:514441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-screening.com"; sid:514442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascrub.com"; sid:514443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseason.com"; sid:514444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecure.com"; sid:514445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfquarantine.com"; sid:514446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftest.com"; sid:514447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftestkit.com"; sid:514448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sense.com"; sid:514449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasense.com"; sid:514450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservicesgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservicesgroup.com"; sid:514451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservizi.com"; sid:514452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfahion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfahion.com"; sid:514453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield.life"; sid:514454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaship.com"; sid:514455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shirts.com"; sid:514456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashocks.com"; sid:514457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoes.com"; sid:514458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop24.com"; sid:514459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashut.com"; sid:514460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasimple.com"; sid:514461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasland.com"; sid:514462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslaves.com"; sid:514463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.com"; sid:514464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocial.com"; sid:514465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoku.com"; sid:514466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-solution.com"; sid:514467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeak.com"; sid:514468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecial.com"; sid:514469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecialist.com"; sid:514470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeedtest.com"; sid:514471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspraysanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspraysanitizer.com"; sid:514472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spread.com"; sid:514473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasproducts.com"; sid:514474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasq.com"; sid:514475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastartups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastartups.com"; sid:514476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-statistics.com"; sid:514477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stats.com"; sid:514478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastest.com"; sid:514479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockmarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockmarketcrash.com"; sid:514480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopfda.com"; sid:514481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.pro"; sid:514482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastory.com"; sid:514483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrain.com"; sid:514484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrains.com"; sid:514485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrippers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrippers.com"; sid:514486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunnews.com"; sid:514487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplementpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplementpack.com"; sid:514488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplier.com"; sid:514489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-support.com"; sid:514490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuraksha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuraksha.com"; sid:514491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurplus.com"; sid:514492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvey.net"; sid:514493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomen.com"; sid:514494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataisaku.com"; sid:514495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakip.com"; sid:514496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalism.com"; sid:514497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taskforce.com"; sid:514498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatbay.com"; sid:514499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateams.com"; sid:514500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatees.com"; sid:514501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelehealth.com"; sid:514502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestco.com"; sid:514503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestct.com"; sid:514504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tester.com"; sid:514505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-kits.com"; sid:514506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnj.com"; sid:514507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnyc.com"; sid:514508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestny.com"; sid:514509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestpa.com"; sid:514510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestusa.com"; sid:514511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathon.com"; sid:514512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimee.com"; sid:514513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatined.com"; sid:514514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatissues.com"; sid:514515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatogo.com"; sid:514516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tokusetsu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tokusetsu.com"; sid:514517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrac.com"; sid:514518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingcenter.com"; sid:514519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackusa.com"; sid:514520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrades.com"; sid:514521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveldeals.com"; sid:514522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturk.com"; sid:514523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatyz.com"; sid:514524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauk.com"; sid:514525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatetoday.com"; sid:514526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-us-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-us-cases.com"; sid:514527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19.com"; sid:514528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav1rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav1rus.com"; sid:514529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacations.com"; sid:514530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacssin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacssin.com"; sid:514531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacssins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacssins.com"; sid:514532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax.biz"; sid:514533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxcoin.com"; sid:514534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax.net"; sid:514535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxtoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxtoken.com"; sid:514536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcheck.com"; sid:514537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcleaner.com"; sid:514538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavector.com"; sid:514539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavert.com"; sid:514540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida.com"; sid:514541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinos.com"; sid:514542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinous.com"; sid:514543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviraus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviraus.com"; sid:514544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviricide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviricide.com"; sid:514545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisnewsnow.com"; sid:514546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris.zone"; sid:514547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirium.com"; sid:514548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirium.net"; sid:514549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirucide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirucide.com"; sid:514550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru.net"; sid:514551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus100.com"; sid:514552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus101rx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus101rx.com"; sid:514553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19blog.com"; sid:514554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19co.com"; sid:514555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19global.com"; sid:514556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19outbreak.com"; sid:514557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19-protection.com"; sid:514558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019news.com"; sid:514559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020survivor.com"; sid:514560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2021survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2021survivor.com"; sid:514561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus212.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus212.com"; sid:514562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus312.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus312.com"; sid:514563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus404.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus404.com"; sid:514564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus415.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus415.com"; sid:514565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus502.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus502.com"; sid:514566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-911.com"; sid:514567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabq.com"; sid:514568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusact.com"; sid:514569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisors.com"; sid:514570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvocate.com"; sid:514571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvocates.com"; sid:514572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaf.com"; sid:514573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafghanistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafghanistan.com"; sid:514574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagency.com"; sid:514575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagent.com"; sid:514576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagents.com"; sid:514577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairfilter.com"; sid:514578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairfiltration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairfiltration.com"; sid:514579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairport.com"; sid:514580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusak.com"; sid:514581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalabama.com"; sid:514582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbuquerque.com"; sid:514583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusal.com"; sid:514584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusall.com"; sid:514585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamalficoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamalficoast.com"; sid:514586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusambulance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusambulance.com"; sid:514587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalyst.com"; sid:514588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusangola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusangola.com"; sid:514589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanitizer.com"; sid:514590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanswer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanswer.com"; sid:514591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietytips.com"; sid:514592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarabia.com"; sid:514593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusar.com"; sid:514594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarena.com"; sid:514595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarkansas.com"; sid:514596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarlington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarlington.com"; sid:514597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarticles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarticles.com"; sid:514598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistance.club"; sid:514599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistance.net"; sid:514600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassociates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassociates.com"; sid:514601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlanta.com"; sid:514602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlantaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlantaga.com"; sid:514603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-attorney.com"; sid:514604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauction.com"; sid:514605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudiobook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudiobook.com"; sid:514606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudiobooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudiobooks.com"; sid:514607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudio.com"; sid:514608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaustria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaustria.com"; sid:514609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauthority.com"; sid:514610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawards.com"; sid:514611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaway.com"; sid:514612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusazerbaijan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusazerbaijan.com"; sid:514613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusball.com"; sid:514614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusballs.com"; sid:514615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaltimore.com"; sid:514616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusband.com"; sid:514617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbangladesh.com"; sid:514618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbank.com"; sid:514619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbanking.com"; sid:514620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbargain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbargain.com"; sid:514621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbargains.com"; sid:514622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbayarea.com"; sid:514623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeijing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeijing.com"; sid:514624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelarus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelarus.com"; sid:514625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelgium.com"; sid:514626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbend.com"; sid:514627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenefit.com"; sid:514628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenin.com"; sid:514629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeprepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeprepared.com"; sid:514630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-berlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-berlin.com"; sid:514631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusberniesanders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusberniesanders.com"; sid:514632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestfacemask.com"; sid:514633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbets.com"; sid:514634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeverlyhills.com"; sid:514635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeware.com"; sid:514636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiden.com"; sid:514637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbingo.com"; sid:514638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiohazard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiohazard.com"; sid:514639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbitches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbitches.com"; sid:514640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblockage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblockage.com"; sid:514641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblogger.com"; sid:514642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtests.com"; sid:514643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblurb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblurb.com"; sid:514644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboat.com"; sid:514645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbob.com"; sid:514646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbolivia.com"; sid:514647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbonds.com"; sid:514648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbooks.com"; sid:514649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbracelets.com"; sid:514650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrands.com"; sid:514651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakouts.com"; sid:514652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbriefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbriefs.com"; sid:514653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbronx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbronx.com"; sid:514654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrooklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrooklyn.com"; sid:514655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbs.com"; sid:514656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbubble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbubble.com"; sid:514657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbugoutbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbugoutbag.com"; sid:514658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuilders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuilders.com"; sid:514659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbulgaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbulgaria.com"; sid:514660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbunker.com"; sid:514661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusburkina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusburkina.com"; sid:514662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusburundi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusburundi.com"; sid:514663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessconsultants.com"; sid:514664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscredit.com"; sid:514665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessfunding.com"; sid:514666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptioninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptioninsurance.com"; sid:514667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-busters.com"; sid:514668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbystate.com"; sid:514669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-ca.com"; sid:514670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusca.com"; sid:514671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cal.com"; sid:514672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscal.com"; sid:514673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalgary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalgary.com"; sid:514674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscali.com"; sid:514675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalif.com"; sid:514676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-california.com"; sid:514677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscall.com"; sid:514678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscambodia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscambodia.com"; sid:514679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscameroon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscameroon.com"; sid:514680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscampaign.com"; sid:514681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscampus.com"; sid:514682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscancellations.com"; sid:514683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapital.com"; sid:514684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapitol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapitol.com"; sid:514685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareer.com"; sid:514686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareers.com"; sid:514687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarekit.com"; sid:514688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareservices.com"; sid:514689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscash.com"; sid:514690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscast.com"; sid:514691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatcare.com"; sid:514692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscat.com"; sid:514693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertification.com"; sid:514694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertified.com"; sid:514695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschad.com"; sid:514696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschaina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschaina.com"; sid:514697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharlotte.com"; sid:514698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.cheap - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.cheap"; sid:514699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschef.com"; sid:514700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschildren.com"; sid:514701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschronicles.com"; sid:514702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscide.com"; sid:514703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscincinnati.com"; sid:514704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscincy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscincy.com"; sid:514705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscity.com"; sid:514706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-claims.com"; sid:514707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsus.com"; sid:514708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimus.com"; sid:514709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclarksville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclarksville.com"; sid:514710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclass.com"; sid:514711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasses.com"; sid:514712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerservices.com"; sid:514713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcompany.com"; sid:514714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningprocedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningprocedures.com"; sid:514715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsanfrancisco.com"; sid:514716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanings.com"; sid:514717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicessanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicessanfrancisco.com"; sid:514718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicessf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicessf.com"; sid:514719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsf.com"; sid:514720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanser.com"; sid:514721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanservices.com"; sid:514722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupcrews.com"; sid:514723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupga.com"; sid:514724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclear.com"; sid:514725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleveland.com"; sid:514726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclick.com"; sid:514727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscliffnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscliffnotes.com"; sid:514728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinton.com"; sid:514729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclock.com"; sid:514730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosings.com"; sid:514731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosures.com"; sid:514732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothing.com"; sid:514733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclub.com"; sid:514734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoaches.com"; sid:514735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoaching.com"; sid:514736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscocktail.com"; sid:514737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscocktails.com"; sid:514738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollapse.com"; sid:514739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscolorado.com"; sid:514740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscolumbus.com"; sid:514741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscombat.com"; sid:514742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscom.com"; sid:514743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedy.com"; sid:514744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedyfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedyfactory.com"; sid:514745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommunity.com"; sid:514746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconference.com"; sid:514747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfirmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfirmed.com"; sid:514748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongo.com"; sid:514749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnecticut.com"; sid:514750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusconsultants.com"; sid:514751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consultants.com"; sid:514752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultants.com"; sid:514753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscook.com"; sid:514754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscostarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscostarica.com"; sid:514755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscost.com"; sid:514756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscotedivoire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscotedivoire.com"; sid:514757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscough.com"; sid:514758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouncil.com"; sid:514759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsel.com"; sid:514760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounseling.com"; sid:514761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouple.com"; sid:514762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoupon.com"; sid:514763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoupons.com"; sid:514764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscourse.com"; sid:514765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscourses.com"; sid:514766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscov19.com"; sid:514767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscover.com"; sid:514768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-dashboard.com"; sid:514769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-france.com"; sid:514770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-n95mask.com"; sid:514771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19preparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19preparedness.com"; sid:514772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19update.com"; sid:514773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrafts.com"; sid:514774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscredit.com"; sid:514775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseinsurance.com"; sid:514776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiselawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiselawsuit.com"; sid:514777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruisesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruisesafety.com"; sid:514778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruises.com"; sid:514779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseship.com"; sid:514780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuba.com"; sid:514781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cure.com"; sid:514782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuree.com"; sid:514783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurekit.com"; sid:514784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cures.com"; sid:514785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscustommask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscustommask.com"; sid:514786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscyprus.com"; sid:514787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusczech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusczech.com"; sid:514788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-daily.com"; sid:514789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailyupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailyupdate.com"; sid:514790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdallas.com"; sid:514791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdamages.com"; sid:514792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dashboard.com"; sid:514793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdash.com"; sid:514794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatabase.com"; sid:514795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatanow.com"; sid:514796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdataonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdataonline.com"; sid:514797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdead.com"; sid:514798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeadpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeadpool.com"; sid:514799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathcalculator.com"; sid:514800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebate.com"; sid:514801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebt.com"; sid:514802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseca.com"; sid:514803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensekits.com"; sid:514804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenses.com"; sid:514805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefinition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefinition.com"; sid:514806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelaware.com"; sid:514807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdenver.com"; sid:514808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdepression.com"; sid:514809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetroit.com"; sid:514810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiary.com"; sid:514811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.digital"; sid:514812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscount.com"; sid:514813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscounts.com"; sid:514814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscovery.com"; sid:514815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscuss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscuss.com"; sid:514816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecovid-19.com"; sid:514817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaseoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaseoutbreak.com"; sid:514818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasesymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasesymptoms.com"; sid:514819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectant.com"; sid:514820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisney.com"; sid:514821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisneyinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisneyinsurance.com"; sid:514822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisneysafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisneysafety.com"; sid:514823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisputes.com"; sid:514824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisruption.com"; sid:514825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dkit.com"; sid:514826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdkits.com"; sid:514827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocblog.com"; sid:514828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocsct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocsct.com"; sid:514829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocumentary.com"; sid:514830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogcare.com"; sid:514831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdog.com"; sid:514832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogs.com"; sid:514833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomain.com"; sid:514834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomainnames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomainnames.com"; sid:514835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdominican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdominican.com"; sid:514836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdownload.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdownload.com"; sid:514837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusduty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusduty.com"; sid:514838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearth.com"; sid:514839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomics.com"; sid:514840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomy.com"; sid:514841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffect.com"; sid:514842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseldercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseldercare.com"; sid:514843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselderlycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselderlycare.com"; sid:514844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselection.com"; sid:514845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectric.com"; sid:514846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselpaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselpaso.com"; sid:514847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencykitbox.com"; sid:514848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentlaw.com"; sid:514849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenelperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenelperu.com"; sid:514850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.energy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.energy"; sid:514851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenperu.com"; sid:514852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenterprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenterprise.com"; sid:514853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusequipment.com"; sid:514854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescapeplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescapeplan.com"; sid:514855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesrx.com"; sid:514856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesshare.com"; sid:514857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestest.com"; sid:514858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesupdate.com"; sid:514859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusethiopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusethiopia.com"; sid:514860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusetiquette.com"; sid:514861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseugene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseugene.com"; sid:514862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseureka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseureka.com"; sid:514863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevaccine.com"; sid:514864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevent.com"; sid:514865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevents.com"; sid:514866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexercise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexercise.com"; sid:514867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexperience.com"; sid:514868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexplosion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexplosion.com"; sid:514869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.exposed"; sid:514870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposure.com"; sid:514871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamily.com"; sid:514872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilykit.com"; sid:514873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilykits.com"; sid:514874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaso.com"; sid:514875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfestival.com"; sid:514876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfiction.com"; sid:514877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighterca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighterca.com"; sid:514878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilm.com"; sid:514879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilms.com"; sid:514880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinance.com"; sid:514881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinland.com"; sid:514882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaid.com"; sid:514883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaidkit.com"; sid:514884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaidkits.com"; sid:514885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfitness.com"; sid:514886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflash.com"; sid:514887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-florida.com"; sid:514888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfocus.com"; sid:514889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfood.com"; sid:514890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforbusinesses.com"; sid:514891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfordummies.com"; sid:514892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforecast.com"; sid:514893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforemployers.com"; sid:514894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortlauderdale.com"; sid:514895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortworth.com"; sid:514896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfranklin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfranklin.com"; sid:514897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfraud.com"; sid:514898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-free.com"; sid:514899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedom.com"; sid:514900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfresno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfresno.com"; sid:514901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuture.com"; sid:514902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgames.com"; sid:514903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgasmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgasmask.com"; sid:514904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgasmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgasmasks.com"; sid:514905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeek.com"; sid:514906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenesis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenesis.com"; sid:514907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenie.com"; sid:514908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenius.com"; sid:514909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenome.com"; sid:514910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgetaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgetaway.com"; sid:514911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusghana.com"; sid:514912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgifts.com"; sid:514913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgirls.com"; sid:514914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalforce.com"; sid:514915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.gold"; sid:514916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgold.com"; sid:514917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoods.com"; sid:514918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentfunds.com"; sid:514919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgranada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgranada.com"; sid:514920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-grants.com"; sid:514921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrants.com"; sid:514922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgraphs.com"; sid:514923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreenzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreenzone.com"; sid:514924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrief.com"; sid:514925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-grippe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-grippe.com"; sid:514926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-guide.com"; sid:514927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguideonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguideonline.com"; sid:514928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguinea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguinea.com"; sid:514929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguy.com"; sid:514930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguys.com"; sid:514931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgym.com"; sid:514932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushacker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushacker.com"; sid:514933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushaiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushaiti.com"; sid:514934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsoap.com"; sid:514935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthchats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthchats.com"; sid:514936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthinfo.com"; sid:514937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthline.com"; sid:514938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthmeds.com"; sid:514939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.net"; sid:514940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheattreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheattreatment.com"; sid:514941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpfund.com"; sid:514942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpkit.com"; sid:514943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpnow.com"; sid:514944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushendersonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushendersonville.com"; sid:514945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushi.com"; sid:514946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushield.com"; sid:514947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hilfe.com"; sid:514948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushire.com"; sid:514949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushistories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushistories.com"; sid:514950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushollywood.com"; sid:514951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomecare.com"; sid:514952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomesafety.com"; sid:514953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomestest.com"; sid:514954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestingkits.com"; sid:514955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestkits.com"; sid:514956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestkits.net"; sid:514957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometests.com"; sid:514958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushonduras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushonduras.com"; sid:514959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushong.com"; sid:514960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushonolulu.com"; sid:514961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushope.com"; sid:514962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalsafety.com"; sid:514963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotels.com"; sid:514964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotlinefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotlinefl.com"; sid:514965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotlineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotlineusa.com"; sid:514966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushumor.com"; sid:514967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushungary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushungary.com"; sid:514968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushunter.com"; sid:514969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushurts.com"; sid:514970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushygiene.com"; sid:514971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushype.com"; sid:514972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusia.com"; sid:514973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidaho.com"; sid:514974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidiots.com"; sid:514975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusil.com"; sid:514976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimages.com"; sid:514977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimaging.com"; sid:514978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunesystemboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunesystemboost.com"; sid:514979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunityboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunityboost.com"; sid:514980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpeachment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpeachment.com"; sid:514981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimunity.com"; sid:514982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimunity.net"; sid:514983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinatlanta.com"; sid:514984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincome.com"; sid:514985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-india.com"; sid:514986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindianapolis.com"; sid:514987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindogs.com"; sid:514988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindonesia.com"; sid:514989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindustry.com"; sid:514990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionreports.com"; sid:514991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoapp.com"; sid:514992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusinfo.com"; sid:514993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfofl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfofl.com"; sid:514994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoforemployers.com"; sid:514995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoguide.com"; sid:514996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfolive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfolive.com"; sid:514997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfous.com"; sid:514998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhaler.com"; sid:514999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhomecare.com"; sid:515000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhouston.com"; sid:515001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryclaims.com"; sid:515002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjury.com"; sid:515003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylawyers.com"; sid:515004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinnovation.com"; sid:515005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinquest.com"; sid:515006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusins.com"; sid:515007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsights.com"; sid:515008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.institute - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.institute"; sid:515009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceagency.com"; sid:515010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvasion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvasion.com"; sid:515011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestment.com"; sid:515012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestor.com"; sid:515013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiowa.com"; sid:515014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiraq.com"; sid:515015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisland.com"; sid:515016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisrael.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisrael.com"; sid:515017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitalia.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitalia.biz"; sid:515018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitems.com"; sid:515019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjacksonville.com"; sid:515020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjob.com"; sid:515021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobs.com"; sid:515022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjoebiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjoebiden.com"; sid:515023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansascity.com"; sid:515024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansas.com"; sid:515025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskazakhstan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskazakhstan.com"; sid:515026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskentucky.com"; sid:515027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskenya.com"; sid:515028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeyword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeyword.com"; sid:515029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillspray.com"; sid:515030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingcounty.com"; sid:515031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingdom.com"; sid:515032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskings.com"; sid:515033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskissmyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskissmyass.com"; sid:515034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskitstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskitstest.com"; sid:515035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskittest.com"; sid:515036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknowledge.com"; sid:515037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknoxville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknoxville.com"; sid:515038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskong.com"; sid:515039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusks.com"; sid:515040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskudlow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskudlow.com"; sid:515041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusky.com"; sid:515042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabchip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabchip.com"; sid:515043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lab.com"; sid:515044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabtests.com"; sid:515045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-la.com"; sid:515046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslasvegas.com"; sid:515047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-latestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-latestnews.com"; sid:515048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-law.com"; sid:515049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirms.com"; sid:515050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawforbusiness.com"; sid:515051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawgroup.com"; sid:515052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawsuits.com"; sid:515053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawsuits.com"; sid:515054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawyer.com"; sid:515055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawyer.com"; sid:515056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawyers.com"; sid:515057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawyers.com"; sid:515058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-l.com"; sid:515059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusl.com"; sid:515060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleader.com"; sid:515061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleaders.com"; sid:515062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleadership.com"; sid:515063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalassistance.com"; sid:515064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalcenter.com"; sid:515065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalhelp.com"; sid:515066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalrights.com"; sid:515067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslibrary.com"; sid:515068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslight.com"; sid:515069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslistingexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslistingexpert.com"; sid:515070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslite.com"; sid:515071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivestream.com"; sid:515072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliving.com"; sid:515073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusllc.com"; sid:515074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloan.com"; sid:515075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloans.com"; sid:515076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocationmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocationmap.com"; sid:515077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslogistics.com"; sid:515078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslondon.com"; sid:515079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongbeach.com"; sid:515080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongisland.com"; sid:515081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosangelesca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosangelesca.com"; sid:515082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslottery.com"; sid:515083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisville.com"; sid:515084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusly.com"; sid:515085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmachine.com"; sid:515086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusma.com"; sid:515087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadagascar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadagascar.com"; sid:515088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadison.com"; sid:515089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-magazin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-magazin.com"; sid:515090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmagazine.com"; sid:515091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaine.com"; sid:515092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakemoney.com"; sid:515093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalaga.com"; sid:515094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalawi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalawi.com"; sid:515095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmali.com"; sid:515096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanager.com"; sid:515097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanhattan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanhattan.com"; sid:515098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmania.com"; sid:515099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-manual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-manual.com"; sid:515100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-manuel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-manuel.com"; sid:515101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mapping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mapping.com"; sid:515102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarbella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarbella.com"; sid:515103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketing.com"; sid:515104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskesi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskesi.net"; sid:515105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskindia.com"; sid:515106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasknow.com"; sid:515107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskscovid19.com"; sid:515108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksn95s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksn95s.com"; sid:515109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmassachusetts.com"; sid:515110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmassagece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmassagece.com"; sid:515111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmd.net"; sid:515112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeal.com"; sid:515113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedford.com"; sid:515114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicinefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicinefamily.com"; sid:515115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedkit.com"; sid:515116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedtest.com"; sid:515117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeeting.com"; sid:515118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphis.com"; sid:515119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphistn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphistn.com"; sid:515120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmenu.com"; sid:515121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmerchant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmerchant.com"; sid:515122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmesa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmesa.com"; sid:515123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmex.com"; sid:515124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mexico.com"; sid:515125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiamiflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiamiflorida.com"; sid:515126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmi.com"; sid:515127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilwaukee.com"; sid:515128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminneapolis.com"; sid:515129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminnesota.com"; sid:515130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmississippi.com"; sid:515131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmlm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmlm.com"; sid:515132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmn.com"; sid:515133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmo.com"; sid:515134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmom.com"; sid:515135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoney.com"; sid:515136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmontana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmontana.com"; sid:515137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgage.com"; sid:515138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoscow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoscow.com"; sid:515139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmozambique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmozambique.com"; sid:515140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmta.com"; sid:515141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmt.com"; sid:515142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmundo.com"; sid:515143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusic.com"; sid:515144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmutation.com"; sid:515145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyanmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyanmar.com"; sid:515146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyrtlebeach.com"; sid:515147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyths.com"; sid:515148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95-respirator-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95-respirator-facemask.com"; sid:515149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusname.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusname.com"; sid:515150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnashville.com"; sid:515151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnation.com"; sid:515152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnatural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnatural.com"; sid:515153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturaldefense.com"; sid:515154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalsupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalsupplements.com"; sid:515155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturopathic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturopathic.com"; sid:515156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaz.com"; sid:515157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnd.com"; sid:515158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnebraska.com"; sid:515159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusne.com"; sid:515160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnegligence.com"; sid:515161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnepal.com"; sid:515162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnetherlands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnetherlands.com"; sid:515163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.network"; sid:515164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewhampshire.com"; sid:515165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewjersey.com"; sid:515166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewmexico.com"; sid:515167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnow.com"; sid:515168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneworleans.com"; sid:515169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews247.com"; sid:515170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews24.com"; sid:515171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsbd.com"; sid:515172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsdaily.com"; sid:515173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsforbusiness.com"; sid:515174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewspage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewspage.com"; sid:515175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewspaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewspaper.com"; sid:515176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsreport.com"; sid:515177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsstories.com"; sid:515178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewswire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewswire.com"; sid:515179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newyork-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newyork-cases.com"; sid:515180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newyork.com"; sid:515181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkny.com"; sid:515182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnh.com"; sid:515183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusniger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusniger.com"; sid:515184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnm.com"; sid:515185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnola.com"; sid:515186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorthcarolina.com"; sid:515187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorth.com"; sid:515188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorthdakota.com"; sid:515189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorway.com"; sid:515190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotes.com"; sid:515191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotify.com"; sid:515192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovel.com"; sid:515193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-now.com"; sid:515194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnownews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnownews.com"; sid:515195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnus.com"; sid:515196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnutrition.com"; sid:515197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnv.com"; sid:515198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnw.com"; sid:515199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoakland.com"; sid:515200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoath.com"; sid:515201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruso.com"; sid:515202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffer.com"; sid:515203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffers.com"; sid:515204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffice.com"; sid:515205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoh.com"; sid:515206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusohio.com"; sid:515207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoil.com"; sid:515208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusok.com"; sid:515209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoklahoma.com"; sid:515210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusolympic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusolympic.com"; sid:515211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusomaha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusomaha.com"; sid:515212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusone.com"; sid:515213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-onlinekongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-onlinekongress.com"; sid:515214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopendata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopendata.com"; sid:515215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoracle.com"; sid:515216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoslo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoslo.com"; sid:515217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutlet.com"; sid:515218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspakistan.com"; sid:515219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemiclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemiclaw.com"; sid:515220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicnews.com"; sid:515221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspantry.com"; sid:515222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspapua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspapua.com"; sid:515223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparadise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparadise.com"; sid:515224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparaso.com"; sid:515225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparis.com"; sid:515226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartner.com"; sid:515227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartners.com"; sid:515228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatient.com"; sid:515229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientmonitoring.com"; sid:515230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientobservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientobservation.com"; sid:515231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientzero.com"; sid:515232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcp.com"; sid:515233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcps.com"; sid:515234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspechino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspechino.com"; sid:515235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspensacola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspensacola.com"; sid:515236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjury.com"; sid:515237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalservices.com"; sid:515238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetition.com"; sid:515239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetsafety.com"; sid:515240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspets.com"; sid:515241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspharmaceutical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspharmaceutical.com"; sid:515242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphilippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphilippines.com"; sid:515243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoenix.com"; sid:515244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoto.com"; sid:515245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphotos.com"; sid:515246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphx.com"; sid:515247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspilot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspilot.com"; sid:515248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.pizza"; sid:515249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaintiff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaintiff.com"; sid:515250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanet.com"; sid:515251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanner.com"; sid:515252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplasma.com"; sid:515253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspledge.com"; sid:515254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplus.com"; sid:515255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoland.com"; sid:515256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolicytemplate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolicytemplate.com"; sid:515257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspopup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspopup.com"; sid:515258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportfolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportfolio.com"; sid:515259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportugal.com"; sid:515260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspositive.com"; sid:515261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspost.com"; sid:515262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusposter.com"; sid:515263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspray.com"; sid:515264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayer.com"; sid:515265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspredictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspredictions.com"; sid:515266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-preparation.com"; sid:515267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prepared.com"; sid:515268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepguide.com"; sid:515269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreps.com"; sid:515270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspresident.com"; sid:515271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventing.com"; sid:515272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention101.com"; sid:515273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-kit.com"; sid:515274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention-kit.com"; sid:515275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-kits.com"; sid:515276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention-kits.com"; sid:515277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprimary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprimary.com"; sid:515278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproblem.com"; sid:515279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproduction.com"; sid:515280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproductions.com"; sid:515281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproduct.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproduct.net"; sid:515282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-products.com"; sid:515283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessional.com"; sid:515284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessor.com"; sid:515285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromo.com"; sid:515286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromotions.com"; sid:515287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofs.com"; sid:515288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproperties.com"; sid:515289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection2020.com"; sid:515290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-box.com"; sid:515291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-kits.com"; sid:515292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspurge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspurge.com"; sid:515293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspurification.com"; sid:515294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspuzzle.com"; sid:515295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-quarantine.com"; sid:515296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantineworkfromhomejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantineworkfromhomejobs.com"; sid:515297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqueens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqueens.com"; sid:515298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-questions.com"; sid:515299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquotes.com"; sid:515300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusr0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusr0.com"; sid:515301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradio.com"; sid:515302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiologist.com"; sid:515303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiologists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiologists.com"; sid:515304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiology.com"; sid:515305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusraleigh.com"; sid:515306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtesting.com"; sid:515307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtestkit.com"; sid:515308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrate.com"; sid:515309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrates.com"; sid:515310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadykit.com"; sid:515311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreal.com"; sid:515312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestateexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestateexpert.com"; sid:515313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreality.com"; sid:515314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecipes.com"; sid:515315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreinfection.com"; sid:515316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotepatientmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotepatientmonitoring.com"; sid:515317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotepatientobservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotepatientobservation.com"; sid:515318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreporter.com"; sid:515319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreporting.com"; sid:515320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearcher.com"; sid:515321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearch.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearch.fund"; sid:515322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcehub.com"; sid:515323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestroomsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestroomsigns.com"; sid:515324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreviews.com"; sid:515325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrightnow.com"; sid:515326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrights.com"; sid:515327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusroma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusroma.com"; sid:515328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusromania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusromania.com"; sid:515329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrule.com"; sid:515330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrumors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrumors.com"; sid:515331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrus.com"; sid:515332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrwanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrwanda.com"; sid:515333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sa.com"; sid:515334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussacramento.com"; sid:515335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafekit.com"; sid:515336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafespot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafespot.com"; sid:515337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyadvice.com"; sid:515338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetykitbox.com"; sid:515339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-safety-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-safety-kit.com"; sid:515340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymanual.com"; sid:515341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymask.com"; sid:515342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyservices.com"; sid:515343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysolutions.com"; sid:515344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetystore.com"; sid:515345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafezone.com"; sid:515346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaga.com"; sid:515347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussale.com"; sid:515348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalem.com"; sid:515349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussales.com"; sid:515350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanders.com"; sid:515351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiego.com"; sid:515352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfrancisco.com"; sid:515353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfran.com"; sid:515354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizers.com"; sid:515355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanjose.com"; sid:515356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussantaclara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussantaclara.com"; sid:515357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sante.com"; sid:515358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussardina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussardina.com"; sid:515359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaudi.com"; sid:515360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussc.com"; sid:515361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschoolclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschoolclosings.com"; sid:515362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschool.com"; sid:515363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-schweiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-schweiz.com"; sid:515364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-s.com"; sid:515365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscottsdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscottsdale.com"; sid:515366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussd.com"; sid:515367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selbsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selbsttest.com"; sid:515368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selftest.com"; sid:515369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selftestkit.com"; sid:515370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftestkit.com"; sid:515371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseminar.com"; sid:515372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseminars.com"; sid:515373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenior.com"; sid:515374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseniors.com"; sid:515375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussentinel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussentinel.com"; sid:515376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserbia.com"; sid:515377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusservice.com"; sid:515378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettle.com"; sid:515379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettlements.com"; sid:515380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussevilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussevilla.com"; sid:515381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseville.com"; sid:515382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussex.com"; sid:515383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshare.com"; sid:515384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusship.com"; sid:515385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopper.com"; sid:515386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoulditravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoulditravel.com"; sid:515387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussign.com"; sid:515388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussites.com"; sid:515389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusskilledcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusskilledcare.com"; sid:515390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-soigner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-soigner.com"; sid:515391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussomalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussomalia.com"; sid:515392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sos.com"; sid:515393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussos.com"; sid:515394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthafrica.com"; sid:515395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthamerica.com"; sid:515396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthcarolina.com"; sid:515397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouth.com"; sid:515398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthdakota.com"; sid:515399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouvenir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouvenir.com"; sid:515400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecial.com"; sid:515401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussppraysanitinizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussppraysanitinizer.com"; sid:515402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sprays.com"; sid:515403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspringfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspringfield.com"; sid:515404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstarter.com"; sid:515405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-state-by-state.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-state-by-state.com"; sid:515406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstay.com"; sid:515407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussterilization.com"; sid:515408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stock-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stock-crash.com"; sid:515409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockholm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockholm.com"; sid:515410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stock-meltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stock-meltdown.com"; sid:515411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstorage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstorage.com"; sid:515412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstoreca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstoreca.com"; sid:515413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstream.com"; sid:515414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstreet.com"; sid:515415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstressball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstressball.com"; sid:515416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstressballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstressballs.com"; sid:515417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrong.com"; sid:515418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstyle.com"; sid:515419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussudan.com"; sid:515420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuplements.com"; sid:515421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplies.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplies.club"; sid:515422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussupplies.com"; sid:515423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupply.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupply.club"; sid:515424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplykitbox.com"; sid:515425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support.com"; sid:515426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportonline.com"; sid:515427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurveys.com"; sid:515428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalbook.com"; sid:515429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalkitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalkitbox.com"; sid:515430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalsupplies.com"; sid:515431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorstory.com"; sid:515432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuvivor.com"; sid:515433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussweden.com"; sid:515434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswitzerland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswitzerland.com"; sid:515435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussxsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussxsw.com"; sid:515436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-symptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-symptom.com"; sid:515437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymtoms.com"; sid:515438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyria.com"; sid:515439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussystems.com"; sid:515440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustablets.com"; sid:515441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaiwan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaiwan.com"; sid:515442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustajikistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustajikistan.com"; sid:515443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustales.com"; sid:515444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustampa.com"; sid:515445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustanzania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustanzania.com"; sid:515446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustax.com"; sid:515447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.taxi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.taxi"; sid:515448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-t.com"; sid:515449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustees.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustees.net"; sid:515450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteledoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteledoc.com"; sid:515451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteledoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteledoctor.com"; sid:515452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustennessee.com"; sid:515453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminator.com"; sid:515454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterror.com"; sid:515455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest101.com"; sid:515456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestathome.com"; sid:515457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestco.com"; sid:515458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustest.com"; sid:515459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestct.com"; sid:515460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing.com"; sid:515461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcompany.com"; sid:515462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglab.com"; sid:515463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestings.com"; sid:515464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test-kit.com"; sid:515465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test-kit.com"; sid:515466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit.net"; sid:515467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkits.net"; sid:515468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnow.com"; sid:515469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestonline.com"; sid:515470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tests.com"; sid:515471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteststrip.com"; sid:515472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-texas.com"; sid:515473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustext.com"; sid:515474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthailand.com"; sid:515475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheband.com"; sid:515476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthemusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthemusical.com"; sid:515477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthenovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthenovel.com"; sid:515478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusticker.com"; sid:515479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustiktok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustiktok.com"; sid:515480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustime.com"; sid:515481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimeline.com"; sid:515482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustip.com"; sid:515483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustn.com"; sid:515484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustokyo.com"; sid:515485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustonic.com"; sid:515486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoolbox.com"; sid:515487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoolkit.com"; sid:515488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoronto.com"; sid:515489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoys.com"; sid:515490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackerapp.com"; sid:515491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrade.com"; sid:515492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrader.com"; sid:515493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrading.com"; sid:515494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustragedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustragedies.com"; sid:515495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustragedy.com"; sid:515496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveladvice.com"; sid:515497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelagent.com"; sid:515498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveldiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveldiscounts.com"; sid:515499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelinsurance.com"; sid:515500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelkits.com"; sid:515501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelpack.com"; sid:515502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelproducts.com"; sid:515503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelsafe.com"; sid:515504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveltips.com"; sid:515505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelupdates.com"; sid:515506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreason.com"; sid:515507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrek.com"; sid:515508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrip.com"; sid:515509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrivia.com"; sid:515510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-trump.com"; sid:515511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusts.com"; sid:515512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirust-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirust-shirt.com"; sid:515513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustshirts.net"; sid:515514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustube.com"; sid:515515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustucson.com"; sid:515516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustulsa.com"; sid:515517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustunisia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustunisia.com"; sid:515518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustutor.com"; sid:515519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuganda.com"; sid:515520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusukraine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusukraine.com"; sid:515521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuk.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuk.support"; sid:515522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunit.com"; sid:515523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunited.com"; sid:515524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunitedkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunitedkingdom.com"; sid:515525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunit.net"; sid:515526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.club"; sid:515527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-updates.net"; sid:515528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupport.com"; sid:515529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-us.com"; sid:515530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-us-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-us-news.com"; sid:515531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusut.com"; sid:515532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuzbekistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuzbekistan.com"; sid:515533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacation.com"; sid:515534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacationdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacationdeals.com"; sid:515535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacations.com"; sid:515536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelist.com"; sid:515537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinenews.com"; sid:515538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-vaccines.com"; sid:515539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusva.com"; sid:515540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvanderbilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvanderbilt.com"; sid:515541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvenezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvenezuela.com"; sid:515542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvermont.com"; sid:515543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvet.com"; sid:515544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveterinarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveterinarian.com"; sid:515545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveterinarians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveterinarians.com"; sid:515546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictim.com"; sid:515547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideo.com"; sid:515548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvietnam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvietnam.com"; sid:515549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitals.com"; sid:515550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitamin.com"; sid:515551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vitamins.com"; sid:515552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoice.com"; sid:515553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvorbeugen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvorbeugen.com"; sid:515554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvote.com"; sid:515555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvrij.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvrij.com"; sid:515556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvt.com"; sid:515557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalkingdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalkingdead.com"; sid:515558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashers.com"; sid:515559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswatchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswatchdog.com"; sid:515560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswave.com"; sid:515561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweekly.com"; sid:515562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestvirginia.com"; sid:515563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswholesale.com"; sid:515564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswi.com"; sid:515565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswipe.com"; sid:515566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wipes.com"; sid:515567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswisconsin.com"; sid:515568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswizard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswizard.com"; sid:515569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkfromhome.com"; sid:515570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworking.com"; sid:515571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkout.com"; sid:515572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-cases.com"; sid:515573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldhealthwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldhealthwatch.com"; sid:515574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldupdates.com"; sid:515575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswriter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswriter.com"; sid:515576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswv.com"; sid:515577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswy.com"; sid:515578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswyoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswyoming.com"; sid:515579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxp.com"; sid:515580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxxx.com"; sid:515581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyemen.com"; sid:515582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszambia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszambia.com"; sid:515583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszicam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszicam.com"; sid:515584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszimbabwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszimbabwe.com"; sid:515585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-zone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-zone.com"; sid:515586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszpack.com"; sid:515587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirux.com"; sid:515588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavius.com"; sid:515589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviz.net"; sid:515590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavkit.com"; sid:515591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrij.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrij.com"; sid:515592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavs.com"; sid:515593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurus.com"; sid:515594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatch2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatch2020.com"; sid:515595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipe.com"; sid:515596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkathome.com"; sid:515597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldmonitor.com"; sid:515598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldwidemonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldwidemonitor.com"; sid:515599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawrongfuldeath.com"; sid:515600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxmask.com"; sid:515601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazaehler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazaehler.com"; sid:515602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazapper.com"; sid:515603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zombie.com"; sid:515604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cotedivoirecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cotedivoirecoronavirus.com"; sid:515605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-10.com"; sid:515606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-advice.com"; sid:515607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19af.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19af.com"; sid:515608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19africa.com"; sid:515609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ak.com"; sid:515610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19al.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19al.com"; sid:515611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-alerts.com"; sid:515612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allert.com"; sid:515613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analys.com"; sid:515614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19app.com"; sid:515615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ar.com"; sid:515616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometest.com"; sid:515617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorney.com"; sid:515618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneys.com"; sid:515619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bjj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bjj.com"; sid:515620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bloodtest.com"; sid:515621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtest.com"; sid:515622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bs.com"; sid:515623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bug.com"; sid:515624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessupdate.com"; sid:515625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calculator.com"; sid:515626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19california.com"; sid:515627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cases.com"; sid:515628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certificate.com"; sid:515629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challenge.com"; sid:515630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claim.com"; sid:515631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.com"; sid:515632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classaction.com"; sid:515633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clean.com"; sid:515634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaner.com"; sid:515635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaner.com"; sid:515636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaners.com"; sid:515637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaners.com"; sid:515638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservice.com"; sid:515639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservices.com"; sid:515640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicaltest.com"; sid:515641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinics.com"; sid:515642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clo2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clo2.com"; sid:515643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cocktail.com"; sid:515644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19co.com"; sid:515645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comedyclub.com"; sid:515646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.com"; sid:515647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concerns.com"; sid:515648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conference.com"; sid:515649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19control.com"; sid:515650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona.biz"; sid:515651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corona.com"; sid:515652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona-virus.com"; sid:515653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus-map.com"; sid:515654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.net"; sid:515655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirustest.com"; sid:515656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.world"; sid:515657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cr.com"; sid:515658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crowd.com"; sid:515659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datanow.com"; sid:515660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deals.com"; sid:515661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19death.com"; sid:515662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19de.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19de.com"; sid:515663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detection.com"; sid:515664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectors.com"; sid:515665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostic.com"; sid:515666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnostics.com"; sid:515667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostics.com"; sid:515668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diet.com"; sid:515669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19directions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19directions.com"; sid:515670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disaster.com"; sid:515671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaseupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaseupdate.com"; sid:515672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectant.com"; sid:515673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectants.com"; sid:515674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disputes.com"; sid:515675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doc.com"; sid:515676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dx.com"; sid:515677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economy.com"; sid:515678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergency.com"; sid:515679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employersupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employersupdate.com"; sid:515680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlaw.com"; sid:515681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19events.com"; sid:515682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experience.com"; sid:515683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposed.com"; sid:515684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fact.com"; sid:515685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-facts.com"; sid:515686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-faq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-faq.com"; sid:515687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fear.com"; sid:515688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19feedback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19feedback.com"; sid:515689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19film.com"; sid:515690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fl.com"; sid:515691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19folding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19folding.com"; sid:515692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fordummies.com"; sid:515693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forums.com"; sid:515694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19france.com"; sid:515695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ga.com"; sid:515696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalemployment.com"; sid:515697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalemploymenttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalemploymenttracker.com"; sid:515698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-grants.com"; sid:515699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grants.com"; sid:515700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitizer.com"; sid:515701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsoap.com"; sid:515702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcare.com"; sid:515703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hilfe.com"; sid:515704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeremedy.com"; sid:515705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometest.com"; sid:515706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkit.com"; sid:515707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometests.com"; sid:515708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospital.com"; sid:515709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotlineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotlineusa.com"; sid:515710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ia.com"; sid:515711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19id.com"; sid:515712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19il.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19il.com"; sid:515713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impact.com"; sid:515714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19in.com"; sid:515715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionreports.com"; sid:515716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhaler.com"; sid:515717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internationalinfectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internationalinfectionreports.com"; sid:515718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inusa.com"; sid:515719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobs.com"; sid:515720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jokes.com"; sid:515721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jokes.com"; sid:515722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ks.com"; sid:515723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ky.com"; sid:515724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labs.com"; sid:515725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labstrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labstrip.com"; sid:515726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawblog.com"; sid:515727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawgroup.com"; sid:515728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuit.com"; sid:515729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawyer.com"; sid:515730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawyer.com"; sid:515731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.com"; sid:515732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyers.com"; sid:515733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19l.com"; sid:515734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19l.com"; sid:515735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-learning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-learning.com"; sid:515736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19learning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19learning.com"; sid:515737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalinformation.com"; sid:515738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19line.com"; sid:515739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live.com"; sid:515740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live-update.com"; sid:515741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live-updates.com"; sid:515742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-losgistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-losgistics.com"; sid:515743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ma.com"; sid:515744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mailer.com"; sid:515745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maps.com"; sid:515746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19me.com"; sid:515747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicine.com"; sid:515748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medtest.com"; sid:515749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-merch.com"; sid:515750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mexico.com"; sid:515751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mi.com"; sid:515752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mn.com"; sid:515753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mo.com"; sid:515754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ms.com"; sid:515755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutation.com"; sid:515756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myths.com"; sid:515757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nc.com"; sid:515758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nd.com"; sid:515759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newswire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newswire.com"; sid:515760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nh.com"; sid:515761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nj.com"; sid:515762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-no.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-no.com"; sid:515763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nyc.com"; sid:515764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oh.com"; sid:515765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.com"; sid:515766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-outbreak.com"; sid:515767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemia.com"; sid:515768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemic.com"; sid:515769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-patient-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-patient-monitoring.com"; sid:515770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalassistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalassistant.com"; sid:515771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalservices.com"; sid:515772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ph.com"; sid:515773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.photos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.photos"; sid:515774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plan.com"; sid:515775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19porn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19porn.com"; sid:515776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19post.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19post.com"; sid:515777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-preparation.com"; sid:515778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prevention.com"; sid:515779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19product.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19product.com"; sid:515780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19productions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19productions.com"; sid:515781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projection.com"; sid:515782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projections.com"; sid:515783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptforum.com"; sid:515784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantine.com"; sid:515785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19queen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19queen.com"; sid:515786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quiz.com"; sid:515787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radar.com"; sid:515788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtests.com"; sid:515789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtesttaken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtesttaken.com"; sid:515790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapitest.com"; sid:515791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19readiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19readiness.com"; sid:515792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realfacts.com"; sid:515793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realinfo.com"; sid:515794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recession.com"; sid:515795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recource.com"; sid:515796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reinfection.com"; sid:515797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-relief.com"; sid:515798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reports.com"; sid:515799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reports.com"; sid:515800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restroomssigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restroomssigns.com"; sid:515801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ri.com"; sid:515802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sa.com"; sid:515803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.com"; sid:515804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedelivery.com"; sid:515805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizer.com"; sid:515806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scams.com"; sid:515807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sc.com"; sid:515808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scoop.com"; sid:515809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scoop.com"; sid:515810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screener.com"; sid:515811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19search.com"; sid:515812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftest.com"; sid:515813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-selftestkit.com"; sid:515814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selftestkit.com"; sid:515815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftestkit.com"; sid:515816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seminar.com"; sid:515817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seminars.com"; sid:515818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlement.com"; sid:515819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sex.com"; sid:515820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sick.com"; sid:515821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sign.com"; sid:515822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soap.com"; sid:515823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solution.com"; sid:515824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutions.com"; sid:515825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19springfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19springfield.com"; sid:515826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistics.com"; sid:515827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stats.com"; sid:515828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-status.com"; sid:515829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stopper.com"; sid:515830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storm.com"; sid:515831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strains.com"; sid:515832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strains.com"; sid:515833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportgroup.com"; sid:515834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survey.com"; sid:515835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalkit.com"; sid:515836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalpack.com"; sid:515837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalpacks.com"; sid:515838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survive.com"; sid:515839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-symptoms.com"; sid:515840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19takip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19takip.com"; sid:515841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19team.com"; sid:515842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.center"; sid:515843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testcenters.com"; sid:515844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tester.com"; sid:515845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testerkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testerkit.com"; sid:515846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testing.com"; sid:515847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing.com"; sid:515848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-kit.com"; sid:515849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.net"; sid:515850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlab.com"; sid:515851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststrip.com"; sid:515852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsupply.com"; sid:515853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thai.com"; sid:515854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tip.com"; sid:515855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tips.com"; sid:515856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tn.com"; sid:515857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toolkit.com"; sid:515858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracker.com"; sid:515859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracking.com"; sid:515860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracking.com"; sid:515861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19training.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19training.net"; sid:515862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travel.com"; sid:515863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelinfo.com"; sid:515864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelupdates.com"; sid:515865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truths.com"; sid:515866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uk.com"; sid:515867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19untoldstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19untoldstories.com"; sid:515868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usatracker.com"; sid:515869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.com"; sid:515870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ustracker.com"; sid:515871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us-update.com"; sid:515872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ut.com"; sid:515873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19v2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19v2.com"; sid:515874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccaine.com"; sid:515875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacine.com"; sid:515876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19va.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19va.com"; sid:515877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19v.com"; sid:515878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19view.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19view.com"; sid:515879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruskiller.com"; sid:515880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusprotection.com"; sid:515881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virussupplies.com"; sid:515882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussupplies.com"; sid:515883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virustest.com"; sid:515884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusupdate.com"; sid:515885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdates.com"; sid:515886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vt.com"; sid:515887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wa.com"; sid:515888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warrior.com"; sid:515889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19watch.com"; sid:515890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whistleblower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whistleblower.com"; sid:515891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19who.com"; sid:515892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wi.com"; sid:515893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplacematters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplacematters.com"; sid:515894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-world-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-world-cases.com"; sid:515895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeath.com"; sid:515896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wuhan.com"; sid:515897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-x.com"; sid:515898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zombies.com"; sid:515899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid29.com"; sid:515900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid420.com"; sid:515901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9app.com"; sid:515902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaffectedmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaffectedmap.com"; sid:515903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagency.com"; sid:515904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamask.com"; sid:515905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalysis.com"; sid:515906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalytica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalytica.com"; sid:515907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalytics.com"; sid:515908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidan.com"; sid:515909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantivirus.com"; sid:515910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidas.com"; sid:515911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarrier.com"; sid:515912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet.com"; sid:515913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbot.com"; sid:515914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.com"; sid:515915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcall.com"; sid:515916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcankissmyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcankissmyass.com"; sid:515917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregel.com"; sid:515918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarekit.com"; sid:515919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcase.com"; sid:515920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenter.com"; sid:515921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchain.com"; sid:515922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.chat"; sid:515923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-check.com"; sid:515924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckup.com"; sid:515925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.com"; sid:515926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaner.com"; sid:515927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.com"; sid:515928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning.com"; sid:515929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoach.com"; sid:515930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcerns.com"; sid:515931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsult.com"; sid:515932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsults.com"; sid:515933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorp.com"; sid:515934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cov-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cov-19.com"; sid:515935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcov19.com"; sid:515936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowork.com"; sid:515937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrafts.com"; sid:515938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurekit.com"; sid:515939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddating.com"; sid:515940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddestroyer.com"; sid:515941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetection.com"; sid:515942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiaries.com"; sid:515943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.direct"; sid:515944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddled.com"; sid:515945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddx.com"; sid:515946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefense.com"; sid:515947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19.com"; sid:515948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetection.com"; sid:515949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevents.com"; sid:515950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-evidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-evidence.com"; sid:515951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevidence.com"; sid:515952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facemasks.com"; sid:515953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshield.com"; sid:515954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacts.biz"; sid:515955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facts.com"; sid:515956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfear.com"; sid:515957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.com"; sid:515958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfund.com"; sid:515959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardian.com"; sid:515960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelmet.com"; sid:515961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.com"; sid:515962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidid.com"; sid:515963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjury.com"; sid:515964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurance.com"; sid:515965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabchip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabchip.com"; sid:515966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabonachip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabonachip.com"; sid:515967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabsprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabsprevention.com"; sid:515968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabstrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabstrip.com"; sid:515969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlove.com"; sid:515970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmailer.com"; sid:515971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaps.com"; sid:515972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskon.com"; sid:515973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masks.com"; sid:515974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatch.com"; sid:515975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.com"; sid:515976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidme.com"; sid:515977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedia.com"; sid:515978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgage.com"; sid:515979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn95.com"; sid:515980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearme.com"; sid:515981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsnow.com"; sid:515982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnow.com"; sid:515983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemics.com"; sid:515984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanic.com"; sid:515985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plan.com"; sid:515986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplan.com"; sid:515987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoetry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoetry.com"; sid:515988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpress.com"; sid:515989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts.com"; sid:515990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionproducts.com"; sid:515991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidcheck.com"; sid:515992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespirator.com"; sid:515993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-risk.com"; sid:515994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisk.com"; sid:515995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrobotic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrobotic.com"; sid:515996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeguard.com"; sid:515997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.life"; sid:515998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safety.com"; sid:515999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetymask.com"; sid:516000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen.com"; sid:516001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseminar.com"; sid:516002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseminars.com"; sid:516003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sense.com"; sid:516004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsense.com"; sid:516005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shield.com"; sid:516006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshields.com"; sid:516007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsite.com"; sid:516008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoap.com"; sid:516009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stats.com"; sid:516010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstl.com"; sid:516011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstuff.com"; sid:516012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summit.com"; sid:516013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplements.com"; sid:516014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivors.com"; sid:516015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteam.com"; sid:516016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkits.com"; sid:516017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststrip.com"; sid:516018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtexas.com"; sid:516019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthai.com"; sid:516020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthailand.com"; sid:516021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidth.com"; sid:516022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreat.com"; sid:516023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeline.com"; sid:516024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoday.com"; sid:516025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoolkit.com"; sid:516026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracking.com"; sid:516027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.com"; sid:516028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatments.com"; sid:516029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidual.com"; sid:516030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-us.com"; sid:516031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidus.net"; sid:516032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustest.com"; sid:516033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwear.com"; sid:516034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxhandsanitizer.com"; sid:516035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxnow.com"; sid:516036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxxhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxxhandsanitizer.com"; sid:516037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzombies.com"; sid:516038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycorona.com"; sid:516039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscommunicationsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscommunicationsforcoronavirus.com"; sid:516040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcorona.com"; sid:516041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocoronavirus.com"; sid:516042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubacoronavirus.com"; sid:516043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4coronavirus.com"; sid:516044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4covid-19.com"; sid:516045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcovid.com"; sid:516046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecoronav.com"; sid:516047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid-19.com"; sid:516048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid19.com"; sid:516049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid.com"; sid:516050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currencycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currencycorona.com"; sid:516051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for czechcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"czechcoronavirus.com"; sid:516052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacoronaviruskit.com"; sid:516053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronamask.com"; sid:516054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daniellencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daniellencorona.com"; sid:516055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadlycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadlycorona.com"; sid:516056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadlycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadlycovid19.com"; sid:516057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-coronavirus.com"; sid:516058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronavirus.com"; sid:516059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-coronavirus.net"; sid:516060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcoronavirus.com"; sid:516061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecoronavirus.com"; sid:516062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirus.com"; sid:516063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncoronavirus.com"; sid:516064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroy-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroy-corona.com"; sid:516065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectcovid19.com"; sid:516066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronavirus.com"; sid:516067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcovid-19.com"; sid:516068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcovid19.com"; sid:516069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnacovid-19.com"; sid:516070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnacovid19.com"; sid:516071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doccorona.com"; sid:516072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-corona-virus.com"; sid:516073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-coronavirus.com"; sid:516074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecoronavirusyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecoronavirusyet.com"; sid:516075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dominicancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dominicancoronavirus.com"; sid:516076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcorona.com"; sid:516077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcoronavirus.com"; sid:516078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgetcoronad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgetcoronad.com"; sid:516079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgetcoronayall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgetcoronayall.com"; sid:516080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecorona.com"; sid:516081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcoronavirus.com"; sid:516082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovid19.com"; sid:516083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucorona.com"; sid:516084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronatest.com"; sid:516085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug4covid19.com"; sid:516086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycoronatest.com"; sid:516087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecuadorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecuadorcoronavirus.com"; sid:516088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eftforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eftforcoronavirus.com"; sid:516089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for egyptcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"egyptcoronavirus.com"; sid:516090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ehime-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ehime-covid19.com"; sid:516091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronaviruss.com"; sid:516092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminarecoronavirus.com"; sid:516093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emcoronavirus.com"; sid:516094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecoronavirus.com"; sid:516095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronatoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronatoday.com"; sid:516096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcorona.com"; sid:516097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcoronavirus.com"; sid:516098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epandemics.com"; sid:516099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicam.com"; sid:516100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicarea.com"; sid:516101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-coronavirus.com"; sid:516102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-data.com"; sid:516103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdata.com"; sid:516104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicetiquette.com"; sid:516105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicforesight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicforesight.com"; sid:516106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicgear.com"; sid:516107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmaps.com"; sid:516108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotect.com"; sid:516109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotectionservices.com"; sid:516110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicshield.com"; sid:516111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatethecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatethecoronavirus19.com"; sid:516112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecorona.com"; sid:516113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecoronavirus.com"; sid:516114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecoronavirus.net"; sid:516115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopiacoronavirus.com"; sid:516116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecoronavirus.com"; sid:516117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasocoronavirus.com"; sid:516118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcoronavirus.com"; sid:516119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feminicidiosvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feminicidiosvscorona.com"; sid:516120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcorona.com"; sid:516121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcoronavirus.com"; sid:516122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcovid-19.com"; sid:516123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaco.com"; sid:516124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-corona-virus.com"; sid:516125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusnow.com"; sid:516126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid.com"; sid:516127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid19.com"; sid:516128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightvscorona.com"; sid:516129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustreatment.com"; sid:516130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingeredinwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingeredinwuhan.com"; sid:516131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcorona.com"; sid:516132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcorona.com"; sid:516133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirus.com"; sid:516134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid.com"; sid:516135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronascreening.com"; sid:516136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustesting.com"; sid:516137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestkit.com"; sid:516138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestkits.com"; sid:516139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frenaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frenaelcoronavirus.com"; sid:516140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocoronavirus.com"; sid:516141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckucorona.com"; sid:516142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucorona.com"; sid:516143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacoronavirus.com"; sid:516144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirus.com"; sid:516145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germanycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germanycoronavirus.com"; sid:516146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronafacts.com"; sid:516147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatest.com"; sid:516148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatesting.com"; sid:516149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusfacemasks.com"; sid:516150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaviruspill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaviruspill.com"; sid:516151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustest.com"; sid:516152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustesting.com"; sid:516153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustreatment.com"; sid:516154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19shot.com"; sid:516155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getready4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getready4covid19.com"; sid:516156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getridofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getridofcorona.com"; sid:516157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghanacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghanacoronavirus.com"; sid:516158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronamap.com"; sid:516159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusdata.com"; sid:516160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusmap.com"; sid:516161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19.com"; sid:516162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19data.com"; sid:516163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalepidemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalepidemic.world"; sid:516164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goawaycorona.com"; sid:516165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemic.com"; sid:516166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greececoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greececoronavirus.com"; sid:516167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grillcoronavirus.com"; sid:516168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guatemalacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guatemalacoronavirus.com"; sid:516169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guide-pratique-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guide-pratique-coronavirus.com"; sid:516170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guineacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guineacoronavirus.com"; sid:516171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for habichdencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"habichdencoronavirus.com"; sid:516172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haiticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haiticoronavirus.com"; sid:516173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcorona.com"; sid:516174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handle-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handle-corona.com"; sid:516175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizercoronavirus.com"; sid:516176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveicorona.com"; sid:516177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveigotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveigotcorona.com"; sid:516178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveigotcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveigotcovid-19.com"; sid:516179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveyoursaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveyoursaycovid19.com"; sid:516180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicoronavirus.com"; sid:516181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heal-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heal-covid19.com"; sid:516182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heal-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heal-covid.com"; sid:516183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpanticorona.com"; sid:516184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpanticoronavirus.com"; sid:516185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helppreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helppreventcoronavirus.com"; sid:516186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heywuhan.com"; sid:516187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofcovid19.com"; sid:516188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronatest.com"; sid:516189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirustest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirustest.net"; sid:516190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirustests.com"; sid:516191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19test.com"; sid:516192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hondurascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hondurascoronavirus.com"; sid:516193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hongcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hongcoronavirus.com"; sid:516194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honolulucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honolulucoronavirus.com"; sid:516195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howmanydeadfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howmanydeadfromcoronavirus.com"; sid:516196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocurethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocurethecoronavirus.com"; sid:516197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtokillthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtokillthecoronavirus.com"; sid:516198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomakemoneyduringcoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomakemoneyduringcoronaquarantine.com"; sid:516199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprepareforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprepareforapandemic.com"; sid:516200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventcovid19.com"; sid:516201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivethecoronavirus.com"; sid:516202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoworkfromhomeduringcoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoworkfromhomeduringcoronaquarantine.com"; sid:516203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hqcoronavirus.com"; sid:516204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hungarycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hungarycoronavirus.com"; sid:516205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygienecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygienecoronavirus.com"; sid:516206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygisoftanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygisoftanticorona.com"; sid:516207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorousacidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorousacidcoronavirus.com"; sid:516208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorouscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorouscoronavirus.com"; sid:516209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorouscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorouscovid-19.com"; sid:516210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iacoronavirus.com"; sid:516211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatthecoronavirus.com"; sid:516212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid20.com"; sid:516213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocoronavirus.com"; sid:516214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcorona.com"; sid:516215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcoronavirus.com"; sid:516216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idiotsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idiotsforcoronavirus.com"; sid:516217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifigetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifigetcorona.com"; sid:516218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcoronavirus.com"; sid:516219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecovid19.com"; sid:516220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscoronavirus.com"; sid:516221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactcovid19.com"; sid:516222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacorona.com"; sid:516223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacoronavirus.com"; sid:516224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianapoliscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianapoliscoronavirus.com"; sid:516225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indonesiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indonesiacoronavirus.com"; sid:516226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid.com"; sid:516227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacion-coronavirus.com"; sid:516228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovativecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovativecorona.com"; sid:516229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovativecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovativecovid.com"; sid:516230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecorona.com"; sid:516231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecoronavirus.com"; sid:516232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insightcovid.com"; sid:516233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19test.com"; sid:516234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19testing.com"; sid:516235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcoronamask.com"; sid:516236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacoronavirus.com"; sid:516237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iraqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iraqcoronavirus.com"; sid:516238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcoronavirus.com"; sid:516239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcovid-19.com"; sid:516240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcoronavirus.com"; sid:516241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istherecoronavirusonmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istherecoronavirusonmy.com"; sid:516242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedarealpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedarealpandemic.com"; sid:516243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-corona.com"; sid:516244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived-corona.com"; sid:516245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona-virus.com"; sid:516246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronavirustime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronavirustime.com"; sid:516247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantcoronavirus.com"; sid:516248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksonvillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksonvillecoronavirus.com"; sid:516249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeremiahgrossmandrinkscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeremiahgrossmandrinkscorona.com"; sid:516250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jingyutongwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jingyutongwuhan.com"; sid:516251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletracoronavirus.com"; sid:516252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascoronavirus.com"; sid:516253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawalcorona.com"; sid:516254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kazakhstancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kazakhstancoronavirus.com"; sid:516255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k-corona.com"; sid:516256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keincorona.com"; sid:516257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckycoronavirus.com"; sid:516258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenyacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenyacoronavirus.com"; sid:516259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kick-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kick-corona.com"; sid:516260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona24.com"; sid:516261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronanow.com"; sid:516262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusnyc.com"; sid:516263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusservice.com"; sid:516264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19virus.com"; sid:516265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidswift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidswift.com"; sid:516266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidvirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidvirus-19.com"; sid:516267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killsthecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killsthecoronavirus19.com"; sid:516268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingdomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingdomcoronavirus.com"; sid:516269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-anticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-anticoronavirus.com"; sid:516270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-covid19.com"; sid:516271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid19.com"; sid:516272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowaboutcorona.com"; sid:516273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowcovid.com"; sid:516274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kongcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kongcoronavirus.com"; sid:516275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koreacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koreacovid.com"; sid:516276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronawiruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronawiruscovid19.com"; sid:516277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kscoronavirus.com"; sid:516278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwaitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwaitcorona.com"; sid:516279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronavirus.com"; sid:516280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lab-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lab-corona.com"; sid:516281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorpcorona.com"; sid:516282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labscorona.com"; sid:516283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidelcorona.com"; sid:516284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidelcoronavirus.com"; sid:516285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lankacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lankacoronavirus.com"; sid:516286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasolutionaucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasolutionaucoronavirus.com"; sid:516287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestoncoronavirus.com"; sid:516288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestoncovid19.com"; sid:516289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawandthecoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawandthecoronaviruscrisis.com"; sid:516290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerforcoronavirus.com"; sid:516291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovid19.com"; sid:516292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovid19cure.com"; sid:516293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovidcure.com"; sid:516294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelpcoronavirus.com"; sid:516295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcoronavirus.com"; sid:516296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsdieofcoronatogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsdieofcoronatogether.com"; sid:516297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19.com"; sid:516298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingonlinecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingonlinecorona-virus.com"; sid:516299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingonlinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingonlinecoronavirus.com"; sid:516300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcorona.com"; sid:516301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcoronavirus.com"; sid:516302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronavirus.com"; sid:516303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longbeachcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longbeachcoronavirus.com"; sid:516304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacoronavirus.com"; sid:516305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisvillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisvillecoronavirus.com"; sid:516306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lowcorona.com"; sid:516307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macoronavirus.com"; sid:516308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madagascarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madagascarcoronavirus.com"; sid:516309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainecoronavirus.com"; sid:516310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malawicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malawicoronavirus.com"; sid:516311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malaysiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malaysiacoronavirus.com"; sid:516312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malicoronavirus.com"; sid:516313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manhattancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manhattancoronavirus.com"; sid:516314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcoronavirus.com"; sid:516315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasparacoronavirus.com"; sid:516316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacorona.com"; sid:516317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid-19.com"; sid:516318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcorona.com"; sid:516319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcorona-virus.com"; sid:516320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcovid.com"; sid:516321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforthecoronavirus.com"; sid:516322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covid19.com"; sid:516323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcovid19.com"; sid:516324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachusettscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachusettscoronavirus.com"; sid:516325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid-19.com"; sid:516326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mecoronavirus.com"; sid:516327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for med-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"med-covid-19.com"; sid:516328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediacoronavirus.com"; sid:516329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-coronamask.com"; sid:516330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-coronamask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-coronamask.net"; sid:516331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicationcorona.com"; sid:516332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memphiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memphiscoronavirus.com"; sid:516333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mesacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mesacoronavirus.com"; sid:516334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocoronavirus.com"; sid:516335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancoronavirus.com"; sid:516336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micoronavirus.com"; sid:516337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microfluidiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microfluidiccovid.com"; sid:516338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwaukeecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwaukeecoronavirus.com"; sid:516339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minneapoliscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minneapoliscoronavirus.com"; sid:516340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minnesotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minnesotacoronavirus.com"; sid:516341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicoronavirus.com"; sid:516342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricorona.com"; sid:516343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricoronavirus.com"; sid:516344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigatecoronavirus.com"; sid:516345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncoronavirus.com"; sid:516346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocoronavirus.com"; sid:516347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelcovid19.com"; sid:516348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelcovid.com"; sid:516349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernpandemic.com"; sid:516350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernpandemics.com"; sid:516351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneycorona.com"; sid:516352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitorcorona.com"; sid:516353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanacoronavirus.com"; sid:516354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccocoronavirus.com"; sid:516355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccovid.com"; sid:516356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mozambiquecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mozambiquecoronavirus.com"; sid:516357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mscoronavirus.com"; sid:516358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtcoronavirus.com"; sid:516359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mu-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mu-coronavirus.com"; sid:516360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mucoronavirus.com"; sid:516361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myanmarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myanmarcoronavirus.com"; sid:516362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakiller.com"; sid:516363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalocations.com"; sid:516364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronateam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronateam.com"; sid:516365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusrights.com"; sid:516366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusteam.com"; sid:516367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustest.com"; sid:516368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestingkit.com"; sid:516369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestkits.com"; sid:516370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustests.com"; sid:516371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19team.com"; sid:516372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid411.com"; sid:516373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmask.com"; sid:516374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidreport.com"; sid:516375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidteam.com"; sid:516376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtracker.com"; sid:516377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myepidemic.com"; sid:516378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95corona.com"; sid:516379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95-prevent-epidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95-prevent-epidemics.com"; sid:516380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for namastecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"namastecorona.com"; sid:516381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturallykillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturallykillcoronavirus.com"; sid:516382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovcovid19.com"; sid:516383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidtaskforce.com"; sid:516384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ndcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ndcoronavirus.com"; sid:516385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacoronavirus.com"; sid:516386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necoronavirus.com"; sid:516387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needtoknowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needtoknowcoronavirus.com"; sid:516388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcorona.com"; sid:516389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcoronavirus.com"; sid:516390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netherlandscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netherlandscoronavirus.com"; sid:516391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyagecoronavirus.com"; sid:516392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacoronavirus.com"; sid:516393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-corona-virus.com"; sid:516394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusupdates.com"; sid:516395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19mask.com"; sid:516396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhampshirecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhampshirecoronavirus.com"; sid:516397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycoronavirus.com"; sid:516398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocoronavirus.com"; sid:516399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscoronaviruscovid19.com"; sid:516400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscovid.com"; sid:516401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruscleaning.com"; sid:516402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextcorona.com"; sid:516403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextepidemic.com"; sid:516404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcoronavirus.com"; sid:516405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nigercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nigercoronavirus.com"; sid:516406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nigeriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nigeriacoronavirus.com"; sid:516407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcoronavirus.com"; sid:516408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobelforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobelforcorona.com"; sid:516409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobelforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobelforcoronavirus.com"; sid:516410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona4u.com"; sid:516411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaflights.com"; sid:516412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronanow.com"; sid:516413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolikecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolikecoronavirus.com"; sid:516414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomigustacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomigustacorona.com"; sid:516415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncoronavirus.com"; sid:516416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcarolinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcarolinacoronavirus.com"; sid:516417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcoronavirus.com"; sid:516418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacoronavirus.com"; sid:516419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronavirus.com"; sid:516420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronavirustshirt.com"; sid:516421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcovid-19.com"; sid:516422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascovid19.com"; sid:516423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-corona.com"; sid:516424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronacure.com"; sid:516425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcorona-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcorona-test.com"; sid:516426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronatest.com"; sid:516427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronatreatment.com"; sid:516428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcorona-virus.com"; sid:516429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushealth.com"; sid:516430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novocoronavirus.com"; sid:516431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuovo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuovo-coronavirus.com"; sid:516432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nutritiontopreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nutritiontopreventcoronavirus.com"; sid:516433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvcoronavirus.com"; sid:516434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronakiller.com"; sid:516435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaspray.com"; sid:516436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruscleaning.com"; sid:516437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oaklandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oaklandcoronavirus.com"; sid:516438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occoronavirus.com"; sid:516439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocoronavirus.com"; sid:516440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocovid19.com"; sid:516441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcoronavirus.com"; sid:516442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocoronavirus.com"; sid:516443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okaycovid.com"; sid:516444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronavirus.com"; sid:516445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid19.com"; sid:516446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacoronavirus.com"; sid:516447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omahacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omahacoronavirus.com"; sid:516448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronachecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronachecker.com"; sid:516449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcorona.com"; sid:516450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcoronavirus.com"; sid:516451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncoronavirus.com"; sid:516452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organizingduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organizingduringcorona.com"; sid:516453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organizingwhilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organizingwhilecorona.com"; sid:516454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcorona.com"; sid:516455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outbreakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outbreakcorona.com"; sid:516456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozone4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozone4covid19.com"; sid:516457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirus.com"; sid:516458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakistancoronavirus.com"; sid:516459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for palcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"palcorona.com"; sid:516460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-2020.com"; sid:516461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvice.com"; sid:516462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandrecession.com"; sid:516463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchat.com"; sid:516464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconspiracies.com"; sid:516465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoupons.com"; sid:516466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid19.com"; sid:516467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeals.com"; sid:516468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefense.com"; sid:516469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiagnostics.com"; sid:516470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdigital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdigital.com"; sid:516471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoodlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoodlist.com"; sid:516472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforesight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforesight.com"; sid:516473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgps.com"; sid:516474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichumor.com"; sid:516475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimpact.com"; sid:516476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicknowledge.com"; sid:516477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclies.com"; sid:516478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmart.com"; sid:516479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconomics.com"; sid:516480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonalpreparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonalpreparedness.com"; sid:516481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolicy.com"; sid:516482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparatiobook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparatiobook.com"; sid:516483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-preparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-preparedness.com"; sid:516484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreppersupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreppersupply.com"; sid:516485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepsupply.com"; sid:516486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproperties.com"; sid:516487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproperty.com"; sid:516488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprovisions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprovisions.com"; sid:516489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsales.com"; sid:516490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuit.com"; sid:516491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalmask.com"; sid:516492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestkit.com"; sid:516493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestkits.com"; sid:516494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthreads.com"; sid:516495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-tracker.com"; sid:516496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictreatment.com"; sid:516497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-us.com"; sid:516498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicxxx.com"; sid:516499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for papuacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"papuacoronavirus.com"; sid:516500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for para-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"para-coronavirus.com"; sid:516501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pascovideorescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pascovideorescue.com"; sid:516502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacoronavirus.com"; sid:516503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perucoronavirus.com"; sid:516504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacovid.com"; sid:516505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philippinescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philippinescoronavirus.com"; sid:516506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phongchongcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phongchongcovid19.com"; sid:516507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetcorona.com"; sid:516508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for polandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"polandcoronavirus.com"; sid:516509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pop-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pop-corona.com"; sid:516510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for popcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"popcorona.com"; sid:516511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandcoronavirus.com"; sid:516512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portugalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portugalcoronavirus.com"; sid:516513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.com"; sid:516514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid19.com"; sid:516515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid.com"; sid:516516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predictcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predictcorona.com"; sid:516517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepareforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepareforapandemic.com"; sid:516518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepareforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepareforcovid-19.com"; sid:516519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepareforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepareforcovid19.com"; sid:516520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparing4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparing4covid19.com"; sid:516521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepcorona.com"; sid:516522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preppingforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preppingforcoronavirus.com"; sid:516523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidenttrumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidenttrumpcorona.com"; sid:516524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidenttrumpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidenttrumpcoronavirus.com"; sid:516525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencioncovid-19.com"; sid:516526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcorona-virus.com"; sid:516527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaviruscontagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaviruscontagion.com"; sid:516528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevent-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevent-covid-19.com"; sid:516529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevent-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevent-covid19.com"; sid:516530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventing-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventing-coronavirus.com"; sid:516531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevention-anti-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevention-anti-coronavirus.com"; sid:516532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevention-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevention-corona.com"; sid:516533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventionkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventionkitcoronavirus.com"; sid:516534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previeneelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previeneelcoronavirus.com"; sid:516535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcorona.com"; sid:516536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcoronavirus.com"; sid:516537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectfromcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectfromcoronavirusnow.com"; sid:516538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovid.com"; sid:516539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegetecontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegetecontraelcoronavirus.com"; sid:516540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegete-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegete-coronavirus.com"; sid:516541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protetcorona.com"; sid:516542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebadecoronavirus.com"; sid:516543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebadelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebadelcoronavirus.com"; sid:516544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasdelcoronavirus.com"; sid:516545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queeselcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queeselcoronavirus.com"; sid:516546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quest-corona.com"; sid:516547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questcorona.com"; sid:516548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronatest.com"; sid:516549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raleighcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raleighcoronavirus.com"; sid:516550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcorona.com"; sid:516551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronakit.com"; sid:516552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronatest.com"; sid:516553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustest.com"; sid:516554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19.com"; sid:516555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19kit.com"; sid:516556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19test.com"; sid:516557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19testing.com"; sid:516558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19testkit.com"; sid:516559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19testkits.com"; sid:516560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid.com"; sid:516561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcovid19.com"; sid:516562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readyforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readyforcorona.com"; sid:516563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readyforcoronavirus.com"; sid:516564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronavirus.com"; sid:516565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remedyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remedyforcoronavirus.com"; sid:516566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remoteagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remoteagainstcoronavirus.com"; sid:516567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repelcoronavirus.com"; sid:516568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantescorona.com"; sid:516569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhodeislandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhodeislandcoronavirus.com"; sid:516570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricoronavirus.com"; sid:516571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricovidroseespelhos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricovidroseespelhos.com"; sid:516572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridcovid.com"; sid:516573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riskcovid19.com"; sid:516574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romaniacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romaniacoronavirus.com"; sid:516575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for russiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"russiacoronavirus.com"; sid:516576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rvandboatstoragecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rvandboatstoragecorona.com"; sid:516577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rwandacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rwandacoronavirus.com"; sid:516578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rxcovidkill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rxcovidkill.com"; sid:516579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacramentocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacramentocoronavirus.com"; sid:516580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeforcorona.com"; sid:516581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefromcorona.com"; sid:516582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocoronavirus.com"; sid:516583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjosecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjosecoronavirus.com"; sid:516584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saudicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saudicoronavirus.com"; sid:516585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savecoronabeer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savecoronabeer.com"; sid:516586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynocoronavirus.com"; sid:516587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccoronavirus.com"; sid:516588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcoronavirus.com"; sid:516589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecorona.com"; sid:516590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronaviruslawyer.com"; sid:516591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19.com"; sid:516592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitycoronavirus.com"; sid:516593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seeyacoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seeyacoronaviruses.com"; sid:516594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for senegalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"senegalcoronavirus.com"; sid:516595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serbiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serbiacoronavirus.com"; sid:516596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shekastcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shekastcorona.com"; sid:516597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shockingcoronatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shockingcoronatruth.com"; sid:516598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-corona.com"; sid:516599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronaready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronaready.com"; sid:516600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoppingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoppingcoronavirus.com"; sid:516601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sintomasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sintomasdelcoronavirus.com"; sid:516602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socovid.com"; sid:516603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionforcoronavirus.com"; sid:516604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somaliacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somaliacoronavirus.com"; sid:516605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcarolinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcarolinacoronavirus.com"; sid:516606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoronavirus.com"; sid:516607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southdakotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southdakotacoronavirus.com"; sid:516608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincoronavirus.com"; sid:516609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springfieldcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springfieldcoronavirus.com"; sid:516610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springfieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springfieldcovid19.com"; sid:516611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sricoronavirus.com"; sid:516612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startofcoronavirus.com"; sid:516613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statescoronavirus.com"; sid:516614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawayfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawayfromcovid19.com"; sid:516615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycoronafree.com"; sid:516616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycoronavirusfree.com"; sid:516617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafefromcorona.com"; sid:516618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronas.com"; sid:516619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronav.com"; sid:516620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaviruskit.com"; sid:516621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.life"; sid:516622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusstore.com"; sid:516623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnow.com"; sid:516624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirus19.com"; sid:516625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronaviruses.com"; sid:516626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirusnyc.com"; sid:516627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studiosalonsuitescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studiosalonsuitescorona.com"; sid:516628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sudancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sudancoronavirus.com"; sid:516629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplementsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplementsforcoronavirus.com"; sid:516630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliescoronavirus.com"; sid:516631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronaguide.com"; sid:516632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronapandemic.com"; sid:516633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronaviruscovid19.com"; sid:516634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronaviruses.com"; sid:516635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-covid19.com"; sid:516636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid19.com"; sid:516637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthepandemic.com"; sid:516638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcovid-19.com"; sid:516639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swedencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swedencoronavirus.com"; sid:516640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for switzerlandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"switzerlandcoronavirus.com"; sid:516641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sxcorona.com"; sid:516642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sxscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sxscorona.com"; sid:516643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sxswcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sxswcoronavirus.com"; sid:516644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomofcoronavirus.com"; sid:516645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomscorona.com"; sid:516646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptoms-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptoms-coronavirus.com"; sid:516647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcovid19.com"; sid:516648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syriacoronavirus.com"; sid:516649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taiwancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taiwancoronavirus.com"; sid:516650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tajikistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tajikistancoronavirus.com"; sid:516651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecoronavirusshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecoronavirusshot.com"; sid:516652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tanzaniacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tanzaniacoronavirus.com"; sid:516653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taskforcecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taskforcecorona.com"; sid:516654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techagainstcoronavirus.com"; sid:516655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tedscoronavirussafetytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tedscoronavirussafetytips.com"; sid:516656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennesseecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennesseecoronavirus.com"; sid:516657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminatecorona.com"; sid:516658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4corona.com"; sid:516659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-corona.com"; sid:516660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-corona-virus.com"; sid:516661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid2019.com"; sid:516662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.com"; sid:516663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdelcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdelcoronavirus.net"; sid:516664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcoronausa.com"; sid:516665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcoronavirus.com"; sid:516666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingforcorona.com"; sid:516667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitcorona.com"; sid:516668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitcoronavirus.com"; sid:516669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitcovid19.com"; sid:516670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testscoronavirus.com"; sid:516671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsforcorona.com"; sid:516672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testujemecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testujemecovid19.com"; sid:516673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirus.net"; sid:516674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovid19.com"; sid:516675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovid.com"; sid:516676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thailandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thailandcoronavirus.com"; sid:516677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticoronamask.com"; sid:516678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcoronavirusmask.com"; sid:516679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcoronavirusprotection.com"; sid:516680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabuster.com"; sid:516681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclassic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclassic.com"; sid:516682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacrisis.com"; sid:516683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadestroyer.com"; sid:516684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiary.com"; sid:516685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafacts.com"; sid:516686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaguide.com"; sid:516687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainfo.com"; sid:516688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainfo.net"; sid:516689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakiller.com"; sid:516690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamarket.com"; sid:516691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashop.com"; sid:516692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasun.com"; sid:516693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasunnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasunnews.com"; sid:516694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruschallenge.com"; sid:516695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscleaner.com"; sid:516696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscorner.com"; sid:516697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscrisis.com"; sid:516698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdoc.com"; sid:516699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfacts.com"; sid:516700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusgame.com"; sid:516701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushub.com"; sid:516702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusinformation.net"; sid:516703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruskiller.com"; sid:516704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmap.com"; sid:516705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmaps.com"; sid:516706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustest.com"; sid:516707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19crisis.com"; sid:516708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19test.com"; sid:516709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19test.com"; sid:516710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchronicles.com"; sid:516711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcrisis.com"; sid:516712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddiaries.com"; sid:516713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidupdate.com"; sid:516714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatpandemic.com"; sid:516715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themaskforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themaskforcorona.com"; sid:516716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcorona.com"; sid:516717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronatest.com"; sid:516718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicconspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicconspiracies.com"; sid:516719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicconspiracy.com"; sid:516720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcoronakiller.com"; sid:516721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thermometercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thermometercoronavirus.com"; sid:516722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipscovid19.com"; sid:516723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncoronavirus.com"; sid:516724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronaproducts.com"; sid:516725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcoronavirus.com"; sid:516726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelduringcoronavirus.com"; sid:516727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatingcovid19.com"; sid:516728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentcorona.com"; sid:516729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentforcovid19.com"; sid:516730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronavirusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronavirusbill.com"; sid:516731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tucsoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tucsoncoronavirus.com"; sid:516732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulsacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulsacoronavirus.com"; sid:516733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tunisiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tunisiacoronavirus.com"; sid:516734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkiyecoronavirusu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkiyecoronavirusu.com"; sid:516735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronavirus.com"; sid:516736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uaecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uaecoronavirus.com"; sid:516737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ugandacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ugandacoronavirus.com"; sid:516738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukrainecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukrainecoronavirus.com"; sid:516739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimatecoronasurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimatecoronasurvivalkit.com"; sid:516740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandingcovid19.com"; sid:516741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedagainstcoronavirus.com"; sid:516742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedcoronavirus.com"; sid:516743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovid-19.com"; sid:516744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-coronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-coronaviruscleaning.com"; sid:516745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utcoronavirus.com"; sid:516746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv4covid19.com"; sid:516747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvacoronavirus.com"; sid:516748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronavirus.com"; sid:516749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uzbekistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uzbekistancoronavirus.com"; sid:516750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccincovid-19.com"; sid:516751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccincovid19.com"; sid:516752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronausa.com"; sid:516753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacoronavirus.com"; sid:516754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vanishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vanishcorona.com"; sid:516755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vax4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vax4covid19.com"; sid:516756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxcoronavirus.com"; sid:516757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxforcovid19.com"; sid:516758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vectorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vectorcorona.com"; sid:516759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venezuelacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venezuelacoronavirus.com"; sid:516760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vermontcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vermontcoronavirus.com"; sid:516761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamcoronavirus.com"; sid:516762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vincovid.com"; sid:516763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacoronavirus.com"; sid:516764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona19.com"; sid:516765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona.chat"; sid:516766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronacovid19.com"; sid:516767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronas.com"; sid:516768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemic.net"; sid:516769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voiceofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voiceofcorona.com"; sid:516770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voiceofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voiceofcovid19.com"; sid:516771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcoronavirus.com"; sid:516772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacoronavirus.com"; sid:516773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warcorona.com"; sid:516774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warningcovid.com"; sid:516775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waron-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waron-corona.com"; sid:516776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waroncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waroncorona.com"; sid:516777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtonstatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtonstatecoronavirus.com"; sid:516778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtonstatecoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtonstatecoronavirusoutbreak.com"; sid:516779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehavecoronavirus.com"; sid:516780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacoronavirus.com"; sid:516781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for where-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"where-coronavirus.com"; sid:516782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherecoronavirus.com"; sid:516783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereiscovid19.com"; sid:516784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherescoronavirus.com"; sid:516785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid19fund.com"; sid:516786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascoronavirus.com"; sid:516787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wicoronavirus.com"; sid:516788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wiki-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wiki-coronavirus.com"; sid:516789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisconsincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisconsincoronavirus.com"; sid:516790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecoronavirus.com"; sid:516791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workstressepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workstressepidemic.com"; sid:516792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-coronavirus.com"; sid:516793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldofcoronavirus.com"; sid:516794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronamonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronamonitor.com"; sid:516795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronamonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronamonitoring.com"; sid:516796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronavirus.com"; sid:516797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan20200123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan20200123.com"; sid:516798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanaoyuan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanaoyuan.com"; sid:516799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancdj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancdj.com"; sid:516800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandutai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandutai.com"; sid:516801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangotyouallincheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangotyouallincheck.com"; sid:516802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangroundzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangroundzero.com"; sid:516803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlianbang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlianbang.com"; sid:516804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanligong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanligong.com"; sid:516805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlvshiw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlvshiw.com"; sid:516806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlw.com"; sid:516807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmedia.com"; sid:516808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanoncloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanoncloud.com"; sid:516809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansuanmingdashi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansuanmingdashi.com"; sid:516810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantaste.com"; sid:516811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-tec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-tec.com"; sid:516812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantfsj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantfsj.com"; sid:516813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwipes.com"; sid:516814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronavirus.com"; sid:516815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wycoronavirus.com"; sid:516816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wyomingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wyomingcoronavirus.com"; sid:516817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovid-19.com"; sid:516818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronazhler-r8a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronazhler-r8a.com"; sid:516819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yemencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yemencoronavirus.com"; sid:516820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcanstopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcanstopcorona.com"; sid:516821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusinfo.com"; sid:516822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yunshangwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yunshangwuhan.com"; sid:516823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zambiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zambiacoronavirus.com"; sid:516824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zcoronavirus.com"; sid:516825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimbabwecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimbabwecoronavirus.com"; sid:516826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zincorona.com"; sid:516827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronavirus.com"; sid:516828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19corona.com"; sid:516829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2curecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2curecoronavirus.com"; sid:516830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2contribute2fightagainstcoronafvirus.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2contribute2fightagainstcoronafvirus.exposed"; sid:516831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2curecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2curecoronavirus.com"; sid:516832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2treatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2treatcoronavirus.com"; sid:516833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411coronavirus.com"; sid:516834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4curingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4curingcoronavirus.com"; sid:516835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99peopleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99peopleofwuhan.com"; sid:516836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertcorona.com"; sid:516837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ansiedadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ansiedadcoronavirus.com"; sid:516838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronagels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronagels.com"; sid:516839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronasprey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronasprey.com"; sid:516840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviruscorona.com"; sid:516841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baohiemcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baohiemcorona.net"; sid:516842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronasafe.com"; sid:516843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronasmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronasmart.com"; sid:516844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidkit.com"; sid:516845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biblicalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biblicalcoronavirus.com"; sid:516846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocorona.com"; sid:516847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackoutcorona.com"; sid:516848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcoronavirus.com"; sid:516849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantstopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantstopcorona.com"; sid:516850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid-19.com"; sid:516851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinawuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinawuhanvirus.com"; sid:516852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinese-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinese-coronavirus.com"; sid:516853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean-corona.com"; sid:516854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanthecoronavirusaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanthecoronavirusaway.com"; sid:516855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanthecoronavirus.com"; sid:516856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicalcovid.com"; sid:516857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcoronaviruscleaning.com"; sid:516858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19masks.com"; sid:516859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantidotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantidotes.com"; sid:516860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-anti-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-anti-virus.com"; sid:516861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasylum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasylum.com"; sid:516862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyrisk.com"; sid:516863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabambino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabambino.com"; sid:516864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeater.com"; sid:516865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablaze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablaze.com"; sid:516866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabnb.com"; sid:516867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathtest.com"; sid:516868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.world"; sid:516869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatastrophe.com"; sid:516870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chatbot.com"; sid:516871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachatbot.com"; sid:516872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cheak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cheak.com"; sid:516873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecklist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecklist.net"; sid:516874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachicago.com"; sid:516875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide.pro"; sid:516876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanandprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanandprotect.com"; sid:516877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningnashville.com"; sid:516878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningstore.com"; sid:516879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningstore.net"; sid:516880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningsupply.com"; sid:516881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningsupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningsupply.net"; sid:516882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansed.com"; sid:516883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanups.com"; sid:516884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearguard.com"; sid:516885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclub.net"; sid:516886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoachellaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoachellaparty.com"; sid:516887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombat.com"; sid:516888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcert.com"; sid:516889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcerts.com"; sid:516890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontingency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontingency.com"; sid:516891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorvid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorvid19.com"; sid:516892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrash2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrash2020.com"; sid:516893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiselines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiselines.com"; sid:516894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruising.com"; sid:516895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadankorunma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadankorunma.com"; sid:516896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeepcleanukltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeepcleanukltd.com"; sid:516897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadezenfekte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadezenfekte.com"; sid:516898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecleanup.com"; sid:516899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecleanup.net"; sid:516900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecure.com"; sid:516901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasescleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasescleanup.com"; sid:516902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasescleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasescleanup.net"; sid:516903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadon.com"; sid:516904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeventguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeventguide.com"; sid:516905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafightersunite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafightersunite.com"; sid:516906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighterusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighterusa.com"; sid:516907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafixer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafixer.com"; sid:516908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeoffice.com"; sid:516909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglove.com"; sid:516910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandrub.com"; sid:516911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsantizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsantizer.com"; sid:516912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsoap.com"; sid:516913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahashtag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahashtag.com"; sid:516914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecompanion.com"; sid:516915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomedisinfecting.com"; sid:516916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeremedy.com"; sid:516917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hometest.com"; sid:516918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometests.com"; sid:516919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahunter.com"; sid:516920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahygienic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahygienic.com"; sid:516921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahygienics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahygienics.com"; sid:516922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronailaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronailaclama.com"; sid:516923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainmanila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainmanila.com"; sid:516924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisolation.com"; sid:516925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaart.net"; sid:516926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaraoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaraoke.com"; sid:516927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakick.com"; sid:516928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidz.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidz.life"; sid:516929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilla.com"; sid:516930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillandprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillandprotect.com"; sid:516931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kits.com"; sid:516932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakit.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakit.support"; sid:516933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknowledge.com"; sid:516934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakorunma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakorunma.com"; sid:516935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtest.com"; sid:516936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawblog.com"; sid:516937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-law.com"; sid:516938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalebanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalebanon.com"; sid:516939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalite.com"; sid:516940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocate.com"; sid:516941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogy.com"; sid:516942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalongvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalongvirus.com"; sid:516943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalungvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalungvirus.com"; sid:516944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamafia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamafia.com"; sid:516945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalta.com"; sid:516946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask2020.com"; sid:516947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskapp.com"; sid:516948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskeu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskeu.com"; sid:516949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasktruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasktruth.com"; sid:516950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedchat.com"; sid:516951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamediation.com"; sid:516952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalhelp.com"; sid:516953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalmafia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalmafia.com"; sid:516954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedics.com"; sid:516955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoji.com"; sid:516956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonalisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonalisa.com"; sid:516957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewskerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewskerala.com"; sid:516958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewyork.com"; sid:516959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoffice.com"; sid:516960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-oral-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-oral-vaccination.com"; sid:516961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaormodelo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaormodelo.com"; sid:516962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pack.com"; sid:516963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartys.net"; sid:516964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestcontrolnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestcontrolnyc.com"; sid:516965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestcontrols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestcontrols.com"; sid:516966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestcontrolus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestcontrolus.com"; sid:516967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestservice.com"; sid:516968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestservice.net"; sid:516969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestservices.com"; sid:516970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestsolutions.com"; sid:516971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplayer.com"; sid:516972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapodcast.com"; sid:516973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprayer.com"; sid:516974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreplist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreplist.com"; sid:516975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprep.net"; sid:516976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionglasses.com"; sid:516977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionnow.com"; sid:516978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiveglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiveglasses.com"; sid:516979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectnow.com"; sid:516980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremediation.com"; sid:516981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepellent.com"; sid:516982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaruia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaruia.com"; sid:516983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyfacts.com"; sid:516984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyzone.com"; sid:516985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalivatest.com"; sid:516986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanering.com"; sid:516987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitary.com"; sid:516988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftests.com"; sid:516989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseniors.com"; sid:516990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfunebresguadalajara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfunebresguadalajara.com"; sid:516991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfunerarias.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfunerarias.madrid"; sid:516992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasize.com"; sid:516993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmap.com"; sid:516994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspin.com"; sid:516995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreadstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreadstop.com"; sid:516996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilizer.com"; sid:516997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastick.com"; sid:516998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoppers.com"; sid:516999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportgroup.com"; sid:517000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-talk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-talk.com"; sid:517001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest2020.com"; sid:517002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestforlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestforlife.com"; sid:517003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testing.com"; sid:517004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkitusa.com"; sid:517005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlabs.com"; sid:517006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestme.com"; sid:517007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaticket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaticket.com"; sid:517008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatickets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatickets.com"; sid:517009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronativa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronativa.com"; sid:517010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronativum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronativum.com"; sid:517011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizers.com"; sid:517012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoronto.com"; sid:517013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruth2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruth2020.com"; sid:517014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatv.net"; sid:517015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav20.com"; sid:517016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacciline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacciline.com"; sid:517017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavairus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavairus.com"; sid:517018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirace.com"; sid:517019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviren-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviren-schutz.com"; sid:517020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisnews.com"; sid:517021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirunewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirunewsnow.com"; sid:517022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru-realtime.com"; sid:517023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19info.com"; sid:517024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.wtf"; sid:517025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.wtf"; sid:517026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus501c3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus501c3.com"; sid:517027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-against.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-against.com"; sid:517028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairports.com"; sid:517029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusangel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusangel.com"; sid:517030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusangels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusangels.com"; sid:517031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeat.com"; sid:517032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesstax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesstax.com"; sid:517033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanary.com"; sid:517034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscan.com"; sid:517035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarecenter.com"; sid:517036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschange.com"; sid:517037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharities.com"; sid:517038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheatsheet.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheatsheet.life"; sid:517039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheckmate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheckmate.com"; sid:517040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschurch.com"; sid:517041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaner.com"; sid:517042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsolutions.com"; sid:517043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clinic.com"; sid:517044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.com"; sid:517045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoure.com"; sid:517046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-news.com"; sid:517047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrazy.com"; sid:517048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.care"; sid:517049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dc.com"; sid:517050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathtracker.com"; sid:517051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-detection.com"; sid:517052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetox.com"; sid:517053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-disease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-disease.com"; sid:517054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-disease.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-disease.net"; sid:517055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaseus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaseus.com"; sid:517056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfecting.com"; sid:517057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonotbescaredbesmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonotbescaredbesmart.com"; sid:517058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonotbescaredbesmart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonotbescaredbesmart.net"; sid:517059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdontbescaredbesmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdontbescaredbesmart.com"; sid:517060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdontbescaredbesmart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdontbescaredbesmart.net"; sid:517061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseasytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseasytest.com"; sid:517062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecare.com"; sid:517063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemail.com"; sid:517064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenespana.com"; sid:517065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenglish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenglish.com"; sid:517066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseraser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseraser.com"; sid:517067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses.chat"; sid:517068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescleanup.com"; sid:517069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescure.com"; sid:517070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses.life"; sid:517071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-essentials.com"; sid:517072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvac.com"; sid:517073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvacs.com"; sid:517074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvideoscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvideoscreen.com"; sid:517075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexamprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexamprep.com"; sid:517076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexpo.com"; sid:517077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-eyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-eyes.com"; sid:517078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaithhealer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaithhealer.com"; sid:517079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfeed.com"; sid:517080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fl.com"; sid:517081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-georgia.com"; sid:517082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gps.com"; sid:517083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgps.com"; sid:517084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrowth.com"; sid:517085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguards.com"; sid:517086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguia.com"; sid:517087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusharitasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusharitasi.com"; sid:517088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealingexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealingexpert.com"; sid:517089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthblog.com"; sid:517090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.biz"; sid:517091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbtea.com"; sid:517092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hoax.com"; sid:517093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebrew.com"; sid:517094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeinternet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeinternet.com"; sid:517095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeopathic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeopathic.com"; sid:517096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeopathy.com"; sid:517097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschool.com"; sid:517098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschool.net"; sid:517099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschools.com"; sid:517100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hotline.com"; sid:517101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushottopic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushottopic.com"; sid:517102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushourlyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushourlyupdates.com"; sid:517103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushrhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushrhelp.com"; sid:517104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusians.com"; sid:517105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidea.com"; sid:517106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusideas.com"; sid:517107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusineurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusineurope.com"; sid:517108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationforemployers.com"; sid:517109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfousa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfousa.com"; sid:517110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinitiative.com"; sid:517111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintheworld.com"; sid:517112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintuitive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintuitive.com"; sid:517113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisforlovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisforlovers.com"; sid:517114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-italia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-italia.net"; sid:517115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjustice.com"; sid:517116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-killer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-killer.net"; sid:517117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskit.today"; sid:517118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabscan.com"; sid:517119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-live.com"; sid:517120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslive.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslive.life"; sid:517121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.loans"; sid:517122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslovebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslovebook.com"; sid:517123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslstrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslstrain.com"; sid:517124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-machine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-machine.com"; sid:517125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusmap.com"; sid:517126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap.today"; sid:517127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskoffer.com"; sid:517128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskstock.com"; sid:517129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-md.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-md.com"; sid:517130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalaid.com"; sid:517131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmelbourn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmelbourn.com"; sid:517132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminerals.com"; sid:517133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusministries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusministries.com"; sid:517134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiraclehealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiraclehealing.com"; sid:517135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmurcia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmurcia.com"; sid:517136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnesnow.com"; sid:517137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewslist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewslist.com"; sid:517138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusni.com"; sid:517139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoasis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoasis.com"; sid:517140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oc.com"; sid:517141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusolutions.com"; sid:517142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetest.com"; sid:517143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeople.com"; sid:517144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplayoffs.com"; sid:517145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprep.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprep.club"; sid:517146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreplist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreplist.com"; sid:517147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevencion.com"; sid:517148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproblems.com"; sid:517149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprof.com"; sid:517150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprograms.com"; sid:517151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotective.com"; sid:517152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquickcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquickcheck.com"; sid:517153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquickscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquickscan.com"; sid:517154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquicktest.com"; sid:517155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-real-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-real-time.com"; sid:517156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresistance.com"; sid:517157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponsenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponsenetwork.com"; sid:517158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresult.com"; sid:517159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresults.com"; sid:517160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresultusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresultusa.com"; sid:517161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitiser.com"; sid:517162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussatan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussatan.com"; sid:517163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruss.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruss.club"; sid:517164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreen.com"; sid:517165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfcare.com"; sid:517166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftest.com"; sid:517167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseniorcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseniorcare.com"; sid:517168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sf.com"; sid:517169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshaman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshaman.com"; sid:517170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshelters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshelters.com"; sid:517171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussignage.com"; sid:517172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-signs.com"; sid:517173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.soccer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.soccer"; sid:517174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocialdistancing.com"; sid:517175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutions.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutions.life"; sid:517176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoup.com"; sid:517177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstarterpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstarterpack.com"; sid:517178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstash.com"; sid:517179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulus.com"; sid:517180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstress.com"; sid:517181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesdirect.com"; sid:517182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportuk.com"; sid:517183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteachers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteachers.com"; sid:517184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustea.com"; sid:517185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechspot.com"; sid:517186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelethon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelethon.com"; sid:517187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminalcleaning.com"; sid:517188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-testing.com"; sid:517189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestprep.com"; sid:517190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustincture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustincture.com"; sid:517191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackr.com"; sid:517192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustutors.com"; sid:517193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustypes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustypes.com"; sid:517194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuksupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuksupport.com"; sid:517195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurvivor.com"; sid:517196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurvivors.com"; sid:517197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacciline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacciline.com"; sid:517198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusventilator.com"; sid:517199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideoscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideoscreen.com"; sid:517200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideovault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideovault.com"; sid:517201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wa.com"; sid:517202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellcare.com"; sid:517203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellnesscenter.com"; sid:517204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellnesscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellnesscenters.com"; sid:517205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhattodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhattodo.com"; sid:517206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswidget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswidget.com"; sid:517207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswiz.com"; sid:517208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkremotely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkremotely.com"; sid:517209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszapper.com"; sid:517210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszero.com"; sid:517211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavis.com"; sid:517212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrius.com"; sid:517213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrus.com"; sid:517214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavtest.com"; sid:517215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurusnewsnow.com"; sid:517216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatcher.com"; sid:517217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazelftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazelftest.com"; sid:517218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaziekte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaziekte.com"; sid:517219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19answer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19answer.com"; sid:517220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19app.net"; sid:517221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assist.com"; sid:517222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19asylum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19asylum.com"; sid:517223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atx.com"; sid:517224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19australia.com"; sid:517225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breaking.com"; sid:517226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buzz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buzz.com"; sid:517227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cases.com"; sid:517228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cdc.com"; sid:517229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.claims"; sid:517230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanings.com"; sid:517231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanings.com"; sid:517232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comics.com"; sid:517233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultants.com"; sid:517234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-consult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-consult.com"; sid:517235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-consulting.com"; sid:517236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consulting.com"; sid:517237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultinggroup.com"; sid:517238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consulting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consulting.net"; sid:517239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crisis.com"; sid:517240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisislaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisislaw.com"; sid:517241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dating.com"; sid:517242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19direct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19direct.com"; sid:517243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19em.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19em.com"; sid:517244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exterminator.com"; sid:517245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-greece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-greece.com"; sid:517246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guidelines.com"; sid:517247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hackathon.com"; sid:517248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitize.com"; sid:517249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitizing.com"; sid:517250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeopathic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeopathic.com"; sid:517251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeopathy.com"; sid:517252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hometest.com"; sid:517253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygiene.com"; sid:517254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iowa.com"; sid:517255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ivd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ivd.com"; sid:517256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labcheck.com"; sid:517257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labtests.com"; sid:517258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-law-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-law-questions.com"; sid:517259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mgmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mgmt.com"; sid:517260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mon.com"; sid:517261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ne.com"; sid:517262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newz.com"; sid:517263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19now.com"; sid:517264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19partnership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19partnership.com"; sid:517265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19project.com"; sid:517266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protection.com"; sid:517267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quickcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quickcheck.com"; sid:517268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresults.com"; sid:517269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidscan.com"; sid:517270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reporter.com"; sid:517271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reporter.com"; sid:517272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resource.com"; sid:517273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resources.com"; sid:517274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responder.com"; sid:517275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-response.com"; sid:517276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responselab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responselab.com"; sid:517277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19risks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19risks.com"; sid:517278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risks.com"; sid:517279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rpm.com"; sid:517280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitize.com"; sid:517281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19school.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19school.com"; sid:517282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shelters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shelters.com"; sid:517283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shop.net"; sid:517284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shots.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shots.net"; sid:517285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-spread.com"; sid:517286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19starterpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19starterpack.com"; sid:517287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stop.com"; sid:517288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesdirect.com"; sid:517289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplies.net"; sid:517290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesnow.com"; sid:517291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survival.com"; sid:517292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teachers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teachers.com"; sid:517293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techspot.com"; sid:517294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkits.net"; sid:517295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapeuticsaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapeuticsaccelerator.com"; sid:517296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapeuticsaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapeuticsaccelerator.com"; sid:517297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-truth.com"; sid:517298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tutors.com"; sid:517299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinepartnership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinepartnership.com"; sid:517300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viral.com"; sid:517301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslawyer.com"; sid:517302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldtour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldtour2020.com"; sid:517303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldtour.com"; sid:517304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019app.com"; sid:517305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019app.net"; sid:517306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019outbreak.com"; sid:517307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.today"; sid:517308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-23.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-23.com"; sid:517309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-24.com"; sid:517310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-25.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-25.com"; sid:517311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-26.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-26.com"; sid:517312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid26.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid26.com"; sid:517313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-27.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-27.com"; sid:517314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid27.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid27.com"; sid:517315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid31.com"; sid:517316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid32.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid32.com"; sid:517317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid911.com"; sid:517318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvisor.com"; sid:517319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvisor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvisor.net"; sid:517320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaegis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaegis.com"; sid:517321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaegis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaegis.net"; sid:517322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalarm.com"; sid:517323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-api.com"; sid:517324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapi.com"; sid:517325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasylum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasylum.com"; sid:517326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanuck.com"; sid:517327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-combat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-combat.com"; sid:517328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnect.com"; sid:517329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consult.com"; sid:517330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontingency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontingency.com"; sid:517331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontingencyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontingencyplan.com"; sid:517332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddirect.com"; sid:517333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfix.com"; sid:517334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgard.com"; sid:517335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobe.com"; sid:517336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.guide"; sid:517337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhome.com"; sid:517338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoy.com"; sid:517339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ibd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ibd.com"; sid:517340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidibd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidibd.com"; sid:517341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-isolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-isolation.com"; sid:517342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisolation.com"; sid:517343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-it.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-it.com"; sid:517344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidit.com"; sid:517345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity.com"; sid:517346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillers.com"; sid:517347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabco.com"; sid:517348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyer.com"; sid:517349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lockdown.com"; sid:517350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlockdown.com"; sid:517351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masks19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masks19.com"; sid:517352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicyadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicyadvisor.com"; sid:517353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicyadvisor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicyadvisor.net"; sid:517354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicy.com"; sid:517355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicy.net"; sid:517356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpr.com"; sid:517357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprof.com"; sid:517358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.coach"; sid:517359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.computer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.computer"; sid:517360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.digital"; sid:517361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.expert"; sid:517362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.guru"; sid:517363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.net"; sid:517364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.network"; sid:517365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.partners"; sid:517366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.services"; sid:517367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.solutions"; sid:517368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.support"; sid:517369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.systems"; sid:517370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.team"; sid:517371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.technology"; sid:517372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.today"; sid:517373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery.training"; sid:517374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreporter.com"; sid:517375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreserve.com"; sid:517376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshots.com"; sid:517377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolution.com"; sid:517378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.support"; sid:517379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.systems"; sid:517380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.team"; sid:517381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslawyers.com"; sid:517382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwall.com"; sid:517383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwall.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwall.net"; sid:517384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-who.com"; sid:517385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwork.com"; sid:517386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.world"; sid:517387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covpandemic.com"; sid:517388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisofcorona.com"; sid:517389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronavirus.com"; sid:517390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcoronaviruscleaning.com"; sid:517391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuentacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuentacoronavirus.com"; sid:517392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curarelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curarelcoronavirus.com"; sid:517393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data-coronavirus.com"; sid:517394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatthecoronavirus.com"; sid:517395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensecorona.com"; sid:517396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deletecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deletecorona.com"; sid:517397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depresioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depresioncoronavirus.com"; sid:517398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designercoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designercoronavirusmask.com"; sid:517399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirus.com"; sid:517400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid19.com"; sid:517401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid.com"; sid:517402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecoronavirus.com"; sid:517403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycurecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycurecovid-19.com"; sid:517404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesdonaldtrumphavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesdonaldtrumphavecoronavirus.com"; sid:517405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronavirustest.com"; sid:517406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatecorona.com"; sid:517407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elisabethcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elisabethcorona.com"; sid:517408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcoronavirus.com"; sid:517409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicoffear.com"; sid:517410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicstore.com"; sid:517411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecorona.com"; sid:517412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estrescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estrescoronavirus.com"; sid:517413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for excorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"excorona.com"; sid:517414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskstopscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskstopscoronavirus.com"; sid:517415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearepidemic.com"; sid:517416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feckcorona.com"; sid:517417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fermiamocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fermiamocoronavirus.com"; sid:517418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightaganistcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightaganistcoronavirus.com"; sid:517419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcorona.com"; sid:517420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcorona.com"; sid:517421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcoronavirus.com"; sid:517422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacorona.com"; sid:517423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusupdate.com"; sid:517424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forocoronavirus.com"; sid:517425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francovidal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francovidal.com"; sid:517426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronatest.com"; sid:517427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavaccine.com"; sid:517428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcoronavirus.com"; sid:517429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundascoronavirus.com"; sid:517430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gethelpwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gethelpwithcoronavirus.com"; sid:517431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getoutcorona.com"; sid:517432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getoutcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getoutcorona.net"; sid:517433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronastats.com"; sid:517434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotcovid19.com"; sid:517435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotcovid.com"; sid:517436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greenbergtraurigcoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greenbergtraurigcoronavirustaskforce.com"; sid:517437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcorona.com"; sid:517438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid19.com"; sid:517439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovid19.com"; sid:517440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcoronavirus19.com"; sid:517441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hicovid19.com"; sid:517442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecovidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecovidbusters.com"; sid:517443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hitcoronavirus.com"; sid:517444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocurecovid19.com"; sid:517445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hqcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hqcovid-19.com"; sid:517446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for httpthismaskwillnotpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"httpthismaskwillnotpreventcoronavirus.com"; sid:517447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idonothavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idonothavecoronavirus.com"; sid:517448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idonthavethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idonthavethecoronavirus.com"; sid:517449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavenocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavenocoronavirus.com"; sid:517450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavenocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavenocoronavirus.net"; sid:517451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incorocontrocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incorocontrocorona.com"; sid:517452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmobiliariacoronarobles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmobiliariacoronarobles.com"; sid:517453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacovid19.com"; sid:517454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusgoingtokillyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusgoingtokillyou.com"; sid:517455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19nearme.com"; sid:517456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecorona.com"; sid:517457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italia-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italia-coronavirus.com"; sid:517458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronavirus.com"; sid:517459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronavirus.net"; sid:517460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jumpcorona.com"; sid:517461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidvirus.com"; sid:517462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killedbycorona.com"; sid:517463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killingcovid.com"; sid:517464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronavirus-covid19.com"; sid:517465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawandthecovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawandthecovid19pandemic.com"; sid:517466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebanoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebanoncorona.com"; sid:517467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for listforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"listforcoronavirus.com"; sid:517468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid-19.com"; sid:517469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luzcorona.com"; sid:517470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapofcorona.com"; sid:517471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracorona.com"; sid:517472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid19.com"; sid:517473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid.com"; sid:517474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaclaim.com"; sid:517475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacures.com"; sid:517476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronamasks.com"; sid:517477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatizer.com"; sid:517478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruscheck.com"; sid:517479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirussite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirussite.com"; sid:517480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19results.com"; sid:517481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidkit.com"; sid:517482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemichealth.com"; sid:517483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95facemask-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95facemask-coronavirus.com"; sid:517484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirusprevention.com"; sid:517485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscoronavirus.com"; sid:517486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2curecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2curecovid19.com"; sid:517487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2treatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2treatcovid19.com"; sid:517488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no4coronavirus.com"; sid:517489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no4covid19.com"; sid:517490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirus19.com"; sid:517491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncovid.com"; sid:517492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncovid.net"; sid:517493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirusclinic.com"; sid:517494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicathon.com"; sid:517495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaware.net"; sid:517496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbaby.com"; sid:517497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.chat"; sid:517498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccontrol.com"; sid:517499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.directory"; sid:517500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.education"; sid:517501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.equipment"; sid:517502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforum.net"; sid:517503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicintelligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicintelligence.com"; sid:517504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjanitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjanitorial.com"; sid:517505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.management"; sid:517506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.mobi"; sid:517507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepperusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepperusa.com"; sid:517508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplies.net"; sid:517509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictees.com"; sid:517510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paraclinic-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paraclinic-covid19.com"; sid:517511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacie-anticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacie-anticoronavirus.com"; sid:517512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcorona.com"; sid:517513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivecoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivecoronanews.com"; sid:517514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for potcurescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"potcurescoronavirus.com"; sid:517515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for potcurescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"potcurescoronavirus.net"; sid:517516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforcorona.com"; sid:517517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforcoronavirus.com"; sid:517518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparationforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparationforcorona.com"; sid:517519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparationforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparationforcoronavirus.com"; sid:517520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenirelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenirelcoronavirus.com"; sid:517521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventfromcorona.com"; sid:517522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectorcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectorcovid-19.com"; sid:517523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pubcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pubcovid.com"; sid:517524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qualitycoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qualitycoronamasks.com"; sid:517525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecoronavirus.com"; sid:517526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queescoronavirus.com"; sid:517527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quehacerencuarentenaporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quehacerencuarentenaporcoronavirus.com"; sid:517528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidresults.com"; sid:517529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirusdiagnostictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirusdiagnostictest.com"; sid:517530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapiddiagnostictestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapiddiagnostictestforcoronavirus.com"; sid:517531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestforcoronavirus.com"; sid:517532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcorona2020.com"; sid:517533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronaclean.com"; sid:517534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronafacts.com"; sid:517535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronamask.com"; sid:517536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronaprotection.com"; sid:517537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronarisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronarisk.com"; sid:517538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronashield.com"; sid:517539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronatest.com"; sid:517540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronatestkit.com"; sid:517541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronatests.com"; sid:517542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronatruth.com"; sid:517543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronavaccine.com"; sid:517544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovid19.com"; sid:517545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for removecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"removecorona.com"; sid:517546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe-covid.com"; sid:517547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcorona.com"; sid:517548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sehatviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sehatviruscorona.com"; sid:517549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shipment-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shipment-covid-19.com"; sid:517550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronavirus.net"; sid:517551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19.com"; sid:517552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19.net"; sid:517553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spesacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spesacorona.com"; sid:517554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standagainstcorona.com"; sid:517555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stashcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stashcoronavirus.com"; sid:517556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stockcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stockcoronavirus.com"; sid:517557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.world"; sid:517558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcoronavirusnow.com"; sid:517559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcovid-19.com"; sid:517560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suckitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suckitcoronavirus.com"; sid:517561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronanow.com"; sid:517562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecoronavirustest.com"; sid:517563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teepandemic.com"; sid:517564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-coronavirus.com"; sid:517565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticorona.com"; sid:517566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabook.com"; sid:517567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahomecompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahomecompanion.com"; sid:517568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakits.com"; sid:517569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatizer.com"; sid:517570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdocumentary.com"; sid:517571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawcenter.com"; sid:517572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusstory.com"; sid:517573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustracker.com"; sid:517574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid-19-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid-19-crisis.com"; sid:517575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19lawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19lawcenter.com"; sid:517576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19prevention.com"; sid:517577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theepidemicoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theepidemicoffear.com"; sid:517578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefearepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefearepidemic.com"; sid:517579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theglobalpandemicresearchconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theglobalpandemicresearchconsortium.com"; sid:517580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenewcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenewcoronavirus.com"; sid:517581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiswillnotpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiswillnotpreventcoronavirus.com"; sid:517582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiendacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiendacoronavirus.com"; sid:517583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforcorona.com"; sid:517584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tldr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tldr-covid19.com"; sid:517585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcorona.com"; sid:517586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traccorona.com"; sid:517587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traccorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traccorona.net"; sid:517588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid-19.com"; sid:517589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcorona.com"; sid:517590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travel-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travel-covid-19.com"; sid:517591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcoronavirusnow.com"; sid:517592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatment-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatment-coronavirus.com"; sid:517593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecoronasymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecoronasymptoms.com"; sid:517594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscorona.com"; sid:517595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulsafightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulsafightscorona.com"; sid:517596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporcoronavirusonline.com"; sid:517597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedbycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedbycoronavirus.com"; sid:517598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatecovid19.com"; sid:517599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillcovid-19.com"; sid:517600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillcovid-19.net"; sid:517601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillcovid.com"; sid:517602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillcovid.net"; sid:517603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronafree.com"; sid:517604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcoronavirus.com"; sid:517605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascovid19.com"; sid:517606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willigetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willigetcovid19.com"; sid:517607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willisurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willisurvivecovid19.com"; sid:517608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldofcorona.com"; sid:517609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancaiyin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancaiyin.com"; sid:517610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmeatmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmeatmarket.com"; sid:517611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanqiyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanqiyi.com"; sid:517612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantoetap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantoetap.com"; sid:517613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus19.com"; sid:517614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxbg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxbg.com"; sid:517615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhentan01.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhentan01.com"; sid:517616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusenespaa-30b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusenespaa-30b.com"; sid:517617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19deelmoon-9m30aa1rzs169mysbw24ewyx663hfa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19deelmoon-9m30aa1rzs169mysbw24ewyx663hfa.com"; sid:517618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoko-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoko-covid19.com"; sid:517619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusexpert.com"; sid:517620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusnews.com"; sid:517621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19results.com"; sid:517622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19test.com"; sid:517623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youredrunkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youredrunkcoronavirus.com"; sid:517624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zcovid-19.com"; sid:517625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zencoronavirus.com"; sid:517626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidoutbreak.com"; sid:517627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020globalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020globalpandemic.com"; sid:517628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscoronavirus.com"; sid:517629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertacorona.com"; sid:517630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafightscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafightscoronavirus.com"; sid:517631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaempresascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaempresascoronavirus.com"; sid:517632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bali-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bali-covid-19.com"; sid:517633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bebascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bebascovid19.com"; sid:517634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beckercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beckercovid19.com"; sid:517635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19smart.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19smart.today"; sid:517636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berniesanderscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berniesanderscoronavirus.com"; sid:517637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blamecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blamecorona.com"; sid:517638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for break-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"break-corona.com"; sid:517639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcorona.com"; sid:517640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncoronavirus.net"; sid:517641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bumpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bumpcovid-19.com"; sid:517642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcoronacure.com"; sid:517643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcovid19.com"; sid:517644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-corona-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-corona-spray.com"; sid:517645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-coronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-coronaspray.com"; sid:517646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccoronaspray.com"; sid:517647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovid19testkits.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovid19testkits.club"; sid:517648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china-coronavirus.net"; sid:517649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycoronavirus.com"; sid:517650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid19.com"; sid:517651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicorona.com"; sid:517652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachingtipsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachingtipsforcoronavirus.com"; sid:517653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocorona.com"; sid:517654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidcleaning.com"; sid:517655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovid.com"; sid:517656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecoronavirus.com"; sid:517657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consumersandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consumersandcoronavirus.com"; sid:517658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraelcoronavirus.com"; sid:517659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcoronaviruses.com"; sid:517660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid19.com"; sid:517661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copewithcorona.com"; sid:517662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2022.com"; sid:517663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-affected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-affected.com"; sid:517664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalarm.com"; sid:517665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamerican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamerican.com"; sid:517666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatlas.com"; sid:517667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabang.com"; sid:517668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabh.com"; sid:517669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablitz.com"; sid:517670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablues.com"; sid:517671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabtc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabtc.com"; sid:517672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.net"; sid:517673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabythehour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabythehour.com"; sid:517674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalc.com"; sid:517675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacampus.com"; sid:517676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancels.com"; sid:517677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cation.com"; sid:517678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacations.com"; sid:517679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachaosapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachaosapp.com"; sid:517680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckusa.com"; sid:517681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide.net"; sid:517682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaning.com"; sid:517683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomback.com"; sid:517684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-concerned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-concerned.com"; sid:517685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacottonmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacottonmask.com"; sid:517686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouple.com"; sid:517687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverup.com"; sid:517688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19onthedash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19onthedash.com"; sid:517689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrats.com"; sid:517690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacustoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacustoms.com"; sid:517691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadashrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadashrx.com"; sid:517692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadating.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadating.net"; sid:517693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarbar.com"; sid:517694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarbars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarbars.com"; sid:517695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarchiropractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarchiropractor.com"; sid:517696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmardermatology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmardermatology.com"; sid:517697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmardoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmardoctor.com"; sid:517698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmardr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmardr.com"; sid:517699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmargym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmargym.com"; sid:517700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarhomeforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarhomeforsale.com"; sid:517701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarplasticsurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarplasticsurgery.com"; sid:517702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmar-realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmar-realestate.com"; sid:517703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarrealtor.com"; sid:517704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarrealtors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarrealtors.com"; sid:517705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarrestaurant.com"; sid:517706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarspa.com"; sid:517707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmaryoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmaryoga.com"; sid:517708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestroy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestroy.com"; sid:517709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiary.com"; sid:517710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocitynewsalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocitynewsalerts.com"; sid:517711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadontpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadontpanic.com"; sid:517712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoom.com"; sid:517713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeffects.com"; sid:517714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaend.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaend.world"; sid:517715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepidemic.net"; sid:517716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaerase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaerase.com"; sid:517717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexplainded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexplainded.com"; sid:517718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.exposed"; sid:517719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafast.com"; sid:517720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fest.com"; sid:517721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflykit.com"; sid:517722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafordummies.com"; sid:517723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forecast.com"; sid:517724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreegel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreegel.com"; sid:517725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeworkforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeworkforce.com"; sid:517726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-games.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-games.com"; sid:517727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageddon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageddon.net"; sid:517728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagetaways.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagetaways.com"; sid:517729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaber.com"; sid:517730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsanitizers.com"; sid:517731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahbruv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahbruv.com"; sid:517732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheightsstunner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheightsstunner.com"; sid:517733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.care"; sid:517734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahumour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahumour.com"; sid:517735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidiot.com"; sid:517736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidiots.com"; sid:517737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ilaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ilaclama.com"; sid:517738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfected.com"; sid:517739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfects.com"; sid:517740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsights.net"; sid:517741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ir.com"; sid:517742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiusa.com"; sid:517743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kanzlei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kanzlei.com"; sid:517744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidz.com"; sid:517745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidz.net"; sid:517746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilavuz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilavuz.com"; sid:517747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleb.com"; sid:517748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalipsync.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalipsync.com"; sid:517749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveblog.com"; sid:517750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanual.com"; sid:517751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskdelivered.com"; sid:517752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedimasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedimasks.com"; sid:517753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedmasks.com"; sid:517754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-memes.com"; sid:517755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamics.com"; sid:517756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamu.com"; sid:517757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneb.com"; sid:517758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneoldu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneoldu.com"; sid:517759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanorge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanorge.com"; sid:517760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanorway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanorway.com"; sid:517761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanusa.com"; sid:517762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlem.com"; sid:517763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonthedash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonthedash.com"; sid:517764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaordrunk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaordrunk.com"; sid:517765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapage.com"; sid:517766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicvirus.com"; sid:517767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobe.com"; sid:517768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalyse.com"; sid:517769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolls.com"; sid:517770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-porn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-porn.com"; sid:517771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepping.com"; sid:517772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionproducts.com"; sid:517773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantine.club"; sid:517774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quicktest.com"; sid:517775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealtime.com"; sid:517776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecon.com"; sid:517777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponder.com"; sid:517778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafecpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafecpr.com"; sid:517779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafepack.com"; sid:517780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavior.com"; sid:517781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzmittel.com"; sid:517782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselloff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselloff.com"; sid:517783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasepeti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasepeti.com"; sid:517784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknessnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknessnews.com"; sid:517785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasociety.com"; sid:517786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforttest.com"; sid:517787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-speedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-speedtest.com"; sid:517788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspringbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspringbreak.com"; sid:517789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasquad.com"; sid:517790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastarterkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastarterkit.com"; sid:517791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stats.net"; sid:517792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stop-forte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stop-forte.com"; sid:517793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastream.com"; sid:517794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunday.com"; sid:517795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesdirect.com"; sid:517796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplyshop.com"; sid:517797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurgery.com"; sid:517798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorclub.com"; sid:517799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorsclub.com"; sid:517800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorshirt.com"; sid:517801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorshirts.com"; sid:517802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorshop.com"; sid:517803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorsshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorsshop.com"; sid:517804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataboo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataboo.com"; sid:517805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxcut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxcut.com"; sid:517806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesters.com"; sid:517807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapie.com"; sid:517808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatone.com"; sid:517809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelinfo.com"; sid:517810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelinsurance.com"; sid:517811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelkit.com"; sid:517812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelupdates.com"; sid:517813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturkiyede.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturkiyede.com"; sid:517814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tv.com"; sid:517815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatweet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatweet.com"; sid:517816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavibe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavibe.com"; sid:517817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavibes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavibes.com"; sid:517818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictim.com"; sid:517819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavino.com"; sid:517820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-2019.com"; sid:517821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.report"; sid:517822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus210.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus210.com"; sid:517823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus213.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus213.com"; sid:517824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus214.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus214.com"; sid:517825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus215.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus215.com"; sid:517826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus305.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus305.com"; sid:517827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus512.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus512.com"; sid:517828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus602.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus602.com"; sid:517829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus60plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus60plus.com"; sid:517830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus615.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus615.com"; sid:517831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus617.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus617.com"; sid:517832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus619.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus619.com"; sid:517833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus713.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus713.com"; sid:517834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabatement.com"; sid:517835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactualidad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactualidad.com"; sid:517836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvices.com"; sid:517837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.amsterdam"; sid:517838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandlime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandlime.com"; sid:517839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandmask.com"; sid:517840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-anwalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-anwalt.com"; sid:517841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassessmentcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassessmentcalculator.com"; sid:517842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathometestkit.com"; sid:517843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-attorneys.com"; sid:517844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattys.com"; sid:517845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauctions.com"; sid:517846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusavatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusavatar.com"; sid:517847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailout.com"; sid:517848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcies.com"; sid:517849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcy.com"; sid:517850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcywatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcywatch.com"; sid:517851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenefits.com"; sid:517852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbericht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbericht.com"; sid:517853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.bet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.bet"; sid:517854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbg.com"; sid:517855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalc.com"; sid:517856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscases.net"; sid:517857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatinsurance.com"; sid:517858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactions.com"; sid:517859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaning.com"; sid:517860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtraining.com"; sid:517861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupak.com"; sid:517862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupal.com"; sid:517863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupar.com"; sid:517864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupas.com"; sid:517865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupaz.com"; sid:517866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupca.com"; sid:517867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupct.com"; sid:517868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupdc.com"; sid:517869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupde.com"; sid:517870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupfl.com"; sid:517871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuphi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuphi.com"; sid:517872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupia.com"; sid:517873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupidaho.com"; sid:517874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupid.com"; sid:517875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupil.com"; sid:517876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupin.com"; sid:517877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupks.com"; sid:517878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupky.com"; sid:517879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupla.com"; sid:517880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupma.com"; sid:517881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmd.com"; sid:517882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupme.com"; sid:517883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmi.com"; sid:517884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmn.com"; sid:517885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmo.com"; sid:517886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupms.com"; sid:517887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmt.com"; sid:517888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnc.com"; sid:517889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnd.com"; sid:517890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupne.com"; sid:517891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnh.com"; sid:517892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnv.com"; sid:517893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupny.com"; sid:517894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupoh.com"; sid:517895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupok.com"; sid:517896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupor.com"; sid:517897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuppa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuppa.com"; sid:517898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupri.com"; sid:517899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupsc.com"; sid:517900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupsd.com"; sid:517901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuptn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuptn.com"; sid:517902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuptx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuptx.com"; sid:517903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuput.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuput.com"; sid:517904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupva.com"; sid:517905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupvt.com"; sid:517906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupwa.com"; sid:517907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupwi.com"; sid:517908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupwv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupwv.com"; sid:517909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupwy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupwy.com"; sid:517910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanwipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanwipe.com"; sid:517911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinic.club"; sid:517912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoachella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoachella.com"; sid:517913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomms.com"; sid:517914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompleteguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompleteguide.com"; sid:517915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontagious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontagious.com"; sid:517916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrash2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrash2020.com"; sid:517917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscremation.com"; sid:517918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruisehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruisehelp.com"; sid:517919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathtoll.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathtoll.net"; sid:517920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecease.com"; sid:517921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationcleaning.com"; sid:517922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeepclean.com"; sid:517923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfection.com"; sid:517924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnostictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnostictest.com"; sid:517925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019.net"; sid:517926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasevaccine.com"; sid:517927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasevaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasevaccines.com"; sid:517928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantfogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantfogger.com"; sid:517929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionservices.com"; sid:517930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoginsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoginsurance.com"; sid:517931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonaldjtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonaldjtrump.com"; sid:517932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonaldtrump.com"; sid:517933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrug.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrug.net"; sid:517934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselections.com"; sid:517935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-elixir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-elixir.com"; sid:517936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesanxiety.com"; sid:517937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseschat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseschat.com"; sid:517938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseschats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseschats.com"; sid:517939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescleanupca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescleanupca.com"; sid:517940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescleanupfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescleanupfl.com"; sid:517941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesdiscussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesdiscussion.com"; sid:517942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesdiscussions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesdiscussions.com"; sid:517943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesforum.com"; sid:517944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesforums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesforums.com"; sid:517945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-essentials.com"; sid:517946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseuropa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseuropa.com"; sid:517947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseventinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseventinsurance.com"; sid:517948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfigures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfigures.com"; sid:517949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.film"; sid:517950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflightinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflightinsurance.com"; sid:517951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.flights"; sid:517952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfogger.com"; sid:517953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfogging.com"; sid:517954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortrump.com"; sid:517955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusftw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusftw.com"; sid:517956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuneral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuneral.com"; sid:517957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunerals.com"; sid:517958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-game.com"; sid:517959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgears.com"; sid:517960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalhelp.com"; sid:517961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgobag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgobag.com"; sid:517962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrid.com"; sid:517963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrippe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrippe.com"; sid:517964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguide2survive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguide2survive.com"; sid:517965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushacks.com"; sid:517966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushardship.com"; sid:517967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthgrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthgrades.com"; sid:517968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthtreatment.com"; sid:517969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpers.com"; sid:517970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusholidayinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusholidayinsurance.com"; sid:517971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushopes.com"; sid:517972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalcalculator.com"; sid:517973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusilaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusilaclama.com"; sid:517974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunityboosters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunityboosters.com"; sid:517975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinbangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinbangladesh.com"; sid:517976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfected.com"; sid:517977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-info-and-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-info-and-updates.com"; sid:517978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfohome.com"; sid:517979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylawyer.com"; sid:517980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurance.club"; sid:517981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.international"; sid:517982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintime.com"; sid:517983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-in-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-in-usa.com"; sid:517984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestingstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestingstrategy.com"; sid:517985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskamerasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskamerasi.com"; sid:517986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskibris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskibris.com"; sid:517987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskrankheiten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskrankheiten.com"; sid:517988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaboratories.com"; sid:517989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaw.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaw.expert"; sid:517990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawsuit.com"; sid:517991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuithelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuithelp.com"; sid:517992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruslawyer.com"; sid:517993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerflorida.com"; sid:517994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyernearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyernearme.com"; sid:517995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslefilm.com"; sid:517996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslender.com"; sid:517997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslenders.com"; sid:517998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliability.com"; sid:517999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruslive.com"; sid:518000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockdown.com"; sid:518001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongisland.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongisland.net"; sid:518002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslozenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslozenge.com"; sid:518003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmachines.com"; sid:518004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap.life"; sid:518005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask1.com"; sid:518006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasked.com"; sid:518007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskprotection.com"; sid:518008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmastermind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmastermind.com"; sid:518009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmealdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmealdelivery.com"; sid:518010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicare.com"; sid:518011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmentalhealth.com"; sid:518012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminimiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminimiser.com"; sid:518013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmisinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmisinformation.com"; sid:518014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmitigationcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmitigationcom.com"; sid:518015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmorgue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmorgue.com"; sid:518016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn958210mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn958210mask.com"; sid:518017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95facemask.com"; sid:518018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95-facemasks.com"; sid:518019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95facemasks.com"; sid:518020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95-facemasks.com"; sid:518021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95-mask.com"; sid:518022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95-masks.com"; sid:518023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnachrichten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnachrichten.com"; sid:518024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalhealing.com"; sid:518025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalimmunity.com"; sid:518026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnearme.net"; sid:518027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusnews.com"; sid:518028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news-liveticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news-liveticker.com"; sid:518029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnextdoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnextdoor.com"; sid:518030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnightmare.com"; sid:518031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnjschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnjschools.com"; sid:518032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreakprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreakprotection.com"; sid:518033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanama.com"; sid:518034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicadvice.com"; sid:518035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.services"; sid:518036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.solutions"; sid:518037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatch.com"; sid:518038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspay.com"; sid:518039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayout.com"; sid:518040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetinsurance.com"; sid:518041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphilly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphilly.com"; sid:518042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pledge.com"; sid:518043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolicy.com"; sid:518044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionflorida.com"; sid:518045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionnow.com"; sid:518046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionsolutions.com"; sid:518047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventiontools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventiontools.com"; sid:518048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessors.com"; sid:518049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionflorida.com"; sid:518050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionmask.net"; sid:518051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealtor.com"; sid:518052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealtors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealtors.com"; sid:518053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealty.com"; sid:518054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryquiz.com"; sid:518055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresolution.com"; sid:518056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresonancecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresonancecure.com"; sid:518057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrife.com"; sid:518058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskassessmentcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskassessmentcalculator.com"; sid:518059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrpm.com"; sid:518060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalvage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalvage.com"; sid:518061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitationservices.com"; sid:518062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitazing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitazing.com"; sid:518063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizerkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizerkit.com"; sid:518064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizerkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizerkits.com"; sid:518065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizing.com"; sid:518066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussciences.com"; sid:518067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussick.com"; sid:518068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussickness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussickness.com"; sid:518069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussong.com"; sid:518070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockpile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockpile.com"; sid:518071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudent.com"; sid:518072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudentsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudentsafety.com"; sid:518073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudents.com"; sid:518074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesonline.com"; sid:518075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor2020.com"; sid:518076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxcut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxcut.com"; sid:518077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechnologies.com"; sid:518078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelehealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelehealth.net"; sid:518079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustents.com"; sid:518080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestla.com"; sid:518081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest-shop.com"; sid:518082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsnow.com"; sid:518083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-themovie.com"; sid:518084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapies.com"; sid:518085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustotal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustotal.com"; sid:518086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackingsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackingsurvey.com"; sid:518087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentspecialists.com"; sid:518088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustripinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustripinsurance.com"; sid:518089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniversitywatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniversitywatch.com"; sid:518090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.life"; sid:518091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.life"; sid:518092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatemap.com"; sid:518093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuptodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuptodate.com"; sid:518094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-usa.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-usa.life"; sid:518095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususa.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususa.life"; sid:518096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacationinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacationinsurance.com"; sid:518097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccination.com"; sid:518098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineglobal.com"; sid:518099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvegas.com"; sid:518100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteer.com"; sid:518101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswallstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswallstreet.com"; sid:518102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestchester.com"; sid:518103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswinner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswinner.com"; sid:518104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkathomejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkathomejobs.com"; sid:518105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitus.com"; sid:518106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivus.com"; sid:518107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteer.com"; sid:518108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorus.com"; sid:518109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatch.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatch.club"; sid:518110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatchdog.com"; sid:518111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithlyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithlyme.com"; sid:518112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-work.com"; sid:518113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-work.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-work.net"; sid:518114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawork.net"; sid:518115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-world.com"; sid:518116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldmeter.com"; sid:518117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldstats.com"; sid:518118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawuhancure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawuhancure.com"; sid:518119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countingcorona.com"; sid:518120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ar.com"; sid:518121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assessment.com"; sid:518122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometestkit.com"; sid:518123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorney.com"; sid:518124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bats.com"; sid:518125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bg.com"; sid:518126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bill.com"; sid:518127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19block.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19block.com"; sid:518128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blocker.com"; sid:518129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breakthrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breakthrough.com"; sid:518130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breakthrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breakthrough.com"; sid:518131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19broadcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19broadcast.com"; sid:518132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bureau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bureau.com"; sid:518133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calc.com"; sid:518134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19center.com"; sid:518135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-check.com"; sid:518136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.com"; sid:518137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19condoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19condoms.com"; sid:518138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19condoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19condoms.com"; sid:518139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-consultants.com"; sid:518140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19count.com"; sid:518141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crypto.com"; sid:518142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dash.com"; sid:518143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19db.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19db.com"; sid:518144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deaths.com"; sid:518145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationcleaning.com"; sid:518146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decontamination.com"; sid:518147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnostictesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnostictesting.com"; sid:518148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.direct"; sid:518149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionservices.com"; sid:518150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19distancehealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19distancehealing.com"; sid:518151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distancehealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distancehealing.com"; sid:518152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diy.com"; sid:518153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19domainsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19domainsales.com"; sid:518154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donate.com"; sid:518155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19energyhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19energyhealing.com"; sid:518156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19energyhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19energyhealing.com"; sid:518157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faq.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faq.world"; sid:518158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19festival.com"; sid:518159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.zone"; sid:518160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funeral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funeral.com"; sid:518161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funerals.com"; sid:518162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19germbegone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19germbegone.com"; sid:518163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-groundzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-groundzero.com"; sid:518164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guideline.com"; sid:518165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hakkinda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hakkinda.com"; sid:518166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handwash.com"; sid:518167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthtech.com"; sid:518168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthtreatment.com"; sid:518169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19holidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19holidays.com"; sid:518170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygiene.com"; sid:518171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurance.net"; sid:518172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuits.com"; sid:518173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lawyer.com"; sid:518174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestream.com"; sid:518175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losangeles.com"; sid:518176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maine.com"; sid:518177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19map.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19map.world"; sid:518178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.memorial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.memorial"; sid:518179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msu.com"; sid:518180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19n958210mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19n958210mask.com"; sid:518181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19natural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19natural.com"; sid:518182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19naturalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19naturalcure.com"; sid:518183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.today"; sid:518184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onthedash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onthedash.com"; sid:518185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panama.com"; sid:518186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemic.today"; sid:518187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.today"; sid:518188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicvirus.com"; sid:518189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.pink - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.pink"; sid:518190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19podcast.com"; sid:518191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pregnancyregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pregnancyregistry.com"; sid:518192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pregnancyregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pregnancyregistry.com"; sid:518193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepardness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepardness.com"; sid:518194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventionproducts.com"; sid:518195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionproducts.com"; sid:518196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19problems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19problems.com"; sid:518197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-protection.com"; sid:518198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection-kits.com"; sid:518199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionkits.com"; sid:518200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionstore.com"; sid:518201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protector.com"; sid:518202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectpak.com"; sid:518203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psa.com"; sid:518204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19publichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19publichealth.com"; sid:518205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19puertorico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19puertorico.com"; sid:518206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapidtest.com"; sid:518207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-realtime.com"; sid:518208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.net"; sid:518209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sandiego.com"; sid:518210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenathome.com"; sid:518211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screen.com"; sid:518212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screening.com"; sid:518213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screens.com"; sid:518214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19security.com"; sid:518215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shirts.com"; sid:518216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-shop.com"; sid:518217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19show.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19show.com"; sid:518218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-speedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-speedtest.com"; sid:518219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-spray.com"; sid:518220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stats.com"; sid:518221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strong.com"; sid:518222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-supplies.com"; sid:518223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surgicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surgicalmasks.com"; sid:518224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorstory.com"; sid:518225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcenter.com"; sid:518226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingclinic.com"; sid:518227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnow.com"; sid:518228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapies.com"; sid:518229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19totalcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19totalcleaningservices.com"; sid:518230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19totalcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19totalcleaningservices.com"; sid:518231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.town - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.town"; sid:518232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracer.com"; sid:518233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracer.com"; sid:518234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackingsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackingsurvey.com"; sid:518235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trends.com"; sid:518236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trends.com"; sid:518237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19triage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19triage.com"; sid:518238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19troopers.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19troopers.club"; sid:518239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uk.net"; sid:518240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.university"; sid:518241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updates.net"; sid:518242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.club"; sid:518243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virussanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virussanitation.com"; sid:518244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virussanitationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virussanitationservices.com"; sid:518245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vn.com"; sid:518246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldwide.com"; sid:518247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xtd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xtd.com"; sid:518248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yyc.com"; sid:518249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid88.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid88.com"; sid:518250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9trump.com"; sid:518251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid.com"; sid:518252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertsapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertsapp.com"; sid:518253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxiety.com"; sid:518254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblog.com"; sid:518255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalc.com"; sid:518256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareinc.com"; sid:518257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningatl.com"; sid:518258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclic.com"; sid:518259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcon2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcon2020.com"; sid:518260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcon2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcon2021.com"; sid:518261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-con.com"; sid:518262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcone.com"; sid:518263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconspiracy.com"; sid:518264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontainmentcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontainmentcorp.com"; sid:518265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounter.com"; sid:518266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrash2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrash2020.com"; sid:518267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eotherapy.com"; sid:518268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ex.com"; sid:518269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfakenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfakenews.com"; sid:518270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeit.com"; sid:518271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeit.net"; sid:518272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgo.com"; sid:518273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviding.com"; sid:518274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintime.com"; sid:518275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-katie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-katie.com"; sid:518276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuit.com"; sid:518277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeter.com"; sid:518278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneb.com"; sid:518279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutbreak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutbreak2020.com"; sid:518280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic2020.com"; sid:518281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-quarantine.com"; sid:518282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquestion.com"; sid:518283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-questions.com"; sid:518284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquestions.com"; sid:518285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryasap.com"; sid:518286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreference.com"; sid:518287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecpr.com"; sid:518288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stat.com"; sid:518289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesters.com"; sid:518290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.net"; sid:518291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtine.com"; sid:518292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelinfo.com"; sid:518293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-world.com"; sid:518294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxiety.com"; sid:518295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.net"; sid:518296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyou.com"; sid:518297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.zone"; sid:518298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronaviruslawsuit.com"; sid:518299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiseshipcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiseshipcoronavirus.com"; sid:518300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crystalcurescorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crystalcurescorona.life"; sid:518301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure2corona.com"; sid:518302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronaviruses.com"; sid:518303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daticoronavirus.com"; sid:518304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detailscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detailscoronavirus.com"; sid:518305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detailscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detailscoronavirus.net"; sid:518306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detailscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detailscovid19.com"; sid:518307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detailscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detailscovid19.net"; sid:518308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dietcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dietcovid.com"; sid:518309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcoronavirus.com"; sid:518310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disaiblecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disaiblecorona.com"; sid:518311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovid19.com"; sid:518312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmvcoronavirus.com"; sid:518313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorcovid.com"; sid:518314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldjtrumpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldjtrumpcoronavirus.com"; sid:518315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for econsultcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"econsultcovid19.com"; sid:518316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for econsultcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"econsultcovid19.net"; sid:518317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for econsultcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"econsultcovid.com"; sid:518318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for econsultcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"econsultcovid.net"; sid:518319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminacoronavirus.com"; sid:518320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emprenderconcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emprenderconcoronavirus.com"; sid:518321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-daily.com"; sid:518322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdaily.com"; sid:518323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsport.com"; sid:518324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escape-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escape-corona-virus.com"; sid:518325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcovid19.com"; sid:518326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faightcorona.com"; sid:518327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fantcoronaes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fantcoronaes.com"; sid:518328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fantcoronaes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fantcoronaes.net"; sid:518329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcorona.com"; sid:518330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19.com"; sid:518331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronanow.com"; sid:518332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaviruses.com"; sid:518333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.net"; sid:518334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid19.today"; sid:518335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcovid-19.com"; sid:518336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcovid19.com"; sid:518337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcovid.com"; sid:518338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fleecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fleecovid19.com"; sid:518339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronaviruspreventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronaviruspreventionkit.com"; sid:518340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ganicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ganicovid19.com"; sid:518341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusprotection.com"; sid:518342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid.com"; sid:518343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaoutbreak.com"; sid:518344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicnews.com"; sid:518345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicupdates.com"; sid:518346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronacare.com"; sid:518347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodmedicinechoicecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodmedicinechoicecorona.com"; sid:518348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grandprincesscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grandprincesscoronavirus.com"; sid:518349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grandprincesscoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grandprincesscoronaviruslawsuit.com"; sid:518350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help4coronavirus.com"; sid:518351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helponthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helponthecoronavirus.com"; sid:518352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for henanwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"henanwuhan.com"; sid:518353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbscorona.com"; sid:518354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hilfe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hilfe-coronavirus.com"; sid:518355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirustesting.com"; sid:518356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtest.com"; sid:518357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtesting.com"; sid:518358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeschoolingandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeschoolingandcoronavirus.com"; sid:518359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrtcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrtcoronatest.com"; sid:518360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for httphrtcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"httphrtcoronatest.com"; sid:518361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ialsosurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ialsosurvivedcorona.com"; sid:518362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifcorona.com"; sid:518363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcorona.com"; sid:518364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunecoronavirus.com"; sid:518365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactcoronavirus.com"; sid:518366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacioncoronavirus.com"; sid:518367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informedcorona.com"; sid:518368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informedcoronavirus.com"; sid:518369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronavirustest.com"; sid:518370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronacure.com"; sid:518371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronaviruscure.com"; sid:518372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcovid-19.com"; sid:518373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcovid19.com"; sid:518374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid.com"; sid:518375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joebidencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joebidencoronavirus.com"; sid:518376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmcorona.com"; sid:518377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmcoronavirus.com"; sid:518378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamourautempsducorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamourautempsducorona.com"; sid:518379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronanews.com"; sid:518380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limeforyourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limeforyourcorona.com"; sid:518381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limitcoronavirus.com"; sid:518382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirusnews.com"; sid:518383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livewithcorona.com"; sid:518384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona19.com"; sid:518385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-corona.com"; sid:518386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luchacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luchacoronavirus.com"; sid:518387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainecovid19.com"; sid:518388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronagreatagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronagreatagain.com"; sid:518389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillas-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillas-covid.com"; sid:518390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maske-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maske-corona.com"; sid:518391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticoronavirus.com"; sid:518392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentoscovid19.com"; sid:518393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicodelcoronavirus.com"; sid:518394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetcorona.com"; sid:518395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mensajecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mensajecoronavirus.com"; sid:518396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mercorona.com"; sid:518397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mersincoronailaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mersincoronailaclama.com"; sid:518398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindbodycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindbodycoronavirus.com"; sid:518399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecarwashcoronaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecarwashcoronaca.com"; sid:518400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronatest.com"; sid:518401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19test.com"; sid:518402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mr-corona-smile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mr-corona-smile.com"; sid:518403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.club"; sid:518404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacrisis.com"; sid:518405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadata.com"; sid:518406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.report"; sid:518407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19app.com"; sid:518408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacovid19.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacovid19.report"; sid:518409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicblog.com"; sid:518410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusalerts.com"; sid:518411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nflcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nflcoronavirus.com"; sid:518412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-corona-4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-corona-4u.com"; sid:518413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-corona4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-corona4u.com"; sid:518414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomocovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomocovid19.world"; sid:518415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus19.com"; sid:518416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelpandemic.com"; sid:518417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oceanblvdcoronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oceanblvdcoronadelmar.com"; sid:518418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofcorona.com"; sid:518419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oncorona.com"; sid:518420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ontariocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ontariocovid19.com"; sid:518421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonekillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonekillscorona.com"; sid:518422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paint-covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paint-covid19.club"; sid:518423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicangels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicangels.com"; sid:518424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbiomedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbiomedical.com"; sid:518425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbiosensors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbiosensors.com"; sid:518426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbnb.com"; sid:518427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.business"; sid:518428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.center"; sid:518429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.coach"; sid:518430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.company"; sid:518431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccuresblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccuresblog.com"; sid:518432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdangerlevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdangerlevel.com"; sid:518433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdangers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdangers.com"; sid:518434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.delivery"; sid:518435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdx.com"; sid:518436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.institute - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.institute"; sid:518437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclaboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclaboratories.com"; sid:518438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclaw.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclaw.expert"; sid:518439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclogistics.com"; sid:518440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoffear.com"; sid:518441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpaper.com"; sid:518442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprecautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprecautions.com"; sid:518443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.bid"; sid:518444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsciences.com"; sid:518445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechnology.com"; sid:518446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictesting.com"; sid:518447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictherapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictherapeutics.com"; sid:518448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictips.com"; sid:518449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvoc-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvoc-19.com"; sid:518450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwerx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwerx.com"; sid:518451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peterpandemic.com"; sid:518452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praytogetherforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praytogetherforcoronavirus.com"; sid:518453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingcovid19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingcovid19spread.com"; sid:518454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-corona.club"; sid:518455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktestcorona.com"; sid:518456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktestcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktestcorona.net"; sid:518457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktest-covid.com"; sid:518458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocovid.com"; sid:518459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiofreecovid.com"; sid:518460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveryfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveryfromcovid19.com"; sid:518461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rpmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rpmcoronavirus.com"; sid:518462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronatest.com"; sid:518463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronavirus.com"; sid:518464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronavirus.net"; sid:518465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saigoncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saigoncorona.net"; sid:518466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltestcorona.com"; sid:518467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltestcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltestcorona.net"; sid:518468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutz-vor-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutz-vor-corona-virus.com"; sid:518469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-coronavirus.com"; sid:518470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sickofcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sickofcorona.club"; sid:518471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sickofcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sickofcorona.today"; sid:518472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapforcovid19.com"; sid:518473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sondakikacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sondakikacorona.com"; sid:518474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sopravvissuticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sopravvissuticovid19.com"; sid:518475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southeastcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southeastcovidcleaning.com"; sid:518476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spraykillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spraykillscoronavirus.com"; sid:518477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statcorona.com"; sid:518478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopp-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopp-corona.com"; sid:518479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppcorona.com"; sid:518480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppt-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppt-corona.com"; sid:518481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopptcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopptcorona.com"; sid:518482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcorona.com"; sid:518483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalcovid19.com"; sid:518484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkcorona.com"; sid:518485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenhocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenhocoronavirus.com"; sid:518486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4coronavirus.com"; sid:518487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid19.com"; sid:518488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusathome.com"; sid:518489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusshop.com"; sid:518490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19athome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19athome.com"; sid:518491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.net"; sid:518492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcoronavirus.com"; sid:518493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatshowyougetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatshowyougetcoronavirus.com"; sid:518494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabusters.com"; sid:518495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.agency"; sid:518496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusattorney.com"; sid:518497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusattorneys.com"; sid:518498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusesforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusesforum.com"; sid:518499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusesforums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusesforums.com"; sid:518500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusgrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusgrid.com"; sid:518501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusguide.com"; sid:518502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushealth.com"; sid:518503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawyer.com"; sid:518504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawyers.com"; sid:518505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lawyer.com"; sid:518506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidquestions.com"; sid:518507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtracker.com"; sid:518508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesolutiontocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesolutiontocoronavirus.com"; sid:518509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhancoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhancoronacure.com"; sid:518510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thismaskwillnotpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thismaskwillnotpreventcoronavirus.com"; sid:518511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiswillnotpreventpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiswillnotpreventpandemic.com"; sid:518512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovid.com"; sid:518513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traintowuhanmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traintowuhanmovie.com"; sid:518514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traitementcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traitementcorona.com"; sid:518515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcoronaviruses.com"; sid:518516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimahoracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimahoracoronavirus.com"; sid:518517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedagainstcorona.com"; sid:518518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatescovid19.com"; sid:518519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19testkit.com"; sid:518520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidclean.com"; sid:518521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillscorona.com"; sid:518522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for versuscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"versuscoronavirus.com"; sid:518523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for versusviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"versusviruscorona.com"; sid:518524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona2020.club"; sid:518525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona2020.com"; sid:518526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid.com"; sid:518527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willigetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willigetcorona.com"; sid:518528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wonderspraykillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wonderspraykillscoronavirus.com"; sid:518529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercorona.com"; sid:518530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirus.net"; sid:518531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusnews.com"; sid:518532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemic2020.com"; sid:518533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbatsoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbatsoup.com"; sid:518534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclean.com"; sid:518535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoronacure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoronacure.net"; sid:518536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-coronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-coronavirus.life"; sid:518537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancures.com"; sid:518538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandon.com"; sid:518539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangvip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangvip.com"; sid:518540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhoneycomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhoneycomb.com"; sid:518541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan.pet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan.pet"; sid:518542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrenmin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrenmin.com"; sid:518543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansanzhen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansanzhen.com"; sid:518544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyihekeji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyihekeji.com"; sid:518545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronavirusx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronavirusx.com"; sid:518546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirsbelirtileri-hicb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirsbelirtileri-hicb.com"; sid:518547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirustrkiye-e3b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirustrkiye-e3b.com"; sid:518548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavrus-3ub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavrus-3ub.com"; sid:518549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xocovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xocovida.com"; sid:518550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronacure.com"; sid:518551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronarisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronarisk.com"; sid:518552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourmomhascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourmomhascoronavirus.com"; sid:518553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcovid19.com"; sid:518554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zonalibredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zonalibredecoronavirus.com"; sid:518555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020censuspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020censuspandemic.com"; sid:518556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-covid-19.com"; sid:518557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020newworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020newworldpandemic.com"; sid:518558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-pandemic.com"; sid:518559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4coronavirus.net"; sid:518560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covid19.club"; sid:518561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covid.com"; sid:518562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronadate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronadate.com"; sid:518563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronalove.com"; sid:518564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronamatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronamatch.com"; sid:518565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.com"; sid:518566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19.com"; sid:518567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.com"; sid:518568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterpandemic.com"; sid:518569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againtscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againtscoronavirus.com"; sid:518570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidcorona.com"; sid:518571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aitempidelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aitempidelcovid19.com"; sid:518572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertacoronavirus.net"; sid:518573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcoronaviruses.com"; sid:518574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allclearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allclearcoronavirus.com"; sid:518575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronashield.com"; sid:518576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacoronaviruscovid-19.com"; sid:518577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacoronaviruscovid19.com"; sid:518578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ankaracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ankaracorona.com"; sid:518579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ankaracoronavirusu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ankaracoronavirusu.com"; sid:518580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annarborcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annarborcorona.com"; sid:518581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona2019.com"; sid:518582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamedication.com"; sid:518583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaparty.com"; sid:518584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.pro"; sid:518585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronasanitizer.com"; sid:518586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.solutions"; sid:518587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusprogram.com"; sid:518588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.solutions"; sid:518589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.today"; sid:518590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19drugs.com"; sid:518591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemic.com"; sid:518592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcorona.com"; sid:518593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovid.com"; sid:518594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artintheageofpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artintheageofpandemics.com"; sid:518595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astalavistacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astalavistacorona.com"; sid:518596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19.com"; sid:518597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidbankruptcy-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidbankruptcy-coronavirus.com"; sid:518598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoid-coronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoid-coronavirusbankruptcy.com"; sid:518599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcorona-virus.com"; sid:518600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronaviruses.com"; sid:518601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for axcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"axcorona.com"; sid:518602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacoronavirus.com"; sid:518603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascoronavirus.com"; sid:518604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycorona.com"; sid:518605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batcovid.com"; sid:518606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecovid19.com"; sid:518607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronavirus.club"; sid:518608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingthecoronavirus.com"; sid:518609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthepandemic.com"; sid:518610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirussmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirussmart.com"; sid:518611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19smart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19smart.com"; sid:518612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecorona.com"; sid:518613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforepandemic.com"; sid:518614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berlincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berlincorona.com"; sid:518615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betcovid.com"; sid:518616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for borcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"borcorona.club"; sid:518617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessdebt-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessdebt-coronavirus.com"; sid:518618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinthetimeofcoronavirus.com"; sid:518619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business-resource-facebook-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business-resource-facebook-covid-19.com"; sid:518620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruskits.com"; sid:518621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidmask.com"; sid:518622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecorona.net"; sid:518623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecoronaonline.com"; sid:518624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecovid.com"; sid:518625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19.com"; sid:518626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcoronabusters.com"; sid:518627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callthecoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callthecoronabusters.com"; sid:518628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacoronavirusnews.com"; sid:518629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canepicworkfromhomeduetocoronavirusyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canepicworkfromhomeduetocoronavirusyet.com"; sid:518630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid19.com"; sid:518631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchingcorona.com"; sid:518632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchingcovid19.com"; sid:518633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdbeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdbeatcoronavirus.com"; sid:518634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccoronavirus.com"; sid:518635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebcovid.com"; sid:518636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebertieswithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebertieswithcorona.com"; sid:518637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritieswithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritieswithcoronavirus.com"; sid:518638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycorona.com"; sid:518639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebswithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebswithcorona.com"; sid:518640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceriterafightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceriterafightcovid19.com"; sid:518641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certcovid19.com"; sid:518642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcorona.com"; sid:518643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcovid19.com"; sid:518644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcovid.com"; sid:518645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkupcorona.com"; sid:518646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheerstocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheerstocorona.com"; sid:518647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chilaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chilaicorona.com"; sid:518648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid2019.com"; sid:518649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid19.com"; sid:518650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovids19.com"; sid:518651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaning4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaning4corona.com"; sid:518652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcovid.com"; sid:518653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovid.com"; sid:518654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovid-19.com"; sid:518655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovid19.com"; sid:518656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coldorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coldorcoronavirus.com"; sid:518657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercoronavirus.com"; sid:518658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid19.com"; sid:518659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraelcoronavirusajedrez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraelcoronavirusajedrez.com"; sid:518660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copewithcovid.com"; sid:518661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcoronavirus.com"; sid:518662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19flu.com"; sid:518663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1stop.com"; sid:518664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2019.net"; sid:518665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020s.com"; sid:518666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020virus.com"; sid:518667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2plus.com"; sid:518668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4u.com"; sid:518669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactivities.com"; sid:518670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advice.net"; sid:518671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalysis.com"; sid:518672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalytic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalytic.com"; sid:518673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalytics.com"; sid:518674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanjenglumemek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanjenglumemek.com"; sid:518675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus.today"; sid:518676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapi.com"; sid:518677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasisi.com"; sid:518678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassist.com"; sid:518679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatlanta.com"; sid:518680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattorneyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattorneyflorida.com"; sid:518681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattorneyorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattorneyorlando.com"; sid:518682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aussteiger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aussteiger.com"; sid:518683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaway.com"; sid:518684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiez.com"; sid:518685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiez.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiez.net"; sid:518686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy2020.com"; sid:518687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabag.com"; sid:518688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabailout.com"; sid:518689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabaloney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabaloney.com"; sid:518690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabastards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabastards.com"; sid:518691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabedamned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabedamned.com"; sid:518692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaberlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaberlin.com"; sid:518693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bet.com"; sid:518694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirus.com"; sid:518695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabis.com"; sid:518696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablogs.com"; sid:518697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboat.com"; sid:518698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabologna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabologna.com"; sid:518699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomers.com"; sid:518700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabots.com"; sid:518701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrand.com"; sid:518702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-brasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-brasil.com"; sid:518703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrokers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrokers.com"; sid:518704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabull.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabull.com"; sid:518705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulls.com"; sid:518706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburada.com"; sid:518707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesshelp.com"; sid:518708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessins.com"; sid:518709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabycountry.com"; sid:518710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancel.com"; sid:518711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapnhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapnhat.com"; sid:518712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.club"; sid:518713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.group"; sid:518714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarellc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarellc.com"; sid:518715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepackages.com"; sid:518716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation2020.com"; sid:518717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationdeals.com"; sid:518718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cctv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cctv.com"; sid:518719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chance.com"; sid:518720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachannel.com"; sid:518721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachats.com"; sid:518722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecktest.com"; sid:518723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck.today"; sid:518724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachildcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachildcare.com"; sid:518725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachip.com"; sid:518726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachips.com"; sid:518727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirus.com"; sid:518728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaims.net"; sid:518729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaning-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaning-advice.com"; sid:518730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanus.com"; sid:518731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-clear.com"; sid:518732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclinic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclinic.net"; sid:518733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloudsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloudsolutions.com"; sid:518734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacluster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacluster.com"; sid:518735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclusters.com"; sid:518736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoinshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoinshop.com"; sid:518737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollar.com"; sid:518738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunication.com"; sid:518739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanycare.com"; sid:518740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnection.com"; sid:518741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconversation.com"; sid:518742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconvos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconvos.com"; sid:518743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookbook.com"; sid:518744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounselor.com"; sid:518745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-count.com"; sid:518746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourtesy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourtesy.com"; sid:518747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrowd.com"; sid:518748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.center"; sid:518749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurefund.com"; sid:518750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.pro"; sid:518751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cures.com"; sid:518752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuresusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuresusa.com"; sid:518753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretracker.com"; sid:518754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadailyvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadailyvirus.com"; sid:518755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathcounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathcounter.com"; sid:518756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebate.com"; sid:518757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebt.com"; sid:518758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebts.com"; sid:518759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeepclean.com"; sid:518760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefeat.com"; sid:518761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.dental"; sid:518762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasters.com"; sid:518763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasemedicine.com"; sid:518764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistributors.com"; sid:518765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadolls.com"; sid:518766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonations.com"; sid:518767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivein.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivein.com"; sid:518768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaductivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaductivity.com"; sid:518769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeliminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeliminator.com"; sid:518770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaequipment.com"; sid:518771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeventban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeventban.com"; sid:518772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexbitkisel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexbitkisel.com"; sid:518773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-facemasks.com"; sid:518774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaface-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaface-masks.com"; sid:518775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacialmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacialmasks.com"; sid:518776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafall.com"; sid:518777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamous.com"; sid:518778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafantasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafantasy.com"; sid:518779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafl.com"; sid:518780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflix.com"; sid:518781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-flu.com"; sid:518782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflu.net"; sid:518783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflyrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflyrus.com"; sid:518784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodmalta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodmalta.com"; sid:518785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodupdatesmalta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodupdatesmalta.com"; sid:518786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforums.com"; sid:518787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeconcerts.com"; sid:518788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefundraiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefundraiser.com"; sid:518789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehealthcare.com"; sid:518790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehotel.com"; sid:518791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreelivemusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreelivemusic.com"; sid:518792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemovement.com"; sid:518793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreere.com"; sid:518794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeshop.com"; sid:518795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreestore.com"; sid:518796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreestores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreestores.com"; sid:518797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetips.com"; sid:518798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetutoring.com"; sid:518799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezone.com"; sid:518800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-frei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-frei.com"; sid:518801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrei.com"; sid:518802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunding.com"; sid:518803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuture.com"; sid:518804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafutures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafutures.com"; sid:518805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageneration.com"; sid:518806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobe.com"; sid:518807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagofund.com"; sid:518808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagotme2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagotme2020.com"; sid:518809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagotme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagotme.com"; sid:518810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagotohell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagotohell.com"; sid:518811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaberler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaberler.com"; sid:518812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahakkinda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahakkinda.com"; sid:518813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandssanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandssanitizer.com"; sid:518814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-health-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-health-check.com"; sid:518815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcure.com"; sid:518816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdesk.com"; sid:518817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdesk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdesk.net"; sid:518818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helpers.com"; sid:518819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherb.com"; sid:518820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfeaustria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfeaustria.com"; sid:518821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hoax.com"; sid:518822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahook.com"; sid:518823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoop.com"; sid:518824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoopusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoopusa.com"; sid:518825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidmd.com"; sid:518826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaif.com"; sid:518827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpacts.com"; sid:518828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronain.com"; sid:518829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindy.com"; sid:518830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infection.com"; sid:518831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionmasks.com"; sid:518832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfektion.com"; sid:518833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo24.com"; sid:518834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo.center"; sid:518835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfoupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfoupdates.com"; sid:518836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainindia.com"; sid:518837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronains.com"; sid:518838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsider.com"; sid:518839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspector.com"; sid:518840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-inspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-inspectors.com"; sid:518841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspectors.com"; sid:518842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspectors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspectors.net"; sid:518843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-instant-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-instant-test.com"; sid:518844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsure.com"; sid:518845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsured.com"; sid:518846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsured.net"; sid:518847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintel.com"; sid:518848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintern.com"; sid:518849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvesting.com"; sid:518850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaios.com"; sid:518851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairish.com"; sid:518852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaislight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaislight.com"; sid:518853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitaly.com"; sid:518854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoes.com"; sid:518855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuegos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuegos.com"; sid:518856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakayak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakayak.com"; sid:518857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillers.net"; sid:518858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindness.com"; sid:518859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakures.com"; sid:518860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakush.com"; sid:518861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-la.com"; sid:518862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronala.com"; sid:518863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalarm.com"; sid:518864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawnewyork.com"; sid:518865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyernewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyernewyork.com"; sid:518866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyersnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyersnewyork.com"; sid:518867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalb.com"; sid:518868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearn.com"; sid:518869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearn.net"; sid:518870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legal.com"; sid:518871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegaldesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegaldesk.com"; sid:518872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalfirm.com"; sid:518873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalhelp.com"; sid:518874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalhelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalhelpdesk.com"; sid:518875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigation.com"; sid:518876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive-map.com"; sid:518877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive-map.net"; sid:518878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivemaps.com"; sid:518879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogs.com"; sid:518880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalone.com"; sid:518881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalost.com"; sid:518882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalotion.com"; sid:518883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalotions.com"; sid:518884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-love.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-love.com"; sid:518885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalovedate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalovedate.com"; sid:518886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalove.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalove.singles"; sid:518887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloveyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloveyes.com"; sid:518888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamade.com"; sid:518889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapping.com"; sid:518890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-maskers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-maskers.com"; sid:518891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamat.com"; sid:518892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalcure.com"; sid:518893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameet.com"; sid:518894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameetup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameetup.com"; sid:518895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamekilukecilasu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamekilukecilasu.com"; sid:518896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meme-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meme-vaccine.com"; sid:518897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemevaccine.com"; sid:518898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametre.com"; sid:518899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamicro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamicro.com"; sid:518900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamodel.com"; sid:518901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoskingz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoskingz.com"; sid:518902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamumbai.com"; sid:518903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamystery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamystery.com"; sid:518904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanations.com"; sid:518905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanba.com"; sid:518906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronancaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronancaa.com"; sid:518907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanceled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanceled.com"; sid:518908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsfeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsfeeds.com"; sid:518909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsusa.com"; sid:518910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanfl.com"; sid:518911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanobrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanobrasil.com"; sid:518912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanothanks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanothanks.com"; sid:518913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonhold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonhold.com"; sid:518914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlinebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlinebusiness.com"; sid:518915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapan.com"; sid:518916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pandemie.com"; sid:518917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassbook.com"; sid:518918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeace.com"; sid:518919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocylipse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocylipse.com"; sid:518920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolcalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolcalypse.com"; sid:518921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapop.com"; sid:518922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaportal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaportal.net"; sid:518923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoxalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoxalypse.com"; sid:518924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prediciton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prediciton.com"; sid:518925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionservices.com"; sid:518926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventiontraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventiontraining.com"; sid:518927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofiteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofiteers.com"; sid:518928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofbusiness.com"; sid:518929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionkits.com"; sid:518930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionservices.com"; sid:518931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-shop.com"; sid:518932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionstore.com"; sid:518933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapush.com"; sid:518934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqanda.com"; sid:518935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqanda.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqanda.net"; sid:518936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqs.com"; sid:518937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqs.net"; sid:518938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradio.net"; sid:518939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarage.com"; sid:518940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarea.com"; sid:518941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaready.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaready.net"; sid:518942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecession2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecession2020.com"; sid:518943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsberatung.com"; sid:518944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecord.com"; sid:518945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecovered.com"; sid:518946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.red - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.red"; sid:518947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareisen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareisen.com"; sid:518948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.center"; sid:518949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-repellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-repellent.com"; sid:518950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresilience.com"; sid:518951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresilient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresilient.com"; sid:518952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresouces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresouces.com"; sid:518953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarobot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarobot.com"; sid:518954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarobots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarobots.com"; sid:518955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroll.com"; sid:518956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarolls.com"; sid:518957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeprotection.com"; sid:518958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyprotection.com"; sid:518959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafteysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafteysigns.com"; sid:518960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sales.com"; sid:518961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasana.com"; sid:518962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasantizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasantizer.com"; sid:518963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaver.com"; sid:518964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasba.com"; sid:518965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-selfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-selfcare.com"; sid:518966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfcare.com"; sid:518967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-service.com"; sid:518968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-set.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-set.com"; sid:518969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-settlement.com"; sid:518970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasettlements.com"; sid:518971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashark.com"; sid:518972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashields.com"; sid:518973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop.biz"; sid:518974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashow.com"; sid:518975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashutdown.com"; sid:518976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingle.com"; sid:518977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialdistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialdistance.com"; sid:518978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialdistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialdistance.net"; sid:518979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sofort-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sofort-test.com"; sid:518980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolutions4business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolutions4business.com"; sid:518981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeeddate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeeddate.com"; sid:518982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeeddating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeeddating.com"; sid:518983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasportsban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasportsban.com"; sid:518984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasportsbans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasportsbans.com"; sid:518985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspot.com"; sid:518986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreme.com"; sid:518987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spring.com"; sid:518988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasticker.com"; sid:518989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulus.com"; sid:518990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoptech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoptech.com"; sid:518991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastylus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastylus.com"; sid:518992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasure.com"; sid:518993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurviver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurviver.com"; sid:518994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor2020.com"; sid:518995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor.club"; sid:518996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor.net"; sid:518997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswag.com"; sid:518998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswaps.com"; sid:518999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalks.com"; sid:519000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateacher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateacher.com"; sid:519001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatechlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatechlabs.com"; sid:519002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest19.com"; sid:519003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestathome.com"; sid:519004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingmiami.com"; sid:519005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestings.com"; sid:519006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsites.com"; sid:519007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testkit.com"; sid:519008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tests.com"; sid:519009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatests.net"; sid:519010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsnow.com"; sid:519011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatexas.com"; sid:519012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-themovie.com"; sid:519013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermalgate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermalgate.com"; sid:519014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathreats.com"; sid:519015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimeline.com"; sid:519016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackr.com"; sid:519017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelban.com"; sid:519018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelbans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelbans.com"; sid:519019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatment.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatment.center"; sid:519020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatmentclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatmentclinic.com"; sid:519021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatmentcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatmentcure.com"; sid:519022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatshirt.com"; sid:519023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmenskrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmenskrise.com"; sid:519024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-updates.net"; sid:519025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupside.com"; sid:519026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurlaub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurlaub.com"; sid:519027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccin.net"; sid:519028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavan.com"; sid:519029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavans.com"; sid:519030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversichern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversichern.com"; sid:519031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverus.net"; sid:519032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviirus.com"; sid:519033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavip.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavip.club"; sid:519034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralonline.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralonline.network"; sid:519035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralonline.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralonline.today"; sid:519036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vir.com"; sid:519037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viru.com"; sid:519038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirud.com"; sid:519039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirulent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirulent.com"; sid:519040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus101.com"; sid:519041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-101.com"; sid:519042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus101.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus101.net"; sid:519043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19-21.com"; sid:519044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19prep.com"; sid:519045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1point3acres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1point3acres.com"; sid:519046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus201.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus201.com"; sid:519047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020app.com"; sid:519048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.center"; sid:519049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020faq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020faq.com"; sid:519050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020s.com"; sid:519051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020update.com"; sid:519052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020usa.com"; sid:519053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2022.com"; sid:519054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus202.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus202.com"; sid:519055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus206.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus206.com"; sid:519056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2319.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2319.com"; sid:519057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus6degrees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus6degrees.com"; sid:519058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus702.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus702.com"; sid:519059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus90210.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus90210.com"; sid:519060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus914.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus914.com"; sid:519061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusad.com"; sid:519062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusads.com"; sid:519063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidforum.com"; sid:519064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandthechurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandthechurch.com"; sid:519065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanimal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanimal.com"; sid:519066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanimalvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanimalvaccine.com"; sid:519067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantivirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantivirals.com"; sid:519068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarbitration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarbitration.com"; sid:519069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-arizona.com"; sid:519070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarrives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarrives.com"; sid:519071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasskicker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasskicker.com"; sid:519072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathletes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathletes.com"; sid:519073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatl.com"; sid:519074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorney.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorney.directory"; sid:519075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyusa.com"; sid:519076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusayuda.com"; sid:519077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbahamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbahamas.com"; sid:519078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailouts.com"; sid:519079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaja.com"; sid:519080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbali.com"; sid:519081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bankruptcy.com"; sid:519082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarbados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarbados.com"; sid:519083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaseball.com"; sid:519084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbasketball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbasketball.com"; sid:519085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelgique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelgique.com"; sid:519086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestprevention.com"; sid:519087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestprotection.com"; sid:519088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbk.com"; sid:519089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblackout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblackout.com"; sid:519090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-businessdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-businessdebt.com"; sid:519091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessdebt.com"; sid:519092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesshelp.com"; sid:519093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinsurance.com"; sid:519094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloan.com"; sid:519095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscallcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscallcenter.com"; sid:519096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscancellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscancellation.com"; sid:519097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanellations.com"; sid:519098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscared.com"; sid:519099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscart.com"; sid:519100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscelebrities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscelebrities.com"; sid:519101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscenter.net"; sid:519102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscenterusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscenterusa.com"; sid:519103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschangedme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschangedme.com"; sid:519104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschanges.com"; sid:519105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschatbot.com"; sid:519106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-claim.com"; sid:519107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-clean.com"; sid:519108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaners.net"; sid:519109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscleaning.com"; sid:519110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmd.com"; sid:519111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean.net"; sid:519112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanse.com"; sid:519113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleanup.com"; sid:519114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclicker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclicker.com"; sid:519115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosure.com"; sid:519116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscloud.com"; sid:519117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoffee.com"; sid:519118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompany.com"; sid:519119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscordoba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscordoba.com"; sid:519120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscostumes.com"; sid:519121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.coupons - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.coupons"; sid:519122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19america.com"; sid:519123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19-information.com"; sid:519124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19oh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19oh.com"; sid:519125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19ohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19ohio.com"; sid:519126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19unitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19unitedstates.com"; sid:519127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19updates.com"; sid:519128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19usa.com"; sid:519129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid20.com"; sid:519130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrate.com"; sid:519131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscr.com"; sid:519132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscremations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscremations.com"; sid:519133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure2020.com"; sid:519134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuretoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuretoday.com"; sid:519135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdanielerugani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdanielerugani.com"; sid:519136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeadly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeadly.com"; sid:519137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-debt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-debt.com"; sid:519138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebts.com"; sid:519139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontamination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontamination.net"; sid:519140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationservice.com"; sid:519141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationservices.com"; sid:519142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeepcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeepcleaners.com"; sid:519143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefend.com"; sid:519144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensemask.com"; sid:519145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseproducts.com"; sid:519146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelivery.com"; sid:519147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetect.com"; sid:519148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdigest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdigest.com"; sid:519149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdigital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdigital.com"; sid:519150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.discount - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.discount"; sid:519151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaseco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaseco.com"; sid:519152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasemasks.com"; sid:519153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasex.com"; sid:519154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-doctor.com"; sid:519155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogvaccine.com"; sid:519156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoll.com"; sid:519157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdriveby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdriveby.com"; sid:519158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethrough.com"; sid:519159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethru.com"; sid:519160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethrutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethrutesting.com"; sid:519161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdriveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdriveup.com"; sid:519162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencies.com"; sid:519163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-emergency.com"; sid:519164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencymasks.com"; sid:519165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyusa.com"; sid:519166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenargentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenargentina.com"; sid:519167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusencolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusencolombia.com"; sid:519168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusend.com"; sid:519169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendparty.com"; sid:519170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendswithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendswithme.com"; sid:519171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendswithus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendswithus.com"; sid:519172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemic2019.com"; sid:519173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses19.com"; sid:519174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescaperoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescaperoom.com"; sid:519175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexeter.com"; sid:519176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfantasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfantasy.com"; sid:519177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarmacia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarmacia.com"; sid:519178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfda.com"; sid:519179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfest.com"; sid:519180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfigi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfigi.com"; sid:519181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilter.net"; sid:519182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfootball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfootball.com"; sid:519183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforpresident.com"; sid:519184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforum.net"; sid:519185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforuspresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforuspresident.com"; sid:519186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree.club"; sid:519187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreehotel.com"; sid:519188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeshop.com"; sid:519189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreestore.com"; sid:519190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreestores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreestores.com"; sid:519191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfriendlybiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfriendlybiz.com"; sid:519192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfriendly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfriendly.com"; sid:519193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundraiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundraiser.com"; sid:519194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundraisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundraisers.com"; sid:519195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunny.com"; sid:519196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfury.com"; sid:519197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgadget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgadget.com"; sid:519198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgadgets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgadgets.com"; sid:519199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgb.com"; sid:519200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgearbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgearbrand.com"; sid:519201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgear.net"; sid:519202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeneration.com"; sid:519203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalhotline.com"; sid:519204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgod.com"; sid:519205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushalloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushalloween.com"; sid:519206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushand.com"; sid:519207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandspray.com"; sid:519208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappyending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappyending.com"; sid:519209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushater.com"; sid:519210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthsolutions.com"; sid:519211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthtips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthtips.com"; sid:519212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheathfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheathfacts.com"; sid:519213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.club"; sid:519214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpguide.com"; sid:519215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.today"; sid:519216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushint.com"; sid:519217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushints.com"; sid:519218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushockey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushockey.com"; sid:519219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoje.com"; sid:519220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomescan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomescan.com"; sid:519221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushouremergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushouremergency.com"; sid:519222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousecleaner.com"; sid:519223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushysteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushysteria.com"; sid:519224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusibiza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusibiza.com"; sid:519225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusibiza.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusibiza.net"; sid:519226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindo.com"; sid:519227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-infection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-infection.com"; sid:519228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoandlinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoandlinks.com"; sid:519229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-info.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-info.club"; sid:519230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.club"; sid:519231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylawfirm.com"; sid:519232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinstanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinstanttest.com"; sid:519233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinupdate.com"; sid:519234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinusa.net"; sid:519235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisfake.com"; sid:519236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisolation.com"; sid:519237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisreal.com"; sid:519238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-italy.com"; sid:519239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjamesharden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjamesharden.com"; sid:519240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjanitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjanitorial.com"; sid:519241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskevinbacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskevinbacon.com"; sid:519242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskids.com"; sid:519243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingscounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingscounty.com"; sid:519244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskitsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskitsonline.com"; sid:519245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatam.com"; sid:519246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawattorney.com"; sid:519247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawminnesota.com"; sid:519248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawonline.com"; sid:519249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitattorneys.com"; sid:519250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuite.com"; sid:519251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitlawyer.com"; sid:519252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuit.net"; sid:519253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerminnesota.com"; sid:519254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyernyc.com"; sid:519255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerorlando.com"; sid:519256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersminnesota.com"; sid:519257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersnewyork.com"; sid:519258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersnyc.com"; sid:519259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersorlando.com"; sid:519260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslebronjames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslebronjames.com"; sid:519261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifestyle.com"; sid:519262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslionelmessi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslionelmessi.com"; sid:519263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslove.com"; sid:519264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ma.com"; sid:519265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmade.com"; sid:519266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaids.com"; sid:519267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarchmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarchmadness.com"; sid:519268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaroc.com"; sid:519269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.pro"; sid:519270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.today"; sid:519271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmate.com"; sid:519272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.mba - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.mba"; sid:519273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.media"; sid:519274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmediation.com"; sid:519275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-medicine.com"; sid:519276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedikamente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedikamente.com"; sid:519277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeditations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeditations.com"; sid:519278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemories.com"; sid:519279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmessi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmessi.com"; sid:519280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mi.com"; sid:519281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmins.com"; sid:519282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminutes.com"; sid:519283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmlb.com"; sid:519284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmobile.com"; sid:519285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmontenegro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmontenegro.com"; sid:519286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmythsandfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmythsandfacts.com"; sid:519287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnature.com"; sid:519288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnba.com"; sid:519289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusncaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusncaa.com"; sid:519290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnecessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnecessities.com"; sid:519291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneedtoknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneedtoknow.com"; sid:519292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsfeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsfeeds.com"; sid:519293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewslive.com"; sid:519294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnetwork.com"; sid:519295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews-update.com"; sid:519296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news-updates.com"; sid:519297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnfl.com"; sid:519298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnhl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnhl.com"; sid:519299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnuevoleon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnuevoleon.com"; sid:519300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomelawyers.com"; sid:519301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnutritiontesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnutritiontesting.com"; sid:519302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ny.com"; sid:519303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnyc.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnyc.today"; sid:519304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficecleaning.com"; sid:519305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoficial.com"; sid:519306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusolution.com"; sid:519307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusomalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusomalia.com"; sid:519308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinebusiness.com"; sid:519309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetutoring.com"; sid:519310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorganica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorganica.com"; sid:519311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorg.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorg.net"; sid:519312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorlando.com"; sid:519313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutpost.com"; sid:519314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pack.com"; sid:519315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic2019.com"; sid:519316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic2020.com"; sid:519317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruspandemic.com"; sid:519318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicinfo.com"; sid:519319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemickit.com"; sid:519320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandemic.net"; sid:519321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicsymptoms.com"; sid:519322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspa.net"; sid:519323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspapertowel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspapertowel.com"; sid:519324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetcure.com"; sid:519325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.photography"; sid:519326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-portugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-portugal.com"; sid:519327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionco.com"; sid:519328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusprevention.com"; sid:519329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.pro"; sid:519330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionstore.com"; sid:519331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproection.com"; sid:519332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofbusiness.com"; sid:519333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionproducts.com"; sid:519334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproviders.com"; sid:519335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestate.net"; sid:519336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefi.com"; sid:519337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefund.com"; sid:519338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefunds.com"; sid:519339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrehab.com"; sid:519340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefloan.com"; sid:519341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremediation.com"; sid:519342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremote.com"; sid:519343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrepair.com"; sid:519344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-reponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-reponse.com"; sid:519345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreponse.com"; sid:519346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresilience.com"; sid:519347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresilient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresilient.com"; sid:519348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourceguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourceguide.com"; sid:519349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresources.net"; sid:519350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponse.net"; sid:519351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusritawilson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusritawilson.com"; sid:519352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrome.com"; sid:519353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusronaldo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusronaldo.com"; sid:519354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrudygobert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrudygobert.com"; sid:519355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-russia.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-russia.today"; sid:519356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrva.com"; sid:519357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafebiz.com"; sid:519358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeproducts.com"; sid:519359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeshop.com"; sid:519360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafestores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafestores.com"; sid:519361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyzone.com"; sid:519362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbabailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbabailout.com"; sid:519363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussba.com"; sid:519364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbahelp.com"; sid:519365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbaloan.com"; sid:519366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbaloans.com"; sid:519367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscam.com"; sid:519368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-scan.com"; sid:519369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruss.com"; sid:519370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecret.com"; sid:519371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-settlement.com"; sid:519372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-settlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-settlements.com"; sid:519373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshelter.com"; sid:519374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopau.com"; sid:519375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopoz.com"; sid:519376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshot.net"; sid:519377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshutdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshutdowns.com"; sid:519378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussixdegrees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussixdegrees.com"; sid:519379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessloan.com"; sid:519380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoccer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoccer.com"; sid:519381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocial.com"; sid:519382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoftware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoftware.net"; sid:519383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusssolutions.com"; sid:519384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstartup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstartup.com"; sid:519385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstaysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstaysafe.com"; sid:519386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stocks.com"; sid:519387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruss.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruss.today"; sid:519388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstoreonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstoreonline.com"; sid:519389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudio.com"; sid:519390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuicide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuicide.com"; sid:519391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.supplies"; sid:519392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesau.com"; sid:519393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesusa.com"; sid:519394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support-group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support-group.com"; sid:519395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvive.com"; sid:519396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivors.com"; sid:519397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustargets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustargets.com"; sid:519398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustatistics.com"; sid:519399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.tax"; sid:519400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustbt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustbt.com"; sid:519401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestaz.com"; sid:519402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.center"; sid:519403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcenter.com"; sid:519404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcenters.com"; sid:519405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingflorida.com"; sid:519406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmiami.com"; sid:519407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testkits.com"; sid:519408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.solutions"; sid:519409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthefullstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthefullstory.com"; sid:519410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-times.com"; sid:519411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoiletpaper.com"; sid:519412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoledo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoledo.com"; sid:519413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustomhanks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustomhanks.com"; sid:519414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustool.com"; sid:519415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustotalstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustotalstoday.com"; sid:519416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustp.com"; sid:519417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackingmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackingmap.com"; sid:519418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-travel.com"; sid:519419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravels.com"; sid:519420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatment2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatment2020.com"; sid:519421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatment.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatment.center"; sid:519422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentcentres.com"; sid:519423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatment.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatment.solutions"; sid:519424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatment.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatment.today"; sid:519425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustsunami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustsunami.com"; sid:519426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustutoring.com"; sid:519427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tx.com"; sid:519428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuhotlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuhotlines.com"; sid:519429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuni.com"; sid:519430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatenews.com"; sid:519431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatesnow.com"; sid:519432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupplies.com"; sid:519433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineupdate.com"; sid:519434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvancouver.com"; sid:519435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusv.com"; sid:519436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideos.com"; sid:519437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.vin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.vin"; sid:519438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashington.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashington.today"; sid:519439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellnesskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellnesskit.com"; sid:519440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswfh.com"; sid:519441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswfhjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswfhjobs.com"; sid:519442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhywhoandwhen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhywhoandwhen.com"; sid:519443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-prevention.com"; sid:519444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitaminc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitaminc.com"; sid:519445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav.net"; sid:519446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorusessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorusessentials.com"; sid:519447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavprep.com"; sid:519448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashington.com"; sid:519449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatch.net"; sid:519450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaway.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaway.net"; sid:519451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawealthreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawealthreport.com"; sid:519452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-what.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-what.com"; sid:519453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhat.com"; sid:519454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawine.com"; sid:519455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawines.com"; sid:519456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawins.com"; sid:519457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawise.com"; sid:519458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoda.com"; sid:519459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazap.com"; sid:519460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazapped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazapped.com"; sid:519461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazilla.com"; sid:519462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazoektbed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazoektbed.com"; sid:519463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazombieapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazombieapocalypse.com"; sid:519464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazoom.com"; sid:519465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countdowncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countdowncoronavirus.com"; sid:519466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for courbe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"courbe-coronavirus.com"; sid:519467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1918.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1918.com"; sid:519468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1920.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1920.com"; sid:519469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-alert.com"; sid:519470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-america.com"; sid:519471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19americas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19americas.com"; sid:519472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19answer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19answer.com"; sid:519473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirus.net"; sid:519474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anxietyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anxietyrelief.com"; sid:519475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apocalypse.com"; sid:519476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19area.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19area.com"; sid:519477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-arizona.com"; sid:519478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arizona.com"; sid:519479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-attorney.com"; sid:519480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-az.com"; sid:519481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19az.com"; sid:519482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baby.com"; sid:519483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barbados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barbados.com"; sid:519484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biocide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biocide.com"; sid:519485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blackbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blackbox.com"; sid:519486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19book.com"; sid:519487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brampton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brampton.com"; sid:519488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breastfeeding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breastfeeding.com"; sid:519489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessdebt.com"; sid:519490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessdebts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessdebts.com"; sid:519491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businesshardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businesshardship.com"; sid:519492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssummit.com"; sid:519493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssummit.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssummit.solutions"; sid:519494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssummit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssummit.today"; sid:519495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buster.com"; sid:519496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buster.com"; sid:519497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19changedmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19changedmylife.com"; sid:519498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19charts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19charts.com"; sid:519499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkup.com"; sid:519500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkupkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkupkit.com"; sid:519501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chronicles.com"; sid:519502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19church.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19church.com"; sid:519503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19church.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19church.net"; sid:519504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanup.com"; sid:519505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clenz.com"; sid:519506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothing.com"; sid:519507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19club.com"; sid:519508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.codes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.codes"; sid:519509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companycare.com"; sid:519510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coping.com"; sid:519511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coverup.com"; sid:519512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crazy.com"; sid:519513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisismanagement.com"; sid:519514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure.center"; sid:519515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19data.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19data.today"; sid:519516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debt.com"; sid:519517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenseproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenseproducts.com"; sid:519518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detect.com"; sid:519519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dialogues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dialogues.com"; sid:519520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19documentary.com"; sid:519521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dr.com"; sid:519522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethru.com"; sid:519523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elderly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elderly.com"; sid:519524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencymanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencymanagement.com"; sid:519525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19escaperoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19escaperoom.com"; sid:519526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19experts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19experts.com"; sid:519527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19express.com"; sid:519528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facemasks.com"; sid:519529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factcheck.com"; sid:519530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facts.net"; sid:519531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-faq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-faq.com"; sid:519532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19filter.com"; sid:519533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filter.com"; sid:519534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flu.net"; sid:519535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flushot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flushot.com"; sid:519536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.club"; sid:519537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freezone.com"; sid:519538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freezones.com"; sid:519539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funding.com"; sid:519540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funds.com"; sid:519541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19funeral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19funeral.com"; sid:519542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19funerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19funerals.com"; sid:519543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19generation.com"; sid:519544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19georgia.com"; sid:519545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalcases.com"; sid:519546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalemployer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalemployer.com"; sid:519547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gotme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gotme.com"; sid:519548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graph.com"; sid:519549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handsoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handsoff.com"; sid:519550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthspray.com"; sid:519551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heatmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heatmap.com"; sid:519552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpers.com"; sid:519553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkit.net"; sid:519554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hub.com"; sid:519555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humanmilk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humanmilk.com"; sid:519556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immune.com"; sid:519557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infocenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infocenter.com"; sid:519558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ino.com"; sid:519559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttest.com"; sid:519560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isahoax.com"; sid:519561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kids.com"; sid:519562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kit.net"; sid:519563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitz.com"; sid:519564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labtest.com"; sid:519565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirm.com"; sid:519566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lawsuit.com"; sid:519567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuit.com"; sid:519568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawsuit.com"; sid:519569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuite.com"; sid:519570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawsuits.com"; sid:519571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitsettlement.com"; sid:519572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19learn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19learn.com"; sid:519573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19learn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19learn.com"; sid:519574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19learn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19learn.net"; sid:519575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lie.com"; sid:519576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19live.com"; sid:519577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livemap.com"; sid:519578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19live.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19live.today"; sid:519579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loan.com"; sid:519580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans.com"; sid:519581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingmanagement.com"; sid:519582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maske.com"; sid:519583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19med.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19med.net"; sid:519584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorial.com"; sid:519585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorial.net"; sid:519586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.net"; sid:519587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memories.com"; sid:519588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-monitor.com"; sid:519589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mythsandfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mythsandfacts.com"; sid:519590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-news.net"; sid:519591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsupdates.com"; sid:519592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newswatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newswatch.com"; sid:519593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noticias.com"; sid:519594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ohio.com"; sid:519595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinetutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinetutoring.com"; sid:519596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orno.com"; sid:519597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreaks.com"; sid:519598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicfund.com"; sid:519599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemic.net"; sid:519600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemic.net"; sid:519601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemie.com"; sid:519602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pe.com"; sid:519603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pets.com"; sid:519604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenix.com"; sid:519605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19physicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19physicians.com"; sid:519606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionkit.com"; sid:519607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionkit.net"; sid:519608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privatesecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privatesecurity.com"; sid:519609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19program.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19program.com"; sid:519610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionproducts.com"; sid:519611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ps.com"; sid:519612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pt.com"; sid:519613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-quarantine.com"; sid:519614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realfacts.com"; sid:519615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recession.com"; sid:519616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-recovery.com"; sid:519617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recovery.com"; sid:519618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registry.com"; sid:519619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-resources.com"; sid:519620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responselogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responselogistics.com"; sid:519621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rrg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rrg.com"; sid:519622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyproducts.com"; sid:519623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safteysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safteysigns.com"; sid:519624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sani.com"; sid:519625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitize.com"; sid:519626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizing.com"; sid:519627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scripts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scripts.com"; sid:519628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19season.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19season.com"; sid:519629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securitymanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securitymanagement.com"; sid:519630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfisolation.com"; sid:519631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfisolators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfisolators.com"; sid:519632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shop.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shop.club"; sid:519633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shop.com"; sid:519634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-soforthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-soforthilfe.com"; sid:519635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soforttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soforttest.com"; sid:519636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidarityresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidarityresponsefund.com"; sid:519637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.today"; sid:519638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stories.com"; sid:519639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.style"; sid:519640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sucks.com"; sid:519641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplystore.com"; sid:519642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survey.com"; sid:519643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survey.net"; sid:519644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surviver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surviver.com"; sid:519645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tales.com"; sid:519646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19targets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19targets.com"; sid:519647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.tax"; sid:519648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.tax"; sid:519649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19telemed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19telemed.com"; sid:519650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemed.com"; sid:519651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinemanagement.com"; sid:519652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinephysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinephysicians.com"; sid:519653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinestaffing.com"; sid:519654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testathome.com"; sid:519655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testaz.com"; sid:519656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcenters.com"; sid:519657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testers.com"; sid:519658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglab.com"; sid:519659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-kit.com"; sid:519660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-kits.com"; sid:519661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19teststrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19teststrips.com"; sid:519662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-themovie.com"; sid:519663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toledo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toledo.com"; sid:519664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tpco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tpco.com"; sid:519665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trakr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trakr.com"; sid:519666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelinsurance.com"; sid:519667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travelkit.com"; sid:519668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelkit.com"; sid:519669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentcenter.com"; sid:519670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentcenters.com"; sid:519671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tripkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tripkit.com"; sid:519672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trump.com"; sid:519673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trump.com"; sid:519674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-truth.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-truth.co.uk"; sid:519675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19truths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19truths.com"; sid:519676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-truth.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-truth.uk"; sid:519677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tshirt.com"; sid:519678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tshirts.com"; sid:519679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tutoring.com"; sid:519680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tv.com"; sid:519681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19undies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19undies.com"; sid:519682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unitedstates.com"; sid:519683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unitedstates.com"; sid:519684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updating.com"; sid:519685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitamins.com"; sid:519686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weareisolated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weareisolated.com"; sid:519687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellness.com"; sid:519688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19world.com"; sid:519689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yearolds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yearolds.com"; sid:519690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zombie.com"; sid:519691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1.com"; sid:519692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019epidemic.com"; sid:519693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-29.com"; sid:519694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4u.com"; sid:519695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid811.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid811.com"; sid:519696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9teen.com"; sid:519697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19.com"; sid:519698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvice.com"; sid:519699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanswers.com"; sid:519700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathome.com"; sid:519701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidayuda.com"; sid:519702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabies.com"; sid:519703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbase.com"; sid:519704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboost.com"; sid:519705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcam.com"; sid:519706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcameras.com"; sid:519707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancellations.com"; sid:519708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcash.com"; sid:519709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcert.com"; sid:519710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchaos.com"; sid:519711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecker.com"; sid:519712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicle.com"; sid:519713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaim.com"; sid:519714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaims.com"; sid:519715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleaners.com"; sid:519716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansed.com"; sid:519717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclenz.com"; sid:519718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanycare.com"; sid:519719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontent.com"; sid:519720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronaupdate.com"; sid:519721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcount.com"; sid:519722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountries.com"; sid:519723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverup.com"; sid:519724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcures.net"; sid:519725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuresusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuresusa.com"; sid:519726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddaily.com"; sid:519727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefence.com"; sid:519728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefender.com"; sid:519729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiary.com"; sid:519730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo20.com"; sid:519731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideodiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideodiary.com"; sid:519732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfighters.com"; sid:519733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-foundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-foundation.com"; sid:519734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoundation.com"; sid:519735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoundation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoundation.net"; sid:519736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.club"; sid:519737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunds.com"; sid:519738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeneration.com"; sid:519739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-global.com"; sid:519740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhall.com"; sid:519741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthkit.com"; sid:519742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomekit.com"; sid:519743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometest.com"; sid:519744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhope.com"; sid:519745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhopes.com"; sid:519746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhub.com"; sid:519747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-intern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-intern.com"; sid:519748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintern.com"; sid:519749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-its-baden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-its-baden.com"; sid:519750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidix.com"; sid:519751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitorial.com"; sid:519752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids.com"; sid:519753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kit.com"; sid:519754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaboratories.com"; sid:519755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaboratory.com"; sid:519756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lawsuit.com"; sid:519757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuits.com"; sid:519758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearn.com"; sid:519759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinks.com"; sid:519760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidltc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidltc.com"; sid:519761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidman.com"; sid:519762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.net"; sid:519763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalstore.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalstore.solutions"; sid:519764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnation.com"; sid:519765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nine-teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nine-teen.com"; sid:519766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotify.com"; sid:519767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnumbers.com"; sid:519768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnurse.com"; sid:519769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnurses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnurses.com"; sid:519770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-onenine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-onenine.com"; sid:519771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorgohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorgohome.com"; sid:519772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutlet.com"; sid:519773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpackage.com"; sid:519774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic2019.com"; sid:519775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pandemie.com"; sid:519776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.party"; sid:519777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatient.com"; sid:519778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeople.com"; sid:519779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-predictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-predictions.com"; sid:519780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepare.com"; sid:519781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotector.com"; sid:519782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealfacts.com"; sid:519783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecord.com"; sid:519784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreports.com"; sid:519785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresources.com"; sid:519786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-respirator.com"; sid:519787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.center"; sid:519788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseplan.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseplan.training"; sid:519789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.solutions"; sid:519790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.support"; sid:519791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.net"; sid:519792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafenow.com"; sid:519793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetykit.com"; sid:519794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitize.com"; sid:519795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscout.com"; sid:519796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreening.com"; sid:519797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.com"; sid:519798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservices.com"; sid:519799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservices.net"; sid:519800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialdistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialdistance.com"; sid:519801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatus.com"; sid:519802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies.net"; sid:519803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurveillance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurveillance.com"; sid:519804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalguide.com"; sid:519805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomchecker.com"; sid:519806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomtracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomtracker.net"; sid:519807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtees.com"; sid:519808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglab.com"; sid:519809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglabs.com"; sid:519810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-kit.com"; sid:519811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelban.com"; sid:519812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrend.com"; sid:519813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtx.com"; sid:519814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictim.com"; sid:519815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictim.net"; sid:519816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimservices.com"; sid:519817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimservices.net"; sid:519818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruspandemic.com"; sid:519819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussurvivalguide.com"; sid:519820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusupdate.com"; sid:519821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvitamins.com"; sid:519822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiki.com"; sid:519823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycoronavirus.com"; sid:519824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for critic-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"critic-pandemic.net"; sid:519825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisebycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisebycoronavirus.com"; sid:519826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid19.com"; sid:519827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptopandemic.com"; sid:519828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curablecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curablecovid19.com"; sid:519829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4covid.com"; sid:519830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronaclub.com"; sid:519831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidpandemic.com"; sid:519832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curemycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curemycoronavirus.com"; sid:519833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingcovid19.com"; sid:519834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currentcoronavirustrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currentcoronavirustrackers.com"; sid:519835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvd19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvd19pandemic.com"; sid:519836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dasarcoronagoblok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dasarcoronagoblok.com"; sid:519837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingintheageofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingintheageofthecoronavirus.com"; sid:519838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealwithcorona.com"; sid:519839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathtocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathtocorona.com"; sid:519840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decameronaitempidelcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decameronaitempidelcovid19.net"; sid:519841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delcoronadoalameda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delcoronadoalameda.com"; sid:519842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid19.com"; sid:519843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarcoronavirus.com"; sid:519844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deteccioncoronavirus.com"; sid:519845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didigetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didigetcoronavirus.com"; sid:519846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diecorona.com"; sid:519847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcoronaguide.com"; sid:519848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discorona.com"; sid:519849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasexcoronavirus.com"; sid:519850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasexcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasexcoronavirusupdates.com"; sid:519851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasexcovid19.com"; sid:519852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasexcovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasexcovid19updates.com"; sid:519853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doestrumphavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doestrumphavecovid.com"; sid:519854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcoronatest.com"; sid:519855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domainpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domainpandemic.com"; sid:519856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethroughcoronavirus.com"; sid:519857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronavirus.com"; sid:519858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronavirustesting.com"; sid:519859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthpandemic.com"; sid:519860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidabella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidabella.com"; sid:519861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronavirustest.com"; sid:519862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicapparel.com"; sid:519863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicbets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicbets.com"; sid:519864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicbox.com"; sid:519865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsforecasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsforecasting.com"; sid:519866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsupplies.com"; sid:519867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicthreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicthreads.com"; sid:519868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicupdate.com"; sid:519869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatingcoronavirus.com"; sid:519870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventbancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventbancorona.com"; sid:519871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evisitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evisitcovid19.com"; sid:519872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evitecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evitecoronavirus.com"; sid:519873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evolution-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evolution-coronavirus.com"; sid:519874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecorona.com"; sid:519875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscorona.com"; sid:519876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscoronacom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscoronacom.com"; sid:519877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouspeoplewithcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouspeoplewithcorona.club"; sid:519878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19now.com"; sid:519879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fighting-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fighting-coronavirus.com"; sid:519880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingthecoronavirus.com"; sid:519881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacureforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacureforcoronavirus.com"; sid:519882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacureforcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacureforcoronavirus.net"; sid:519883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19.com"; sid:519884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcoronanow.com"; sid:519885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkkcorona.com"; sid:519886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flatteningcoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flatteningcoronacurve.com"; sid:519887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruses.com"; sid:519888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruslawyer.com"; sid:519889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flupandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flupandemickit.com"; sid:519890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flycoronavirus.com"; sid:519891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcovid.com"; sid:519892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forumcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forumcorona.com"; sid:519893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecorona.com"; sid:519894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusmask.com"; sid:519895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusscreening.com"; sid:519896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustest.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustest.today"; sid:519897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona.today"; sid:519898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckupcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckupcoronavirus.com"; sid:519899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckupcovid19.com"; sid:519900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid19.com"; sid:519901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid.com"; sid:519902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukcorona.com"; sid:519903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fullcoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fullcoronaprotection.com"; sid:519904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurecorona.com"; sid:519905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxckcoronavirus.com"; sid:519906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearcovid19.com"; sid:519907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcorona.com"; sid:519908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcovid.com"; sid:519909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geopandemic.com"; sid:519910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georigacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georigacoronavirus.com"; sid:519911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georigacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georigacoronaviruslawyer.com"; sid:519912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusinfo.com"; sid:519913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19.com"; sid:519914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getthecovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getthecovid19vaccine.com"; sid:519915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronapandemic.com"; sid:519916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaviruspandemic.com"; sid:519917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidtracking.com"; sid:519918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic-2020.com"; sid:519919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.today"; sid:519920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gloveinthetimeofcorona.com"; sid:519921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.com"; sid:519922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gofundcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gofundcorona.com"; sid:519923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcoronanews.com"; sid:519924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcoronavirusnews.com"; sid:519925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gospelpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gospelpandemic.com"; sid:519926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterhoustoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterhoustoncoronavirus.com"; sid:519927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grocerylistforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grocerylistforapandemic.com"; sid:519928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcovid19.com"; sid:519929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hanxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hanxcorona.com"; sid:519930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hastalavistacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hastalavistacorona.com"; sid:519931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for havecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"havecorona.com"; sid:519932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for health4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"health4corona.com"; sid:519933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthycovid19.com"; sid:519934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hebikcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hebikcorona.com"; sid:519935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid19.com"; sid:519936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpslowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpslowcovid19.com"; sid:519937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbsforcoronavirus.com"; sid:519938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeforcorona.com"; sid:519939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homescoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homescoronavirusfree.com"; sid:519940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homewithcorona.com"; sid:519941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotcoronadeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotcoronadeals.com"; sid:519942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howiovercamecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howiovercamecoronavirus.com"; sid:519943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventcorona.com"; sid:519944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecoronavirus.net"; sid:519945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid19.com"; sid:519946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotreatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotreatcoronavirus.com"; sid:519947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancorona.com"; sid:519948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcorona2020.com"; sid:519949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatthecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatthecoronavirus19.com"; sid:519950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icscovid.com"; sid:519951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcorona2020.com"; sid:519952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcorona.com"; sid:519953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotthecorona.com"; sid:519954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcorona2020.com"; sid:519955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilikecorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilikecorona.club"; sid:519956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid.com"; sid:519957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid-19.com"; sid:519958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocoronavirus2019.com"; sid:519959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacaocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacaocoronavirus.com"; sid:519960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacioncoronavirus.net"; sid:519961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcovid-19.com"; sid:519962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalpandemic.com"; sid:519963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusjustliketheflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusjustliketheflu.com"; sid:519964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecorona.com"; sid:519965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona2020.com"; sid:519966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona.club"; sid:519967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona.net"; sid:519968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19.com"; sid:519969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itwentcoronaviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itwentcoronaviral.com"; sid:519970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecoronavirus.com"; sid:519971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jamucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jamucorona.com"; sid:519972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcpscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcpscorona.com"; sid:519973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joypandemic.com"; sid:519974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jxcorona.com"; sid:519975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid-19.net"; sid:519976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnessintheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnessintheageofcorona.com"; sid:519977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitdeteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitdeteccioncoronavirus.com"; sid:519978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kulturgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kulturgegencorona.com"; sid:519979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronavirus.net"; sid:519980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lethalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lethalcorona.com"; sid:519981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbattlecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbattlecoronavirus.com"; sid:519982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfcorona.com"; sid:519983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letskillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letskillcorona.com"; sid:519984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lexcoronavirus.com"; sid:519985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lickingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lickingcoronavirus.com"; sid:519986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercorona.com"; sid:519987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforecorona.com"; sid:519988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcorona.com"; sid:519989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiarcoronavirus.com"; sid:519990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacoronavirus.com"; sid:519991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezadecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezadecovid19.com"; sid:519992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezascoronavirus.com"; sid:519993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid.com"; sid:519994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livewithoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livewithoutcoronavirus.com"; sid:519995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid19.com"; sid:519996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losttocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losttocoronavirus.com"; sid:519997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisvillecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisvillecorona.com"; sid:519998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.net"; sid:519999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronaviruses.com"; sid:520000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.net"; sid:520001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovid19free.com"; sid:520002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maatregelencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maatregelencoronavirus.com"; sid:520003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madecorona.com"; sid:520004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madecoronavirus.com"; sid:520005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeincoronavirus.com"; sid:520006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marchcoronamadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marchcoronamadness.com"; sid:520007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-coronavirus-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-coronavirus-france.com"; sid:520008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcorona.com"; sid:520009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdlivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdlivecovid-19.com"; sid:520010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdlivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdlivecovid19.com"; sid:520011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdlivecovid-19physicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdlivecovid-19physicians.com"; sid:520012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdlivecovid19physicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdlivecovid19physicians.com"; sid:520013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meds4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meds4covid19.com"; sid:520014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medscovid19.com"; sid:520015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memecoronavirus.com"; sid:520016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mepidemics.com"; sid:520017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirustesting.com"; sid:520018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancorona.com"; sid:520019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitorcoronavirus.com"; sid:520020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moviepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moviepandemic.com"; sid:520021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabox.com"; sid:520022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronarecord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronarecord.com"; sid:520023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronareport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronareport.com"; sid:520024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatestusa.com"; sid:520025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusstory.com"; sid:520026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19kit.com"; sid:520027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidguide.com"; sid:520028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmaskitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmaskitaly.com"; sid:520029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmasksouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmasksouthafrica.com"; sid:520030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19.com"; sid:520031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n99coronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n99coronavirusmasks.com"; sid:520032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nahcorona.com"; sid:520033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcurecovid19.com"; sid:520034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbacorona.com"; sid:520035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncaacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncaacorona.com"; sid:520036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.net"; sid:520037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronanews.com"; sid:520038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscoronavirus.com"; sid:520039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscovid19.com"; sid:520040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newworldpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newworldpandemic2020.com"; sid:520041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newworldpandemic.com"; sid:520042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextcoronavirus.com"; sid:520043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nflcoronaban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nflcoronaban.com"; sid:520044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nflcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nflcorona.com"; sid:520045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nipcovid19.com"; sid:520046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronavirus.com"; sid:520047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nnycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nnycoronavirus.com"; sid:520048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronahere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronahere.com"; sid:520049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaph.com"; sid:520050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronathere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronathere.com"; sid:520051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirus.club"; sid:520052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-corona-virus.com"; sid:520053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacoronavirus.com"; sid:520054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norwegiancoronacruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norwegiancoronacruise.com"; sid:520055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticias-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticias-coronavirus.com"; sid:520056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticovid19.com"; sid:520057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronafacts.com"; sid:520058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruslaw.com"; sid:520059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcovid-19.com"; sid:520060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid-19.com"; sid:520061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oldhamcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oldhamcorona.com"; sid:520062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirustraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirustraining.com"; sid:520063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirustutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirustutoring.com"; sid:520064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid.com"; sid:520065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid.net"; sid:520066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercoronatest.com"; sid:520067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncoronavirusupdate.com"; sid:520068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osservatorio-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osservatorio-coronavirus.com"; sid:520069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osservatorio-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osservatorio-covid19.com"; sid:520070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomecoronavirus.com"; sid:520071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcorona.com"; sid:520072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic20.com"; sid:520073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemically.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemically.com"; sid:520074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-america.com"; sid:520075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbets.com"; sid:520076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboy.com"; sid:520077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessinsurance.com"; sid:520078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccalculator.com"; sid:520079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccloud.com"; sid:520080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccorona.com"; sid:520081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-coronavirus.com"; sid:520082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid.com"; sid:520083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicearth.com"; sid:520084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomics.com"; sid:520085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicengineer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicengineer.com"; sid:520086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicengineers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicengineers.com"; sid:520087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfaq.com"; sid:520088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfun.com"; sid:520089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglobe.com"; sid:520090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsuranceclaims.com"; sid:520091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurance.net"; sid:520092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicist.com"; sid:520093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicists.com"; sid:520094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawyer.com"; sid:520095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawyers.com"; sid:520096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclink.com"; sid:520097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmerch.com"; sid:520098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicof2020.com"; sid:520099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpacks.com"; sid:520100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpalooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpalooza.com"; sid:520101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoems.com"; sid:520102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionkit.com"; sid:520103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofstudios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofstudios.com"; sid:520104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.solutions"; sid:520105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.training"; sid:520106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetysupply.com"; sid:520107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsanity.com"; sid:520108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsanityguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsanityguide.com"; sid:520109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsur.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsur.bid"; sid:520110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurf.com"; sid:520111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthemovie.com"; sid:520112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoken.com"; sid:520113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.tours - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.tours"; sid:520114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvpn.com"; sid:520115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvpn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvpn.net"; sid:520116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiecovid19.com"; sid:520117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiecovid19.net"; sid:520118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracorona.com"; sid:520119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phunthuoccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phunthuoccorona.com"; sid:520120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcoronavirus.com"; sid:520121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcovid19.com"; sid:520122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivepandemicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivepandemicplan.com"; sid:520123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-19.com"; sid:520124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.com"; sid:520125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-19.net"; sid:520126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.com"; sid:520127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.net"; sid:520128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pratacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pratacorona.com"; sid:520129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayercovid19.com"; sid:520130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precoronatp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precoronatp.com"; sid:520131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusoutbreak.com"; sid:520132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productoscoronavirus.com"; sid:520133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacoronavirus.com"; sid:520134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid19.com"; sid:520135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quercetincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quercetincovid-19.com"; sid:520136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quercetinforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quercetinforcoronavirus.com"; sid:520137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quercetinforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quercetinforcovid.com"; sid:520138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronacases.com"; sid:520139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronaviruscases.com"; sid:520140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19.com"; sid:520141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacoronavirus.com"; sid:520142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecorona.com"; sid:520143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecoronavirus.com"; sid:520144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ronacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ronacorona.com"; sid:520145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefromcovid.com"; sid:520146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovid-19.com"; sid:520147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santacorona.com"; sid:520148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayyestocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayyestocorona.com"; sid:520149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacorona.com"; sid:520150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronaloans.com"; sid:520151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirus.com"; sid:520152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloan.com"; sid:520153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloans.com"; sid:520154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusrelief.com"; sid:520155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19.com"; sid:520156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19.com"; sid:520157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloancoronavirus.com"; sid:520158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltest-covid19.com"; sid:520159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltestcovid19.com"; sid:520160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencoronavirus.com"; sid:520161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencovid19.com"; sid:520162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcoronavirus.com"; sid:520163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcovid19.com"; sid:520164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecorona.com"; sid:520165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segurocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segurocoronavirus.com"; sid:520166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcarecoronavirus.com"; sid:520167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcheckcorona.com"; sid:520168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servprocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servprocoronavirus.com"; sid:520169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shelbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shelbycorona.com"; sid:520170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcoronavirus.com"; sid:520171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronamask.com"; sid:520172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopforcorona.com"; sid:520173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for situation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"situation-coronavirus.com"; sid:520174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivealcoronavirus.com"; sid:520175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-corona.com"; sid:520176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid.com"; sid:520177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadcovid.com"; sid:520178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscovid19.com"; sid:520179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickitcorona.com"; sid:520180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcalcovid.com"; sid:520181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcalcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcalcovid.net"; sid:520182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.today"; sid:520183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirusesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirusesnow.com"; sid:520184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirus.net"; sid:520185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthepandemic.com"; sid:520186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadcovid19.com"; sid:520187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesofcoronavirus.com"; sid:520188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for subvencionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"subvencionescoronavirus.com"; sid:520189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suivi-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suivi-coronavirus.com"; sid:520190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethatcorona.com"; sid:520191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamponecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamponecoronavirus.com"; sid:520192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tchcovid.com"; sid:520193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telefonocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telefonocoronavirus.com"; sid:520194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tengoelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tengoelcoronavirus.com"; sid:520195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaathome.com"; sid:520196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testscovid19.com"; sid:520197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thailand-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thailand-coronavirus.com"; sid:520198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020pandemic.com"; sid:520199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronablog.com"; sid:520200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacleaners.com"; sid:520201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacure.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacure.today"; sid:520202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-files.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-files.com"; sid:520203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafree.com"; sid:520204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronageneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronageneration.com"; sid:520205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaparties.com"; sid:520206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasoap.com"; sid:520207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatestkit.com"; sid:520208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona-vaccine.com"; sid:520209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus2020.com"; sid:520210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusband.com"; sid:520211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscookbook.com"; sid:520212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscoverup.com"; sid:520213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnightmare.com"; sid:520214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusonline.com"; sid:520215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusprayer.com"; sid:520216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusprayer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusprayer.net"; sid:520217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussong.com"; sid:520218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustestkit.com"; sid:520219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawar.com"; sid:520220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19chronicles.com"; sid:520221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19group.com"; sid:520222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19memorial.com"; sid:520223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19memorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19memorial.net"; sid:520224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pandemic.net"; sid:520225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19protect.com"; sid:520226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19site.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19site.com"; sid:520227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19site.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19site.com"; sid:520228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid2020.com"; sid:520229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleaners.com"; sid:520230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidflu.com"; sid:520231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmap.com"; sid:520232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtest.com"; sid:520233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecureforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecureforthecoronavirus.com"; sid:520234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelawofpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelawofpandemics.com"; sid:520235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themoviepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themoviepandemic.com"; sid:520236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsite.com"; sid:520237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovid19.com"; sid:520238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcureforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcureforcoronavirus.com"; sid:520239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthoncoronavirus.com"; sid:520240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tienecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tienecoronavirus.com"; sid:520241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeforcorona.com"; sid:520242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tinmoicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tinmoicovid19.com"; sid:520243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipcoronavirus.com"; sid:520244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipscoronavirus.com"; sid:520245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpapercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpapercovid19.com"; sid:520246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankscorona.com"; sid:520247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankscoronavirus.com"; sid:520248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankscovid.com"; sid:520249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankshascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankshascorona.com"; sid:520250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankshascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankshascoronavirus.com"; sid:520251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomhankshascoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomhankshascoronaviruses.com"; sid:520252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamientoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamientoscoronavirus.com"; sid:520253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecoronacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecoronacases.com"; sid:520254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecorona.com"; sid:520255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecoronaviruscases.com"; sid:520256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronavirusmishandling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronavirusmishandling.com"; sid:520257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid19mishandling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid19mishandling.com"; sid:520258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovidmishandling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovidmishandling.com"; sid:520259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcovid-19.com"; sid:520260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulanesphtmcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulanesphtmcovid-19.com"; sid:520261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulanesphtmcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulanesphtmcovid-19.net"; sid:520262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuttosulcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuttosulcorona.com"; sid:520263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uberdoctorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uberdoctorcoronavirus.com"; sid:520264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucsbcovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucsbcovidstudy.com"; sid:520265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for untestedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"untestedcoronavirus.com"; sid:520266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for untestedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"untestedcovid19.com"; sid:520267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatescorona.com"; sid:520268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatesoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatesoncorona.com"; sid:520269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uptodate-coronavirustrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uptodate-coronavirustrackers.com"; sid:520270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgencecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgencecoronavirus.com"; sid:520271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruscovid-19.com"; sid:520272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruscovid19.com"; sid:520273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19.net"; sid:520274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscensuspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscensuspandemic.com"; sid:520275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronamap.com"; sid:520276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscovid-19.com"; sid:520277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscovid19.com"; sid:520278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacationcorona.com"; sid:520279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineforthecoronavirus.com"; sid:520280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralpandemics.com"; sid:520281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronavirusphysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronavirusphysicians.com"; sid:520282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona-covid19.com"; sid:520283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronadrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronadrug.com"; sid:520284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronalive.com"; sid:520285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-covid19.net"; sid:520286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualcovid.com"; sid:520287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitaminscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitaminscovid19.com"; sid:520288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vpnpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vpnpandemic.com"; sid:520289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vpnpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vpnpandemic.net"; sid:520290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid19.com"; sid:520291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecuredcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecuredcovid-19.com"; sid:520292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcovid.com"; sid:520293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivecovid-19.com"; sid:520294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid-19.com"; sid:520295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid19.com"; sid:520296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatisapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatisapandemic.com"; sid:520297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatscorona.com"; sid:520298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatyoucandocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatyoucandocovid.com"; sid:520299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheelcovid19.com"; sid:520300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherescorona.com"; sid:520301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willnotpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willnotpreventcoronavirus.com"; sid:520302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wontpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wontpreventcoronavirus.com"; sid:520303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid-19.com"; sid:520304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19.net"; sid:520305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for writeonwallcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"writeonwallcovid19.com"; sid:520306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanboom.com"; sid:520307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbracelet.com"; sid:520308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancovid19virus.com"; sid:520309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancovid2019.com"; sid:520310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhannmszs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhannmszs.com"; sid:520311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshebao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshebao.com"; sid:520312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwillies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwillies.com"; sid:520313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19.com"; sid:520314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusbelgi-prb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusbelgi-prb.com"; sid:520315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofcorona.com"; sid:520316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofthecorona.com"; sid:520317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yescoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yescoronalove.com"; sid:520318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yocorona20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yocorona20.com"; sid:520319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronacures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronacures.com"; sid:520320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusbarcelona.com"; sid:520321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoyocorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoyocorona2020.com"; sid:520322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoyocorona20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoyocorona20.com"; sid:520323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoyoyocorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoyoyocorona2020.com"; sid:520324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoyoyocorona20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoyoyocorona20.com"; sid:520325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcorona.com"; sid:520326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcorona.net"; sid:520327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocoronavirus.com"; sid:520328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800corona.com"; sid:520329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stcoronatest.com"; sid:520330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2000peoplemourningforcoronadeath.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2000peoplemourningforcoronadeath.exposed"; sid:520331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronasurvivor.com"; sid:520332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020nocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020nocorona.com"; sid:520333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2coronavirus.com"; sid:520334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1corona.com"; sid:520335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abate-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abate-coronavirus.com"; sid:520336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abate-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abate-covid19.com"; sid:520337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-corona.com"; sid:520338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actionagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actionagainstcovid19.com"; sid:520339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actionforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actionforcoronavirus.com"; sid:520340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advicecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advicecoronavirus.com"; sid:520341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid19.com"; sid:520342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid-19.com"; sid:520343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.com"; sid:520344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agacovid19.com"; sid:520345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aicoronavirus.com"; sid:520346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airambulance-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airambulance-covid.net"; sid:520347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajanscorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajanscorona.club"; sid:520348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allegracorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allegracorona.net"; sid:520349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for almazcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"almazcorona.com"; sid:520350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altoalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altoalcoronavirus.com"; sid:520351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americascoronavirus.com"; sid:520352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amourautempsducorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amourautempsducorona.com"; sid:520353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analises-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analises-covid-19.com"; sid:520354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analisescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analisescovid19.com"; sid:520355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona19.com"; sid:520356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona-19.com"; sid:520357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaherbal.com"; sid:520358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaherbals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaherbals.com"; sid:520359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona.life"; sid:520360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaservice.com"; sid:520361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronasocialclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronasocialclub.com"; sid:520362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviris.com"; sid:520363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusclub.com"; sid:520364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus-covid-19.com"; sid:520365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-virus.net"; sid:520366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.world"; sid:520367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19.life"; sid:520368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid9teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid9teen.com"; sid:520369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arhcovid19.com"; sid:520370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atemschutzmasken-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atemschutzmasken-gegen-corona.com"; sid:520371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athenacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athenacovid-19.com"; sid:520372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athenacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athenacovid19.com"; sid:520373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronatesting.com"; sid:520374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustesting.com"; sid:520375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustests.com"; sid:520376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcoronavirus.com"; sid:520377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackcoronavirus.com"; sid:520378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneycoronavirus.com"; sid:520379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for availablecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"availablecoronatest.com"; sid:520380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19.world"; sid:520381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azpandemic.com"; sid:520382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azpandemic.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azpandemic.media"; sid:520383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babiescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babiescovid19.com"; sid:520384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bailoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bailoutcorona.com"; sid:520385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barbequecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barbequecovid-19.com"; sid:520386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbqcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbqcovid-19.com"; sid:520387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcorona.com"; sid:520388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-coronavirus.com"; sid:520389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatscorona.com"; sid:520390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirus.com"; sid:520391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirusready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirusready.com"; sid:520392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidfree.com"; sid:520393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsmart.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsmart.company"; sid:520394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovid.com"; sid:520395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusloan.com"; sid:520396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusloans.com"; sid:520397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencoronavirus.com"; sid:520398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencoronavirusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencoronavirusplan.com"; sid:520399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocovid19.com"; sid:520400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocovid.com"; sid:520401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcoronaviruses.com"; sid:520402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredcorona.com"; sid:520403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidfacts.com"; sid:520404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronasafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronasafety.com"; sid:520405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronatest.com"; sid:520406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19test.com"; sid:520407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebye-corona-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebye-corona-party.com"; sid:520408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecoronaparty.com"; sid:520409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebye-corona-party.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebye-corona-party.net"; sid:520410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecoronaparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecoronaparty.net"; sid:520411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19corona.com"; sid:520412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calgarycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calgarycoronavirus.com"; sid:520413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmwithcorona.com"; sid:520414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmwithcovid.com"; sid:520415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovid.com"; sid:520416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canceledbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canceledbycovid.com"; sid:520417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelledbycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelledbycorona.net"; sid:520418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelledbycorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelledbycorona.wtf"; sid:520419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelledbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelledbycovid.com"; sid:520420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canlicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canlicorona.com"; sid:520421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for care4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"care4corona.com"; sid:520422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carealtorscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carealtorscoronavirus.com"; sid:520423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casescorona.com"; sid:520424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscoronaviruscolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscoronaviruscolombia.com"; sid:520425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscoronavirus.com"; sid:520426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeofcoronavirus.com"; sid:520427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causesofcoronavirus.com"; sid:520428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cautionforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cautionforcorona.com"; sid:520429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cazacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cazacoronavirus.com"; sid:520430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid-19.com"; sid:520431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-coronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-coronafacts.com"; sid:520432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccoronavirustest.com"; sid:520433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritieswithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritieswithcovid19.com"; sid:520434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycoronavirus.com"; sid:520435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirustrainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirustrainer.com"; sid:520436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidresponsefund.com"; sid:520437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidresponsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidresponsefund.net"; sid:520438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciaocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciaocorona.com"; sid:520439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanawaycorona.com"; sid:520440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancoronavirus.solutions"; sid:520441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean-covid19.com"; sid:520442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid-19.com"; sid:520443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronavirus.net"; sid:520444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcovid19.com"; sid:520445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningupcorona.com"; sid:520446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcorona.com"; sid:520447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcovid-19.com"; sid:520448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearancecoronamiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearancecoronamiami.com"; sid:520449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcorona.com"; sid:520450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovid-19bbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovid-19bbq.com"; sid:520451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedbycorona.com"; sid:520452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid.com"; sid:520453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirusmedicalsupplies.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirusmedicalsupplies.company"; sid:520454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegeinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegeinthetimeofcoronavirus.com"; sid:520455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorado-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorado-coronavirus.com"; sid:520456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronavirusnow.com"; sid:520457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcoronavirus.com"; sid:520458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcoronaviruses.com"; sid:520459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comosobreviviralcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comosobreviviralcoronavirus.com"; sid:520460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovid19.com"; sid:520461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquer-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquer-coronavirus.com"; sid:520462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conspiracycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conspiracycoronavirus.com"; sid:520463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracovid19.com"; sid:520464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractsandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractsandcoronavirus.com"; sid:520465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19connect.com"; sid:520466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cure.com"; sid:520467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19fix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19fix.com"; sid:520468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19global.com"; sid:520469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19killer.com"; sid:520470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19movie.com"; sid:520471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19strain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19strain.com"; sid:520472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19strong.com"; sid:520473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19virus.com"; sid:520474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1sttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1sttest.com"; sid:520475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-24.com"; sid:520476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona3d.com"; sid:520477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4president.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4president.com"; sid:520478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-action.com"; sid:520479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaction.com"; sid:520480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvisory.com"; sid:520481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advocaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advocaat.com"; sid:520482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaage.com"; sid:520483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.agency"; sid:520484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaidkit.com"; sid:520485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aid-trade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aid-trade.com"; sid:520486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aktuell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aktuell.com"; sid:520487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandchill.com"; sid:520488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antivirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antivirus.world"; sid:520489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-anwaelte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-anwaelte.com"; sid:520490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apocalypse.com"; sid:520491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapproved.com"; sid:520492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbeitsrecht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbeitsrecht.com"; sid:520493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattacks.com"; sid:520494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaustralia.com"; sid:520495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies.club"; sid:520496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomer.com"; sid:520497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomer.net"; sid:520498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomers.com"; sid:520499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomers.net"; sid:520500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomin.com"; sid:520501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboomin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboomin.net"; sid:520502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy.club"; sid:520503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyclub.com"; sid:520504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-baby.com"; sid:520505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy.net"; sid:520506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyusa.com"; sid:520507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabartontutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabartontutor.com"; sid:520508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabases.com"; sid:520509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeerus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeerus.club"; sid:520510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegone.net"; sid:520511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabelirtileri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabelirtileri.com"; sid:520512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabenefits.com"; sid:520513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beratung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beratung.com"; sid:520514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizloans.com"; sid:520515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablockchain.com"; sid:520516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablocked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablocked.com"; sid:520517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablock.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablock.life"; sid:520518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabloggen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabloggen.com"; sid:520519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabola.com"; sid:520520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabola.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabola.net"; sid:520521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-boomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-boomer.com"; sid:520522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomer.com"; sid:520523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabra.com"; sid:520524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddy.com"; sid:520525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessclaims.com"; sid:520526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessloan.com"; sid:520527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessloans.com"; sid:520528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessloss.com"; sid:520529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslosses.com"; sid:520530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessresilience.com"; sid:520531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.biz"; sid:520532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.world"; sid:520533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacademy.com"; sid:520534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamps.com"; sid:520535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cancelled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cancelled.com"; sid:520536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancer.com"; sid:520537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacandle.com"; sid:520538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapsules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapsules.com"; sid:520539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare2020.com"; sid:520540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaremask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaremask.com"; sid:520541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashnow.com"; sid:520542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasual.com"; sid:520543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation-2020.com"; sid:520544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacdcnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacdcnews.com"; sid:520545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacelebs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacelebs.com"; sid:520546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertification.com"; sid:520547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertificationcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertificationcourse.com"; sid:520548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachan.club"; sid:520549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharity.com"; sid:520550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checker.com"; sid:520551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacia.com"; sid:520552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-claim.com"; sid:520553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactioncase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactioncase.com"; sid:520554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassroom.com"; sid:520555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean4u.com"; sid:520556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanca.com"; sid:520557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleancalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleancalifornia.com"; sid:520558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaned.com"; sid:520559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaners4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaners4u.com"; sid:520560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanflordia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanflordia.com"; sid:520561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.cleaning"; sid:520562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcrew.com"; sid:520563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaning.net"; sid:520564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanky.com"; sid:520565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanllc.com"; sid:520566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannewyork.com"; sid:520567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanny.com"; sid:520568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanpro.com"; sid:520569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansers.com"; sid:520570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansing.com"; sid:520571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleantx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleantx.com"; sid:520572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupcrew.com"; sid:520573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclocks.com"; sid:520574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosings.com"; sid:520575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosingsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosingsnyc.com"; sid:520576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosingsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosingsny.com"; sid:520577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosures.com"; sid:520578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cloud.com"; sid:520579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedyclub.com"; sid:520580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunitycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunitycare.com"; sid:520581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-community.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-community.com"; sid:520582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunityofcaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunityofcaring.com"; sid:520583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compare.com"; sid:520584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompare.com"; sid:520585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompassion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompassion.com"; sid:520586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcern.com"; sid:520587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcious.com"; sid:520588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfirmedcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfirmedcases.com"; sid:520589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contact.com"; sid:520590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainment.net"; sid:520591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacook.com"; sid:520592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacops.com"; sid:520593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoronadontleavemealona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoronadontleavemealona.com"; sid:520594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounselingseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounselingseattle.com"; sid:520595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounselors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounselors.com"; sid:520596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounter.net"; sid:520597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouples.com"; sid:520598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourse.com"; sid:520599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19.net"; sid:520600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19.net"; sid:520601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraze.com"; sid:520602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crazy.com"; sid:520603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazy.net"; sid:520604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-credit.com"; sid:520605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacredits.com"; sid:520606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruisers.com"; sid:520607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuddle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuddle.com"; sid:520608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacupid.com"; sid:520609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuracao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuracao.com"; sid:520610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurefoundation.com"; sid:520611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cure.net"; sid:520612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.world"; sid:520613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacutie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacutie.com"; sid:520614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacyber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacyber.com"; sid:520615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadankorun.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadankorun.net"; sid:520616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadapt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadapt.com"; sid:520617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dashboard.com"; sid:520618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaycalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaycalculator.com"; sid:520619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-day.com"; sid:520620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefend.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefend.agency"; sid:520621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademic.com"; sid:520622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadepression.com"; sid:520623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries.net"; sid:520624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diary.com"; sid:520625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadigitalsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadigitalsummit.com"; sid:520626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiploma.com"; sid:520627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterrelief.com"; sid:520628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterrelief.net"; sid:520629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease19.com"; sid:520630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfection.com"; sid:520631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocumentary.com"; sid:520632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-drive-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-drive-in.com"; sid:520633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrones.com"; sid:520634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadudes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadudes.com"; sid:520635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelection2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelection2020.com"; sid:520636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenvironmentalcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenvironmentalcleaningservices.com"; sid:520637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaescapes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaescapes.com"; sid:520638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ex.com"; sid:520639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexplained.com"; sid:520640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakenews.com"; sid:520641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyplan.com"; sid:520642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyplanning.com"; sid:520643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-faqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-faqs.com"; sid:520644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaqs.com"; sid:520645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafbi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafbi.com"; sid:520646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafearless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafearless.com"; sid:520647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeeds.com"; sid:520648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaferien.schule - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaferien.schule"; sid:520649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.film"; sid:520650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirewall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirewall.com"; sid:520651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafitness.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafitness.world"; sid:520652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafits.com"; sid:520653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafly.com"; sid:520654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafobi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafobi.com"; sid:520655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-folgen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-folgen.com"; sid:520656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafooty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafooty.com"; sid:520657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free.net"; sid:520658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesanitizer.com"; sid:520659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrequencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrequencies.com"; sid:520660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafromhome.com"; sid:520661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundsba.com"; sid:520662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagate2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagate2020.com"; sid:520663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronage.com"; sid:520664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagedon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagedon.com"; sid:520665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagen.com"; sid:520666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-generation.com"; sid:520667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenerations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenerations.com"; sid:520668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagovernmentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagovernmentrelief.com"; sid:520669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahand.com"; sid:520670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandy.com"; sid:520671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahangover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahangover.com"; sid:520672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahat.com"; sid:520673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheals.com"; sid:520674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpsf.com"; sid:520675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.today"; sid:520676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbalmask.com"; sid:520677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheros.com"; sid:520678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.expert"; sid:520679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.net"; sid:520680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahits.com"; sid:520681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholic.com"; sid:520682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecare.com"; sid:520683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomehealth.com"; sid:520684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homeoffice.com"; sid:520685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschool.com"; sid:520686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometestkit.com"; sid:520687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahook.net"; sid:520688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahookup.com"; sid:520689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahookups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahookups.com"; sid:520690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahopehelps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahopehelps.com"; sid:520691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahope.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahope.today"; sid:520692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahorror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahorror.com"; sid:520693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahulp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahulp.com"; sid:520694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahulp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahulp.net"; sid:520695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahumor.com"; sid:520696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygienics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygienics.com"; sid:520697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaillinois.com"; sid:520698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impact.com"; sid:520699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincalifornia.com"; sid:520700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaineurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaineurope.com"; sid:520701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfluenza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfluenza.com"; sid:520702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformatie.com"; sid:520703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnewyork.com"; sid:520704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insanity.com"; sid:520705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsanity.com"; sid:520706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insight.com"; sid:520707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceclaim.com"; sid:520708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceclaims.com"; sid:520709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintheusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintheusa.com"; sid:520710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvaders.com"; sid:520711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisdead.com"; sid:520712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisreal.com"; sid:520713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaissance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaissance.com"; sid:520714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajab.com"; sid:520715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajam.com"; sid:520716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajones.com"; sid:520717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakickstarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakickstarter.com"; sid:520718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kids.com"; sid:520719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kidz.com"; sid:520720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillcount.com"; sid:520721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillcount.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillcount.net"; sid:520722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilledthenba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilledthenba.com"; sid:520723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilledthencaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilledthencaa.com"; sid:520724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilledthenhl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilledthenhl.com"; sid:520725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleanco.com"; sid:520726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-klean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-klean.com"; sid:520727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaklean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaklean.com"; sid:520728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleaning.com"; sid:520729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoozie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoozie.com"; sid:520730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoozies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoozies.com"; sid:520731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kredit.com"; sid:520732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatam.com"; sid:520733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawattorney.com"; sid:520734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleak.com"; sid:520735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearning.com"; sid:520736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearning.net"; sid:520737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lebanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lebanon.com"; sid:520738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalexperts.com"; sid:520739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifesafer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifesafer.com"; sid:520740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitevirus.com"; sid:520741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronallc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronallc.com"; sid:520742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalmaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalmaz.com"; sid:520743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloans.net"; sid:520744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloansusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloansusa.com"; sid:520745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalove.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalove.events"; sid:520746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalypse.com"; sid:520747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamachine.com"; sid:520748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-madness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-madness.com"; sid:520749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanages.com"; sid:520750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanila.com"; sid:520751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamap.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamap.today"; sid:520752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapus.com"; sid:520753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarch.com"; sid:520754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mart.com"; sid:520755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask3.com"; sid:520756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskasap.com"; sid:520757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskofficial.com"; sid:520758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskon.com"; sid:520759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskpro.com"; sid:520760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masque.com"; sid:520761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamassive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamassive.com"; sid:520762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatata.com"; sid:520763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaths.com"; sid:520764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamc.net"; sid:520765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalsupply.com"; sid:520766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicament.com"; sid:520767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meme.com"; sid:520768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerica.com"; sid:520769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameter.net"; sid:520770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametre.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametre.net"; sid:520771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiamidade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiamidade.com"; sid:520772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamist.com"; sid:520773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamitch.com"; sid:520774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamood.com"; sid:520775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamood.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamood.net"; sid:520776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortalityrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortalityrate.com"; sid:520777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamugs.com"; sid:520778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundschutz.com"; sid:520779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanado.com"; sid:520780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronancelled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronancelled.com"; sid:520781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanchill.com"; sid:520782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanets.com"; sid:520783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsar.com"; sid:520784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsny.com"; sid:520785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanl.com"; sid:520786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanorthamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanorthamerica.com"; sid:520787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoway.com"; sid:520788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanuzable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanuzable.com"; sid:520789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanz.com"; sid:520790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlinesummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlinesummit.com"; sid:520791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopinion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopinion.com"; sid:520792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutreach.com"; sid:520793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverview.com"; sid:520794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapackages.com"; sid:520795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapak.com"; sid:520796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalooza.com"; sid:520797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalooza.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalooza.net"; sid:520798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicstore.com"; sid:520799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemictest.com"; sid:520800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayrolltax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayrolltax.com"; sid:520801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaperks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaperks.com"; sid:520802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestcontrol.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestcontrol.biz"; sid:520803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaylists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaylists.com"; sid:520804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaza.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaza.life"; sid:520805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplug.com"; sid:520806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse2020.com"; sid:520807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolicy.com"; sid:520808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapong.com"; sid:520809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaposts.com"; sid:520810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapotion.com"; sid:520811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapotions.com"; sid:520812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapregnancy.com"; sid:520813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepusa.com"; sid:520814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprojections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprojections.com"; sid:520815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofyourbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofyourbusiness.com"; sid:520816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protect.net"; sid:520817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectors.com"; sid:520818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproterctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproterctor.com"; sid:520819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotocolmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotocolmovie.com"; sid:520820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqr.com"; sid:520821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquest.com"; sid:520822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicktest.com"; sid:520823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarama.com"; sid:520824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtestkit.com"; sid:520825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsanwalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsanwalt.com"; sid:520826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.fund"; sid:520827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.loan"; sid:520828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefusa.com"; sid:520829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieve.com"; sid:520830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareplay.com"; sid:520831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareset.com"; sid:520832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarictus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarictus.com"; sid:520833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariculum.com"; sid:520834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ride.com"; sid:520835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroulette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroulette.com"; sid:520836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasa.com"; sid:520837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasadness.com"; sid:520838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasadness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasadness.net"; sid:520839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafebiz.com"; sid:520840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafer.com"; sid:520841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeusa.com"; sid:520842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasatellite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasatellite.com"; sid:520843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbaloan.com"; sid:520844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascams.com"; sid:520845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.school - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.school"; sid:520846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasci.com"; sid:520847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreener.com"; sid:520848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascuties.com"; sid:520849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasd.com"; sid:520850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecrets.com"; sid:520851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashade.com"; sid:520852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashelter.com"; sid:520853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashits.com"; sid:520854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashopper.com"; sid:520855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashred.com"; sid:520856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sickness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sickness.com"; sid:520857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocial.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocial.events"; sid:520858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasong.com"; sid:520859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasound.com"; sid:520860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspore.com"; sid:520861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspores.com"; sid:520862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspraying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspraying.com"; sid:520863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprayingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprayingservice.com"; sid:520864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastats.world"; sid:520865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stem.com"; sid:520866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastem.com"; sid:520867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteria.com"; sid:520868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopers.com"; sid:520869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastores.com"; sid:520870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrengh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrengh.com"; sid:520871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasub.com"; sid:520872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubs.com"; sid:520873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasun.com"; sid:520874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplycenter.com"; sid:520875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplychain.com"; sid:520876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplydepot.com"; sid:520877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupport.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupport.business"; sid:520878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivors2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivors2020.com"; sid:520879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasus.com"; sid:520880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptome.com"; sid:520881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxcredits.com"; sid:520882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxhelp.com"; sid:520883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateach.com"; sid:520884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatechsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatechsupport.com"; sid:520885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateleworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateleworking.com"; sid:520886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemizligi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemizligi.com"; sid:520887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterror.com"; sid:520888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestavailable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestavailable.com"; sid:520889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting.center"; sid:520890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting.net"; sid:520891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingnow.com"; sid:520892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkit.net"; sid:520893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnow.com"; sid:520894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathursday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathursday.com"; sid:520895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatility.com"; sid:520896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatility.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatility.net"; sid:520897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipps.com"; sid:520898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronativ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronativ.com"; sid:520899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronativity.com"; sid:520900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoll.com"; sid:520901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatown.com"; sid:520902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack.net"; sid:520903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trader.com"; sid:520904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrader.com"; sid:520905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrader.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrader.net"; sid:520906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraders.com"; sid:520907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrain.com"; sid:520908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraining.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraining.net"; sid:520909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraitement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraitement.com"; sid:520910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrak.com"; sid:520911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravel.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravel.network"; sid:520912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrench.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrench.com"; sid:520913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrip.com"; sid:520914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronats.com"; sid:520915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatshirts.com"; sid:520916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattack.com"; sid:520917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattacks.com"; sid:520918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauitbraak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauitbraak.com"; sid:520919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates.net"; sid:520920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauprising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauprising.com"; sid:520921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaustralia.com"; sid:520922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.center"; sid:520923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.club"; sid:520924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.today"; sid:520925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccins.com"; sid:520926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaci.com"; sid:520927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacs.com"; sid:520928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavalley.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavalley.life"; sid:520929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavend.com"; sid:520930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.com"; sid:520931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictims.net"; sid:520932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviolence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviolence.com"; sid:520933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavip.com"; sid:520934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir20.com"; sid:520935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralmask.com"; sid:520936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralonline.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralonline.life"; sid:520937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralonline.net"; sid:520938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralonline.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralonline.world"; sid:520939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir.care"; sid:520940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirgin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirgin.com"; sid:520941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirgins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirgins.com"; sid:520942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirrus.com"; sid:520943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus020.com"; sid:520944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19cure.com"; sid:520945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020facts.com"; sid:520946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020olympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020olympics.com"; sid:520947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.pro"; sid:520948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus2020survivor.com"; sid:520949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus301.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus301.com"; sid:520950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus33.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus33.com"; sid:520951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus34.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus34.com"; sid:520952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus39.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus39.com"; sid:520953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus425.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus425.com"; sid:520954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus44.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus44.com"; sid:520955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus49.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus49.com"; sid:520956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus4president.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus4president.com"; sid:520957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus504.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus504.com"; sid:520958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus516.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus516.com"; sid:520959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus561.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus561.com"; sid:520960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus631.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus631.com"; sid:520961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus650.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus650.com"; sid:520962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus817.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus817.com"; sid:520963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus949.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus949.com"; sid:520964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactivities.com"; sid:520965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusahora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusahora.com"; sid:520966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-aktuell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-aktuell.com"; sid:520967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-alarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-alarm.com"; sid:520968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalgerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalgerie.com"; sid:520969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandalucia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandalucia.com"; sid:520970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandbusiness.com"; sid:520971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibacterialgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibacterialgel.com"; sid:520972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-appeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-appeal.com"; sid:520973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusappeal.com"; sid:520974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-askhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-askhr.com"; sid:520975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-assistance.com"; sid:520976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistant.com"; sid:520977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassist.com"; sid:520978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathometest.com"; sid:520979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-australia.com"; sid:520980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautotest.com"; sid:520981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabe.com"; sid:520982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-baseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-baseball.com"; sid:520983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeats.com"; sid:520984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeers.com"; sid:520985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-behandlung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-behandlung.com"; sid:520986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbet.com"; sid:520987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-bg.com"; sid:520988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bg.com"; sid:520989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbible.com"; sid:520990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblocked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblocked.com"; sid:520991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbracket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbracket.com"; sid:520992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrasil.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrasil.net"; sid:520993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbroward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbroward.com"; sid:520994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusters.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusters.co.uk"; sid:520995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusters.org.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusters.org.uk"; sid:520996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuyproductsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuyproductsonline.com"; sid:520997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cancellations.com"; sid:520998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscancer.com"; sid:520999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscelebs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscelebs.com"; sid:521000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertificationcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertificationcourse.com"; sid:521001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschain.com"; sid:521002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschamps.com"; sid:521003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharlesbarkley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharlesbarkley.com"; sid:521004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschat.net"; sid:521005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusclaims.com"; sid:521006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimslawyer.com"; sid:521007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-class-action.com"; sid:521008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactioncom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactioncom.com"; sid:521009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-class-actions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-class-actions.com"; sid:521010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clean.com"; sid:521011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaners.com"; sid:521012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningco.com"; sid:521013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcompanies.com"; sid:521014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.company"; sid:521015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.contractors"; sid:521016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.expert"; sid:521017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningkit.com"; sid:521018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnyc.com"; sid:521019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpro.com"; sid:521020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpros.com"; sid:521021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsolution.com"; sid:521022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.solutions"; sid:521023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsupplies.com"; sid:521024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleansers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleansers.com"; sid:521025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleansing.com"; sid:521026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanup.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanup.biz"; sid:521027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosingsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosingsnyc.com"; sid:521028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosingsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosingsny.com"; sid:521029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosingsnys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosingsnys.com"; sid:521030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothes.com"; sid:521031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.clothing"; sid:521032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.coffee"; sid:521033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollective.com"; sid:521034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcerts.com"; sid:521035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscondition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscondition.com"; sid:521036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfidentialtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfidentialtest.com"; sid:521037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsejos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsejos.com"; sid:521038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontact.com"; sid:521039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscopd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscopd.com"; sid:521040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19pandemicsurvivesurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19pandemicsurvivesurvivalguide.com"; sid:521041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.world"; sid:521042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid2019.com"; sid:521043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrash.net"; sid:521044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.credit"; sid:521045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscredits.com"; sid:521046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrises.com"; sid:521047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-crisis.com"; sid:521048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.biz"; sid:521049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.center"; sid:521050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.life"; sid:521051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurenews.com"; sid:521052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdate.com"; sid:521053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.dating"; sid:521054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathmap.com"; sid:521055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathtotal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathtotal.com"; sid:521056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecals.com"; sid:521057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeconmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeconmiami.com"; sid:521058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationflorida.com"; sid:521059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontamination.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontamination.services"; sid:521060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeduction.com"; sid:521061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefences.com"; sid:521062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusderby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusderby.com"; sid:521063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectionkit.com"; sid:521064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectionkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectionkits.com"; sid:521065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscrimination.com"; sid:521066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfecting.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfecting.services"; sid:521067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonovanmitchell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonovanmitchell.com"; sid:521068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoomsdaycult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoomsdaycult.com"; sid:521069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-emergency-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-emergency-kit.com"; sid:521070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenvironmentalcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenvironmentalcleaners.com"; sid:521071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenvironmentalcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenvironmentalcleaningservices.com"; sid:521072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescleanup.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescleanup.biz"; sid:521073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesestateplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesestateplanning.com"; sid:521074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessymptoms.com"; sid:521075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestateplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestateplanning.com"; sid:521076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesusa.com"; sid:521077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseuro2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseuro2020.com"; sid:521078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexpertsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexpertsecrets.com"; sid:521079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexterminator.com"; sid:521080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusezprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusezprevention.com"; sid:521081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusf1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusf1.com"; sid:521082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacecover.com"; sid:521083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemaskshop.com"; sid:521084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfact.net"; sid:521085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactors.com"; sid:521086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsandfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsandfears.com"; sid:521087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsfiction.com"; sid:521088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsorfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsorfear.com"; sid:521089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaith.com"; sid:521090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfashion.com"; sid:521091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfightback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfightback.com"; sid:521092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirsttest.com"; sid:521093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfixes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfixes.com"; sid:521094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridas.com"; sid:521095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsafety.com"; sid:521096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodservice.com"; sid:521097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.football - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.football"; sid:521098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfootballnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfootballnews.com"; sid:521099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-forever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-forever.com"; sid:521100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforgyms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforgyms.com"; sid:521101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusformula1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusformula1.com"; sid:521102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-france.com"; sid:521103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeplan.com"; sid:521104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree.today"; sid:521105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreevaccine.com"; sid:521106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreezone.com"; sid:521107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreezone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreezone.net"; sid:521108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuck.com"; sid:521109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gear.com"; sid:521110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.gifts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.gifts"; sid:521111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgohome.com"; sid:521112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgolf.com"; sid:521113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-goods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-goods.com"; sid:521114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrocery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrocery.com"; sid:521115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroceryretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroceryretail.com"; sid:521116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroundzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroundzero.com"; sid:521117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.guide"; sid:521118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.guru"; sid:521119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanitizerspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanitizerspray.com"; sid:521120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushands.com"; sid:521121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcoach.com"; sid:521122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthycure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthycure.com"; sid:521123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthycures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthycures.com"; sid:521124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelplineflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelplineflorida.com"; sid:521125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.world"; sid:521126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbal.com"; sid:521127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbalremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbalremedy.com"; sid:521128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbs.net"; sid:521129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushibernation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushibernation.com"; sid:521130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushiv.com"; sid:521131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.holiday"; sid:521132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomesupply.com"; sid:521133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hometest.com"; sid:521134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoops.com"; sid:521135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotelsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotelsafety.com"; sid:521136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushowtomakemoneyincomegetjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushowtomakemoneyincomegetjobs.com"; sid:521137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hr.com"; sid:521138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunity2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunity2020.com"; sid:521139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinarizona.com"; sid:521140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinaz.com"; sid:521141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.biz"; sid:521142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-info-chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-info-chatbot.com"; sid:521143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.expert"; sid:521144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.international"; sid:521145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.report"; sid:521146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationandstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationandstatistics.com"; sid:521147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationcenter.com"; sid:521148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationcenter.net"; sid:521149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.world"; sid:521150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuries.com"; sid:521151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsidejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsidejob.com"; sid:521152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceclaims.com"; sid:521153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.insure"; sid:521154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-irvine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-irvine.com"; sid:521155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisahoax.com"; sid:521156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisolationkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisolationkit.com"; sid:521157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusistight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusistight.com"; sid:521158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusja.com"; sid:521159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjamaica.com"; sid:521160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjesus.com"; sid:521161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskentuckyderby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskentuckyderby.com"; sid:521162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingofbeers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingofbeers.com"; sid:521163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskitchen.com"; sid:521164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskitco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskitco.com"; sid:521165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskit.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskit.team"; sid:521166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskure.com"; sid:521167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskyderby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskyderby.com"; sid:521168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaboratory.com"; sid:521169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaboratorysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaboratorysupplies.com"; sid:521170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabsupplies.com"; sid:521171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatestupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatestupdates.com"; sid:521172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslavageauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslavageauto.com"; sid:521173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslavageautomobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslavageautomobile.com"; sid:521174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawdaily.com"; sid:521175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawsuit.com"; sid:521176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruslawsuits.com"; sid:521177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslevel.com"; sid:521178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.limited - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.limited"; sid:521179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivequarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivequarantine.com"; sid:521180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-loans.com"; sid:521181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslog.com"; sid:521182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslpga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslpga.com"; sid:521183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmacro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmacro.com"; sid:521184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusman.com"; sid:521185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-map.net"; sid:521186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarathon.com"; sid:521187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarathons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarathons.com"; sid:521188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarch.com"; sid:521189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-market.com"; sid:521190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaryland.com"; sid:521191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.life"; sid:521192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskreviews.com"; sid:521193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.world"; sid:521194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskz.com"; sid:521195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasters.com"; sid:521196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-materials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-materials.com"; sid:521197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeasures.com"; sid:521198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedecine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedecine.com"; sid:521199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalhelp.com"; sid:521200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedi.com"; sid:521201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeltdown.com"; sid:521202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmentor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmentor.com"; sid:521203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-miami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-miami.com"; sid:521204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmicro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmicro.com"; sid:521205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilitary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilitary.com"; sid:521206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmls.com"; sid:521207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmma.com"; sid:521208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgages.com"; sid:521209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmovies.com"; sid:521210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyeloma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyeloma.com"; sid:521211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnascar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnascar.com"; sid:521212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnc.com"; sid:521213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ncov2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ncov2019.com"; sid:521214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnetflix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnetflix.com"; sid:521215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewletter.com"; sid:521216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsforyou.com"; sid:521217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.mobi"; sid:521218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusnewsnow.com"; sid:521219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewspakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewspakistan.com"; sid:521220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.world"; sid:521221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnl.com"; sid:521222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnlime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnlime.com"; sid:521223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusny.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusny.net"; sid:521224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffices.com"; sid:521225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusolympics2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusolympics2020.com"; sid:521226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonly.com"; sid:521227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreak.markets - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreak.markets"; sid:521228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreaktees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreaktees.com"; sid:521229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreak.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreak.today"; sid:521230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreakupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreakupdate.com"; sid:521231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspainrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspainrelief.com"; sid:521232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandemia.com"; sid:521233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.life"; sid:521234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemiclive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemiclive.com"; sid:521235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicsurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicsurvivalguide.com"; sid:521236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicsurvivalguide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicsurvivalguide.net"; sid:521237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemictest.com"; sid:521238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicupdate.com"; sid:521239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaper.com"; sid:521240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparty.net"; sid:521241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeoplemeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeoplemeet.com"; sid:521242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjuries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjuries.com"; sid:521243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspga.com"; sid:521244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspgh.com"; sid:521245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspics.com"; sid:521246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaybook.com"; sid:521247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-poland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-poland.com"; sid:521248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspopupclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspopupclinic.com"; sid:521249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prayer.com"; sid:521250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayergroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayergroup.com"; sid:521251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreachers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreachers.com"; sid:521252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspregnancy.com"; sid:521253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspremierleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspremierleague.com"; sid:521254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-preparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-preparedness.com"; sid:521255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepkits.com"; sid:521256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevented.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevented.com"; sid:521257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention2020.com"; sid:521258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.services"; sid:521259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.solutions"; sid:521260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionus.com"; sid:521261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventtesttreatfactsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventtesttreatfactsinfo.com"; sid:521262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprinting.com"; sid:521263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruspro.com"; sid:521264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproductos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproductos.com"; sid:521265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessionals.com"; sid:521266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromise.com"; sid:521267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection101.com"; sid:521268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionsupplies.com"; sid:521269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectivewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectivewear.com"; sid:521270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotocols.com"; sid:521271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantined.com"; sid:521272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantines.com"; sid:521273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquicktesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquicktesting.com"; sid:521274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rates.com"; sid:521275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreagent.com"; sid:521276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreagents.com"; sid:521277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreason.com"; sid:521278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-recession.com"; sid:521279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-relief.com"; sid:521280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.loan"; sid:521281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremede.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremede.com"; sid:521282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremediation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremediation.net"; sid:521283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremedios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremedios.com"; sid:521284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseteam.com"; sid:521285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestoration.com"; sid:521286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrollingstones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrollingstones.com"; sid:521287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrules.com"; sid:521288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyprotection.com"; sid:521289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetys.com"; sid:521290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-saftey-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-saftey-protection.com"; sid:521291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.salon - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.salon"; sid:521292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sa.net"; sid:521293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussa.net"; sid:521294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanfrancisco.com"; sid:521295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanitizer.com"; sid:521296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfquarantine.com"; sid:521297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftestkits.com"; sid:521298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftests.com"; sid:521299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussermons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussermons.com"; sid:521300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshots.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshots.net"; sid:521301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussickleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussickleave.com"; sid:521302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-situation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-situation.com"; sid:521303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoaps.com"; sid:521304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-southkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-southkorea.com"; sid:521305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatisticsandinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatisticsandinformation.com"; sid:521306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stickers.com"; sid:521307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstickers.com"; sid:521308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockmarket.com"; sid:521309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrikes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrikes.com"; sid:521310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussubsidy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussubsidy.com"; sid:521311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyco.com"; sid:521312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-supply.com"; sid:521313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplydepot.com"; sid:521314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalguide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalguide.net"; sid:521315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalsystem.com"; sid:521316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorof2020.com"; sid:521317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswag.com"; sid:521318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruss.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruss.world"; sid:521319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustalk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustalk.net"; sid:521320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustalks.com"; sid:521321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxcredit.com"; sid:521322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxhelp.com"; sid:521323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tee.com"; sid:521324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteledentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteledentistry.com"; sid:521325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestca.com"; sid:521326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.clinic"; sid:521327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestdallas.com"; sid:521328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestdfw.com"; sid:521329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesters.com"; sid:521330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfl.com"; sid:521331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestflorida.com"; sid:521332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingca.com"; sid:521333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcenter.com"; sid:521334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcenters.com"; sid:521335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustesting.com"; sid:521336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingfacilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingfacilities.com"; sid:521337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingfacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingfacility.com"; sid:521338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingfl.com"; sid:521339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingkit.net"; sid:521340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingky.com"; sid:521341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglabs.com"; sid:521342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingla.com"; sid:521343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglocations.com"; sid:521344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmi.com"; sid:521345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnewyork.com"; sid:521346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingny.com"; sid:521347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsupplies.com"; sid:521348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitsmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitsmn.com"; sid:521349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestmichigan.com"; sid:521350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestmi.com"; sid:521351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnearme.com"; sid:521352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnewyork.com"; sid:521353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestny.com"; sid:521354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestprescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestprescription.com"; sid:521355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestresult.com"; sid:521356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsites.com"; sid:521357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestskit.com"; sid:521358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsupplies.com"; sid:521359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesttools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesttools.com"; sid:521360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthefilm.com"; sid:521361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthemovie.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthemovie.world"; sid:521362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthreats.com"; sid:521363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustippingpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustippingpoint.com"; sid:521364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tipps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tipps.com"; sid:521365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tips.com"; sid:521366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoiletries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoiletries.com"; sid:521367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustown.com"; sid:521368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrainingcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrainingcertificate.com"; sid:521369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraining.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraining.net"; sid:521370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraitement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraitement.com"; sid:521371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelban.com"; sid:521372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrudeau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrudeau.com"; sid:521373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-truth.com"; sid:521374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustruth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustruth.net"; sid:521375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustruths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustruths.com"; sid:521376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tshirt.com"; sid:521377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustunisie.com"; sid:521378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustv.com"; sid:521379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuefa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuefa.com"; sid:521380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusufc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusufc.com"; sid:521381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-unitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-unitedstates.com"; sid:521382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatednews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatednews.com"; sid:521383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.today"; sid:521384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususainfo.com"; sid:521385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususainfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususainfo.net"; sid:521386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaloan.com"; sid:521387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaloans.com"; sid:521388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.vacations - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.vacations"; sid:521389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine2020.com"; sid:521390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineinfo.com"; sid:521391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineusa.com"; sid:521392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineus.com"; sid:521393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoiceofreason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoiceofreason.com"; sid:521394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteercorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteercorps.com"; sid:521395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteercorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteercorps.net"; sid:521396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvsflu.com"; sid:521397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvshousekeeping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvshousekeeping.com"; sid:521398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebmd.com"; sid:521399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-whattodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-whattodo.com"; sid:521400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswise.com"; sid:521401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkoutprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkoutprogram.com"; sid:521402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkouts.com"; sid:521403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusww.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusww.com"; sid:521404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswwe.com"; sid:521405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav.life"; sid:521406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlinks.com"; sid:521407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavnews.com"; sid:521408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavnineteen.com"; sid:521409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavnow.com"; sid:521410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavote.com"; sid:521411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijwilligers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijwilligers.com"; sid:521412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsurvivor.com"; sid:521413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavupdates.com"; sid:521414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawager.com"; sid:521415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-walk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-walk.com"; sid:521416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalk.com"; sid:521417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarehouse.com"; sid:521418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatchlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatchlist.com"; sid:521419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaves.com"; sid:521420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhere.com"; sid:521421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawidow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawidow.com"; sid:521422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawidows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawidows.com"; sid:521423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipess.com"; sid:521424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipie.com"; sid:521425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkout.com"; sid:521426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworld.net"; sid:521427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworry.com"; sid:521428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxmas.com"; sid:521429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazappers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazappers.com"; sid:521430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazelftest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazelftest.net"; sid:521431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikadisease.com"; sid:521432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazon.com"; sid:521433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazorg.com"; sid:521434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid191sttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid191sttest.com"; sid:521435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abatement.com"; sid:521436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19africa.com"; sid:521437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ai.com"; sid:521438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alaska.com"; sid:521439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andbusiness.com"; sid:521440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodycheck.com"; sid:521441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibody.com"; sid:521442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytest.com"; sid:521443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19api.com"; sid:521444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apparel.com"; sid:521445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-app.com"; sid:521446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appeal.com"; sid:521447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assitance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assitance.com"; sid:521448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneys.com"; sid:521449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19az.com"; sid:521450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-babies.com"; sid:521451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babies.com"; sid:521452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babyadvice.com"; sid:521453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19baby.com"; sid:521454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19band.com"; sid:521455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19barter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19barter.com"; sid:521456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19base.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19base.com"; sid:521457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bbq.com"; sid:521458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bbq.com"; sid:521459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bendthecurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bendthecurve.com"; sid:521460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19benefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19benefits.com"; sid:521461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bitches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bitches.com"; sid:521462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blackswan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blackswan.com"; sid:521463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bracket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bracket.com"; sid:521464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brand.com"; sid:521465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19business.com"; sid:521466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bythenumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bythenumbers.com"; sid:521467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ca.com"; sid:521468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-canada.com"; sid:521469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canarias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canarias.com"; sid:521470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cancellations.com"; sid:521471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19care.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19care.net"; sid:521472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cast.com"; sid:521473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19central.com"; sid:521474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certification.com"; sid:521475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certificationcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certificationcourse.com"; sid:521476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certified.com"; sid:521477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19champions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19champions.com"; sid:521478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chat.com"; sid:521479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactions.com"; sid:521480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.cleaning"; sid:521481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cleaning.com"; sid:521482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.net"; sid:521483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearance.com"; sid:521484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearanceflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearanceflorida.com"; sid:521485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.clothing"; sid:521486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cn.com"; sid:521487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19co.com"; sid:521488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comms.com"; sid:521489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connect.com"; sid:521490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19containment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19containment.com"; sid:521491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-corona.com"; sid:521492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruspandemic.com"; sid:521493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruspandemic.net"; sid:521494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19course.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19course.com"; sid:521495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19course.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19course.com"; sid:521496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crash.com"; sid:521497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19credits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19credits.com"; sid:521498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cure.life"; sid:521499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curriculum.com"; sid:521500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curve.com"; sid:521501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailyupdates.com"; sid:521502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dashboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dashboards.com"; sid:521503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dc.com"; sid:521504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.deals - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.deals"; sid:521505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathtoll.com"; sid:521506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decon.com"; sid:521507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deconflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deconflorida.com"; sid:521508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deconmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deconmiami.com"; sid:521509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationflorida.com"; sid:521510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diary.com"; sid:521511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19directory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19directory.com"; sid:521512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterrelief.com"; sid:521513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfect.com"; sid:521514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfecting.com"; sid:521515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dontpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dontpanic.com"; sid:521516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19downunder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19downunder.com"; sid:521517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-drums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-drums.com"; sid:521518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earlyalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earlyalert.com"; sid:521519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ed.com"; sid:521520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyflorida.com"; sid:521521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencymiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencymiami.com"; sid:521522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19environment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19environment.com"; sid:521523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ers.com"; sid:521524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19europe.com"; sid:521525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19europe.com"; sid:521526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exchange.com"; sid:521527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19explained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19explained.com"; sid:521528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-facemask.com"; sid:521529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19factsandfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19factsandfears.com"; sid:521530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-facts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-facts.net"; sid:521531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fakenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fakenews.com"; sid:521532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familyplan.com"; sid:521533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fashion.com"; sid:521534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firsttest.com"; sid:521535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fla.com"; sid:521536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fl.com"; sid:521537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19florida.com"; sid:521538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19florida.com"; sid:521539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-free.com"; sid:521540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.net"; sid:521541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freevaccine.com"; sid:521542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fromchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fromchina.com"; sid:521543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fu.com"; sid:521544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fu.com"; sid:521545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gmpcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gmpcleaners.com"; sid:521546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-greece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-greece.com"; sid:521547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19group.com"; sid:521548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19groups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19groups.com"; sid:521549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19growth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19growth.com"; sid:521550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitizers.com"; sid:521551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthadvice.com"; sid:521552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcoach.com"; sid:521553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcoach.com"; sid:521554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.club"; sid:521555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-help.com"; sid:521556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helplineflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helplineflorida.com"; sid:521557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helplinemiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helplinemiami.com"; sid:521558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herbs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herbs.net"; sid:521559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19home.com"; sid:521560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometesting.com"; sid:521561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hope.com"; sid:521562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hq.com"; sid:521563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hrconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hrconsultants.com"; sid:521564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hx.com"; sid:521565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hx.com"; sid:521566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hype.com"; sid:521567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19india.com"; sid:521568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19influenzacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19influenzacleaners.com"; sid:521569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informationcenter.com"; sid:521570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informationcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informationcenter.net"; sid:521571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injection.com"; sid:521572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intel.com"; sid:521573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-intervention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-intervention.com"; sid:521574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intheus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intheus.com"; sid:521575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ishere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ishere.com"; sid:521576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-isolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-isolation.com"; sid:521577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19italy.com"; sid:521578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ja.com"; sid:521579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jamaica.com"; sid:521580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19japan.com"; sid:521581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jesus.com"; sid:521582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jm.com"; sid:521583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19k.com"; sid:521584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k.com"; sid:521585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ke.com"; sid:521586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepitreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepitreal.com"; sid:521587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kh.com"; sid:521588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killers.com"; sid:521589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killers.com"; sid:521590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labtesting.com"; sid:521591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19la.com"; sid:521592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawdaily.com"; sid:521593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lawsuits.com"; sid:521594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuits.com"; sid:521595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawyers.com"; sid:521596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-life.com"; sid:521597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livemaps.com"; sid:521598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livetracker.com"; sid:521599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loan.com"; sid:521600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19log.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19log.com"; sid:521601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19logistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19logistics.com"; sid:521602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ma.com"; sid:521603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manifest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manifest.com"; sid:521604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19manifesto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19manifesto.com"; sid:521605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manifesto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manifesto.com"; sid:521606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19map.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19map.today"; sid:521607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marathon.com"; sid:521608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19march.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19march.com"; sid:521609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-market.com"; sid:521610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mart.com"; sid:521611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mask.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mask.world"; sid:521612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19massive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19massive.com"; sid:521613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19merch.com"; sid:521614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merch.com"; sid:521615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mexico.com"; sid:521616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miami.com"; sid:521617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mi.com"; sid:521618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19money.com"; sid:521619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.movie"; sid:521620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19muhammad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19muhammad.com"; sid:521621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19network.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19network.com"; sid:521622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsblog.com"; sid:521623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nj.com"; sid:521624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nl.com"; sid:521625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nomore.com"; sid:521626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ny.com"; sid:521627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19one.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19one.com"; sid:521628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onesteptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onesteptest.com"; sid:521629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19openings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19openings.com"; sid:521630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreaktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreaktest.com"; sid:521631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pa.com"; sid:521632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemictest.com"; sid:521633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.world"; sid:521634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemie.com"; sid:521635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panel.com"; sid:521636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pettest.com"; sid:521637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharmacy.com"; sid:521638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19planning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19planning.net"; sid:521639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plans.com"; sid:521640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policy.com"; sid:521641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-portugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-portugal.com"; sid:521642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portugal.com"; sid:521643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19posters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19posters.com"; sid:521644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prayer.com"; sid:521645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prayer.com"; sid:521646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pr.com"; sid:521647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prepper.com"; sid:521648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prescription.com"; sid:521649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prescription.com"; sid:521650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prescriptions.com"; sid:521651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prescriptions.com"; sid:521652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pui.com"; sid:521653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qanda.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qanda.net"; sid:521654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantines.com"; sid:521655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radio.com"; sid:521656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reagent.com"; sid:521657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reagents.com"; sid:521658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recon.com"; sid:521659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19removal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19removal.com"; sid:521660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repellent.com"; sid:521661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reserveteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reserveteams.com"; sid:521662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19residency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19residency.com"; sid:521663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsefund.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsefund.mobi"; sid:521664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restrictions.com"; sid:521665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19results.com"; sid:521666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19russia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19russia.com"; sid:521667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.salon - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.salon"; sid:521668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbarelief.com"; sid:521669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbarelief.com"; sid:521670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolclosures.com"; sid:521671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scout.com"; sid:521672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screening.net"; sid:521673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattle.com"; sid:521674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shedding.com"; sid:521675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shirt.com"; sid:521676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sickleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sickleave.com"; sid:521677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sickmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sickmap.com"; sid:521678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sites.com"; sid:521679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19situation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19situation.com"; sid:521680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19socialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19socialdistancing.com"; sid:521681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19soky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19soky.com"; sid:521682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sports.com"; sid:521683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19status.com"; sid:521684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimulus.com"; sid:521685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strain.com"; sid:521686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19study.com"; sid:521687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.net"; sid:521688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivor2020.com"; sid:521689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivorof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivorof2020.com"; sid:521690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorof2020.com"; sid:521691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabkit.com"; sid:521692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabkits.com"; sid:521693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabtest.com"; sid:521694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sx.com"; sid:521695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tales.com"; sid:521696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tellyourstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tellyourstory.com"; sid:521697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.care"; sid:521698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.clinic"; sid:521699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingfacilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingfacilities.com"; sid:521700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingflorida.com"; sid:521701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkit.com"; sid:521702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkits.com"; sid:521703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testinglabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testinglabs.com"; sid:521704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testinglocations.com"; sid:521705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmiami.com"; sid:521706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingsites.com"; sid:521707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testkits.com"; sid:521708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlist.com"; sid:521709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlocations.com"; sid:521710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnearme.com"; sid:521711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testresults.com"; sid:521712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tests.com"; sid:521713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsite.com"; sid:521714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testsites.com"; sid:521715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsites.com"; sid:521716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testskit.com"; sid:521717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thebook.com"; sid:521718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19today.com"; sid:521719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19town.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19town.com"; sid:521720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19track.com"; sid:521721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracking.net"; sid:521722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transparency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transparency.com"; sid:521723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travelban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travelban.com"; sid:521724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travel.com"; sid:521725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treat.com"; sid:521726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-truths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-truths.com"; sid:521727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tshirts.com"; sid:521728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turkey.com"; sid:521729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turkiye.com"; sid:521730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turkiye.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turkiye.net"; sid:521731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ukraine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ukraine.com"; sid:521732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unitedstates.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unitedstates.services"; sid:521733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19university.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19university.com"; sid:521734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-update.com"; sid:521735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-updates.com"; sid:521736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-updates.com"; sid:521737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-usa.com"; sid:521738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.care"; sid:521739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-us.com"; sid:521740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19us.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19us.world"; sid:521741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19utah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19utah.com"; sid:521742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19utah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19utah.com"; sid:521743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ut.com"; sid:521744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccination.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccination.world"; sid:521745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineinfo.com"; sid:521746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.life"; sid:521747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineusa.com"; sid:521748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacination.com"; sid:521749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacines.com"; sid:521750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.ventures"; sid:521751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusattorney.com"; sid:521752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusclean.com"; sid:521753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscleaning.com"; sid:521754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfacts.com"; sid:521755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusinfo.com"; sid:521756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusinformation.com"; sid:521757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruskit.com"; sid:521758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virussymptoms.com"; sid:521759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussymptoms.com"; sid:521760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustestkit.com"; sid:521761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupplies.com"; sid:521762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusvaccine.com"; sid:521763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusvaccines.com"; sid:521764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.world"; sid:521765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wa.com"; sid:521766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wi.com"; sid:521767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplacepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplacepolicy.com"; sid:521768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldtour.com"; sid:521769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019map.com"; sid:521770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019testkit.com"; sid:521771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019testkit.com"; sid:521772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019testkits.com"; sid:521773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.run"; sid:521774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021.com"; sid:521775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-32.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-32.com"; sid:521776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5thyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5thyear.com"; sid:521777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid666.com"; sid:521778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacademic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacademic.com"; sid:521779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidally.com"; sid:521780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandchill.com"; sid:521781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapparel.com"; sid:521782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchive.com"; sid:521783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchives.com"; sid:521784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorney.com"; sid:521785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneys.com"; sid:521786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaby.com"; sid:521787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbible.com"; sid:521788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbitcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbitcoin.com"; sid:521789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackswan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackswan.com"; sid:521790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbluelight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbluelight.com"; sid:521791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboomers.com"; sid:521792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrasil.com"; sid:521793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbtc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbtc.com"; sid:521794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.business"; sid:521795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuster.com"; sid:521796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancelations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancelations.com"; sid:521797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancelled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancelled.com"; sid:521798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-care.com"; sid:521799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcares.com"; sid:521800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cases.com"; sid:521801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcast.com"; sid:521802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcbd.com"; sid:521803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcelebrities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcelebrities.com"; sid:521804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcelebs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcelebs.com"; sid:521805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchallenge.com"; sid:521806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharity.com"; sid:521807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchat.com"; sid:521808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chat.net"; sid:521809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcide.com"; sid:521810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-claims.com"; sid:521811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clean.com"; sid:521812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cleaning"; sid:521813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansing.com"; sid:521814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanup.com"; sid:521815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.clinic"; sid:521816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcloth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcloth.com"; sid:521817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollab.com"; sid:521818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollab.net"; sid:521819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollection.com"; sid:521820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomms.com"; sid:521821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunity.com"; sid:521822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-connect.com"; sid:521823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconomy.com"; sid:521824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consults.com"; sid:521825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontact.com"; sid:521826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-contingency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-contingency.com"; sid:521827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooking.com"; sid:521828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooties.com"; sid:521829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoupon.com"; sid:521830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoupons.com"; sid:521831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovers.com"; sid:521832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazies.com"; sid:521833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-19.com"; sid:521834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd19.com"; sid:521835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd.com"; sid:521836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathcalculator.com"; sid:521837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeduction.com"; sid:521838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diecinueve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diecinueve.com"; sid:521839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrivethru.com"; sid:521840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19vaccination.com"; sid:521841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelection2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelection2020.com"; sid:521842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelection.com"; sid:521843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencykit.com"; sid:521844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemic.net"; sid:521845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemonium.com"; sid:521846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.events"; sid:521847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.expert"; sid:521848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacts.net"; sid:521849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyplan.com"; sid:521850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfestival.com"; sid:521851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.net"; sid:521852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlyconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlyconcerts.com"; sid:521853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.fund"; sid:521854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgames.com"; sid:521855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgive.com"; sid:521856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgone.com"; sid:521857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgotme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgotme.com"; sid:521858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphs.com"; sid:521859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgroup.com"; sid:521860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgroups.com"; sid:521861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-guard.com"; sid:521862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguilt.com"; sid:521863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.guru"; sid:521864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhack.com"; sid:521865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsanitizer.com"; sid:521866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help.com"; sid:521867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherbs.com"; sid:521868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hofstra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hofstra.com"; sid:521869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestkit.com"; sid:521870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhookups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhookups.com"; sid:521871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidim.com"; sid:521872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpact2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpact2020.com"; sid:521873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpact.com"; sid:521874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinc.com"; sid:521875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfection.com"; sid:521876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsider.com"; sid:521877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurance.claims"; sid:521878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintel.com"; sid:521879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidireland.com"; sid:521880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisolationkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisolationkit.com"; sid:521881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-journal.com"; sid:521882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjournal.com"; sid:521883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillawine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillawine.com"; sid:521884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerwine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerwine.com"; sid:521885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lab.com"; sid:521886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawdaily.com"; sid:521887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawfirm.com"; sid:521888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaws.com"; sid:521889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyer.net"; sid:521890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyers.com"; sid:521891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalclaim.com"; sid:521892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalconsulting.com"; sid:521893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidllc.com"; sid:521894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloan.com"; sid:521895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans.com"; sid:521896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans.net"; sid:521897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmadness.com"; sid:521898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.biz"; sid:521899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapper.com"; sid:521900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.today"; sid:521901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketing.com"; sid:521902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatters.com"; sid:521903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemes.com"; sid:521904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorial.com"; sid:521905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorial.net"; sid:521906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmerch.com"; sid:521907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmune.com"; sid:521908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneed.com"; sid:521909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteenvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteenvirus.com"; sid:521910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenvirus.com"; sid:521911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninetees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninetees.com"; sid:521912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonline.com"; sid:521913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinerelief.com"; sid:521914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonly.com"; sid:521915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidout.com"; sid:521916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidovic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidovic.com"; sid:521917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidovich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidovich.com"; sid:521918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic.world"; sid:521919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplaybook.com"; sid:521920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplunge2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplunge2020.com"; sid:521921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplunge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplunge.com"; sid:521922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidporn.com"; sid:521923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidportal.com"; sid:521924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproof.com"; sid:521925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqr.com"; sid:521926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recov.com"; sid:521927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecov.com"; sid:521928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefund.com"; sid:521929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefunds.com"; sid:521930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.expert"; sid:521931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselaw.com"; sid:521932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseplan.com"; sid:521933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.services"; sid:521934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrumors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrumors.com"; sid:521935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsale.com"; sid:521936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitation.com"; sid:521937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaviors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaviors.com"; sid:521938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbaloan.com"; sid:521939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.science"; sid:521940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscure.com"; sid:521941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsign.com"; sid:521942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolve.com"; sid:521943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories.com"; sid:521944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrong.com"; sid:521945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrong.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrong.net"; sid:521946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsubsidy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsubsidy.com"; sid:521947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummit.com"; sid:521948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor.club"; sid:521949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptom.com"; sid:521950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtee.com"; sid:521951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsites.com"; sid:521952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtown.com"; sid:521953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracer.com"; sid:521954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrade19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrade19.com"; sid:521955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.training"; sid:521956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraking.com"; sid:521957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.network"; sid:521958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.university"; sid:521959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprep.com"; sid:521960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruss.com"; sid:521961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustesting.com"; sid:521962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustreatment.com"; sid:521963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusupdates.com"; sid:521964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.world"; sid:521965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteer.com"; sid:521966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteers.com"; sid:521967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvr.com"; sid:521968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwars.com"; sid:521969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwithkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwithkids.com"; sid:521970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworking.com"; sid:521971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkout.com"; sid:521972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidz.com"; sid:521973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzone.com"; sid:521974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crashcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crashcovid.com"; sid:521975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for criminalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"criminalcoronavirus.com"; sid:521976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscorona.com"; sid:521977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisdelcoronavirus.com"; sid:521978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crossovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crossovercorona.com"; sid:521979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdsourcecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdsourcecoronavirus.com"; sid:521980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcoronavirus.com"; sid:521981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid.com"; sid:521982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuarentenacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuarentenacoronavirus.com"; sid:521983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadoscoronavirus.com"; sid:521984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidados-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidados-covid19.com"; sid:521985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curaelcoronavirus.com"; sid:521986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbcorona.com"; sid:521987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbcovid.com"; sid:521988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirus.life"; sid:521989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-covid.com"; sid:521990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureofcoronavirus.com"; sid:521991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureyourcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureyourcoronavirus.com"; sid:521992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingcoronavirus.com"; sid:521993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cybercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cybercorona.com"; sid:521994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronanews.com"; sid:521995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealwithcoronavirus.com"; sid:521996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deconcovid19miami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deconcovid19miami.com"; sid:521997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-corona-virus.com"; sid:521998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-covid-19.com"; sid:521999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronashake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronashake.com"; sid:522000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleancoronavirus.com"; sid:522001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeat-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeat-coronavirus.com"; sid:522002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendcovid19.com"; sid:522003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defenseagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defenseagainstcorona.com"; sid:522004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensecoronavirus.com"; sid:522005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensefromcoronavirus.com"; sid:522006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deletecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deletecoronavirus.com"; sid:522007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccion-coronavirus.com"; sid:522008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus.com"; sid:522009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid-19.com"; sid:522010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroycovid19.com"; sid:522011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnostico-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnostico-coronavirus.com"; sid:522012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diaryofapandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diaryofapandemic.net"; sid:522013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronavirus.com"; sid:522014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronavirus.pro"; sid:522015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronavirus.solutions"; sid:522016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dodgecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dodgecoronavirus.com"; sid:522017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesmorhavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesmorhavecorona.com"; sid:522018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesrachaelrayhavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesrachaelrayhavecoronavirus.com"; sid:522019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-corona.com"; sid:522020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecoronavirustest.com"; sid:522021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-covid19.com"; sid:522022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovid19test.com"; sid:522023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumphascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumphascoronavirus.com"; sid:522024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doodcorona.com"; sid:522025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doordiecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doordiecorona.com"; sid:522026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doordiecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doordiecorona.net"; sid:522027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyourecognizecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyourecognizecorona.com"; sid:522028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drive-thrucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drive-thrucorona.com"; sid:522029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drive-thrucoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drive-thrucoronatest.com"; sid:522030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucovid19.com"; sid:522031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucovid19test.com"; sid:522032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugskillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugskillcoronavirus.com"; sid:522033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dscoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dscoronatime.com"; sid:522034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dxcovid19.com"; sid:522035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid19.com"; sid:522036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronavirusmalta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronavirusmalta.com"; sid:522037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcorona.net"; sid:522038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronaviruses.com"; sid:522039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccentre.com"; sid:522040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccontrolapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccontrolapp.com"; sid:522041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicspread.com"; sid:522042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsurvivalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsurvivalist.com"; sid:522043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiecoronavirus.com"; sid:522044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatecorona.com"; sid:522045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecorona.net"; sid:522046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evadecoronavirus.com"; sid:522047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingcovid19.com"; sid:522048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evitarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evitarcoronavirus.com"; sid:522049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examencoronavirus.com"; sid:522050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecoronavirus.com"; sid:522051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakenewspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakenewspandemic.com"; sid:522052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouspeoplewithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouspeoplewithcoronavirus.com"; sid:522053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouswithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouswithcorona.com"; sid:522054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmacorona.com"; sid:522055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fck-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fck-corona.com"; sid:522056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcorona.com"; sid:522057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcovid19.com"; sid:522058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona-virus.com"; sid:522059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusnews.com"; sid:522060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.today"; sid:522061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid-19.com"; sid:522062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid-19.net"; sid:522063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid19.net"; sid:522064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthecorona.com"; sid:522065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financiallysurvivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financiallysurvivingcovid19.com"; sid:522066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatesting.com"; sid:522067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustest.com"; sid:522068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustesting.com"; sid:522069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustests.com"; sid:522070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findthecoronavirus.com"; sid:522071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcoronatest.com"; sid:522072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for focuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"focuscorona.com"; sid:522073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for focuscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"focuscorona.net"; sid:522074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcorona.com"; sid:522075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcoronavirustesting.com"; sid:522076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcoronavirustestkits.com"; sid:522077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronamasks.com"; sid:522078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronatestkits.com"; sid:522079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronatests.com"; sid:522080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirus.net"; sid:522081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusoffer.com"; sid:522082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusreport.com"; sid:522083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-corona.com"; sid:522084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19.com"; sid:522085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckoffcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckoffcovid-19.com"; sid:522086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckoffcovid19.com"; sid:522087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecorona.com"; sid:522088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.com"; sid:522089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.world"; sid:522090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukucovid.com"; sid:522091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamecovid.com"; sid:522092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearforcoronavirus.com"; sid:522093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsam-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsam-gegen-corona.com"; sid:522094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencorona.com"; sid:522095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19help.com"; sid:522096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19info.com"; sid:522097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19test.com"; sid:522098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19test.com"; sid:522099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19tested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19tested.com"; sid:522100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfacts.com"; sid:522101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfacts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfacts.net"; sid:522102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettoknowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettoknowcoronavirus.com"; sid:522103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givemecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givemecorona.com"; sid:522104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalepidemicstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalepidemicstatus.com"; sid:522105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemiccenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemiccenter.com"; sid:522106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.life"; sid:522107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.world"; sid:522108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronavirustest.com"; sid:522109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godisbiggerthancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godisbiggerthancoronavirus.com"; sid:522110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotyoucovid19.com"; sid:522111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotyoucovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotyoucovid19.net"; sid:522112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotyoucovid.com"; sid:522113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greetingsfromwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greetingsfromwuhan.com"; sid:522114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for habe-ich-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"habe-ich-corona.com"; sid:522115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for habeichcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"habeichcorona.com"; sid:522116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid.com"; sid:522117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hasthecoronavirusdestroyedtheworldyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hasthecoronavirusdestroyedtheworldyet.com"; sid:522118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hasthecovid-19destroyedtheworldyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hasthecovid-19destroyedtheworldyet.com"; sid:522119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcoronaviruses.com"; sid:522120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healfromcorona.com"; sid:522121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healfromcoronavirus.com"; sid:522122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatcovid-19.com"; sid:522123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatcovid19.com"; sid:522124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-corona.com"; sid:522125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecorona.com"; sid:522126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycorona.today"; sid:522127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hgecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hgecovidcare.com"; sid:522128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higienecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higienecoronavirus.com"; sid:522129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofcoronavirus.com"; sid:522130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holacorona.com"; sid:522131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecarecovid19.com"; sid:522132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronatesting.com"; sid:522133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19testing.com"; sid:522134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19testkit.com"; sid:522135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19testkits.com"; sid:522136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitcovid19.com"; sid:522137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeremediescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeremediescoronavirus.com"; sid:522138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeschoolpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeschoolpandemic.com"; sid:522139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcoronavirus.com"; sid:522140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcovid19.com"; sid:522141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingcoronavirus.com"; sid:522142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingcovid19.com"; sid:522143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homewardboundsurvivingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homewardboundsurvivingthecoronavirus.com"; sid:522144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotfreshcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotfreshcoronavirus.com"; sid:522145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housekeepingvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housekeepingvscoronavirus.com"; sid:522146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howthecoronabeginning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howthecoronabeginning.com"; sid:522147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcovid-19.com"; sid:522148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcovid19.com"; sid:522149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcovid-19.net"; sid:522150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcovid19.net"; sid:522151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidthecoronavirus.com"; sid:522152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidthecoronavirus.net"; sid:522153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocombatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocombatcoronavirus.com"; sid:522154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocurewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocurewuhanvirus.com"; sid:522155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoplaythemarketduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoplaythemarketduringcovid19.com"; sid:522156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirus19.com"; sid:522157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansofcoronavirus.com"; sid:522158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansofcovid19.com"; sid:522159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hybridcoronastrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hybridcoronastrain.com"; sid:522160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hybridcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hybridcovid-19.com"; sid:522161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamgoingtodiefromalcoholpoisoningbeforeidiefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamgoingtodiefromalcoholpoisoningbeforeidiefromcorona.com"; sid:522162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamgoingtodiefromalcoholpoisoningbeforeidiefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamgoingtodiefromalcoholpoisoningbeforeidiefromcoronavirus.com"; sid:522163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibuycoronavirushouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibuycoronavirushouses.com"; sid:522164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ididntsurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ididntsurvivethecoronavirus.com"; sid:522165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifcoronadidntkillyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifcoronadidntkillyou.com"; sid:522166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcovid.com"; sid:522167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecoronavirusbecause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecoronavirusbecause.com"; sid:522168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecoronavirus.net"; sid:522169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecovid19because.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecovid19because.com"; sid:522170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecovid19.com"; sid:522171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecoronavirus.net"; sid:522172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilikecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilikecorona.com"; sid:522173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iloveagoodpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iloveagoodpandemic.com"; sid:522174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imacoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imacoronababy.com"; sid:522175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for influenzacovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"influenzacovid19cleaners.com"; sid:522176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19.net"; sid:522177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoforcoronavirus.com"; sid:522178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronatest.com"; sid:522179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronatesting.com"; sid:522180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronavirustesting.com"; sid:522181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insightcovid19.com"; sid:522182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronahelp.com"; sid:522183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronatest.com"; sid:522184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronavirustest.com"; sid:522185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid-19test.com"; sid:522186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusnearme.com"; sid:522187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid-19.com"; sid:522188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19.com"; sid:522189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvidedthewuhanflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvidedthewuhanflu.com"; sid:522190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona2019.com"; sid:522191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronapocalypse2020.com"; sid:522192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronapocalypse.com"; sid:522193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronashirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronashirts.com"; sid:522194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronatee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronatee.com"; sid:522195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.clothing"; sid:522196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusshop.com"; sid:522197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid192020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid192020.net"; sid:522198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.net"; sid:522199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid2020.com"; sid:522200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid2020.world"; sid:522201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthe2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthe2020pandemic.com"; sid:522202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaviruscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaviruscom.com"; sid:522203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaviruses.com"; sid:522204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirus.net"; sid:522205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusof2020.com"; sid:522206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaviruspandemic.com"; sid:522207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19virus.com"; sid:522208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19virus.net"; sid:522209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthepandemic.com"; sid:522210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiasgotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiasgotcovid19.com"; sid:522211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italypandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italypandemic2020.com"; sid:522212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italypandemic.com"; sid:522213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itestedpositiveforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itestedpositiveforcoronavirus.com"; sid:522214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkihavethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkihavethecoronavirus.com"; sid:522215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscovid-19time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscovid-19time.com"; sid:522216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscovid19time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscovid19time.com"; sid:522217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwasthere2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwasthere2020covid19.com"; sid:522218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwastherecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwastherecovid19.com"; sid:522219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwouldratherdieofcoronavirusthangotodetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwouldratherdieofcoronavirusthangotodetroit.com"; sid:522220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwouldratherdieofcoronavirusthanleavedetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwouldratherdieofcoronavirusthanleavedetroit.com"; sid:522221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwouldrathergotodetroitthandieofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwouldrathergotodetroitthandieofthecoronavirus.com"; sid:522222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwouldratherodthandieofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwouldratherodthandieofcoronavirus.com"; sid:522223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwouldratherodthandieofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwouldratherodthandieofthecoronavirus.com"; sid:522224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaisurvecuaucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaisurvecuaucoronavirus.com"; sid:522225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juridischecoronahelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juridischecoronahelpdesk.com"; sid:522226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karmacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karmacorona.com"; sid:522227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcorona.com"; sid:522228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepawaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepawaycoronavirus.com"; sid:522229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepawaycovid.com"; sid:522230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ketocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ketocoronavirus.com"; sid:522231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickthecorona.com"; sid:522232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsbycorona.com"; sid:522233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona.net"; sid:522234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirus19.com"; sid:522235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19atl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19atl.com"; sid:522236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killmycorona.com"; sid:522237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killzcorona.com"; sid:522238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitparacoronavirus.com"; sid:522239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsforcoronavirus.com"; sid:522240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koshercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koshercorona.com"; sid:522241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koshercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koshercoronavirus.com"; sid:522242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koshercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koshercovid19.com"; sid:522243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koshercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koshercovid.com"; sid:522244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamourauxtempsducorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamourauxtempsducorona.com"; sid:522245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavageautocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavageautocoronavirus.com"; sid:522246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavageautomobilecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavageautomobilecoronavirus.com"; sid:522247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laverdaddelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laverdaddelcoronavirus.com"; sid:522248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcorona.com"; sid:522249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawschoolinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawschoolinthetimeofcorona.com"; sid:522250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitscoronavirus.com"; sid:522251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadershipintheageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadershipintheageofcoronavirus.com"; sid:522252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadingintheageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadingintheageofcoronavirus.com"; sid:522253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnaboutcovid19.com"; sid:522254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legal-rights-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legal-rights-corona-virus.com"; sid:522255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalrights-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalrights-coronavirus.com"; sid:522256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcorona.com"; sid:522257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid.com"; sid:522258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcovid-19.com"; sid:522259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19.com"; sid:522260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinpandemic2020.com"; sid:522261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinpandemic.com"; sid:522262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronafree.com"; sid:522263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livepandemics.com"; sid:522264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livepandemics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livepandemics.net"; sid:522265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid.com"; sid:522266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locatecoronavirus.com"; sid:522267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveaftercovid19.com"; sid:522268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecoronavirus.com"; sid:522269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofthecoronavirus.com"; sid:522270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lyftcoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lyftcoronavirusprotection.com"; sid:522271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeamericacoronafreeagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeamericacoronafreeagain.com"; sid:522272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maladiecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maladiecoronavirus.com"; sid:522273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapadelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapadelcoronavirus.com"; sid:522274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapscorona.com"; sid:522275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcoronavirusupdates.com"; sid:522276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascara-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascara-coronavirus.com"; sid:522277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracorona-virus.com"; sid:522278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillas-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillas-covid-19.com"; sid:522279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasproteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasproteccioncoronavirus.com"; sid:522280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcorona.net"; sid:522281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskantiviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskantiviruscovid-19.com"; sid:522282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid19.com"; sid:522283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mastercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mastercorona.com"; sid:522284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicinecorona.com"; sid:522285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid19.com"; sid:522286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetcoronavirus.com"; sid:522287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidcommunity.com"; sid:522288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moorcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moorcorona.net"; sid:522289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaattorney.com"; sid:522290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaattorneys.com"; sid:522291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiaries.com"; sid:522292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiary.com"; sid:522293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronajournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronajournal.com"; sid:522294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalawfirm.com"; sid:522295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalawyer.com"; sid:522296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalawyers.com"; sid:522297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasafemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasafemask.com"; sid:522298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatesting.com"; sid:522299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruses.com"; sid:522300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruslawyer.com"; sid:522301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruslawyers.com"; sid:522302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusnow.com"; sid:522303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.world"; sid:522304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidattorney.com"; sid:522305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidattorneys.com"; sid:522306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhero.com"; sid:522307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlawyer.com"; sid:522308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlawyers.com"; sid:522309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidresponse.com"; sid:522310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfirstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfirstpandemic.com"; sid:522311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95-covid19.com"; sid:522312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacorona.com"; sid:522313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalremedyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalremedyforcoronavirus.com"; sid:522314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronacases.com"; sid:522315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirustest.com"; sid:522316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19.com"; sid:522317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19news.com"; sid:522318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid.com"; sid:522319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newspandemic.com"; sid:522320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcorona.com"; sid:522321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhlcorona.com"; sid:522322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaa.com"; sid:522323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronabeerhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronabeerhere.com"; sid:522324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronamask.com"; sid:522325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirus.life"; sid:522326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidforme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidforme.com"; sid:522327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nopanicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nopanicpandemic.com"; sid:522328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notengocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notengocoronavirus.com"; sid:522329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticias-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticias-covid19.com"; sid:522330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiasdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiasdecoronavirus.com"; sid:522331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notodaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notodaycovid.com"; sid:522332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nottodaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nottodaycoronavirus.com"; sid:522333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirus-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirus-2019.com"; sid:522334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushandsanitizer.com"; sid:522335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusinformationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusinformationcenter.com"; sid:522336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusinformationcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusinformationcenter.net"; sid:522337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelviruscovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelviruscovid19survivor.com"; sid:522338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuzablecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuzablecorona.com"; sid:522339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirusdisinfecting.com"; sid:522340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupycovid19.com"; sid:522341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupycovid19.net"; sid:522342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusinfo.com"; sid:522343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusnews.com"; sid:522344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omgcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omgcorona.com"; sid:522345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcoronashop.com"; sid:522346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirustelemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirustelemedicine.com"; sid:522347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlycorona.com"; sid:522348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncovid.com"; sid:522349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovid.com"; sid:522350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pancovidemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pancovidemonium.com"; sid:522351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.academy"; sid:522352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvantage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvantage.com"; sid:522353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicam.com"; sid:522354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicart.com"; sid:522355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicartschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicartschool.com"; sid:522356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbankruptcy.com"; sid:522357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccenter.com"; sid:522358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchurch.com"; sid:522359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-clothing.com"; sid:522360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoaching.com"; sid:522361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconsultantsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconsultantsgroup.com"; sid:522362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconsultantsinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconsultantsinc.com"; sid:522363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconsultinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconsultinggroup.com"; sid:522364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconsultinginc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconsultinginc.com"; sid:522365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoverage.com"; sid:522366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.events"; sid:522367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforecast.com"; sid:522368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguard.com"; sid:522369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.insure"; sid:522370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickitchen.com"; sid:522371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmall.com"; sid:522372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedicine.com"; sid:522373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnation.com"; sid:522374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpals.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpals.club"; sid:522375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpals.com"; sid:522376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanel.com"; sid:522377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparenting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparenting.net"; sid:522378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpeace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpeace.com"; sid:522379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpedagogy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpedagogy.com"; sid:522380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpodcast2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpodcast2020.com"; sid:522381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpodcasting2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpodcasting2020.com"; sid:522382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpodcasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpodcasting.com"; sid:522383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpracticality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpracticality.com"; sid:522384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpracticality.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpracticality.solutions"; sid:522385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpracticality.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpracticality.today"; sid:522386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproject.com"; sid:522387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresources.net"; sid:522388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.expert"; sid:522389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplan.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplan.expert"; sid:522390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplan.net"; sid:522391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplanning.com"; sid:522392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplanning.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplanning.expert"; sid:522393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplan.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplan.services"; sid:522394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.services"; sid:522395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshirts.com"; sid:522396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshop.net"; sid:522397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsounds.com"; sid:522398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspace.com"; sid:522399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsports.com"; sid:522400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstore.net"; sid:522401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplies.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplies.today"; sid:522402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivas.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivas.bid"; sid:522403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictest.com"; sid:522404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwatch.net"; sid:522405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicpandemic.com"; sid:522406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pausecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pausecorona.com"; sid:522407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paxcorona.com"; sid:522408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplewithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplewithcoronavirus.com"; sid:522409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planningforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planningforpandemic.com"; sid:522410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planningforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planningforpandemics.com"; sid:522411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plungecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plungecovid19.com"; sid:522412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plungecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plungecovid.com"; sid:522413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for politicsoftrumpcoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"politicsoftrumpcoronacurve.com"; sid:522414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivecorona.com"; sid:522415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivitycurescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivitycurescoronavirus.com"; sid:522416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcardfromwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcardfromwuhan.com"; sid:522417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcardsfromwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcardsfromwuhan.com"; sid:522418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaamerica.com"; sid:522419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaeconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaeconomy.com"; sid:522420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayercoronavirus.com"; sid:522421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerforpandemic.com"; sid:522422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayformecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayformecoronavirus.com"; sid:522423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayformecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayformecoronavirus.net"; sid:522424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-corona.com"; sid:522425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepare4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepare4corona.com"; sid:522426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepared-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepared-for-coronavirus.com"; sid:522427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciondecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciondecoronavirus.com"; sid:522428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciondelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciondelcoronavirus.com"; sid:522429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productoscorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productoscorona-virus.com"; sid:522430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productoscoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productoscoronavirusonline.com"; sid:522431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productoscovid.com"; sid:522432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecthomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecthomecorona.com"; sid:522433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegetecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegetecoronavirus.com"; sid:522434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologos-covid19.com"; sid:522435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologoscovid19.com"; sid:522436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychology-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychology-covid19.com"; sid:522437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychologycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychologycovid19.com"; sid:522438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qcorona.com"; sid:522439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocoronavirus.com"; sid:522440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radyocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radyocorona.com"; sid:522441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ravago-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ravago-corona.com"; sid:522442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readcoronavirus.com"; sid:522443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for real-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"real-corona-virus.com"; sid:522444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecorona.com"; sid:522445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovercorona.com"; sid:522446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remediescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remediescoronavirus.com"; sid:522447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remedycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remedycorona.com"; sid:522448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcoronavirus.com"; sid:522449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcovid-19.com"; sid:522450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcovid19.com"; sid:522451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridesharecoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridesharecoronavirusprotection.com"; sid:522452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riocontraocorona.rio - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riocontraocorona.rio"; sid:522453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcorona.com"; sid:522454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runfromcorona.com"; sid:522455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefromcovid19.com"; sid:522456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyfromcorona.com"; sid:522457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycoronatesting.com"; sid:522458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycoronavirustesting.com"; sid:522459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizeragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizeragainstcoronavirus.com"; sid:522460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizercoronavirus.com"; sid:522461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizingagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizingagainstcoronavirus.com"; sid:522462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizingcoronavirus.com"; sid:522463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-coronavirus.com"; sid:522464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-cov-2-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-cov-2-pandemic.com"; sid:522465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocorona.com"; sid:522466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocoronavirus.com"; sid:522467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocoronavirus.world"; sid:522468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronaloan.com"; sid:522469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirus.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirus.loan"; sid:522470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidfunds.com"; sid:522471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidloans.com"; sid:522472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutz-vor-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutz-vor-corona.com"; sid:522473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdworxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdworxcorona.com"; sid:522474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sealcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sealcorona.com"; sid:522475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecorona19.com"; sid:522476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronasurvivor.com"; sid:522477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcoronavirus.com"; sid:522478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcovid19.com"; sid:522479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellcoronafree.com"; sid:522480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for severeacuterespiratorysyndromecoronavirus2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"severeacuterespiratorysyndromecoronavirus2.com"; sid:522481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcovid19solutions.com"; sid:522482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shaham-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shaham-corona.com"; sid:522483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shitcorona.com"; sid:522484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid-19.com"; sid:522485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincoronavirus.net"; sid:522486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaycoronavirus.com"; sid:522487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smcorona.com"; sid:522488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapvscoronavirus.com"; sid:522489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapvscovid19.com"; sid:522490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapvscovid.com"; sid:522491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidarite-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidarite-coronavirus.com"; sid:522492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spacepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spacepandemic.com"; sid:522493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spedaleniguarda-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spedaleniguarda-covid19.com"; sid:522494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotcorona.com"; sid:522495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecovid19testing.com"; sid:522496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafefromcoronavirus.com"; sid:522497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stiricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stiricoronavirus.com"; sid:522498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronarivus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronarivus.com"; sid:522499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirustoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirustoday.com"; sid:522500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaworldwide.com"; sid:522501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightoutofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightoutofwuhan.com"; sid:522502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strikecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strikecoronavirus.com"; sid:522503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strongerthancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strongerthancorona.com"; sid:522504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stuffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stuffcorona.com"; sid:522505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surmodics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surmodics-covid19.com"; sid:522506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirus2020.com"; sid:522507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirusfinancially.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirusfinancially.com"; sid:522508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona2020.com"; sid:522509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona2020.net"; sid:522510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirus2020.com"; sid:522511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirus.net"; sid:522512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecoronavirus.com"; sid:522513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcorona.club"; sid:522514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronaclub.com"; sid:522515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirusfinancially.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirusfinancially.com"; sid:522516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirusquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirusquarantine.com"; sid:522517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19financially.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19financially.com"; sid:522518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcoronavirus2020.com"; sid:522519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcoronavirus2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcoronavirus2020.net"; sid:522520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcoronavirus.com"; sid:522521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcoronavirus.net"; sid:522522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsfromcoronavirus.com"; sid:522523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swabkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swabkitcovid19.com"; sid:522524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacklecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacklecoronavirus.com"; sid:522525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taylorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taylorcovid19.com"; sid:522526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tehillim-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tehillim-against-corona.com"; sid:522527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tejascovido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tejascovido.com"; sid:522528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teletrabajocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teletrabajocoronavirus.com"; sid:522529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teletravail-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teletravail-coronavirus.com"; sid:522530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellacoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellacoronavirusstory.com"; sid:522531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminatecoronavirus.com"; sid:522532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testathomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testathomecoronavirus.com"; sid:522533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronanow.com"; sid:522534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaonline.com"; sid:522535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronashop.com"; sid:522536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-coronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-coronaviruss.com"; sid:522537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaweb.com"; sid:522538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdecoronavirus.com"; sid:522539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdeteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdeteccioncoronavirus.com"; sid:522540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid-19.com"; sid:522541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcoronamiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcoronamiami.com"; sid:522542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcoronavirusflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcoronavirusflorida.com"; sid:522543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitscoronavirus.com"; sid:522544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmeforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmeforcovid19.com"; sid:522545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-nacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-nacoronavirus.com"; sid:522546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsforcoronavirus.com"; sid:522547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsforcovid-19.com"; sid:522548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyouchinaforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyouchinaforcovid19.com"; sid:522549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcorona.com"; sid:522550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020coronavirus.com"; sid:522551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona2020.com"; sid:522552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaattorney.com"; sid:522553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaattorneys.com"; sid:522554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachallenge.com"; sid:522555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconspiracy.com"; sid:522556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahoax.com"; sid:522557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaissance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaissance.com"; sid:522558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalawsuit.com"; sid:522559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalawyer.com"; sid:522560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalawyers.com"; sid:522561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaloans.com"; sid:522562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.net"; sid:522563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapack.com"; sid:522564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapocalypse.com"; sid:522565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaprotocol.com"; sid:522566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatime.com"; sid:522567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatimes.com"; sid:522568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaverse.com"; sid:522569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusaustralia.com"; sid:522570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscriminals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscriminals.com"; sid:522571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscure2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscure2020.com"; sid:522572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscure2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscure2020.net"; sid:522573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusepidemic.com"; sid:522574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushomeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushomeschool.com"; sid:522575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusinfection.com"; sid:522576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawfirm.com"; sid:522577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawsuit.com"; sid:522578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslitigation.com"; sid:522579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus-reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus-reports.com"; sid:522580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusshow.com"; sid:522581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusstats.com"; sid:522582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswebsite.com"; sid:522583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19facts.com"; sid:522584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19movie.com"; sid:522585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19report.com"; sid:522586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidattorney.com"; sid:522587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidattorneys.com"; sid:522588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcases.com"; sid:522589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclean.com"; sid:522590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlawyer.com"; sid:522591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlawyers.com"; sid:522592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshopper.com"; sid:522593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidvaccine.com"; sid:522594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecurecoronavirus.com"; sid:522595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemickitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemickitchen.com"; sid:522596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicmovie.com"; sid:522597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemic.net"; sid:522598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcoronavirus.com"; sid:522599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-wuhan-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-wuhan-flu.com"; sid:522600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiscorona.com"; sid:522601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiscoronavirus.com"; sid:522602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpaperpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpaperpandemic.com"; sid:522603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronaprotection.com"; sid:522604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronavirus.com"; sid:522605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcorona.life"; sid:522606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for track-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"track-covid19.com"; sid:522607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidla.com"; sid:522608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tradingthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tradingthroughcoronavirus.com"; sid:522609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tradingthroughcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tradingthroughcovid-19.com"; sid:522610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tradingthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tradingthroughcovid19.com"; sid:522611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcoronanow.com"; sid:522612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treat-covid19.com"; sid:522613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-has-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-has-coronavirus.com"; sid:522614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthcoronavirus.com"; sid:522615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubercoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubercoronavirusprotection.com"; sid:522616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucorona.com"; sid:522617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uelcontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uelcontracoronavirus.com"; sid:522618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedwaycovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedwaycovidfund.com"; sid:522619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronamap.com"; sid:522620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusvaccine.com"; sid:522621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19coronavirus.com"; sid:522622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19coronavirus.com"; sid:522623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemic.com"; sid:522624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronafacts.com"; sid:522625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirus.net"; sid:522626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirustesting.com"; sid:522627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemic2020.com"; sid:522628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcorona.com"; sid:522629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uzielcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uzielcorona.com"; sid:522630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccincorona.com"; sid:522631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccincoronavirus.com"; sid:522632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacoronafacts.com"; sid:522633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencealcoronavirus.com"; sid:522634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verificadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verificadocoronavirus.com"; sid:522635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vetsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vetsagainstcoronavirus.com"; sid:522636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viagracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viagracorona.com"; sid:522637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronacure.com"; sid:522638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronavaccin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronavaccin.com"; sid:522639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronavaccine.com"; sid:522640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitsipcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitsipcoronaclean.com"; sid:522641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitsipcoronadefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitsipcoronadefence.com"; sid:522642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitsipcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitsipcoronarelief.com"; sid:522643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerforcoronavirus.com"; sid:522644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerforcoronavirushawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerforcoronavirushawaii.com"; sid:522645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voxcorona.com"; sid:522646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearingthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearingthecorona.com"; sid:522647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcorona.com"; sid:522648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webuycoronavirushouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webuycoronavirushouses.com"; sid:522649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleancovid19.com"; sid:522650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcoronavirus.com"; sid:522651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcovid19.com"; sid:522652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehatecoronavirus.com"; sid:522653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronavirus2020.com"; sid:522654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronavirus2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronavirus2020.net"; sid:522655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronavirus.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronavirus.clothing"; sid:522656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedthecoronavirus.com"; sid:522657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wfh-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wfh-covid19.com"; sid:522658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatthecoronavirus.com"; sid:522659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoaboutcovid19.com"; sid:522660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattoknowaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattoknowaboutcoronavirus.com"; sid:522661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereyoubeencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereyoubeencovid19.com"; sid:522662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocausedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocausedcoronavirus.com"; sid:522663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whogotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whogotcovid19.com"; sid:522664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoiscorona.com"; sid:522665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcoronakillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcoronakillme.com"; sid:522666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willigetthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willigetthecoronavirus.com"; sid:522667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutcoronavirus.com"; sid:522668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutcovid.com"; sid:522669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-of-coronavirus.com"; sid:522670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemics.com"; sid:522671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchicken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchicken.com"; sid:522672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchinacovid19.com"; sid:522673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanflusurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanflusurvivor.com"; sid:522674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpandemic2020.com"; sid:522675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpool.com"; sid:522676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpools.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpools.net"; sid:522677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusfromchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusfromchina.com"; sid:522678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus.life"; sid:522679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusvaccines.com"; sid:522680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronalawyer.com"; sid:522681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronalawyers.com"; sid:522682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronaflle-w5a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronaflle-w5a.com"; sid:522683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirus-quarantne-o2b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirus-quarantne-o2b.com"; sid:522684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yocogicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yocogicoronavirus.com"; sid:522685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yonotengocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yonotengocoronavirus.com"; sid:522686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusattorney.com"; sid:522687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaviruslawyer.com"; sid:522688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaviruslawyers.com"; sid:522689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zcorona.com"; sid:522690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronageddon.com"; sid:522691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronapocalypse.com"; sid:522692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicsurvivor.com"; sid:522693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20secondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20secondcorona.com"; sid:522694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abccoronavirus.com"; sid:522695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcoronaviruses.com"; sid:522696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcoronavirus.net"; sid:522697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronageddon.com"; sid:522698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronapocalypse.com"; sid:522699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronaviruscure.com"; sid:522700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid-19stateofmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid-19stateofmind.com"; sid:522701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualizacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualizacioncovid19.com"; sid:522702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adanacoronailaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adanacoronailaclama.com"; sid:522703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaparty.com"; sid:522704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirusparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirusparty.com"; sid:522705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidparty.com"; sid:522706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-covid19.com"; sid:522707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovid.com"; sid:522708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcoronavirus.com"; sid:522709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbornecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbornecoronavirus.com"; sid:522710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbornecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbornecovid19.com"; sid:522711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aiuticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aiuticoronavirus.com"; sid:522712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovid19.com"; sid:522713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alavistacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alavistacorona.com"; sid:522714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcovid.com"; sid:522715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcovid.net"; sid:522716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allclearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allclearcovid19.com"; sid:522717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingscoronavirus.com"; sid:522718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingscoronavirus.net"; sid:522719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amicorona.com"; sid:522720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amigonnadiefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amigonnadiefromcoronavirus.com"; sid:522721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ammenda-coronavirus-oblazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ammenda-coronavirus-oblazione.com"; sid:522722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafilter.com"; sid:522723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviral.com"; sid:522724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.cloud"; sid:522725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusdrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusdrugs.com"; sid:522726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusmovie.com"; sid:522727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirustechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirustechnology.com"; sid:522728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirustechnology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirustechnology.net"; sid:522729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirustienda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirustienda.com"; sid:522730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirustips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirustips.com"; sid:522731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti--covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti--covid.com"; sid:522732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidshop.com"; sid:522733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidstore.com"; sid:522734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidunit.com"; sid:522735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscoronacovid19maskmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscoronacovid19maskmedical.com"; sid:522736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid-19.com"; sid:522737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apollocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apollocovid19.com"; sid:522738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apoyomutuocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apoyomutuocovid.com"; sid:522739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovid19.com"; sid:522740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asapcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asapcoronavirus.com"; sid:522741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ashevillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ashevillecoronavirus.com"; sid:522742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurance-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurance-coronavirus.com"; sid:522743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurancecoronavirus.com"; sid:522744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aycorona.com"; sid:522745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aycorona.net"; sid:522746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayecorona.com"; sid:522747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronavirus19.com"; sid:522748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19tees.com"; sid:522749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidpa.com"; sid:522750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidtogether.com"; sid:522751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcovid19.com"; sid:522752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcovid.com"; sid:522753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcorona.com"; sid:522754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsmart.com"; sid:522755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bergencoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bergencoronatest.com"; sid:522756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronatest.com"; sid:522757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betoncoronavirus.com"; sid:522758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioreco-protection-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioreco-protection-coronavirus.com"; sid:522759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blmcovid19.com"; sid:522760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasilcoronavirus.com"; sid:522761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakpointeandcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakpointeandcoronado.com"; sid:522762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business-facebook-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business-facebook-covid19.com"; sid:522763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronatests.com"; sid:522764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruskit.com"; sid:522765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirustest.com"; sid:522766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirustests.com"; sid:522767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidpen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidpen.com"; sid:522768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabincoronafever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabincoronafever.com"; sid:522769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronaviruscleaner.com"; sid:522770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronaviruscleaners.com"; sid:522771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruscleaners.com"; sid:522772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruslaw.com"; sid:522773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruspro.com"; sid:522774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19injury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19injury.com"; sid:522775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidlaw.com"; sid:522776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidlawyer.com"; sid:522777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovid-19.com"; sid:522778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovid19.com"; sid:522779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canceledbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canceledbycorona.com"; sid:522780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcorona.com"; sid:522781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcoronavirus.com"; sid:522782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcovid-19.com"; sid:522783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcovid19.com"; sid:522784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canigetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canigetcoronavirus.com"; sid:522785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for care4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"care4covid.com"; sid:522786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careclixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careclixcovid.com"; sid:522787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carolinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carolinacovid19.com"; sid:522788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casosdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casosdecoronavirus.com"; sid:522789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for castlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"castlecorona.com"; sid:522790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdforcorona.com"; sid:522791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdcquickswabtestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdcquickswabtestcoronavirus.com"; sid:522792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebswithcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebswithcoronavirus.club"; sid:522793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronafreedeliverydrivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronafreedeliverydrivers.com"; sid:522794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19free.com"; sid:522795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19freedeliverydrivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19freedeliverydrivers.com"; sid:522796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengewithcorona.com"; sid:522797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chase7-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chase7-covid.com"; sid:522798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chestercountycovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chestercountycovid19responsefund.com"; sid:522799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19responsefund.com"; sid:522800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19responsefund.net"; sid:522801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofcorona.com"; sid:522802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofthecovid.com"; sid:522803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinawuhancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinawuhancoronavirus.com"; sid:522804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccorona.com"; sid:522805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcoronavirushelp.com"; sid:522806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencovid.com"; sid:522807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcorona.com"; sid:522808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcoronavirus.com"; sid:522809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcovid19.com"; sid:522810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovid19.com"; sid:522811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for club-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"club-corona.com"; sid:522812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronacuremedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronacuremedicalsupplies.com"; sid:522813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronamedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronamedicalsupplies.com"; sid:522814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirusmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirusmedical.com"; sid:522815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocorona-virusmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocorona-virusmedicalsupplies.com"; sid:522816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirusmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirusmedicalsupplies.com"; sid:522817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirusmedicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirusmedicalsupply.com"; sid:522818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirusmedsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirusmedsupply.com"; sid:522819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirussolutions.com"; sid:522820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirussupplies.com"; sid:522821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronamedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronamedicalsupplies.com"; sid:522822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusmedical.com"; sid:522823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusmedicalsupplies.com"; sid:522824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusmedicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusmedicalsupply.com"; sid:522825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusservice.com"; sid:522826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusservices.com"; sid:522827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirussolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirussolution.com"; sid:522828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirussolutions.com"; sid:522829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirussupplies.com"; sid:522830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovid19.com"; sid:522831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronavirustoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronavirustoday.com"; sid:522832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcoronadisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcoronadisinfecting.com"; sid:522833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsenseandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsenseandcoronavirus.com"; sid:522834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsenseandcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsenseandcoronavirus.net"; sid:522835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionatecovid.com"; sid:522836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassioncovid19.com"; sid:522837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassioncovid.com"; sid:522838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionforcovid19.com"; sid:522839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcovid19.com"; sid:522840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingincovid19.com"; sid:522841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingwhilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingwhilecorona.com"; sid:522842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid.com"; sid:522843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcovid.com"; sid:522844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingthroughcorona.com"; sid:522845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid19.com"; sid:522846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19cure.com"; sid:522847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-france.com"; sid:522848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-info.com"; sid:522849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19news.com"; sid:522850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19safemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19safemask.com"; sid:522851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19survivor.com"; sid:522852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19survivor.net"; sid:522853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19test.com"; sid:522854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19testing.com"; sid:522855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020gear.com"; sid:522856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-2020.net"; sid:522857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona313.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona313.com"; sid:522858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabout.com"; sid:522859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactionplan.com"; sid:522860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvocaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvocaat.com"; sid:522861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaageddon.com"; sid:522862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaide.com"; sid:522863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairlines.com"; sid:522864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaampworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaampworks.com"; sid:522865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandcancer.com"; sid:522866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus.club"; sid:522867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantiviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantiviruss.com"; sid:522868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapparel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapparel.net"; sid:522869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ar.com"; sid:522870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasia.com"; sid:522871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-away.com"; sid:522872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-babies.com"; sid:522873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiess.com"; sid:522874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababys.com"; sid:522875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyshop.com"; sid:522876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabayou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabayou.com"; sid:522877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.bet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.bet"; sid:522878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabi.com"; sid:522879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiddokeskepri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiddokeskepri.com"; sid:522880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabi.net"; sid:522881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirusnewsnow.com"; sid:522882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboards.com"; sid:522883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabolona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabolona.com"; sid:522884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-boom.com"; sid:522885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabored.com"; sid:522886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboredom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboredom.com"; sid:522887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrewery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrewery.com"; sid:522888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrewing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrewing.com"; sid:522889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabro.com"; sid:522890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabugzapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabugzapper.com"; sid:522891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabutt.com"; sid:522892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalmprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalmprogram.com"; sid:522893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamping.com"; sid:522894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cannabis.com"; sid:522895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanon.com"; sid:522896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanvas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanvas.com"; sid:522897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarebox.com"; sid:522898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecard.com"; sid:522899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarefl.com"; sid:522900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareflorida.com"; sid:522901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaretaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaretaker.com"; sid:522902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cases.com"; sid:522903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacastlechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacastlechallenge.com"; sid:522904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-castle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-castle.com"; sid:522905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacastle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacastle.com"; sid:522906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-castles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-castles.com"; sid:522907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacastles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacastles.com"; sid:522908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacease.com"; sid:522909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-center.com"; sid:522910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachat.net"; sid:522911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckit.com"; sid:522912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachild.com"; sid:522913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles.world"; sid:522914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-church.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-church.com"; sid:522915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-church.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-church.net"; sid:522916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirusnews.com"; sid:522917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirusnewsnow.com"; sid:522918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimco.com"; sid:522919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclarity.com"; sid:522920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclass2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclass2020.com"; sid:522921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclass.net"; sid:522922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaus.com"; sid:522923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanair.com"; sid:522924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleancouriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleancouriers.com"; sid:522925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaners.com"; sid:522926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningco.com"; sid:522927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningdocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningdocs.com"; sid:522928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningdoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningdoctors.com"; sid:522929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanit.com"; sid:522930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleanup.com"; sid:522931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclientupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclientupdate.com"; sid:522932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclout.com"; sid:522933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.club"; sid:522934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclypse.com"; sid:522935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coach.com"; sid:522936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffeenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffeenyc.com"; sid:522937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffeeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffeeusa.com"; sid:522938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollection.com"; sid:522939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomeup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomeup.com"; sid:522940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommon.com"; sid:522941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanions.com"; sid:522942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfessions.com"; sid:522943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfront.com"; sid:522944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconqueror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconqueror.com"; sid:522945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconspiracies.com"; sid:522946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrolshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrolshop.com"; sid:522947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacootiecatcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacootiecatcher.com"; sid:522948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorps.com"; sid:522949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacount.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacount.life"; sid:522950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacount.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacount.net"; sid:522951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-courier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-courier.com"; sid:522952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverage.com"; sid:522953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19test.com"; sid:522954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19-vaccine.com"; sid:522955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidinfo.com"; sid:522956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidnews.com"; sid:522957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidtest.com"; sid:522958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidvirus.com"; sid:522959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidvirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidvirustest.com"; sid:522960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-craft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-craft.com"; sid:522961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrashes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrashes.com"; sid:522962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crises.com"; sid:522963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.care"; sid:522964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis-finder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis-finder.com"; sid:522965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisfinder.com"; sid:522966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacryo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacryo.com"; sid:522967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacryotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacryotherapy.com"; sid:522968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacue.com"; sid:522969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuredlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuredlist.com"; sid:522970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurekits.com"; sid:522971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurenow.com"; sid:522972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureprevention.com"; sid:522973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurerecovery.com"; sid:522974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurve.com"; sid:522975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacviruscleaning.com"; sid:522976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacvs.com"; sid:522977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-date.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-date.com"; sid:522978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathclock.com"; sid:522979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathmadness.com"; sid:522980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeepcleaning.com"; sid:522981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfectie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfectie.com"; sid:522982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries.club"; sid:522983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diaries.com"; sid:522984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadigest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadigest.com"; sid:522985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscount.com"; sid:522986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease2020.com"; sid:522987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisruption.com"; sid:522988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiytest.com"; sid:522989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoislavista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoislavista.com"; sid:522990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadollars.com"; sid:522991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadont.com"; sid:522992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotrailsmaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotrailsmaids.com"; sid:522993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriveby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriveby.com"; sid:522994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-drive-through.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-drive-through.com"; sid:522995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriveup.com"; sid:522996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriveuptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriveuptest.com"; sid:522997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaedu.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaedu.life"; sid:522998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelimination.com"; sid:522999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemailupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemailupdates.com"; sid:523000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaestimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaestimate.com"; sid:523001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaetiquette.com"; sid:523002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-face-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-face-mask.com"; sid:523003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacevisor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacevisor.net"; sid:523004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafake.com"; sid:523005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafatal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafatal.com"; sid:523006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafederalrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafederalrelief.com"; sid:523007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafedrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafedrelief.com"; sid:523008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafest2020.com"; sid:523009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafied.com"; sid:523010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fitness.com"; sid:523011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafora.com"; sid:523012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforamerica.com"; sid:523013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreaks.com"; sid:523014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedating.com"; sid:523015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefood.com"; sid:523016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemeat.com"; sid:523017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreewater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreewater.com"; sid:523018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeyoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeyoga.com"; sid:523019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezone.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezone.biz"; sid:523020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrontline.com"; sid:523021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagallery.com"; sid:523022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagamers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagamers.com"; sid:523023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-games.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-games.net"; sid:523024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageneesmiddel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageneesmiddel.com"; sid:523025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-geneesmiddelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-geneesmiddelen.com"; sid:523026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagileadsciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagileadsciences.com"; sid:523027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirusnewsnow.com"; sid:523028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagofers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagofers.com"; sid:523029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagofers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagofers.net"; sid:523030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-graph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-graph.com"; sid:523031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-graph.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-graph.net"; sid:523032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahacker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahacker.com"; sid:523033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappens.com"; sid:523034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappy.com"; sid:523035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaharbor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaharbor.com"; sid:523036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupply.com"; sid:523037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-help.net"; sid:523038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heroes.com"; sid:523039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahhs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahhs.com"; sid:523040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.net"; sid:523041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfmittel.com"; sid:523042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfspaket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfspaket.com"; sid:523043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahut.com"; sid:523044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaides.com"; sid:523045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaid.life"; sid:523046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaid.net"; sid:523047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaillne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaillne.com"; sid:523048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaillness.com"; sid:523049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunesupport.com"; sid:523050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunity.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunity.healthcare"; sid:523051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisadrag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisadrag.com"; sid:523052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiv.com"; sid:523053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajamaica.com"; sid:523054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajm.com"; sid:523055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jokes.com"; sid:523056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillclock.com"; sid:523057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilled.com"; sid:523058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknow.com"; sid:523059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrach.com"; sid:523060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise.net"; sid:523061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabcorp.com"; sid:523062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuitaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuitaction.com"; sid:523063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyer24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyer24.com"; sid:523064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyers24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyers24.com"; sid:523065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegacy.com"; sid:523066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.legal"; sid:523067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalie.com"; sid:523068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloaner.com"; sid:523069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lockdown.com"; sid:523070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloss.com"; sid:523071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadik.com"; sid:523072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamama.com"; sid:523073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-map-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-map-data.com"; sid:523074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.pro"; sid:523075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamathinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamathinitiative.com"; sid:523076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-md.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-md.com"; sid:523077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedecijn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedecijn.com"; sid:523078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicijn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicijn.com"; sid:523079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicijnen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicijnen.com"; sid:523080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameditationclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameditationclasses.com"; sid:523081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamicroloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamicroloan.com"; sid:523082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiyiz.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiyiz.biz"; sid:523083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovedmymeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovedmymeeting.com"; sid:523084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovies.com"; sid:523085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamyass.com"; sid:523086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamythbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamythbusters.com"; sid:523087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanationwidetravelrestrictions.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanationwidetravelrestrictions.golf"; sid:523088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanativirustechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanativirustechnology.com"; sid:523089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanial.com"; sid:523090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanials.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanials.life"; sid:523091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronannial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronannial.com"; sid:523092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanola.com"; sid:523093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanono.com"; sid:523094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanumbers.com"; sid:523095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaohno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaohno.com"; sid:523096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-online.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-online.net"; sid:523097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaovirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaovirus.com"; sid:523098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapakistan.com"; sid:523099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapakistan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapakistan.net"; sid:523100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicusa.com"; sid:523101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pandemie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pandemie.net"; sid:523102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemie.net"; sid:523103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeople.com"; sid:523104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapflaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapflaster.com"; sid:523105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pharm.com"; sid:523106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobic.com"; sid:523107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse666.com"; sid:523108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse666.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse666.net"; sid:523109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypsenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypsenow.com"; sid:523110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocolypse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocolypse.net"; sid:523111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolitics.com"; sid:523112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaport.net"; sid:523113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappetite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappetite.com"; sid:523114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepper.net"; sid:523115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprik.com"; sid:523116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapuzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapuzzles.com"; sid:523117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantines.com"; sid:523118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquestdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquestdiagnostics.com"; sid:523119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quiz.com"; sid:523120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-realty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-realty.com"; sid:523121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecessionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecessionplan.com"; sid:523122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecht24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecht24.com"; sid:523123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryfund.com"; sid:523124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-refund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-refund.com"; sid:523125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefloan.com"; sid:523126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareparte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareparte.com"; sid:523127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareplacementjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareplacementjobs.com"; sid:523128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-report.com"; sid:523129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareport.net"; sid:523130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretroviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretroviral.com"; sid:523131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rettungsschirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rettungsschirm.com"; sid:523132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaribbons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaribbons.com"; sid:523133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarice.com"; sid:523134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroche.com"; sid:523135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarules.com"; sid:523136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafty.com"; sid:523137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sale.com"; sid:523138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasandsliders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasandsliders.com"; sid:523139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascape.com"; sid:523140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzschild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzschild.com"; sid:523141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningsite.com"; sid:523142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningwebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningwebsite.com"; sid:523143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascure.com"; sid:523144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasessionsnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasessionsnola.com"; sid:523145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashake.net"; sid:523146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaside.com"; sid:523147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmith.com"; sid:523148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialnetwork.com"; sid:523149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe.com"; sid:523150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-software.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-software.com"; sid:523151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprayersandmisters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprayersandmisters.com"; sid:523152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprayers.com"; sid:523153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spread-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spread-test.com"; sid:523154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreadtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreadtest.com"; sid:523155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspy.com"; sid:523156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastate.com"; sid:523157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronast.com"; sid:523158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteps.com"; sid:523159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastories.net"; sid:523160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrategies.com"; sid:523161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrongwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrongwa.com"; sid:523162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplykit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplykit.net"; sid:523163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplykits.com"; sid:523164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplykits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplykits.net"; sid:523165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswan.com"; sid:523166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-symptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-symptom.com"; sid:523167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-symptome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-symptome.com"; sid:523168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatactics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatactics.com"; sid:523169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakeaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakeaway.com"; sid:523170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatax24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatax24.com"; sid:523171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelecommute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelecommute.com"; sid:523172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestdiy.com"; sid:523173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatested.com"; sid:523174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfinder.com"; sid:523175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinfo.com"; sid:523176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingclinic.com"; sid:523177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingnearme.com"; sid:523178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingnearme.net"; sid:523179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingonline.com"; sid:523180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsite.com"; sid:523181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsites.net"; sid:523182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-kit.com"; sid:523183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkiti.com"; sid:523184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlocations.com"; sid:523185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmap.com"; sid:523186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsite.com"; sid:523187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsites.com"; sid:523188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsolutions.com"; sid:523189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestteam.com"; sid:523190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test.today"; sid:523191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheepidemic.com"; sid:523192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathemovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathemovies.com"; sid:523193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathon2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathon2020.com"; sid:523194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatime.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatime.club"; sid:523195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatini.com"; sid:523196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-today.com"; sid:523197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoday.net"; sid:523198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatomorrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatomorrow.com"; sid:523199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatookmyjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatookmyjob.com"; sid:523200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoolseurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoolseurope.com"; sid:523201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracing.com"; sid:523202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracks.com"; sid:523203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatment.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatment.services"; sid:523204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatriage.com"; sid:523205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatricks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatricks.com"; sid:523206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrue.com"; sid:523207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-truth.com"; sid:523208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-und-resilienz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-und-resilienz.com"; sid:523209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauni.com"; sid:523210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatesireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatesireland.com"; sid:523211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates.world"; sid:523212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatetracker.com"; sid:523213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauv.com"; sid:523214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.direct"; sid:523215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.tips"; sid:523216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.works - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.works"; sid:523217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavarius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavarius.com"; sid:523218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavarud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavarud.com"; sid:523219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavarus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavarus.com"; sid:523220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavate.com"; sid:523221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavd19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavd19.com"; sid:523222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavector.net"; sid:523223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavent.com"; sid:523224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversity.com"; sid:523225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavhelp.com"; sid:523226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid.club"; sid:523227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavieus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavieus.com"; sid:523228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavieusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavieusnewsnow.com"; sid:523229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavil.com"; sid:523230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavimmune.com"; sid:523231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirasnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirasnewsnow.com"; sid:523232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviresnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviresnewnow.com"; sid:523233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviresnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviresnewsnow.com"; sid:523234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisnewnow.com"; sid:523235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirius.com"; sid:523236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviriusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviriusnewsnow.com"; sid:523237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousnewsnow.com"; sid:523238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsudriveuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsudriveuptesting.com"; sid:523239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsunewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsunewsnow.com"; sid:523240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsusnewsnow.com"; sid:523241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruanewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruanewsnow.com"; sid:523242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirudnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirudnewsnow.com"; sid:523243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruesnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruesnewsnow.com"; sid:523244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruisnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruisnews.com"; sid:523245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus112.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus112.com"; sid:523246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus112.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus112.net"; sid:523247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19gear.com"; sid:523248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19houston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19houston.com"; sid:523249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19-info.com"; sid:523250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19label.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19label.com"; sid:523251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19labels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19labels.com"; sid:523252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19law.com"; sid:523253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19sanitize.com"; sid:523254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19sanitize.com"; sid:523255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19socialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19socialdistancing.com"; sid:523256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-1.com"; sid:523257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.biz"; sid:523258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020stuff.com"; sid:523259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus216.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus216.com"; sid:523260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus303.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus303.com"; sid:523261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus313.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus313.com"; sid:523262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus314.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus314.com"; sid:523263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus317.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus317.com"; sid:523264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus319.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus319.com"; sid:523265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus330.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus330.com"; sid:523266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus361.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus361.com"; sid:523267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus385.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus385.com"; sid:523268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus401.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus401.com"; sid:523269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus402.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus402.com"; sid:523270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus405.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus405.com"; sid:523271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus408.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus408.com"; sid:523272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus410.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus410.com"; sid:523273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus412.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus412.com"; sid:523274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus414.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus414.com"; sid:523275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus419.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus419.com"; sid:523276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus423.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus423.com"; sid:523277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus443.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus443.com"; sid:523278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus480.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus480.com"; sid:523279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus503.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus503.com"; sid:523280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus505.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus505.com"; sid:523281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus509.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus509.com"; sid:523282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus510.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus510.com"; sid:523283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus513.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus513.com"; sid:523284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus515.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus515.com"; sid:523285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus517.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus517.com"; sid:523286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus520.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus520.com"; sid:523287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus5k.com"; sid:523288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus5minutemdconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus5minutemdconsult.com"; sid:523289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus608.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus608.com"; sid:523290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus612.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus612.com"; sid:523291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus614.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus614.com"; sid:523292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus623.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus623.com"; sid:523293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus704.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus704.com"; sid:523294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus714.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus714.com"; sid:523295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus717.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus717.com"; sid:523296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus727.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus727.com"; sid:523297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus737.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus737.com"; sid:523298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus787.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus787.com"; sid:523299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus801.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus801.com"; sid:523300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus808.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus808.com"; sid:523301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus809.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus809.com"; sid:523302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus814.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus814.com"; sid:523303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus859.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus859.com"; sid:523304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactionplan.com"; sid:523305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadieu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadieu.com"; sid:523306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadventures.com"; sid:523307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaffair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaffair.com"; sid:523308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafter.com"; sid:523309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermath.com"; sid:523310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafterparty.com"; sid:523311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalerta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalerta.com"; sid:523312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandcancer.com"; sid:523313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandchill.com"; sid:523314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanswersnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanswersnow.com"; sid:523315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanthem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanthem.com"; sid:523316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantidotum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantidotum.com"; sid:523317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietyrelief.com"; sid:523318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietysupport.com"; sid:523319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusas.com"; sid:523320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassessment.com"; sid:523321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistancecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistancecenter.com"; sid:523322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistancecenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistancecenter.net"; sid:523323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathometesting.com"; sid:523324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorney.net"; sid:523325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneys.net"; sid:523326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusavoidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusavoidance.com"; sid:523327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusavvocati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusavvocati.com"; sid:523328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusavvocato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusavvocato.com"; sid:523329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailprogram.com"; sid:523330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbands.com"; sid:523331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankrupt.com"; sid:523332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcylawyer.com"; sid:523333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbbq.com"; sid:523334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbesafe.com"; sid:523335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblackswan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblackswan.com"; sid:523336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbostonmarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbostonmarathon.com"; sid:523337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessclaim.com"; sid:523338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessclaims.com"; sid:523339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessguidance.com"; sid:523340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloans.com"; sid:523341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessrecovery.com"; sid:523342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessrecovery.net"; sid:523343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-canada.com"; sid:523344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-challenge.com"; sid:523345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheck.net"; sid:523346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinamarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinamarket.com"; sid:523347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaim.net"; sid:523348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaims.net"; sid:523349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean.biz"; sid:523350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanercalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanercalifornia.com"; sid:523351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbayarea.com"; sid:523352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cleaning.com"; sid:523353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicenj.com"; sid:523354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanup.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanup.partners"; sid:523355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupteam.com"; sid:523356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-closings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-closings.com"; sid:523357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensation.net"; sid:523358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.computer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.computer"; sid:523359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcert.com"; sid:523360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconquerer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconquerer.com"; sid:523361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontrol.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontrol.international"; sid:523362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscool.com"; sid:523363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscount.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscount.life"; sid:523364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscount.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscount.world"; sid:523365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-covid19.net"; sid:523366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisis.net"; sid:523367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure247.com"; sid:523368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureclinic.com"; sid:523369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurenow.com"; sid:523370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuretherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuretherapy.com"; sid:523371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.tips"; sid:523372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuretreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuretreatment.com"; sid:523373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureusa.com"; sid:523374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurve.com"; sid:523375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatos.com"; sid:523376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminate.com"; sid:523377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-decontamination-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-decontamination-services.com"; sid:523378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesease.com"; sid:523379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesign.net"; sid:523380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfectante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfectante.com"; sid:523381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfectantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfectantes.com"; sid:523382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdestroyer.com"; sid:523383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnostictests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnostictests.com"; sid:523384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdidnotkillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdidnotkillme.com"; sid:523385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdietplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdietplan.com"; sid:523386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecure.com"; sid:523387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasedailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasedailyupdates.com"; sid:523388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasenews.com"; sid:523389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfestazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfestazione.com"; sid:523390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-doc.com"; sid:523391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctornearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctornearme.com"; sid:523392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-doctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-doctors.com"; sid:523393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrink.com"; sid:523394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivebytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivebytesting.com"; sid:523395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdriveintesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdriveintesting.com"; sid:523396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethroughtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethroughtest.com"; sid:523397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethroughtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethroughtesting.com"; sid:523398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethrutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethrutest.com"; sid:523399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethrutesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethrutesting.net"; sid:523400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdriveuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdriveuptesting.com"; sid:523401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseeuu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseeuu.com"; sid:523402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusefacts.com"; sid:523403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseljuego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseljuego.com"; sid:523404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruse-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruse-map.com"; sid:523405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployment.com"; sid:523406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentresources.com"; sid:523407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentservices.com"; sid:523408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusencasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusencasa.com"; sid:523409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenewnow.com"; sid:523410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenewsnow.com"; sid:523411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.engineering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.engineering"; sid:523412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.enterprises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.enterprises"; sid:523413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruserniejohnson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruserniejohnson.com"; sid:523414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseseffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseseffect.com"; sid:523415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseskilledmyjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseskilledmyjob.com"; sid:523416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.estate - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.estate"; sid:523417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestesting.com"; sid:523418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusewsnow.com"; sid:523419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-face-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-face-mask.com"; sid:523420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemaskprotector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemaskprotector.com"; sid:523421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacts.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacts.club"; sid:523422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfiles.com"; sid:523423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.financial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.financial"; sid:523424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfiscale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfiscale.com"; sid:523425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflightinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflightinfo.com"; sid:523426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflights.com"; sid:523427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflow.com"; sid:523428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflu.net"; sid:523429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflutest.com"; sid:523430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforeclosure.com"; sid:523431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeisland.com"; sid:523432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-freetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-freetesting.com"; sid:523433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreetesting.com"; sid:523434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrequency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrequency.com"; sid:523435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreshstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreshstart.com"; sid:523436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfu.com"; sid:523437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfund.net"; sid:523438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgearnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgearnow.com"; sid:523439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgifts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgifts.net"; sid:523440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoogle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoogle.com"; sid:523441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-gov.com"; sid:523442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentrelief.com"; sid:523443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovhelp.com"; sid:523444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroup.net"; sid:523445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushaber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushaber.com"; sid:523446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushalloweencostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushalloweencostumes.com"; sid:523447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappens.com"; sid:523448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushat.com"; sid:523449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushats.com"; sid:523450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthplans.com"; sid:523451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthsupplies.com"; sid:523452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.center"; sid:523453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-help.net"; sid:523454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelptest.com"; sid:523455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-herbs.com"; sid:523456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometips.com"; sid:523457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushouston.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushouston.net"; sid:523458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoy.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoy.digital"; sid:523459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushumana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushumana.com"; sid:523460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ibiza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ibiza.com"; sid:523461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunotherapy.com"; sid:523462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindenver.com"; sid:523463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.industries - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.industries"; sid:523464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinelpaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinelpaso.com"; sid:523465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.guru"; sid:523466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfomap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfomap.com"; sid:523467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusinformation.com"; sid:523468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylaw.com"; sid:523469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinrealtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinrealtime.com"; sid:523470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceclaim.com"; sid:523471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintheusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintheusa.com"; sid:523472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintrigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintrigue.com"; sid:523473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.investments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.investments"; sid:523474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiv.com"; sid:523475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjewelry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjewelry.com"; sid:523476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskennysmith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskennysmith.com"; sid:523477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskilledmyjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskilledmyjob.com"; sid:523478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknowhow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknowhow.com"; sid:523479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabel.com"; sid:523480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabels.com"; sid:523481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslane.com"; sid:523482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslanecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslanecounty.com"; sid:523483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirm.net"; sid:523484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawpa.com"; sid:523485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuits.net"; sid:523486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer.net"; sid:523487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyers.net"; sid:523488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegacy.com"; sid:523489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaldaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaldaily.com"; sid:523490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegale.com"; sid:523491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalhelp.net"; sid:523492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegal.net"; sid:523493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifeinsurance.com"; sid:523494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivedeathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivedeathtoll.com"; sid:523495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslive.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslive.report"; sid:523496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivetracker.com"; sid:523497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloans.net"; sid:523498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloses.com"; sid:523499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslpestilence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslpestilence.com"; sid:523500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap.pro"; sid:523501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapsproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapsproject.com"; sid:523502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaralago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaralago.com"; sid:523503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarchsadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarchsadness.com"; sid:523504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmascotas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmascotas.com"; sid:523505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-maskco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-maskco.com"; sid:523506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksusa.com"; sid:523507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-masque.com"; sid:523508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmastercleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmastercleanse.com"; sid:523509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalcure.com"; sid:523510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedications.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedications.net"; sid:523511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeditation.com"; sid:523512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medsupplies.com"; sid:523513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmed-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmed-supplies.com"; sid:523514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedsupplies.com"; sid:523515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedsupply.com"; sid:523516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeet.com"; sid:523517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-meme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-meme.com"; sid:523518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-memes.com"; sid:523519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmerchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmerchandise.com"; sid:523520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmewsnow.com"; sid:523521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmobiletesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmobiletesting.com"; sid:523522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-montpellier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-montpellier.com"; sid:523523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmumbai.com"; sid:523524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnasalswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnasalswab.com"; sid:523525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnationalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnationalemergency.com"; sid:523526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnationalsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnationalsafety.com"; sid:523527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalcure.com"; sid:523528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnees.com"; sid:523529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneesnow.com"; sid:523530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewa.com"; sid:523531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewanow.com"; sid:523532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnews.com"; sid:523533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsbow.com"; sid:523534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsmap.com"; sid:523535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsmow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsmow.com"; sid:523536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.network"; sid:523537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnew.com"; sid:523538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsniw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsniw.com"; sid:523539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnkw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnkw.com"; sid:523540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnnow.com"; sid:523541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnoe.com"; sid:523542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsow.com"; sid:523543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewwnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewwnow.com"; sid:523544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorcal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorcal.com"; sid:523545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotice.com"; sid:523546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoticia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoticia.com"; sid:523547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnownew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnownew.com"; sid:523548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnow.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnow.world"; sid:523549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oblazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oblazione.com"; sid:523550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoc.com"; sid:523551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlineshop.com"; sid:523552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorthodontics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorthodontics.com"; sid:523553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreaksurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreaksurvival.com"; sid:523554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-outbreak.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-outbreak.today"; sid:523555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutfitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutfitters.com"; sid:523556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-outreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-outreach.com"; sid:523557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspackage.com"; sid:523558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic2020.net"; sid:523559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatent.com"; sid:523560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatentlaw.com"; sid:523561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspelosi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspelosi.com"; sid:523562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pharmaceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pharmaceuticals.com"; sid:523563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pharmacy.com"; sid:523564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspilots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspilots.com"; sid:523565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoint.com"; sid:523566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-polezno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-polezno.com"; sid:523567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolitics.com"; sid:523568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspornvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspornvideos.com"; sid:523569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-portal.com"; sid:523570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusposts.com"; sid:523571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention360.com"; sid:523572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionplan.com"; sid:523573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionusa.com"; sid:523574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprivatetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprivatetest.com"; sid:523575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofiles.com"; sid:523576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofbiz.com"; sid:523577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-quebec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-quebec.com"; sid:523578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-radar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-radar.net"; sid:523579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradar.net"; sid:523580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealvsfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealvsfake.com"; sid:523581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecover.com"; sid:523582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusrecovery.com"; sid:523583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefuge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefuge.com"; sid:523584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregistration.com"; sid:523585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.reisen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.reisen"; sid:523586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusrelief.com"; sid:523587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffund.com"; sid:523588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffund.net"; sid:523589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreparations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreparations.com"; sid:523590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrepellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrepellent.com"; sid:523591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreport.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreport.world"; sid:523592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresistant.com"; sid:523593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseact.com"; sid:523594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseact.net"; sid:523595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponsepartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponsepartners.com"; sid:523596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseteam.net"; sid:523597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.restaurant"; sid:523598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresults.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresults.net"; sid:523599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresurrection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresurrection.com"; sid:523600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafebusiness.com"; sid:523601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanificazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanificazione.com"; sid:523602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sba.com"; sid:523603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.schule - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.schule"; sid:523604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screening.com"; sid:523605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreeningsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreeningsites.com"; sid:523606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreeningtest.com"; sid:523607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreen.net"; sid:523608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscrub.com"; sid:523609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussentmehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussentmehome.com"; sid:523610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sete.com"; sid:523611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettlement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettlement.net"; sid:523612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettlements.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettlements.net"; sid:523613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshaquilleoneal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshaquilleoneal.com"; sid:523614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshops.com"; sid:523615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshortstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshortstory.com"; sid:523616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-signs.com"; sid:523617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocal.com"; sid:523618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-social.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-social.com"; sid:523619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolanocounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolanocounty.com"; sid:523620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatecases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatecases.com"; sid:523621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstats.net"; sid:523622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussticker.com"; sid:523623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockindex.com"; sid:523624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstressrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstressrelief.com"; sid:523625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudiolegale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudiolegale.com"; sid:523626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussubs.com"; sid:523627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuccess.com"; sid:523628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuccessstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuccessstories.com"; sid:523629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-superstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-superstore.com"; sid:523630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesco.com"; sid:523631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplies-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplies-usa.com"; sid:523632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support-group.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support-group.co.uk"; sid:523633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support-group.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support-group.uk"; sid:523634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupport.net"; sid:523635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurrey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurrey.com"; sid:523636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivals.com"; sid:523637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-survivor.com"; sid:523638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-survivor.net"; sid:523639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussux.com"; sid:523640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyptoms.com"; sid:523641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussystem.com"; sid:523642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustasse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustasse.com"; sid:523643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelemed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelemed.com"; sid:523644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelesalud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelesalud.com"; sid:523645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteria.com"; sid:523646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestapp.com"; sid:523647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestclinics.com"; sid:523648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestdelivery.com"; sid:523649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesterfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesterfinder.com"; sid:523650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesterfinders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesterfinders.com"; sid:523651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfinder.com"; sid:523652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfinders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfinders.com"; sid:523653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfinders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfinders.net"; sid:523654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesthelp.com"; sid:523655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinformation.com"; sid:523656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinginfo.com"; sid:523657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinginformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinginformation.com"; sid:523658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest-kit.com"; sid:523659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit.today"; sid:523660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlabs.com"; sid:523661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlocation.com"; sid:523662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlocations.com"; sid:523663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlocator.com"; sid:523664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test.net"; sid:523665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.pro"; sid:523666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestresult.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestresult.today"; sid:523667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsfinder.com"; sid:523668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsfinders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsfinders.com"; sid:523669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsinformation.com"; sid:523670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsite.com"; sid:523671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestwebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestwebsite.com"; sid:523672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustexasupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustexasupdates.com"; sid:523673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustexts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustexts.com"; sid:523674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapeuticsaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapeuticsaccelerator.com"; sid:523675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthetruth.com"; sid:523676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-together.com"; sid:523677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustogether.com"; sid:523678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustookmyjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustookmyjob.com"; sid:523679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustop.net"; sid:523680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.toys - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.toys"; sid:523681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrain.com"; sid:523682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraininfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraininfo.com"; sid:523683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrait.com"; sid:523684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveling.com"; sid:523685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentcure.com"; sid:523686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatments.net"; sid:523687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustriage.com"; sid:523688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustutelalegale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustutelalegale.com"; sid:523689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustweets.com"; sid:523690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateus.com"; sid:523691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurgentcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurgentcare.com"; sid:523692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacaville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacaville.com"; sid:523693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelawyer.com"; sid:523694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-venezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-venezuela.com"; sid:523695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictim.net"; sid:523696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictims.net"; sid:523697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictoria.com"; sid:523698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideos.net"; sid:523699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitamine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitamine.com"; sid:523700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarrior.com"; sid:523701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebsitealert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebsitealert.com"; sid:523702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebsitenotice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebsitenotice.com"; sid:523703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wellness.com"; sid:523704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellnessquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellnessquarantine.com"; sid:523705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhere.com"; sid:523706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswife.com"; sid:523707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-world.com"; sid:523708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldstat.com"; sid:523709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusx2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusx2.com"; sid:523710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusx2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusx2.net"; sid:523711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavised.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavised.com"; sid:523712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisor.com"; sid:523713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisor.net"; sid:523714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisrus.com"; sid:523715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisus.com"; sid:523716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitaminciv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitaminciv.com"; sid:523717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitusnewsnow.com"; sid:523718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviusnewsnow.com"; sid:523719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoedselpakket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoedselpakket.com"; sid:523720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoip.com"; sid:523721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorusnewsnow.com"; sid:523722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsupply.com"; sid:523723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurisnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurisnewsnow.com"; sid:523724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalmart.com"; sid:523725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawayinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawayinc.com"; sid:523726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawelfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawelfare.com"; sid:523727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawelfare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawelfare.net"; sid:523728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawelfare.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawelfare.world"; sid:523729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawellnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawellnesscenter.com"; sid:523730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawinkel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawinkel.com"; sid:523731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipedout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipedout.com"; sid:523732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wirtschaftshilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wirtschaftshilfe.com"; sid:523733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wirtschaftshilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wirtschaftshilfe.net"; sid:523734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithhope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithhope.com"; sid:523735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawoke.com"; sid:523736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworker.com"; sid:523737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkers.com"; sid:523738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkfromhome.com"; sid:523739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkouts.com"; sid:523740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-worldmap.com"; sid:523741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldpandemic.com"; sid:523742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-worlds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-worlds.com"; sid:523743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazika.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazika.com"; sid:523744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikaprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikaprevention.com"; sid:523745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikavirus.com"; sid:523746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazombiesthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazombiesthemovie.com"; sid:523747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazone.net"; sid:523748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coroncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coroncovid-19.com"; sid:523749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrycorona.com"; sid:523750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrycoronavirus.com"; sid:523751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrycovid.com"; sid:523752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covercleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covercleancovid.com"; sid:523753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covered4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covered4covid.com"; sid:523754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-101.com"; sid:523755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10.com"; sid:523756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1918.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1918.com"; sid:523757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020.net"; sid:523758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020worldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020worldtour.com"; sid:523759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abidjan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abidjan.com"; sid:523760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountabilityproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountabilityproject.com"; sid:523761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aid.com"; sid:523762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allclear.com"; sid:523763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andcancer.com"; sid:523764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andyou.com"; sid:523765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anguilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anguilla.com"; sid:523766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19answersnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19answersnow.com"; sid:523767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-apparel.com"; sid:523768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19armor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19armor.com"; sid:523769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneyhelp.com"; sid:523770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyhelp.com"; sid:523771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-au.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-au.com"; sid:523772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avvocato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avvocato.com"; sid:523773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19away.com"; sid:523774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-azores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-azores.com"; sid:523775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19babies.com"; sid:523776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19babyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19babyboom.com"; sid:523777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailout.com"; sid:523778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailprogram.com"; sid:523779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ban.com"; sid:523780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19b.com"; sid:523781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19begone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19begone.com"; sid:523782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biz.com"; sid:523783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boston.com"; sid:523784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brasil.com"; sid:523785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brazil.com"; sid:523786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bunker.com"; sid:523787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.business"; sid:523788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessclaim.com"; sid:523789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessclaims.com"; sid:523790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloss.com"; sid:523791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busters.com"; sid:523792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19call.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19call.com"; sid:523793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careone.com"; sid:523794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19census.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19census.com"; sid:523795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19churchsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19churchsummit.com"; sid:523796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claim.com"; sid:523797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claims.com"; sid:523798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.net"; sid:523799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classaction.com"; sid:523800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawsuit.com"; sid:523801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsupplies.com"; sid:523802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupteam.com"; sid:523803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothes.com"; sid:523804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collectivecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collectivecare.com"; sid:523805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19colorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19colorado.com"; sid:523806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concert.com"; sid:523807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consult.com"; sid:523808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-crash.com"; sid:523809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-crash.com"; sid:523810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisis.net"; sid:523811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure.life"; sid:523812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19curenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19curenow.com"; sid:523813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallas.com"; sid:523814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallas.net"; sid:523815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19data.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19data.center"; sid:523816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19data.com"; sid:523817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataproject.com"; sid:523818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19data.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19data.zone"; sid:523819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19date.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19date.com"; sid:523820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dating.com"; sid:523821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.deals - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.deals"; sid:523822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decisiontrees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decisiontrees.com"; sid:523823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decoded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decoded.com"; sid:523824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defeated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defeated.com"; sid:523825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-defense.com"; sid:523826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defense.net"; sid:523827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deliveries.com"; sid:523828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-delivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-delivery.com"; sid:523829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deliveryservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deliveryservices.com"; sid:523830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dental.com"; sid:523831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19denver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19denver.com"; sid:523832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disease.com"; sid:523833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donate.com"; sid:523834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19douala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19douala.com"; sid:523835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethrough.com"; sid:523836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethroughtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethroughtest.com"; sid:523837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethrus.com"; sid:523838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethrutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethrutest.com"; sid:523839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19driveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19driveup.com"; sid:523840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19driveuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19driveuptesting.com"; sid:523841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-drug.com"; sid:523842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-drugs.com"; sid:523843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dsoclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dsoclean.com"; sid:523844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eats.com"; sid:523845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ebook.com"; sid:523846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edoctor.com"; sid:523847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employment.com"; sid:523848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epic.com"; sid:523849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eu.net"; sid:523850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fight.com"; sid:523851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fight.net"; sid:523852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fiscale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fiscale.com"; sid:523853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flow.com"; sid:523854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freegrocerydelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freegrocerydelivery.com"; sid:523855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freetesting.com"; sid:523856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freetestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freetestingsites.com"; sid:523857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraisers.com"; sid:523858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraisers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraisers.net"; sid:523859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19give.com"; sid:523860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentassistance.com"; sid:523861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.gripe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.gripe"; sid:523862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guidebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guidebook.com"; sid:523863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handbook.com"; sid:523864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19happyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19happyhour.com"; sid:523865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heal.com"; sid:523866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-heal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-heal.com"; sid:523867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heal.com"; sid:523868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healing.com"; sid:523869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthplans.com"; sid:523870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthservices.com"; sid:523871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthshield.com"; sid:523872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helps.com"; sid:523873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hi.com"; sid:523874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotzone.com"; sid:523875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houston.com"; sid:523876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houston.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houston.net"; sid:523877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonscreen.com"; sid:523878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonscreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonscreen.net"; sid:523879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-how-long-does-infection-last.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-how-long-does-infection-last.com"; sid:523880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howlongdoesinfectionlast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howlongdoesinfectionlast.com"; sid:523881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-how-long-does-infection-last.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-how-long-does-infection-last.net"; sid:523882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howlongdoesinfectionlast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howlongdoesinfectionlast.net"; sid:523883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19illinois.com"; sid:523884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insider.com"; sid:523885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaim.com"; sid:523886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaims.com"; sid:523887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.insure"; sid:523888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19journal.com"; sid:523889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19katy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19katy.com"; sid:523890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19katy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19katy.net"; sid:523891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19katyscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19katyscreen.com"; sid:523892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19katyscreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19katyscreen.net"; sid:523893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kid.com"; sid:523894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kills.com"; sid:523895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ks.com"; sid:523896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19label.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19label.com"; sid:523897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19label.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19label.com"; sid:523898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labels.com"; sid:523899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labels.com"; sid:523900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-law.com"; sid:523901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19layoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19layoffs.com"; sid:523902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legale.com"; sid:523903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalhelp.com"; sid:523904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelp.com"; sid:523905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifeinsurance.com"; sid:523906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.limited - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.limited"; sid:523907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lives.com"; sid:523908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveupdate.com"; sid:523909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loss.com"; sid:523910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losses.com"; sid:523911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19louisiana.com"; sid:523912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19love.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19love.com"; sid:523913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19madeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19madeinchina.com"; sid:523914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mahayana.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mahayana.net"; sid:523915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mapper.com"; sid:523916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maptrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maptrack.com"; sid:523917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mc.com"; sid:523918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicament.com"; sid:523919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicament.com"; sid:523920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medications.com"; sid:523921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medications.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medications.net"; sid:523922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medpacks.com"; sid:523923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meds.net"; sid:523924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memories.com"; sid:523925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milwaukee.com"; sid:523926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19misinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19misinformation.com"; sid:523927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mobiletestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mobiletestingservices.com"; sid:523928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-moja-vjerojatnost-izracun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-moja-vjerojatnost-izracun.com"; sid:523929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutualaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutualaid.com"; sid:523930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutualaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutualaid.net"; sid:523931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nba.com"; sid:523932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nearesttestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nearesttestingsites.com"; sid:523933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nearyou.com"; sid:523934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19need.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19need.com"; sid:523935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neworleans.com"; sid:523936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newyork.com"; sid:523937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nigeria.com"; sid:523938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notice.com"; sid:523939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nowwhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nowwhat.com"; sid:523940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nys.com"; sid:523941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nz.com"; sid:523942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinetest.com"; sid:523943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19org.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19org.com"; sid:523944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outlook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outlook.com"; sid:523945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-outreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-outreach.com"; sid:523946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outreach.com"; sid:523947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic2020.com"; sid:523948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic2020.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic2020.mobi"; sid:523949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic2020.net"; sid:523950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicstats.com"; sid:523951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paris.com"; sid:523952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patch.com"; sid:523953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pcr.com"; sid:523954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19personalshopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19personalshopper.com"; sid:523955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pharmaceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pharmaceuticals.com"; sid:523956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pharmacy.com"; sid:523957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharm.com"; sid:523958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ph.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ph.net"; sid:523959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenix.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenix.net"; sid:523960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasma.com"; sid:523961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmatherapy.com"; sid:523962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19point.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19point.com"; sid:523963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policies.com"; sid:523964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poll.com"; sid:523965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19post.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19post.com"; sid:523966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pr.com"; sid:523967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prepared.com"; sid:523968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepared.com"; sid:523969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19press.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19press.com"; sid:523970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventioncenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventioncenter.com"; sid:523971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19profiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19profiles.com"; sid:523972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proofbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proofbiz.com"; sid:523973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19publichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19publichealth.com"; sid:523974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19publicrelations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19publicrelations.com"; sid:523975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantine.life"; sid:523976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantine.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantine.media"; sid:523977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quickresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quickresponse.com"; sid:523978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quickresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quickresponse.com"; sid:523979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktest.com"; sid:523980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raleigh.com"; sid:523981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapid-test.com"; sid:523982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ready.com"; sid:523983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebound.com"; sid:523984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-recovery.com"; sid:523985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refund.com"; sid:523986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refunds.com"; sid:523987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19registry.com"; sid:523988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19registry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19registry.net"; sid:523989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relations.com"; sid:523990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19releif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19releif.com"; sid:523991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefloan.com"; sid:523992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefloan.com"; sid:523993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remboursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remboursement.com"; sid:523994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remboursements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remboursements.com"; sid:523995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remdesivir.com"; sid:523996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remdesivir.com"; sid:523997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remedies.com"; sid:523998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remedy.com"; sid:523999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.com"; sid:524000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remote.com"; sid:524001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repository.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repository.com"; sid:524002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-research.com"; sid:524003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchers.com"; sid:524004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respirator.com"; sid:524005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19responders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19responders.com"; sid:524006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responders.com"; sid:524007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsefund.com"; sid:524008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsefund.net"; sid:524009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19result.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19result.com"; sid:524010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rks.net"; sid:524011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rochester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rochester.com"; sid:524012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safearea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safearea.com"; sid:524013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeproducts.com"; sid:524014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetravel.com"; sid:524015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safezone.com"; sid:524016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safty.com"; sid:524017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanantonio.com"; sid:524018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitation.com"; sid:524019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scare.com"; sid:524020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-schnelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-schnelltest.com"; sid:524021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenaustin.com"; sid:524022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenaustin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenaustin.net"; sid:524023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenchicago.com"; sid:524024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenchicago.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenchicago.net"; sid:524025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screencolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screencolumbus.com"; sid:524026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screencolumbus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screencolumbus.net"; sid:524027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screendallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screendallas.com"; sid:524028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screendallas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screendallas.net"; sid:524029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screendenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screendenver.com"; sid:524030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screendenver.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screendenver.net"; sid:524031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenfortworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenfortworth.com"; sid:524032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenfortworth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenfortworth.net"; sid:524033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-screening.com"; sid:524034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenjacksonville.com"; sid:524035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenjacksonville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenjacksonville.net"; sid:524036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenlosangeles.com"; sid:524037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenlosangeles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenlosangeles.net"; sid:524038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screen.net"; sid:524039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screennewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screennewyork.com"; sid:524040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screennewyork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screennewyork.net"; sid:524041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenphiladelphia.com"; sid:524042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenphiladelphia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenphiladelphia.net"; sid:524043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenphoenix.com"; sid:524044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenphoenix.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenphoenix.net"; sid:524045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanantonio.com"; sid:524046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanantonio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanantonio.net"; sid:524047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensandiego.com"; sid:524048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensandiego.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensandiego.net"; sid:524049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanfrancisco.com"; sid:524050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanfrancisco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanfrancisco.net"; sid:524051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanjose.com"; sid:524052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screensanjose.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screensanjose.net"; sid:524053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenwashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenwashington.com"; sid:524054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seattle.com"; sid:524055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattlesurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattlesurvivor.com"; sid:524056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19security.com"; sid:524057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftestkits.com"; sid:524058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftests.com"; sid:524059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19settlement.com"; sid:524060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shipping.com"; sid:524061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shops.com"; sid:524062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sms.com"; sid:524063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancing.com"; sid:524064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19source.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19source.com"; sid:524065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southcarolina.com"; sid:524066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19statecases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19statecases.com"; sid:524067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statecases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statecases.com"; sid:524068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19states.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19states.com"; sid:524069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stats-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stats-info.com"; sid:524070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockmarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockmarketcrash.com"; sid:524071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stocks.com"; sid:524072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strips.com"; sid:524073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studies.com"; sid:524074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studiolegale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studiolegale.com"; sid:524075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19successstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19successstories.com"; sid:524076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-summit.com"; sid:524077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-summit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-summit.email"; sid:524078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-summit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-summit.net"; sid:524079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sunnyvale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sunnyvale.com"; sid:524080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.center"; sid:524081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19support.com"; sid:524082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survive.com"; sid:524083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor.club"; sid:524084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-survivor.com"; sid:524085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survivor.com"; sid:524086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorcom.com"; sid:524087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor.life"; sid:524088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swab.com"; sid:524089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tablet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tablet.com"; sid:524090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tablets.com"; sid:524091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tasse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tasse.com"; sid:524092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxrefund.com"; sid:524093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxrefunds.com"; sid:524094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teleclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teleclinic.com"; sid:524095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telehealthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telehealthplans.com"; sid:524096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinereflief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinereflief.com"; sid:524097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinereflieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinereflieffund.com"; sid:524098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicinerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicinerelief.com"; sid:524099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19telemedicinetaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19telemedicinetaskforce.com"; sid:524100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testdelivery.com"; sid:524101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testerkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testerkit.com"; sid:524102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingcenters.com"; sid:524103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglocations.com"; sid:524104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testprivate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testprivate.com"; sid:524105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tests.com"; sid:524106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19texasscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19texasscreen.com"; sid:524107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19texasscreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19texasscreen.net"; sid:524108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19texts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19texts.com"; sid:524109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toddlers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toddlers.com"; sid:524110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tpforme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tpforme.com"; sid:524111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-training.com"; sid:524112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-training.com"; sid:524113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travelinsurance.com"; sid:524114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveltips.com"; sid:524115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tr.com"; sid:524116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tshirt.com"; sid:524117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tshirt.com"; sid:524118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tube.com"; sid:524119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tube.com"; sid:524120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tulsa.com"; sid:524121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tutelalegale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tutelalegale.com"; sid:524122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tweets.com"; sid:524123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19united.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19united.com"; sid:524124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updateonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updateonline.com"; sid:524125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usascreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usascreen.com"; sid:524126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usascreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usascreen.net"; sid:524127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us-cases.com"; sid:524128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine2020.com"; sid:524129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virginia.com"; sid:524130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualdoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualdoctor.com"; sid:524131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruscure.com"; sid:524132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscure.com"; sid:524133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virushelp.com"; sid:524134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.science"; sid:524135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussocialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussocialdistancing.com"; sid:524136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washingtondc.com"; sid:524137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19websitealert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19websitealert.com"; sid:524138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19websitenotice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19websitenotice.com"; sid:524139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wellness.com"; sid:524140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whattodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whattodo.com"; sid:524141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatworks.com"; sid:524142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wny.com"; sid:524143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldtour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldtour2020.com"; sid:524144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x2.com"; sid:524145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x2.net"; sid:524146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19xs2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19xs2020.com"; sid:524147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.ltd"; sid:524148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019ph.com"; sid:524149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019tests.com"; sid:524150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20crash.com"; sid:524151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20test.com"; sid:524152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20test.com"; sid:524153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2k.com"; sid:524154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2k.com"; sid:524155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid313.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid313.com"; sid:524156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-33.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-33.com"; sid:524157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-45.com"; sid:524158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid502.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid502.com"; sid:524159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9-teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9-teen.com"; sid:524160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9tees.com"; sid:524161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida20.com"; sid:524162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-al.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-al.com"; sid:524163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalliance.com"; sid:524164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcancer.com"; sid:524165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandme.com"; sid:524166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-apparel.com"; sid:524167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassist.com"; sid:524168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidating.com"; sid:524169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbartender19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbartender19.com"; sid:524170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbartender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbartender.com"; sid:524171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbartender.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbartender.net"; sid:524172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbestpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbestpractice.com"; sid:524173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.blue"; sid:524174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreastfeeding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreastfeeding.com"; sid:524175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreastfeeding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreastfeeding.net"; sid:524176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreastmilk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreastmilk.com"; sid:524177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreastmilk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreastmilk.net"; sid:524178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbunker.com"; sid:524179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalm.com"; sid:524180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalm.net"; sid:524181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanada.com"; sid:524182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepackages.com"; sid:524183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaretaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaretaker.com"; sid:524184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-case.com"; sid:524185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchallenge2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchallenge2020.com"; sid:524186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharts.com"; sid:524187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cheap - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cheap"; sid:524188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclass2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclass2020.com"; sid:524189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassaction.com"; sid:524190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersllc.com"; sid:524191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.net"; sid:524192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanse.com"; sid:524193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleanup.com"; sid:524194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclientupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclientupdate.com"; sid:524195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicaltrials.com"; sid:524196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosings.com"; sid:524197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.coach"; sid:524198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodes.com"; sid:524199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunities.com"; sid:524200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompare.com"; sid:524201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectcare.com"; sid:524202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookbook.com"; sid:524203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coronavirus.com"; sid:524204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounseling.com"; sid:524205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovered.com"; sid:524206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrash2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrash2021.com"; sid:524207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.world"; sid:524208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcronicles.com"; sid:524209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddash.com"; sid:524210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddate.com"; sid:524211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathmadness.com"; sid:524212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetect.com"; sid:524213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscussion.com"; sid:524214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideats.com"; sid:524215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.education"; sid:524216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo-19.com"; sid:524217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocourse.com"; sid:524218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos19.com"; sid:524219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepidemic.com"; sid:524220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.express"; sid:524221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfefe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfefe.com"; sid:524222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fermetures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fermetures.com"; sid:524223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiles.com"; sid:524224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilm.com"; sid:524225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfit.com"; sid:524226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfitness.com"; sid:524227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforums.com"; sid:524228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedom.com"; sid:524229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeorthodontics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeorthodontics.com"; sid:524230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreezone.com"; sid:524231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgarde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgarde.com"; sid:524232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-germany.com"; sid:524233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgermany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgermany.com"; sid:524234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoaway.com"; sid:524235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-go.com"; sid:524236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrants.com"; sid:524237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhacks.com"; sid:524238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.healthcare"; sid:524239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthshield.com"; sid:524240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpdesk.com"; sid:524241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.net"; sid:524242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotline.com"; sid:524243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanmilk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanmilk.com"; sid:524244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanmilk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanmilk.net"; sid:524245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylaw.com"; sid:524246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.institute - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.institute"; sid:524247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.international"; sid:524248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ir.com"; sid:524249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidir.com"; sid:524250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisadrag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisadrag.com"; sid:524251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjournals.com"; sid:524252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid.com"; sid:524253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsclub.com"; sid:524254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledthelivemusicstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledthelivemusicstar.com"; sid:524255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkills.com"; sid:524256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkindness.com"; sid:524257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkit19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkit19.com"; sid:524258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlatest.com"; sid:524259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidletters.com"; sid:524260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-life.com"; sid:524261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeinsurance.com"; sid:524262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigation.com"; sid:524263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask-store.com"; sid:524264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.memorial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.memorial"; sid:524265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmothersmilk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmothersmilk.com"; sid:524266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmothersmilk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmothersmilk.net"; sid:524267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmx.com"; sid:524268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyheart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyheart.com"; sid:524269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneg.com"; sid:524270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsroom.com"; sid:524271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewyorkcity.com"; sid:524272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnine.com"; sid:524273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonline.net"; sid:524274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinetest.com"; sid:524275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoperation.com"; sid:524276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ops.com"; sid:524277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidops.com"; sid:524278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatch.com"; sid:524279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcsupport.com"; sid:524280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcsupport.net"; sid:524281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonesystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonesystem.com"; sid:524282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoint.com"; sid:524283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpos.com"; sid:524284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prevention-and-treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prevention-and-treatment.com"; sid:524285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionkit.com"; sid:524286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproduct.com"; sid:524287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.productions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.productions"; sid:524288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofbiz.com"; sid:524289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofing.com"; sid:524290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-radar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-radar.com"; sid:524291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradar.com"; sid:524292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistry.com"; sid:524293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistry.net"; sid:524294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremote.com"; sid:524295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresult.com"; sid:524296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemask.com"; sid:524297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetips.com"; sid:524298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsans.com"; sid:524299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsba.com"; sid:524300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscam.com"; sid:524301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-schnelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-schnelltest.com"; sid:524302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-screening.com"; sid:524303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftest.com"; sid:524304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftesting.com"; sid:524305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmith.com"; sid:524306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocial.com"; sid:524307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsociety.com"; sid:524308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-solidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-solidarity.com"; sid:524309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolidarity.com"; sid:524310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstory.com"; sid:524311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrip.com"; sid:524312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucks.com"; sid:524313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summit.email"; sid:524314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summit.net"; sid:524315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplier.com"; sid:524316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survivor.com"; sid:524317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor.net"; sid:524318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidszn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidszn.com"; sid:524319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtales.com"; sid:524320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalk.com"; sid:524321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtea.com"; sid:524322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelehealth.com"; sid:524323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesteu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesteu.com"; sid:524324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthere.com"; sid:524325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsite.com"; sid:524326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsites.com"; sid:524327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnow.com"; sid:524328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtext.com"; sid:524329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtexts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtexts.com"; sid:524330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthis.com"; sid:524331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackin.com"; sid:524332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrack.net"; sid:524333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtriage.com"; sid:524334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtshirt.com"; sid:524335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccine.net"; sid:524336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-v.com"; sid:524337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidv.com"; sid:524338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvenom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvenom.com"; sid:524339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictims.com"; sid:524340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscures.com"; sid:524341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdefense.com"; sid:524342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidv.net"; sid:524343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoip.com"; sid:524344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteer.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteer.network"; sid:524345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkfrompc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkfrompc.com"; sid:524346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx2.com"; sid:524347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx2.net"; sid:524348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzap.com"; sid:524349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzero.com"; sid:524350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzilla.com"; sid:524351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creacontrecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creacontrecorona.com"; sid:524352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronicacoronanoyaguatemalensis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronicacoronanoyaguatemalensis.com"; sid:524353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crscovid19.com"; sid:524354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidnineteen.com"; sid:524355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryocorona.com"; sid:524356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryotherapycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryotherapycorona.com"; sid:524357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcorona.com"; sid:524358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19.com"; sid:524359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuarentenacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuarentenacovid19.com"; sid:524360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-corona19.com"; sid:524361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona-19.com"; sid:524362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona19.com"; sid:524363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronaglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronaglobal.com"; sid:524364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-corona-virus.com"; sid:524365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirustoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirustoday.com"; sid:524366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19now.com"; sid:524367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19virus.com"; sid:524368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidvirus.com"; sid:524369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedcorona.com"; sid:524370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcoronaaus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcoronaaus.net"; sid:524371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcoronausa.com"; sid:524372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethepandemic.com"; sid:524373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidmasks.com"; sid:524374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovid-19.com"; sid:524375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovid19.com"; sid:524376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damnyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damnyoucorona.com"; sid:524377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damnyoucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damnyoucoronavirus.com"; sid:524378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data4covid19.com"; sid:524379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data4covid.com"; sid:524380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataforcoronavirus.com"; sid:524381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingintheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingintheageofcorona.com"; sid:524382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datoscoronavirus.com"; sid:524383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleaningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleaningcoronavirus.com"; sid:524384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecovid19.com"; sid:524385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandascoronavirus.com"; sid:524386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid-19.com"; sid:524387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despidoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despidoscoronavirus.com"; sid:524388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectmycovid.com"; sid:524389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecorona.com"; sid:524390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasecoronavirus.com"; sid:524391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasepandemic.com"; sid:524392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disfrazdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disfrazdecoronavirus.com"; sid:524393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfestazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfestazionecoronavirus.com"; sid:524394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronatest.com"; sid:524395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doeshappymediumhavethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doeshappymediumhavethecoronavirus.com"; sid:524396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doigotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doigotcoronavirus.com"; sid:524397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecoronavirus.solutions"; sid:524398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontpandemic.com"; sid:524399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontpandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontpandemic.world"; sid:524400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dotcoronavirus.com"; sid:524401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drinkcoronaathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drinkcoronaathome.com"; sid:524402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveincoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveincoronavirustest.com"; sid:524403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveincoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveincoronavirustesting.com"; sid:524404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethroughcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethroughcovid19test.com"; sid:524405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronavirustests.com"; sid:524406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcorona.com"; sid:524407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for egyptcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"egyptcovid.com"; sid:524408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorenlostiemposdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorenlostiemposdelcorona.com"; sid:524409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elections-and-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elections-and-coronavirus.com"; sid:524410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatecoronachicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatecoronachicago.com"; sid:524411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatecovid19.com"; sid:524412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatingcoronavirus.com"; sid:524413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronakits.com"; sid:524414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronaviruskit.com"; sid:524415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencykitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencykitcovid-19.com"; sid:524416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emerycoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emerycoronatestkit.com"; sid:524417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicare.com"; sid:524418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmode.com"; sid:524419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictracking.com"; sid:524420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatecovid19.com"; sid:524421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecoronavirus.com"; sid:524422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapethecoronavirus.com"; sid:524423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escortcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escortcorona.com"; sid:524424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escortcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escortcoronavirus.com"; sid:524425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurofins-diatherix-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurofins-diatherix-covid-19.com"; sid:524426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evadecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evadecovid19.com"; sid:524427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyesurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyesurvivedcorona.com"; sid:524428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcovid19.com"; sid:524429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcovid.com"; sid:524430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesfirstcoronavirusresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesfirstcoronavirusresponseact.com"; sid:524431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familyfirstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familyfirstcorona.com"; sid:524432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronatest.com"; sid:524433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckyoucorona.com"; sid:524434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcoronavirustest.com"; sid:524435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacoronavirustest.com"; sid:524436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightbackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightbackcoronavirus.com"; sid:524437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronatogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronatogether.com"; sid:524438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirus.life"; sid:524439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fileyourcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fileyourcoronaclaim.com"; sid:524440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatestsite.com"; sid:524441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidtest.com"; sid:524442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponsecovid19.com"; sid:524443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcorona.com"; sid:524444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirussolutions.com"; sid:524445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirussolutions.com"; sid:524446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for footballcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"footballcoronavirus.com"; sid:524447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronatesting.com"; sid:524448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronaviruskit.com"; sid:524449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19test.com"; sid:524450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontiercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontiercovid.com"; sid:524451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona.life"; sid:524452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19merchandise.com"; sid:524453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukcovid19.com"; sid:524454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuvkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuvkcoronavirus.com"; sid:524455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvck-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvck-corona.com"; sid:524456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvckcoronavirus.com"; sid:524457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvckcovid19.com"; sid:524458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxckcorona.com"; sid:524459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for games4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"games4coronavirus.com"; sid:524460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gardenstatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gardenstatecovid19.com"; sid:524461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirusupdate.com"; sid:524462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirusupdates.com"; sid:524463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19.com"; sid:524464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacoronasba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacoronasba.com"; sid:524465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcheckedforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcheckedforcoronavirus.com"; sid:524466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatested.com"; sid:524467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaviruskit.com"; sid:524468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirussolutions.com"; sid:524469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testkit.com"; sid:524470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtesting.com"; sid:524471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getswabedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getswabedcoronavirus.com"; sid:524472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettested-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettested-coronavirus.com"; sid:524473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettested-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettested-covid19.com"; sid:524474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gharsekaamcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gharsekaamcorona.com"; sid:524475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovid19.com"; sid:524476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovid.com"; sid:524477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goingcoronal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goingcoronal.com"; sid:524478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gonecoronal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gonecoronal.com"; sid:524479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirus.com"; sid:524480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid19.com"; sid:524481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.club"; sid:524482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for have-i-had-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"have-i-had-corona.com"; sid:524483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcorona.com"; sid:524484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcorona.net"; sid:524485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcovid.com"; sid:524486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcovid.net"; sid:524487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovid-19.com"; sid:524488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcoronavirusanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcoronavirusanxiety.com"; sid:524489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcoronavirusfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcoronavirusfear.com"; sid:524490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcovid.com"; sid:524491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcovid19.com"; sid:524492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthcorona.com"; sid:524493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpbeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpbeatcovid.com"; sid:524494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbsforcorona.com"; sid:524495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbsforcovid.com"; sid:524496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hicorona.com"; sid:524497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hicorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hicorona.net"; sid:524498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hitcovid.com"; sid:524499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holyfuckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holyfuckcoronavirus.com"; sid:524500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitcovid19.com"; sid:524501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopewhilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopewhilecorona.com"; sid:524502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howmanypeoplewilldiefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howmanypeoplewilldiefromcoronavirus.com"; sid:524503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcorona.com"; sid:524504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopcovid-19.com"; sid:524505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurviveapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurviveapandemic.com"; sid:524506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hulksmashcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hulksmashcoronavirus.com"; sid:524507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansofcorona.com"; sid:524508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacovid19survivor.com"; sid:524509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamasurvivorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamasurvivorcovid19.com"; sid:524510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamfreeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamfreeofcovid19.com"; sid:524511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid-19.com"; sid:524512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid19.com"; sid:524513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icocovid19.com"; sid:524514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid19.com"; sid:524515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadthecoronavirus.com"; sid:524516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecovid.com"; sid:524517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihelpedkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihelpedkillcovid19.com"; sid:524518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihelpedkillcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihelpedkillcovid19.net"; sid:524519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid19.com"; sid:524520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imacoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imacoronasurvivor.com"; sid:524521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imacovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imacovid19survivor.com"; sid:524522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacovid19.com"; sid:524523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info4coronavirus.com"; sid:524524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-covid.com"; sid:524525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecovid.com"; sid:524526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceforapandemic.com"; sid:524527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceforcovid-19.com"; sid:524528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceforpandemic.com"; sid:524529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcoronavirus.com"; sid:524530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investcorona.com"; sid:524531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancovid19.com"; sid:524532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusnearme.net"; sid:524533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isupportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isupportcoronavirus.com"; sid:524534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurviedthecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurviedthecoronavirus2020.com"; sid:524535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronatshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronatshirts.com"; sid:524536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus2020.net"; sid:524537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronaviruswithouttoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronaviruswithouttoiletpaper.com"; sid:524538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronaviruswithouttp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronaviruswithouttp.com"; sid:524539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-covid-19.com"; sid:524540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived-covid-19.com"; sid:524541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19seattle2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19seattle2020.com"; sid:524542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19virus.com"; sid:524543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovidvirus.com"; sid:524544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedpandemic2020.com"; sid:524545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedpandemic2020tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedpandemic2020tshirt.com"; sid:524546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusswag.com"; sid:524547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirust-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirust-shirt.com"; sid:524548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirustshirt.com"; sid:524549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaviruswithouttoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaviruswithouttoiletpaper.com"; sid:524550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaviruswithouttp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaviruswithouttp.com"; sid:524551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthepandemictshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthepandemictshirt.com"; sid:524552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedwuhan.com"; sid:524553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedwuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedwuhan.net"; sid:524554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkihavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkihavecorona.com"; sid:524555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivcorona.com"; sid:524556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivegotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivegotcorona.com"; sid:524557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwoncoronavirus.com"; sid:524558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacuzzicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacuzzicovid19.com"; sid:524559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcovid.com"; sid:524560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joinedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joinedbycovid19.com"; sid:524561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joinedbycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joinedbycovid19.net"; sid:524562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcoronavirus.com"; sid:524563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascovid19.com"; sid:524564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckycovid19.com"; sid:524565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecoronavirusclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecoronavirusclothing.com"; sid:524566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindness4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindness4corona.com"; sid:524567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit2corona.com"; sid:524568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowyourcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowyourcovid-19.com"; sid:524569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwaitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwaitcovid-19.com"; sid:524570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laconspiraciondelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laconspiraciondelcoronavirus.com"; sid:524571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learninginthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learninginthetimeofcoronavirus.com"; sid:524572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcoronavirus.com"; sid:524573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstalkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstalkcovid19.com"; sid:524574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcovid19.com"; sid:524575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcovid.com"; sid:524576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezas-stopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezas-stopcoronavirus.com"; sid:524577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaidcorona.com"; sid:524578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirusupdate.com"; sid:524579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid-19.com"; sid:524580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livedthrucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livedthrucoronavirus.com"; sid:524581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livincovidaloca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livincovidaloca.com"; sid:524582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingcovid-19.com"; sid:524583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinglifecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinglifecorona.com"; sid:524584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinglifecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinglifecovid-19.com"; sid:524585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronavirustest.com"; sid:524586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronavirustests.com"; sid:524587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncoronatesting.com"; sid:524588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losmexicanosinmunesalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losmexicanosinmunesalcoronavirus.com"; sid:524589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacovid19.com"; sid:524590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcoronavirus.com"; sid:524591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcovid-19.com"; sid:524592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcovid19.com"; sid:524593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcorona.com"; sid:524594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronavirus.life"; sid:524595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronavirus.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronavirus.tips"; sid:524596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofpandemic.com"; sid:524597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luchacontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luchacontracoronavirus.com"; sid:524598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeinchinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeinchinacovid19.com"; sid:524599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainecovid-19.com"; sid:524600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makingamericacovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makingamericacovid19free.com"; sid:524601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managecoronavirus.com"; sid:524602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manfuckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manfuckcoronavirus.com"; sid:524603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapcorona19.com"; sid:524604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketcorona.com"; sid:524605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherare-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherare-covid19.com"; sid:524606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskanticovid19.com"; sid:524607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-for-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-for-corona-virus.com"; sid:524608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-for-coronavirus.com"; sid:524609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-sanitizers-gloves-supplies-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-sanitizers-gloves-supplies-corona-virus.com"; sid:524610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-anti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-anti-covid19.com"; sid:524611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachusettscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachusettscovid19.com"; sid:524612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mccovid19.com"; sid:524613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicament-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicament-covid19.com"; sid:524614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentcovid19.com"; sid:524615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicine-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicine-corona.com"; sid:524616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovid19.com"; sid:524617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovid-19recovery.com"; sid:524618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovidrecovery.com"; sid:524619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindfulcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindfulcorona.com"; sid:524620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for misscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"misscoronavirus.com"; sid:524621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncorona.com"; sid:524622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicovid19.com"; sid:524623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigatecovid19.com"; sid:524624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanacovid19.com"; sid:524625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myanmarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myanmarcovid19.com"; sid:524626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona19safemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona19safemask.com"; sid:524627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-aid.com"; sid:524628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaclaims.com"; sid:524629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacure.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacure.today"; sid:524630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaid.com"; sid:524631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalawsuit.com"; sid:524632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.life"; sid:524633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapatch.com"; sid:524634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronarecovery.com"; sid:524635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasupplies.com"; sid:524636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusclaim.com"; sid:524637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusinfo.com"; sid:524638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusinfo.net"; sid:524639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirussymptoms.com"; sid:524640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19test.com"; sid:524641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19test.net"; sid:524642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhealth.com"; sid:524643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhealth.net"; sid:524644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidjournal.com"; sid:524645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysymptomscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysymptomscoronavirus.com"; sid:524646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacerentiemposdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacerentiemposdelcoronavirus.com"; sid:524647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naropacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naropacovid19.com"; sid:524648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaims.com"; sid:524649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaims.net"; sid:524650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronaviruscure.com"; sid:524651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbacoronavirus.com"; sid:524652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbacovid19.com"; sid:524653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n-covid19.com"; sid:524654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskascovid19.com"; sid:524655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacovid19.com"; sid:524656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevercoronavirus.com"; sid:524657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhampshirecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhampshirecovid19.com"; sid:524658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycovid19.com"; sid:524659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocovid19.com"; sid:524660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemic.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemic.bid"; sid:524661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19.com"; sid:524662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nexgenpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nexgenpandemic.com"; sid:524663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronavirusbankruptcy.com"; sid:524664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona2020.com"; sid:524665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirus.biz"; sid:524666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-covid-19.com"; sid:524667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-covid.com"; sid:524668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacoronavirusclaims.com"; sid:524669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomascovid.com"; sid:524670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacovid19.com"; sid:524671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronavirusnews.com"; sid:524672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notthecoronavirus.com"; sid:524673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronadisease.com"; sid:524674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus.club"; sid:524675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushometest.com"; sid:524676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushometestkit.com"; sid:524677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushometestkits.com"; sid:524678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushometests.com"; sid:524679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruskits.com"; sid:524680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruslab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruslab.com"; sid:524681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruslabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruslabtests.com"; sid:524682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus.support"; sid:524683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustesters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustesters.com"; sid:524684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustestingkit.com"; sid:524685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustestingkits.com"; sid:524686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustestlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustestlab.com"; sid:524687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusworldtour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusworldtour2020.com"; sid:524688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronawear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronawear.com"; sid:524689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscovid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscovid19challenge.com"; sid:524690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obat-corona.com"; sid:524691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for odin-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"odin-covid19.com"; sid:524692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcorona.com"; sid:524693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirus19.com"; sid:524694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronaviruses.com"; sid:524695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19.com"; sid:524696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19.com"; sid:524697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacovid19.com"; sid:524698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondemandcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondemandcovid19test.com"; sid:524699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondemandcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondemandcovid19testing.com"; sid:524700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinebusinesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinebusinesscorona.com"; sid:524701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid19.com"; sid:524702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcoronavirus.com"; sid:524703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcovid19.com"; sid:524704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestoncoronavirus.com"; sid:524705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestoncovid19.com"; sid:524706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid19.net"; sid:524707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid.world"; sid:524708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncovid19.com"; sid:524709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocoronavirussolutions.com"; sid:524710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoviddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoviddiary.com"; sid:524711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidjournal.com"; sid:524712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingcorona.com"; sid:524713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozcovid19.com"; sid:524714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packanticontagiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packanticontagiocoronavirus.com"; sid:524715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacorona.com"; sid:524716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020store.com"; sid:524717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020survivor.com"; sid:524718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicarchitecture.com"; sid:524719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicathletics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicathletics.com"; sid:524720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbabies.com"; sid:524721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbond.com"; sid:524722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccentury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccentury.com"; sid:524723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconnection.com"; sid:524724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconsult.com"; sid:524725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccover.com"; sid:524726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdate.com"; sid:524727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdating.com"; sid:524728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefenseforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefenseforce.net"; sid:524729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiet.com"; sid:524730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflukits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflukits.com"; sid:524731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmd.com"; sid:524732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemes.com"; sid:524733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmind.com"; sid:524734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmode.com"; sid:524735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmom.com"; sid:524736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpac.com"; sid:524737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpackusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpackusa.com"; sid:524738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpal.com"; sid:524739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpapa.com"; sid:524740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparent.com"; sid:524741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.partners"; sid:524742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperk.com"; sid:524743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperks.com"; sid:524744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpod.com"; sid:524745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolice.com"; sid:524746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicporn.com"; sid:524747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprayer.com"; sid:524748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpublishing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpublishing.com"; sid:524749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsecompany.com"; sid:524750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsarchitecture.com"; sid:524751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsecurity.com"; sid:524752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicselfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicselfcare.com"; sid:524753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsex.com"; sid:524754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshelter.com"; sid:524755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsocial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsocial.com"; sid:524756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspeeddating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspeeddating.com"; sid:524757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstatistics.com"; sid:524758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplykit.com"; sid:524759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalbox.com"; sid:524760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictouch.com"; sid:524761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictouching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictouching.com"; sid:524762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictravelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictravelinsurance.com"; sid:524763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscontrol.com"; sid:524764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscontrol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscontrol.net"; sid:524765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscontrols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscontrols.com"; sid:524766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirustesting.com"; sid:524767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwatchonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwatchonline.com"; sid:524768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for papeleocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"papeleocoronavirus.com"; sid:524769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovid19.com"; sid:524770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petercoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petercoronado.com"; sid:524771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillyvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillyvscovid.com"; sid:524772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pizzapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pizzapandemic.com"; sid:524773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcardsofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcardsofthepandemic.com"; sid:524774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.digital"; sid:524775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.life"; sid:524776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.net"; sid:524777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaparty.com"; sid:524778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.world"; sid:524779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicgear.com"; sid:524780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for potsandpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"potsandpandemics.com"; sid:524781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecoronavirus.com"; sid:524782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovid-19.com"; sid:524783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerforcoronavirus.com"; sid:524784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayersforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayersforcoronavirus.com"; sid:524785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayersforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayersforcovid19.com"; sid:524786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precautionfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precautionfromcoronavirus.com"; sid:524787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparecovid19.com"; sid:524788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparedforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparedforcovid-19.com"; sid:524789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepareforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepareforcovid.com"; sid:524790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preperationpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preperationpandemic.com"; sid:524791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preplancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preplancovid19.com"; sid:524792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenir-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenir-coronavirus.com"; sid:524793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronanow.com"; sid:524794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirus19.com"; sid:524795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusco.com"; sid:524796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusnaturally.com"; sid:524797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaviruss.com"; sid:524798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previenecombatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previenecombatecoronavirus.com"; sid:524799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecoronatest.com"; sid:524800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecoronavirustests.com"; sid:524801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovid19test.com"; sid:524802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovid19tests.com"; sid:524803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for problemilegalicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"problemilegalicoronavirus.com"; sid:524804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for processyourcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"processyourcovidclaim.com"; sid:524805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovid.com"; sid:524806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectagainstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectagainstpandemic.com"; sid:524807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyour401kfromcovid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyour401kfromcovid19crash.com"; sid:524808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologia-covid19.com"; sid:524809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologiacovid19.com"; sid:524810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publiccorona.com"; sid:524811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purgecovid19.com"; sid:524812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for q8covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"q8covid-19.com"; sid:524813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantenacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantenacovid19.com"; sid:524814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queenscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queenscoronavirus.com"; sid:524815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacioncoronavirus.com"; sid:524816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacioncovid19.com"; sid:524817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid19.com"; sid:524818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid.net"; sid:524819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid.services"; sid:524820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid.support"; sid:524821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redshirtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redshirtcorona.com"; sid:524822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redshirtcoronayear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redshirtcoronayear.com"; sid:524823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecovid19.com"; sid:524824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remoteworkingduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remoteworkingduringcoronavirus.com"; sid:524825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for removecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"removecoronavirus.com"; sid:524826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid19.com"; sid:524827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for republicansliedaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"republicansliedaboutcoronavirus.com"; sid:524828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcoronavirus.com"; sid:524829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhodeislandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhodeislandcovid19.com"; sid:524830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riskcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riskcovid.com"; sid:524831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rootbranch-videocontest-kidsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rootbranch-videocontest-kidsoncovid19.com"; sid:524832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rosemaryshandgelcoronaviruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rosemaryshandgelcoronaviruskiller.com"; sid:524833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycorona.com"; sid:524834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanidadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanidadcoronavirus.com"; sid:524835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecoronavirus.com"; sid:524836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocovid-19.com"; sid:524837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19fund.com"; sid:524838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scarycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scarycoronavirus.com"; sid:524839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencovid19.net"; sid:524840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningcoronavirus.com"; sid:524841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningcoronavirus.net"; sid:524842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19.com"; sid:524843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19survivor.com"; sid:524844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcheckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcheckcovid19.com"; sid:524845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfstoragecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfstoragecoronavirus.com"; sid:524846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronatime.com"; sid:524847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-covid19.com"; sid:524848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldigettestedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldigettestedcovid19.com"; sid:524849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaycovid19.com"; sid:524850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.club"; sid:524851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.com"; sid:524852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.life"; sid:524853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.net"; sid:524854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.world"; sid:524855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sliderscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sliderscorona.com"; sid:524856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sliderscoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sliderscoronas.com"; sid:524857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivialcoronavirus.com"; sid:524858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescoronavirus.com"; sid:524859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcarolinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcarolinacovid19.com"; sid:524860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southdakotacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southdakotacovid19.com"; sid:524861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spotcovid.com"; sid:524862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsagainstcorona.com"; sid:524863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsagainstcoronavirus.com"; sid:524864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statesborocovidchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statesborocovidchat.com"; sid:524865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staypositiveduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staypositiveduringcorona.com"; sid:524866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona-19.com"; sid:524867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus19.com"; sid:524868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-19.net"; sid:524869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19.net"; sid:524870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19ua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19ua.com"; sid:524871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19ua.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19ua.net"; sid:524872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesofcorona.com"; sid:524873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcovid19.com"; sid:524874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suethechinesegovernment-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suethechinesegovernment-covid19.com"; sid:524875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplycorona.com"; sid:524876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcoronavirus.com"; sid:524877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid19.com"; sid:524878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid19cure.com"; sid:524879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid19cure.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid19cure.mobi"; sid:524880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid19cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid19cure.net"; sid:524881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovidsurvivor.com"; sid:524882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppresscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppresscorona.com"; sid:524883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surivecorona.com"; sid:524884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecorona.net"; sid:524885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronaviruspandemic.com"; sid:524886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survived-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survived-covid19.com"; sid:524887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid.com"; sid:524888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving-corona.com"; sid:524889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorofcoronavirus.com"; sid:524890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcorona.com"; sid:524891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid19.com"; sid:524892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid19.net"; sid:524893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomscoronavirus.net"; sid:524894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcovid-19.com"; sid:524895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeyourmindoffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeyourmindoffcorona.com"; sid:524896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techagainstcovid19.com"; sid:524897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techcovid.com"; sid:524898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telacoronavirus.com"; sid:524899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecoronavirus.com"; sid:524900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennesseecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennesseecovid19.com"; sid:524901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirus.today"; sid:524902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid.com"; sid:524903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedforcovid19.com"; sid:524904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcorona.com"; sid:524905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid.com"; sid:524906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testoncoronavirus.com"; sid:524907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirusattorney.com"; sid:524908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19.com"; sid:524909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankscoronavirus.com"; sid:524910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucoronavirus.com"; sid:524911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababyboom.com"; sid:524912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaboom.com"; sid:524913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabump.com"; sid:524914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachronicles.com"; sid:524915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclassroom.com"; sid:524916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacles.com"; sid:524917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacourse.com"; sid:524918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.life"; sid:524919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamovie.com"; sid:524920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronathon.com"; sid:524921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbunker.com"; sid:524922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfoundation.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfoundation.today"; sid:524923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmovie.com"; sid:524924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusrecession.com"; sid:524925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusspreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusspreads.com"; sid:524926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusstore.com"; sid:524927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.support"; sid:524928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustester.com"; sid:524929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustestkits.com"; sid:524930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.today"; sid:524931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavshield.com"; sid:524932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronayear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronayear.com"; sid:524933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19attorney.com"; sid:524934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19-cure.com"; sid:524935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19cure.com"; sid:524936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19recession.com"; sid:524937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19vaccine.com"; sid:524938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19vaccine.com"; sid:524939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcure.com"; sid:524940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfoundation.com"; sid:524941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgeneration.com"; sid:524942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinstitute.com"; sid:524943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlaw.com"; sid:524944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlife.com"; sid:524945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsociety.com"; sid:524946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsurvivor.com"; sid:524947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtester.com"; sid:524948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedailycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedailycovid.com"; sid:524949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theglobalpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theglobalpandemic.net"; sid:524950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thejoyofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thejoyofcovid.com"; sid:524951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelovepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelovepandemic.com"; sid:524952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicguide.com"; sid:524953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpodcast.com"; sid:524954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesymptomsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesymptomsofcoronavirus.com"; sid:524955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesymptomsofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesymptomsofcovid-19.com"; sid:524956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewordcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewordcorona.com"; sid:524957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theyearofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theyearofthecorona.com"; sid:524958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theygotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theygotcovid19.com"; sid:524959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisiscoronavirus.com"; sid:524960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thwwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thwwuhanvirus.com"; sid:524961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwithcorona.com"; sid:524962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwithcoronavirus.com"; sid:524963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpapercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpapercoronavirus.com"; sid:524964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronavirusattorney.com"; sid:524965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronaviruslawyer.com"; sid:524966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovid-19.com"; sid:524967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tradecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tradecorona.com"; sid:524968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcovid.com"; sid:524969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trendingcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trendingcoronavirusnews.com"; sid:524970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump2020coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump2020coronavirus.com"; sid:524971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-covid19.com"; sid:524972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpdidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpdidcovid.com"; sid:524973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumphascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumphascorona.com"; sid:524974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpliedaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpliedaboutcoronavirus.com"; sid:524975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulsacoronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulsacoronaviruscleaningservice.com"; sid:524976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulsacovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulsacovid19cleaningservice.com"; sid:524977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcorona.com"; sid:524978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronavirusenlondres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronavirusenlondres.com"; sid:524979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovid.com"; sid:524980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontraelcoronavirus.com"; sid:524981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporelcoronavirus.com"; sid:524982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosxelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosxelcoronavirus.com"; sid:524983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosxelcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosxelcoronavirus.net"; sid:524984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniteagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniteagainstcovid-19.com"; sid:524985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniteagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniteagainstcovid19.com"; sid:524986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedbythecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedbythecoronavirus.com"; sid:524987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovid19.com"; sid:524988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedwaycovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedwaycovid19fund.com"; sid:524989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19test.com"; sid:524990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscorona19.com"; sid:524991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscorona19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscorona19virus.com"; sid:524992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronatracker.com"; sid:524993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19count.com"; sid:524994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19test.com"; sid:524995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19virus.com"; sid:524996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidmap.com"; sid:524997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidvirus.com"; sid:524998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovid19.com"; sid:524999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine4covid19.com"; sid:525000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-corona.com"; sid:525001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronavirus19.com"; sid:525002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacoronavirus19.com"; sid:525003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaincrelecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaincrelecorona.com"; sid:525004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veiligcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veiligcorona.com"; sid:525005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venturacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venturacoronavirus.com"; sid:525006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venturacoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venturacoronavirusinfo.com"; sid:525007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venturacountycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venturacountycoronavirus.com"; sid:525008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venturacountycoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venturacountycoronavirusinfo.com"; sid:525009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vermontcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vermontcovid19.com"; sid:525010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vircorona.com"; sid:525011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voluntarioscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voluntarioscoronavirus.com"; sid:525012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voluntarioscoronavius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voluntarioscoronavius.com"; sid:525013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voluntariscovid19andorra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voluntariscovid19andorra.com"; sid:525014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voting-and-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voting-and-coronavirus.com"; sid:525015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovid19response.com"; sid:525016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovid19response.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovid19response.net"; sid:525017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovidresponse.com"; sid:525018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovidresponse.net"; sid:525019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacorona.com"; sid:525020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walkinginthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walkinginthetimeofcoronavirus.com"; sid:525021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walmartcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walmartcovid19test.com"; sid:525022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washawaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washawaycoronavirus.com"; sid:525023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncovid19.com"; sid:525024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid19.com"; sid:525025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid.com"; sid:525026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecanbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecanbeatcovid19.com"; sid:525027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovid19.com"; sid:525028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcorona.com"; sid:525029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronavirus.com"; sid:525030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecoronavirus.com"; sid:525031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecoronavirus.net"; sid:525032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcoronavirusdid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcoronavirusdid.today"; sid:525033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsthecoronavirus.com"; sid:525034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatthecorona.com"; sid:525035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoinanepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoinanepidemic.com"; sid:525036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoinanepidemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoinanepidemic.today"; sid:525037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheretogo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheretogo-covid19.com"; sid:525038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascovid-19.com"; sid:525039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascovid.com"; sid:525040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whycovid19.com"; sid:525041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wirgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wirgegencorona.com"; sid:525042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisconsincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisconsincovid19.com"; sid:525043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecorona.com"; sid:525044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronamap.com"; sid:525045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusresistance.com"; sid:525046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldstrongfreeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldstrongfreeofcovid19.com"; sid:525047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbanjiawang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbanjiawang.com"; sid:525048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoranavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoranavirus.com"; sid:525049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanffm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanffm.com"; sid:525050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwear.com"; sid:525051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wyomingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wyomingcovid19.com"; sid:525052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronanlem-jcb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronanlem-jcb.com"; sid:525053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronakit.com"; sid:525054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirushandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirushandbook.com"; sid:525055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirustest.com"; sid:525056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidopinions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidopinions.com"; sid:525057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youropiniononcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youropiniononcovid.com"; sid:525058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourvoiceoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourvoiceoncovid.com"; sid:525059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yousurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yousurvivedcovid19.com"; sid:525060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zero-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zero-corona.com"; sid:525061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zero-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zero-covid19.com"; sid:525062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus.world"; sid:525063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.world"; sid:525064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 220covid-19safetyparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"220covid-19safetyparties.com"; sid:525065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 901covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"901covid19.com"; sid:525066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid.com"; sid:525067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99coronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99coronaparty.com"; sid:525068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-corona-united.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-corona-united.com"; sid:525069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcoronaunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcoronaunited.com"; sid:525070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovid19.com"; sid:525071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovid.com"; sid:525072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahcsaccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahcsaccovid19.com"; sid:525073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbnbcovidcancellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbnbcovidcancellation.com"; sid:525074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbnbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbnbcovid.com"; sid:525075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akcovid19.com"; sid:525076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcovid19.com"; sid:525077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertacovid19.com"; sid:525078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliveinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliveinthetimeofcoronavirus.com"; sid:525079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti3coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti3coronavirus.com"; sid:525080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti3covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti3covid19.com"; sid:525081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus19.com"; sid:525082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidnineteen.com"; sid:525083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-pandemic.com"; sid:525084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscorona.net"; sid:525085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anwalt-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anwalt-corona.com"; sid:525086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicstory.com"; sid:525087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apocalipsiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apocalipsiscovid19.com"; sid:525088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovid19.com"; sid:525089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for armacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"armacoronavirus.com"; sid:525090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artagainstcorona.com"; sid:525091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistsagainstcovid19.com"; sid:525092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcorona.com"; sid:525093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcorona.net"; sid:525094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyscoronavirus.com"; sid:525095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyscovid19.com"; sid:525096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincorona.com"; sid:525097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avertcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avertcorona.com"; sid:525098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacoronavirus.net"; sid:525099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovid.com"; sid:525100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudas-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudas-coronavirus.com"; sid:525101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudas-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudas-covid19.com"; sid:525102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid-19.com"; sid:525103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid19.com"; sid:525104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycoronavirus.com"; sid:525105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangkokcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangkokcovid19.com"; sid:525106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptfromcorona.com"; sid:525107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battagliacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battagliacoronavirus.com"; sid:525108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbkcoronavirus.com"; sid:525109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.net"; sid:525110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatedcorona.com"; sid:525111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatpandemic.com"; sid:525112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beckercovid19-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beckercovid19-nj.com"; sid:525113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronafree.com"; sid:525114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforeandaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforeandaftercoronavirus.com"; sid:525115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafefromcoronavirus.com"; sid:525116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blindatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blindatecovid.com"; sid:525117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcovid19.com"; sid:525118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcovid.com"; sid:525119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockthecovid.com"; sid:525120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredbycorona.com"; sid:525121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bristolcovidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bristolcovidproject.com"; sid:525122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulletproofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulletproofcorona.com"; sid:525123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buongkhucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buongkhucovid.com"; sid:525124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptcoronavirus.com"; sid:525125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavires.com"; sid:525126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-coronavirus.com"; sid:525127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirustestkit.com"; sid:525128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidtestkit.com"; sid:525129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-for-coronavirus.com"; sid:525130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyforcoronavirus.com"; sid:525131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buzzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buzzcorona.com"; sid:525132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19.com"; sid:525133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafe-corona.com"; sid:525134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmcovid.com"; sid:525135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camisetascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camisetascoronavirus.com"; sid:525136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovid-19.com"; sid:525137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscurescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscurescorona.com"; sid:525138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringthrucovid.com"; sid:525139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchingcovid9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchingcovid9.com"; sid:525140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccorona.com"; sid:525141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chatcorona.com"; sid:525142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chatcovid19.com"; sid:525143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chatcovid.com"; sid:525144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chateaucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chateaucorona.com"; sid:525145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirus2020.com"; sid:525146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovid19.com"; sid:525147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchaftercoronavirus.com"; sid:525148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchaftercovid19.com"; sid:525149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchaftercovid.com"; sid:525150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchandcoronavirus.com"; sid:525151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovidresponse.com"; sid:525152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classof2020covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classof2020covid.com"; sid:525153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean-coronavirus.com"; sid:525154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancoronaviruses.com"; sid:525155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clobberthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clobberthecorona.com"; sid:525156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closed4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closed4corona.com"; sid:525157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothed4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothed4corona.com"; sid:525158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid19.com"; sid:525159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codersagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codersagainstcovid.com"; sid:525160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeewithcovid.com"; sid:525161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeewithcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeewithcovid.net"; sid:525162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirustest.com"; sid:525163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovid19test.com"; sid:525164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona19.com"; sid:525165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcoronaviruspodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcoronaviruspodcast.com"; sid:525166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsensecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsensecorona.com"; sid:525167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comoprevenirelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comoprevenirelcoronavirus.com"; sid:525168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquer-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquer-covid.com"; sid:525169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracovid.com"; sid:525170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractingcorona.com"; sid:525171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractingcoronavirus.com"; sid:525172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractingcovid.com"; sid:525173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingforcorona.com"; sid:525174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingforcoronavirus.com"; sid:525175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingforcovid19.com"; sid:525176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid-19.com"; sid:525177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid19.life"; sid:525178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona019.com"; sid:525179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona10.com"; sid:525180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19check.com"; sid:525181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19doctor.com"; sid:525182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19epichouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19epichouseparty.com"; sid:525183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19help.com"; sid:525184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19labtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19labtesting.com"; sid:525185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.mobi"; sid:525186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19selfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19selfcheck.com"; sid:525187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19selftest.com"; sid:525188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19update.com"; sid:525189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19-virus.com"; sid:525190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19viruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19viruses.com"; sid:525191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1st.com"; sid:525192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.world"; sid:525193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona50plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona50plus.com"; sid:525194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona5k.com"; sid:525195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona60plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona60plus.com"; sid:525196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afterparty.com"; sid:525197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaafterparty.com"; sid:525198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalert.net"; sid:525199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-anwalt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-anwalt.net"; sid:525200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-attacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-attacks.com"; sid:525201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyonesies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyonesies.com"; sid:525202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ball.com"; sid:525203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabatshitcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabatshitcrazy.com"; sid:525204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinge.com"; sid:525205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiz.com"; sid:525206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.black"; sid:525207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablock.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablock.club"; sid:525208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabook2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabook2020.com"; sid:525209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabookmarks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabookmarks.com"; sid:525210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboom.net"; sid:525211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreak2020.com"; sid:525212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabs.com"; sid:525213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabucks.com"; sid:525214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulletproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulletproof.com"; sid:525215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabullshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabullshit.com"; sid:525216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterscharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterscharlotte.com"; sid:525217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-button.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-button.com"; sid:525218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuyersguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuyersguide.com"; sid:525219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacage.com"; sid:525220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancel.net"; sid:525221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.agency"; sid:525222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarnaval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarnaval.com"; sid:525223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashloans.com"; sid:525224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashrelief.com"; sid:525225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacdc.com"; sid:525226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacelebrities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacelebrities.com"; sid:525227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacelebrity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacelebrity.com"; sid:525228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentres.com"; sid:525229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaceo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaceo.com"; sid:525230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachance.com"; sid:525231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckout.com"; sid:525232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checks.com"; sid:525233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachildren.com"; sid:525234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacider.com"; sid:525235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacise.com"; sid:525236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcontractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcontractor.com"; sid:525237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcontractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcontractors.com"; sid:525238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcrews.com"; sid:525239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanssanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanssanitizer.com"; sid:525240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanteam.com"; sid:525241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclicker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclicker.com"; sid:525242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosed.com"; sid:525243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosed.net"; sid:525244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothfacemask.com"; sid:525245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothfacemasks.com"; sid:525246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloud.net"; sid:525247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclysm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclysm.com"; sid:525248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffins.com"; sid:525249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacog.com"; sid:525250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolypse.com"; sid:525251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomeback.com"; sid:525252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomfort.com"; sid:525253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomicrelief.com"; sid:525254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compass.com"; sid:525255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompass.com"; sid:525256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacon20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacon20.com"; sid:525257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-connect.com"; sid:525258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconomy.com"; sid:525259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contest.com"; sid:525260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coupons.com"; sid:525261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coverage.com"; sid:525262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovered.com"; sid:525263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19-vaccination.com"; sid:525264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacowboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacowboy.com"; sid:525265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrat.com"; sid:525266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrates.com"; sid:525267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraziness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraziness.com"; sid:525268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscounseling.com"; sid:525269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis-monitor.com"; sid:525270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurevaccine.com"; sid:525271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuts.com"; sid:525272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadagboeken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadagboeken.com"; sid:525273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-daily.com"; sid:525274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dailyfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dailyfun.com"; sid:525275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaisycarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaisycarnival.com"; sid:525276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dayli-fun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dayli-fun.com"; sid:525277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-daylifun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-daylifun.com"; sid:525278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeath2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeath2019.com"; sid:525279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeath2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeath2020.com"; sid:525280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeception.com"; sid:525281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecon.com"; sid:525282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelco.com"; sid:525283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelco.net"; sid:525284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadezenfekteistanbul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadezenfekteistanbul.com"; sid:525285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecarnival.com"; sid:525286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasetest.com"; sid:525287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistancing.com"; sid:525288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocumentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocumentry.com"; sid:525289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoworkout.com"; sid:525290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-drugs.com"; sid:525291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-emergency-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-emergency-plan.com"; sid:525292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyplan.com"; sid:525293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenigma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenigma.com"; sid:525294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepichouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepichouseparty.com"; sid:525295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexperience.com"; sid:525296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fact.com"; sid:525297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsnotfear.com"; sid:525298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafail.com"; sid:525299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fakenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fakenews.com"; sid:525300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fakes.com"; sid:525301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyfun.com"; sid:525302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaqs.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaqs.biz"; sid:525303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafest.net"; sid:525304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaffair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaffair.com"; sid:525305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fighter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fighter.net"; sid:525306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighting.com"; sid:525307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafile.com"; sid:525308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialhardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialhardship.com"; sid:525309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fit.com"; sid:525310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-flowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-flowers.com"; sid:525311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflushot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflushot.com"; sid:525312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforex.com"; sid:525313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrance.com"; sid:525314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecaregivers.com"; sid:525315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedisney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedisney.com"; sid:525316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeevents.com"; sid:525317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeporn.com"; sid:525318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesex.com"; sid:525319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreestamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreestamps.com"; sid:525320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundme.com"; sid:525321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageensalaris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageensalaris.com"; sid:525322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenaration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenaration.com"; sid:525323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageners.com"; sid:525324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageners.net"; sid:525325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-goettingen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-goettingen.com"; sid:525326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gram.com"; sid:525327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrizeprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrizeprojects.com"; sid:525328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagroceries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagroceries.com"; sid:525329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrowth.com"; sid:525330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguide.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguide.bid"; sid:525331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandshake.com"; sid:525332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahead.com"; sid:525333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-healing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-healing.com"; sid:525334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthadvice.com"; sid:525335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcheck.com"; sid:525336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.cloud"; sid:525337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdirectory.com"; sid:525338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdirectory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdirectory.net"; sid:525339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpers.net"; sid:525340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpforyou.com"; sid:525341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.life"; sid:525342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpnow.com"; sid:525343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-versuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-versuch.com"; sid:525344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfsprogramm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfsprogramm.com"; sid:525345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholistic.com"; sid:525346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahollidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahollidays.com"; sid:525347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomegym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomegym.com"; sid:525348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeless.com"; sid:525349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometesting.com"; sid:525350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahospitalityhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahospitalityhelp.com"; sid:525351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahospitalitysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahospitalitysupport.com"; sid:525352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotelconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotelconsulting.com"; sid:525353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotelhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotelhelp.com"; sid:525354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahug.com"; sid:525355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaials.com"; sid:525356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immun.com"; sid:525357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincomeloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincomeloss.com"; sid:525358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionaid.com"; sid:525359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainflection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainflection.com"; sid:525360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformation.net"; sid:525361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insolvenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insolvenz.com"; sid:525362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insovenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insovenz.com"; sid:525363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvasion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvasion.com"; sid:525364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisgone.com"; sid:525365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-isolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-isolation.com"; sid:525366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-israel.com"; sid:525367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajams.com"; sid:525368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajams.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajams.net"; sid:525369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakampf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakampf.com"; sid:525370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakenya.com"; sid:525371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillaz.com"; sid:525372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindnesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindnesschallenge.com"; sid:525373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindness.net"; sid:525374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitcol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitcol.com"; sid:525375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitties.com"; sid:525376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kriese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kriese.com"; sid:525377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakriese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakriese.com"; sid:525378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawfirms.com"; sid:525379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearningcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearningcenter.com"; sid:525380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalennial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalennial.com"; sid:525381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalennials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalennials.com"; sid:525382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalibre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalibre.com"; sid:525383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifeline.com"; sid:525384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive.club"; sid:525385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivemap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivemap.net"; sid:525386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive.today"; sid:525387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdates.net"; sid:525388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogic.com"; sid:525389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogistics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogistics.net"; sid:525390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloon.com"; sid:525391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalossclaims.com"; sid:525392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyzer.com"; sid:525393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadrid.com"; sid:525394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamance.com"; sid:525395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapa.com"; sid:525396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarchmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarchmadness.com"; sid:525397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask-sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask-sa.com"; sid:525398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskz.com"; sid:525399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meine-stadt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meine-stadt.com"; sid:525400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meinestadt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meinestadt.com"; sid:525401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamembers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamembers.com"; sid:525402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-memes.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-memes.club"; sid:525403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemes.net"; sid:525404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamencement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamencement.com"; sid:525405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meter.com"; sid:525406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamicrobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamicrobe.com"; sid:525407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamidwife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamidwife.com"; sid:525408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminderuren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminderuren.com"; sid:525409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiracle.com"; sid:525410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamojo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamojo.com"; sid:525411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamojo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamojo.net"; sid:525412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoment.com"; sid:525413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamontco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamontco.com"; sid:525414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamorona.com"; sid:525415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mu.net"; sid:525416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewnormal.com"; sid:525417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.fyi"; sid:525418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.life"; sid:525419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.network"; sid:525420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanext.com"; sid:525421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanials.com"; sid:525422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanny.com"; sid:525423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanocorona.com"; sid:525424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaobituaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaobituaries.com"; sid:525425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaof.com"; sid:525426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-older.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-older.com"; sid:525427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlineuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlineuniversity.com"; sid:525428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonthecouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonthecouch.com"; sid:525429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopen.com"; sid:525430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoppas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoppas.com"; sid:525431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapad.com"; sid:525432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapanel.com"; sid:525433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapa.net"; sid:525434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapanic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapanic.net"; sid:525435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapantry.com"; sid:525436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapetit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapetit.com"; sid:525437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphilly.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphilly.net"; sid:525438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapic.com"; sid:525439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaydate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaydate.com"; sid:525440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplease.com"; sid:525441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pocalypse.com"; sid:525442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-products.com"; sid:525443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofit.com"; sid:525444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquercetin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquercetin.com"; sid:525445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradiation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradiation.com"; sid:525446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraze.com"; sid:525447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaready.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaready.biz"; sid:525448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-realtime.com"; sid:525449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recht.com"; sid:525450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecipes.com"; sid:525451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefunds.com"; sid:525452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-regional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-regional.com"; sid:525453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.reisen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.reisen"; sid:525454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarescue.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarescue.club"; sid:525455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponseact.com"; sid:525456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroom.com"; sid:525457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarunner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarunner.com"; sid:525458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarunners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarunners.com"; sid:525459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarush.com"; sid:525460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarva.com"; sid:525461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarvirus.com"; sid:525462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.network"; sid:525463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafes.com"; sid:525464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafesex.com"; sid:525465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetrade.com"; sid:525466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyguide.com"; sid:525467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalud.com"; sid:525468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalvation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalvation.com"; sid:525469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaurus.com"; sid:525470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascale.com"; sid:525471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascarwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascarwash.com"; sid:525472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzschirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzschirm.com"; sid:525473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeninglogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeninglogistics.com"; sid:525474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningsolutions.com"; sid:525475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecret.com"; sid:525476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaself.com"; sid:525477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-self-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-self-test.com"; sid:525478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-selftest.com"; sid:525479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftestingkits.com"; sid:525480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashirt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashirt.net"; sid:525481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppingguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppingguide.com"; sid:525482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashots.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashots.net"; sid:525483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesstest.com"; sid:525484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesstreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesstreatment.com"; sid:525485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmoothies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmoothies.com"; sid:525486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasofar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasofar.com"; sid:525487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoft.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoft.net"; sid:525488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasondakika.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasondakika.com"; sid:525489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoup.com"; sid:525490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspray.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspray.world"; sid:525491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasshole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasshole.com"; sid:525492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastamps.com"; sid:525493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-statistic.com"; sid:525494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoper.com"; sid:525495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stories.com"; sid:525496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrength.com"; sid:525497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.style"; sid:525498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesshop.com"; sid:525499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportstore.com"; sid:525500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivell.com"; sid:525501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivors.com"; sid:525502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivors.net"; sid:525503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatable.com"; sid:525504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatag.com"; sid:525505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taxi.com"; sid:525506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tea.com"; sid:525507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterminator.com"; sid:525508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestapp.com"; sid:525509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfind.com"; sid:525510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglocations.com"; sid:525511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglogistics.com"; sid:525512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlogistics.com"; sid:525513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsearch.com"; sid:525514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathinktank.com"; sid:525515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathinktank.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathinktank.net"; sid:525516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatic.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatic.cat"; sid:525517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatips.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatips.net"; sid:525518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatom.com"; sid:525519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tonic.com"; sid:525520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatonics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatonics.com"; sid:525521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrace.com"; sid:525522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackandfieldinvitational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackandfieldinvitational.com"; sid:525523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracker2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracker2020.com"; sid:525524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerpa.com"; sid:525525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracking.net"; sid:525526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingusa.com"; sid:525527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveladvice.com"; sid:525528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelconsulting.com"; sid:525529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrend.com"; sid:525530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturage.com"; sid:525531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatenews.com"; sid:525532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates.today"; sid:525533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacances.com"; sid:525534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavbabies.com"; sid:525535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavgifts.com"; sid:525536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavgifts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavgifts.net"; sid:525537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vibes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vibes.com"; sid:525538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicide.com"; sid:525539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralpneumonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralpneumonia.com"; sid:525540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirii.com"; sid:525541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirith.com"; sid:525542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir.life"; sid:525543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus007.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus007.com"; sid:525544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.cat"; sid:525545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19facts.com"; sid:525546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19forum.com"; sid:525547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19pandemic.com"; sid:525548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19test.com"; sid:525549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19update.com"; sid:525550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020bysk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020bysk.com"; sid:525551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020updates.com"; sid:525552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2023.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2023.com"; sid:525553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2024.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2024.com"; sid:525554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus31.com"; sid:525555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus32.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus32.com"; sid:525556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus3.com"; sid:525557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus41.com"; sid:525558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus43.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus43.com"; sid:525559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus45.com"; sid:525560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus46.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus46.com"; sid:525561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus47.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus47.com"; sid:525562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus501.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus501.com"; sid:525563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus506.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus506.com"; sid:525564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus507.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus507.com"; sid:525565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus52.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus52.com"; sid:525566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus53.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus53.com"; sid:525567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus54.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus54.com"; sid:525568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus55.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus55.com"; sid:525569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus5.com"; sid:525570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus61.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus61.com"; sid:525571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus63.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus63.com"; sid:525572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus66.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus66.com"; sid:525573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus777.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus777.com"; sid:525574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus81.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus81.com"; sid:525575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus82.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus82.com"; sid:525576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus84.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus84.com"; sid:525577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus852.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus852.com"; sid:525578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus904.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus904.com"; sid:525579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus91.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus91.com"; sid:525580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus972.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus972.com"; sid:525581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus98.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus98.com"; sid:525582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadviser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadviser.com"; sid:525583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaffectedarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaffectedarea.com"; sid:525584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-afterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-afterparty.com"; sid:525585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ahora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ahora.com"; sid:525586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairbnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairbnb.com"; sid:525587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalertapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalertapp.com"; sid:525588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamerica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamerica.net"; sid:525589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamsterdam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamsterdam.com"; sid:525590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandme.com"; sid:525591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandyourhomesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandyourhomesale.com"; sid:525592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapple.com"; sid:525593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarabic.com"; sid:525594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusart.com"; sid:525595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasesoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasesoria.com"; sid:525596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasu.com"; sid:525597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusayudas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusayudas.com"; sid:525598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-babies.com"; sid:525599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-baby.com"; sid:525600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabysitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabysitters.com"; sid:525601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbat.com"; sid:525602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbest.com"; sid:525603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestpractices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestpractices.com"; sid:525604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbet.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbet.club"; sid:525605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbkinpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbkinpa.com"; sid:525606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloomberg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloomberg.com"; sid:525607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboca.com"; sid:525608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bocaraton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bocaraton.com"; sid:525609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboeing.com"; sid:525610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbogota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbogota.com"; sid:525611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbots.com"; sid:525612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrussels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrussels.com"; sid:525613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbucaramanga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbucaramanga.com"; sid:525614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessresponse.com"; sid:525615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuyersguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuyersguide.com"; sid:525616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaldas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaldas.com"; sid:525617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscamp.com"; sid:525618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscams.com"; sid:525619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscare.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscare.care"; sid:525620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbs.com"; sid:525621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbus.com"; sid:525622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleans.com"; sid:525623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleantech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleantech.com"; sid:525624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosing.com"; sid:525625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscmap.com"; sid:525626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscnbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscnbc.com"; sid:525627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscnn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscnn.com"; sid:525628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollection.com"; sid:525629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomcast.com"; sid:525630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontroversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontroversy.com"; sid:525631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscostco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscostco.com"; sid:525632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsels.com"; sid:525633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouture.com"; sid:525634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-covid-19.net"; sid:525635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-crazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-crazy.com"; sid:525636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreening.com"; sid:525637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuomo.com"; sid:525638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureuk.com"; sid:525639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscvs.com"; sid:525640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdaily.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdaily.net"; sid:525641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdaisycarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdaisycarnival.com"; sid:525642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdashboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdashboards.com"; sid:525643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-death-rate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-death-rate.com"; sid:525644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-deathrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-deathrate.com"; sid:525645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeaths.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeaths.world"; sid:525646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeblasio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeblasio.com"; sid:525647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebthelp.com"; sid:525648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtrelief.com"; sid:525649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeclassified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeclassified.com"; sid:525650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensebuilder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensebuilder.com"; sid:525651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelraybeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelraybeach.com"; sid:525652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdevelopments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdevelopments.com"; sid:525653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiaryfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiaryfilm.com"; sid:525654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisaster.com"; sid:525655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecarnival.com"; sid:525656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecovid19.com"; sid:525657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdish.com"; sid:525658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdow.com"; sid:525659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethrutests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethrutests.com"; sid:525660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrones.com"; sid:525661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseando.com"; sid:525662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecure.com"; sid:525663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusedu.com"; sid:525664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffects2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffects2020.com"; sid:525665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseguide.com"; sid:525666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselbump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselbump.com"; sid:525667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselbumps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselbumps.com"; sid:525668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusellen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusellen.com"; sid:525669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentlawyer.com"; sid:525670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusen.com"; sid:525671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenespanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenespanol.com"; sid:525672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespn.com"; sid:525673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesstats.com"; sid:525674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusetest.com"; sid:525675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusetests.com"; sid:525676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevictions.com"; sid:525677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacebook.com"; sid:525678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactnotfear.com"; sid:525679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsnotfear.com"; sid:525680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacts.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacts.today"; sid:525681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastclean.com"; sid:525682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfed.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfed.loans"; sid:525683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilm.net"; sid:525684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfit.com"; sid:525685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforblackpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforblackpeople.com"; sid:525686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfox.com"; sid:525687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoxnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoxnews.com"; sid:525688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-franchise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-franchise.com"; sid:525689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrombat.com"; sid:525690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoodwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoodwill.com"; sid:525691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgosport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgosport.com"; sid:525692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgossip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgossip.com"; sid:525693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgossip.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgossip.net"; sid:525694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovermentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovermentrelief.com"; sid:525695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreekfreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreekfreak.com"; sid:525696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgriefsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgriefsupport.com"; sid:525697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushbo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushbo.com"; sid:525698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthguide.com"; sid:525699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthhelp.com"; sid:525700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthresources.com"; sid:525701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp360.com"; sid:525702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp360.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp360.net"; sid:525703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp911.com"; sid:525704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpcenters.com"; sid:525705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpexchange.com"; sid:525706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpinfo.com"; sid:525707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpinformation.com"; sid:525708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.support"; sid:525709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpusa.com"; sid:525710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hero.com"; sid:525711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushero.com"; sid:525712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheroes.com"; sid:525713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushilfspaket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushilfspaket.com"; sid:525714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushilfspaket.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushilfspaket.net"; sid:525715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusholistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusholistics.com"; sid:525716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalitysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalitysupport.com"; sid:525717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotelconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotelconsulting.com"; sid:525718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotelhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotelhelp.com"; sid:525719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindiaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindiaclub.com"; sid:525720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-india-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-india-map.com"; sid:525721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfected.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfected.club"; sid:525722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectedme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectedme.com"; sid:525723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionprevention.com"; sid:525724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo2020.com"; sid:525725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfonow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfonow.com"; sid:525726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformation2020.com"; sid:525727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-information.com"; sid:525728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-infos.com"; sid:525729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinput.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinput.com"; sid:525730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurance.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurance.company"; sid:525731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceusa.com"; sid:525732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinuk.com"; sid:525733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-isolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-isolation.com"; sid:525734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusivyleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusivyleague.com"; sid:525735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjunk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjunk.com"; sid:525736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskindness.com"; sid:525737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskirkland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskirkland.com"; sid:525738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskredit.com"; sid:525739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskredit.net"; sid:525740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabstest.com"; sid:525741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabtesting.com"; sid:525742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatinoamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatinoamerica.com"; sid:525743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruslawsuit.com"; sid:525744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer911.com"; sid:525745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyers911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyers911.com"; sid:525746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer.solutions"; sid:525747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerusa.com"; sid:525748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaywer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaywer.com"; sid:525749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslearning.com"; sid:525750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleave.com"; sid:525751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegislation.com"; sid:525752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslies.com"; sid:525753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifekit.com"; sid:525754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivecounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivecounter.com"; sid:525755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanhelp.com"; sid:525756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lockdown.com"; sid:525757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockdown.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockdown.net"; sid:525758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslol.com"; sid:525759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslyft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslyft.com"; sid:525760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadeinchina.com"; sid:525761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmail.com"; sid:525762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmania.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmania.net"; sid:525763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanizales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanizales.com"; sid:525764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapp.com"; sid:525765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmartiallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmartiallaw.com"; sid:525766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask24.com"; sid:525767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksuk.com"; sid:525768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalclinic.com"; sid:525769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalphysician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalphysician.com"; sid:525770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicene.com"; sid:525771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmojo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmojo.com"; sid:525772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmojo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmojo.net"; sid:525773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoms.com"; sid:525774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmovie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmovie.net"; sid:525775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmysterys.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmysterys.today"; sid:525776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmysterys.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmysterys.world"; sid:525777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95facialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95facialmask.com"; sid:525778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95facialmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95facialmasks.com"; sid:525779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnamaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnamaste.com"; sid:525780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalprevention.com"; sid:525781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnbc.com"; sid:525782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnearesttestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnearesttestingsites.com"; sid:525783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnegative.com"; sid:525784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewrochelle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewrochelle.com"; sid:525785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsaustralia.com"; sid:525786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.international"; sid:525787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.life"; sid:525788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsom.com"; sid:525789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewstv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewstv.com"; sid:525790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsuk.com"; sid:525791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsusa.com"; sid:525792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewzealand.com"; sid:525793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ninja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ninja.com"; sid:525794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnomore.com"; sid:525795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnyt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnyt.com"; sid:525796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusohiostate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusohiostate.com"; sid:525797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonesie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonesie.com"; sid:525798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinestore.com"; sid:525799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopinionpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopinionpodcast.com"; sid:525800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoprah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoprah.com"; sid:525801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusout.net"; sid:525802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oximeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oximeter.com"; sid:525803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoximeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoximeter.com"; sid:525804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaidleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaidleave.com"; sid:525805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspalmbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspalmbeach.com"; sid:525806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanicrelief.com"; sid:525807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-patch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-patch.com"; sid:525808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatches.com"; sid:525809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspedia.com"; sid:525810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetridish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetridish.com"; sid:525811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspills.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspills.net"; sid:525812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pray-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pray-now.com"; sid:525813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprescreen.com"; sid:525814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionbundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionbundle.com"; sid:525815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprhelp.com"; sid:525816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprints.com"; sid:525817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspr.net"; sid:525818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprogress.com"; sid:525819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona--virus--protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona--virus--protection.com"; sid:525820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionguide.com"; sid:525821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotect.net"; sid:525822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspt.com"; sid:525823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pulse-oximeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pulse-oximeter.com"; sid:525824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspulseoximeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspulseoximeter.com"; sid:525825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspune.com"; sid:525826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusq.com"; sid:525827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquercetin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquercetin.com"; sid:525828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquestioner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquestioner.com"; sid:525829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquestionnaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquestionnaire.com"; sid:525830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusracism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusracism.com"; sid:525831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-reading-list.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-reading-list.com"; sid:525832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecessionguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecessionguide.com"; sid:525833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreducation.com"; sid:525834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreducation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreducation.net"; sid:525835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreiki.com"; sid:525836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreimbursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreimbursement.com"; sid:525837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefbill.com"; sid:525838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrent.com"; sid:525839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearch.net"; sid:525840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponsefund.com"; sid:525841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponses.com"; sid:525842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrocks.com"; sid:525843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-russia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-russia.com"; sid:525844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussah.com"; sid:525845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussamsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussamsclub.com"; sid:525846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaniwipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaniwipe.com"; sid:525847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaniwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaniwipes.com"; sid:525848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screen.com"; sid:525849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecure.com"; sid:525850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfhelp.com"; sid:525851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selfisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selfisolation.com"; sid:525852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussfh.com"; sid:525853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoppingguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoppingguide.com"; sid:525854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshowtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshowtime.com"; sid:525855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshtf.com"; sid:525856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusiness.com"; sid:525857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspot.com"; sid:525858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussprint.com"; sid:525859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussreening.com"; sid:525860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussteamclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussteamclean.com"; sid:525861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stop.net"; sid:525862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudyfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudyfromhome.com"; sid:525863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussupport.com"; sid:525864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportnetwork.com"; sid:525865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportusa.com"; sid:525866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalcourse.com"; sid:525867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussurvivalkit.com"; sid:525868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussurvivors.com"; sid:525869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptoms.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptoms.club"; sid:525870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustarget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustarget.com"; sid:525871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteachfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteachfromhome.com"; sid:525872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tees.com"; sid:525873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-telescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-telescreen.com"; sid:525874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestclinic.com"; sid:525875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustester.com"; sid:525876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinfo.com"; sid:525877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmap.com"; sid:525878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing.net"; sid:525879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnow.com"; sid:525880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsites.com"; sid:525881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitusa.com"; sid:525882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestresults.com"; sid:525883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustfh.com"; sid:525884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthebook.com"; sid:525885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustj.com"; sid:525886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustownhallmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustownhallmeeting.com"; sid:525887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-treatment.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-treatment.today"; sid:525888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustshirts2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustshirts2020.com"; sid:525889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustwc.com"; sid:525890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuber.com"; sid:525891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuc.com"; sid:525892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-uncensored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-uncensored.com"; sid:525893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniversities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniversities.com"; sid:525894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatecdn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatecdn.com"; sid:525895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates2020.com"; sid:525896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates.today"; sid:525897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvandy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvandy.com"; sid:525898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ventilator.com"; sid:525899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusventilators.com"; sid:525900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusverizon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusverizon.com"; sid:525901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusviacom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusviacom.com"; sid:525902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvr.com"; sid:525903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalgreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalgreens.com"; sid:525904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalmart.com"; sid:525905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswapo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswapo.com"; sid:525906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhat.com"; sid:525907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-what-to-buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-what-to-buy.com"; sid:525908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhattobuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhattobuy.com"; sid:525909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkoutclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkoutclub.com"; sid:525910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkspacesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkspacesolution.com"; sid:525911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld.club"; sid:525912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswsj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswsj.com"; sid:525913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusya.com"; sid:525914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyopal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyopal.com"; sid:525915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszion.com"; sid:525916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszionwilliamson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszionwilliamson.com"; sid:525917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruz.net"; sid:525918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vital.com"; sid:525919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavital.com"; sid:525920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviurs-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviurs-map.com"; sid:525921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteers.com"; sid:525922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteers.net"; sid:525923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoucher.com"; sid:525924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijwillger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijwillger.com"; sid:525925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vs-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vs-world.com"; sid:525926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vs-world.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vs-world.net"; sid:525927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashablefacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashablefacemask.com"; sid:525928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashablefacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashablefacemasks.com"; sid:525929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebsite.com"; sid:525930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawfh.com"; sid:525931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipies.com"; sid:525932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithalyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithalyme.com"; sid:525933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldkids.com"; sid:525934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayuda.com"; sid:525935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazona.com"; sid:525936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazona.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazona.fyi"; sid:525937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazone.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazone.fyi"; sid:525938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countcovid.com"; sid:525939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covered4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covered4corona.com"; sid:525940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid101.com"; sid:525941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid101.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid101.net"; sid:525942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19101.com"; sid:525943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid191o1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid191o1.com"; sid:525944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accessories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accessories.com"; sid:525945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-action.com"; sid:525946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19advice.com"; sid:525947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-affected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-affected.com"; sid:525948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-airtraffic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-airtraffic.com"; sid:525949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alabama.com"; sid:525950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19almostkilledme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19almostkilledme.com"; sid:525951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19almostkilledme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19almostkilledme.com"; sid:525952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analysis.com"; sid:525953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andrestaurants.com"; sid:525954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19apparel.com"; sid:525955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistance.com"; sid:525956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistant.com"; sid:525957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babyboom.com"; sid:525958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bayarea.com"; sid:525959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-benefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-benefits.com"; sid:525960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19best.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19best.com"; sid:525961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bible.com"; sid:525962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biblio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biblio.com"; sid:525963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biden.com"; sid:525964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19board.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19board.com"; sid:525965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bogota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bogota.com"; sid:525966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-book.com"; sid:525967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19booster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19booster.com"; sid:525968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bulgaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bulgaria.com"; sid:525969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessemergency.com"; sid:525970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessguide.com"; sid:525971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buy.com"; sid:525972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19caldas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19caldas.com"; sid:525973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19california.com"; sid:525974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caribtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caribtracker.com"; sid:525975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19casanare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19casanare.com"; sid:525976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cash.com"; sid:525977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centernearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centernearme.com"; sid:525978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-charts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-charts.com"; sid:525979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chats.com"; sid:525980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chats.com"; sid:525981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checks.com"; sid:525982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chilledandconsiderate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chilledandconsiderate.com"; sid:525983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chilledandconsiderate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chilledandconsiderate.net"; sid:525984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanexperts.com"; sid:525985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanexperts.com"; sid:525986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicsusa.com"; sid:525987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicsus.com"; sid:525988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19code.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19code.com"; sid:525989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19colombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19colombia.com"; sid:525990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comicrelief.com"; sid:525991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19community.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19community.support"; sid:525992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.company"; sid:525993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compendium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compendium.com"; sid:525994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19conversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19conversation.com"; sid:525995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cpr.com"; sid:525996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cured.com"; sid:525997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19danger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19danger.com"; sid:525998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclock.com"; sid:525999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defend.com"; sid:526000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defender.com"; sid:526001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defender.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defender.net"; sid:526002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defend.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defend.net"; sid:526003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dehypnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dehypnosis.com"; sid:526004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectant.com"; sid:526005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfecting.com"; sid:526006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disruption.com"; sid:526007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19docs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19docs.com"; sid:526008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-documentary.com"; sid:526009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19documentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19documentry.com"; sid:526010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donation.com"; sid:526011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donation.com"; sid:526012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donation.net"; sid:526013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugs2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugs2020.com"; sid:526014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfund.com"; sid:526015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfund.net"; sid:526016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-emergencyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-emergencyhelp.com"; sid:526017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyhelp.com"; sid:526018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyhelpers.com"; sid:526019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19encyclopedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19encyclopedia.com"; sid:526020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.energy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.energy"; sid:526021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eng.com"; sid:526022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epichouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epichouseparty.com"; sid:526023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictions.com"; sid:526024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expert.com"; sid:526025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-explained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-explained.com"; sid:526026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factnotfear.com"; sid:526027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facts2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facts2020.com"; sid:526028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsnotfear.com"; sid:526029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.faith - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.faith"; sid:526030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fallenheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fallenheros.com"; sid:526031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fallenstars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fallenstars.com"; sid:526032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19family.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19family.com"; sid:526033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.farm - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.farm"; sid:526034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fast.com"; sid:526035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19film.com"; sid:526036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-film.com"; sid:526037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19film.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19film.net"; sid:526038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.finance"; sid:526039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstaid.com"; sid:526040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forecast.com"; sid:526041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-forums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-forums.com"; sid:526042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freecaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freecaregivers.com"; sid:526043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19germany.com"; sid:526044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19global.com"; sid:526045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goods.com"; sid:526046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goods.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goods.delivery"; sid:526047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gpscreeningform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gpscreeningform.com"; sid:526048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19grid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19grid.com"; sid:526049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grid.com"; sid:526050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handwasher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handwasher.com"; sid:526051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthadvice.com"; sid:526052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcheck.com"; sid:526053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.center"; sid:526054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpnow.com"; sid:526055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heros.com"; sid:526056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19holistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19holistic.com"; sid:526057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometesting.com"; sid:526058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hotspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hotspot.com"; sid:526059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotzones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotzones.com"; sid:526060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19house.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19house.com"; sid:526061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19impact.com"; sid:526062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infectionprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infectionprevention.com"; sid:526063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infoapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infoapp.com"; sid:526064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-info-gc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-info-gc.com"; sid:526065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infohub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infohub.com"; sid:526066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infonet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infonet.com"; sid:526067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19informacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19informacion.com"; sid:526068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-information.com"; sid:526069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informed.com"; sid:526070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infousa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infousa.com"; sid:526071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kirkland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kirkland.com"; sid:526072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kw.com"; sid:526073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.land - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.land"; sid:526074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latam.com"; sid:526075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-law.com"; sid:526076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legal.com"; sid:526077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lessons.com"; sid:526078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lies.com"; sid:526079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.life"; sid:526080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19liveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19liveupdate.com"; sid:526081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loan.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loan.guru"; sid:526082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loans.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loans.center"; sid:526083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loans.com"; sid:526084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loans.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loans.expert"; sid:526085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loans.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loans.guru"; sid:526086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mag.com"; sid:526087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mania.com"; sid:526088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19map.net"; sid:526089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketplace.com"; sid:526090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksupply.com"; sid:526091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealth.com"; sid:526092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealthsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealthsupport.com"; sid:526093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19money.com"; sid:526094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitoring.com"; sid:526095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-monitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-monitor.net"; sid:526096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.moscow - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.moscow"; sid:526097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.movie"; sid:526098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutualaidslc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutualaidslc.com"; sid:526099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nashville.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nashville.today"; sid:526100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalnews.com"; sid:526101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalsupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalsupplements.com"; sid:526102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.world"; sid:526103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19numbers.com"; sid:526104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offens.com"; sid:526105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offense.com"; sid:526106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offense.net"; sid:526107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offens.net"; sid:526108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ok.com"; sid:526109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinesupport.com"; sid:526110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19only.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19only.com"; sid:526111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreak2020.com"; sid:526112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicinfo.com"; sid:526113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicnews.com"; sid:526114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicnews.com"; sid:526115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panic.com"; sid:526116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19patch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19patch.com"; sid:526117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patches.com"; sid:526118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pedia.com"; sid:526119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pedia.com"; sid:526120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19planning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19planning.com"; sid:526121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19podcast.com"; sid:526122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19politics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19politics.com"; sid:526123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-poll.com"; sid:526124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19portal.com"; sid:526125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prakun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prakun.com"; sid:526126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preppers.com"; sid:526127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prescreen.com"; sid:526128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionmasks.com"; sid:526129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection.net"; sid:526130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proust.com"; sid:526131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-puertorico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-puertorico.com"; sid:526132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-quarantaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-quarantaine.com"; sid:526133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantine.club"; sid:526134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantined.com"; sid:526135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinelife.com"; sid:526136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quercetin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quercetin.com"; sid:526137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19query.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19query.com"; sid:526138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quiz.com"; sid:526139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffund.com"; sid:526140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffunds.com"; sid:526141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefnow.com"; sid:526142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remediation.com"; sid:526143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remedies.com"; sid:526144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researcher.com"; sid:526145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19research.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19research.net"; sid:526146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19results.com"; sid:526147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyguidlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyguidlines.com"; sid:526148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetypack.com"; sid:526149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanitizer.com"; sid:526150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19santander.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19santander.com"; sid:526151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sarscov2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sarscov2.com"; sid:526152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-saude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-saude.com"; sid:526153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sba.com"; sid:526154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sba.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sba.loan"; sid:526155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaloan.com"; sid:526156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sba.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sba.net"; sid:526157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scan.com"; sid:526158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-screen.com"; sid:526159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screen.net"; sid:526160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sea.com"; sid:526161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19secure.com"; sid:526162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selftestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selftestingkits.com"; sid:526163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftestingkits.com"; sid:526164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-serology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-serology.com"; sid:526165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-serology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-serology.net"; sid:526166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serology.net"; sid:526167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-services.com"; sid:526168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sextoys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sextoys.com"; sid:526169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shirt.com"; sid:526170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sideeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sideeffects.com"; sid:526171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19signs.com"; sid:526172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19situations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19situations.com"; sid:526173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbizassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbizassist.com"; sid:526174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smallbusinesstaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smallbusinesstaxcredit.com"; sid:526175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinesstaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinesstaxcredit.com"; sid:526176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-solution.com"; sid:526177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spain.com"; sid:526178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialist.com"; sid:526179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19speedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19speedtest.com"; sid:526180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-statistics.com"; sid:526181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.life"; sid:526182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-status.com"; sid:526183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statusus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statusus.com"; sid:526184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stayhome.com"; sid:526185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stories.com"; sid:526186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-story.com"; sid:526187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stressreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stressreduction.com"; sid:526188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-summit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-summit.email"; sid:526189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survival.club"; sid:526190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivalguide.com"; sid:526191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalhacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalhacks.com"; sid:526192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor.net"; sid:526193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-takecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-takecare.com"; sid:526194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxcredit.com"; sid:526195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxcredit.com"; sid:526196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19technology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19technology.com"; sid:526197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tee.com"; sid:526198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tee.com"; sid:526199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-telescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-telescreen.com"; sid:526200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19telescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19telescreen.com"; sid:526201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telescreen.com"; sid:526202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-telescreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-telescreen.net"; sid:526203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telescreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telescreen.net"; sid:526204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-teletravail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-teletravail.com"; sid:526205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdirect.com"; sid:526206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testers.com"; sid:526207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfinder.com"; sid:526208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcenter.com"; sid:526209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcenters.com"; sid:526210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testinginfo.com"; sid:526211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglocation.com"; sid:526212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingmachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingmachine.com"; sid:526213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmachine.com"; sid:526214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingmachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingmachines.com"; sid:526215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmachines.com"; sid:526216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlabs.com"; sid:526217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testregistration.com"; sid:526218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.solutions"; sid:526219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststrips.com"; sid:526220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.today"; sid:526221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thebook.com"; sid:526222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thefilm.com"; sid:526223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thermometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thermometer.com"; sid:526224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tips.com"; sid:526225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19top.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19top.com"; sid:526226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19topics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19topics.com"; sid:526227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topics.com"; sid:526228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toronto.com"; sid:526229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-treatment.com"; sid:526230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-treatment.com"; sid:526231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19truth.com"; sid:526232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ts.com"; sid:526233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19t-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19t-shirt.com"; sid:526234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19update.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19update.net"; sid:526235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usacases.com"; sid:526236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualrun.com"; sid:526237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus2020.com"; sid:526238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdrug.com"; sid:526239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusmedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusmedication.com"; sid:526240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusoutbreak.com"; sid:526241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusoutbreak.com"; sid:526242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruspandemic.com"; sid:526243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-realtime.com"; sid:526244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virustesting.com"; sid:526245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19voucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19voucher.com"; sid:526246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ware.com"; sid:526247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wars.com"; sid:526248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19way.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19way.com"; sid:526249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19web.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19web.net"; sid:526250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-whatnext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-whatnext.com"; sid:526251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-whatodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-whatodo.com"; sid:526252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wi.com"; sid:526253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wipe.com"; sid:526254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workspacesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workspacesolution.com"; sid:526255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x.pro"; sid:526256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x.solutions"; sid:526257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19yopal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19yopal.com"; sid:526258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zapper.com"; sid:526259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zone.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zone.fyi"; sid:526260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2024.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2024.com"; sid:526261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20pro.com"; sid:526262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20shop.com"; sid:526263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20supplies.com"; sid:526264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-419.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-419.com"; sid:526265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid90.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid90.com"; sid:526266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-911.com"; sid:526267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9map.com"; sid:526268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9maps.com"; sid:526269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teens.com"; sid:526270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid2020.com"; sid:526271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamerica.com"; sid:526272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanti.com"; sid:526273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-apocalypse.com"; sid:526274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-apocalypse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-apocalypse.net"; sid:526275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps.com"; sid:526276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistance.com"; sid:526277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatlas.com"; sid:526278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawareness.com"; sid:526279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessmonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessmonth.com"; sid:526280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabies2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabies2020.com"; sid:526281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabies2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabies2021.com"; sid:526282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyboom.com"; sid:526283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbands.com"; sid:526284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboom.com"; sid:526285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbored.com"; sid:526286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessclaims.com"; sid:526287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalculator.com"; sid:526288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalmclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalmclasses.com"; sid:526289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanary.com"; sid:526290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-card.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-card.com"; sid:526291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaution.com"; sid:526292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcell.com"; sid:526293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecks.com"; sid:526294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchile.com"; sid:526295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclers.com"; sid:526296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.net"; sid:526297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcircus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcircus.com"; sid:526298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.claims"; sid:526299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassof2020.com"; sid:526300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcrew.com"; sid:526301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcrews.com"; sid:526302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningohio.com"; sid:526303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningservices.com"; sid:526304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.net"; sid:526305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardate.com"; sid:526306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardating.com"; sid:526307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcode.com"; sid:526308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.codes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.codes"; sid:526309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomeback.com"; sid:526310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfort.com"; sid:526311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourt.com"; sid:526312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovid.com"; sid:526313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazy.com"; sid:526314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreativeconvention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreativeconvention.com"; sid:526315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.net"; sid:526316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisplan.com"; sid:526317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidculture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidculture.com"; sid:526318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurve.com"; sid:526319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuties.com"; sid:526320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddays.com"; sid:526321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-defence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-defence.com"; sid:526322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenial.com"; sid:526323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidensemble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidensemble.com"; sid:526324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidential.com"; sid:526325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideofest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideofest.com"; sid:526326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos.world"; sid:526327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepression.com"; sid:526328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexam.com"; sid:526329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexchange.com"; sid:526330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexperts.com"; sid:526331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfest.com"; sid:526332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforecast.com"; sid:526333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedate.com"; sid:526334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedating.com"; sid:526335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoods.com"; sid:526336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoogle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoogle.com"; sid:526337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcenters.com"; sid:526338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealth.net"; sid:526339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheatmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheatmap.com"; sid:526340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpers.com"; sid:526341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpireland.com"; sid:526342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help.net"; sid:526343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalneeds.com"; sid:526344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhw.com"; sid:526345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhygiene.com"; sid:526346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiab.com"; sid:526347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmune.com"; sid:526348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiasupport.com"; sid:526349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.net"; sid:526350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.com"; sid:526351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisteril.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisteril.com"; sid:526352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistil.com"; sid:526353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditalia.com"; sid:526354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidj.com"; sid:526355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk.com"; sid:526356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidstalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidstalk.com"; sid:526357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidz.com"; sid:526358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabtest.com"; sid:526359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabtests.com"; sid:526360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.legal"; sid:526361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivemap.com"; sid:526362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocal.com"; sid:526363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlock.com"; sid:526364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmadeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmadeinchina.com"; sid:526365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapp.com"; sid:526366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapp.net"; sid:526367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarket.com"; sid:526368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketplace.com"; sid:526369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmart.com"; sid:526370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskusa.com"; sid:526371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalmask.com"; sid:526372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmom.com"; sid:526373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.moscow - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.moscow"; sid:526374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn19.com"; sid:526375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteentracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteentracker.com"; sid:526376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoregon.com"; sid:526377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpedia.com"; sid:526378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpodcast.com"; sid:526379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprep.net"; sid:526380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescription.com"; sid:526381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproust.com"; sid:526382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarry.com"; sid:526383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradarlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradarlive.com"; sid:526384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistry.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistry.today"; sid:526385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief2020.net"; sid:526386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.events"; sid:526387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.network"; sid:526388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidres.com"; sid:526389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresource.com"; sid:526390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseoregon.com"; sid:526391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskcalculator.com"; sid:526392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitise.com"; sid:526393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentinel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentinel.com"; sid:526394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop.net"; sid:526395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigns.com"; sid:526396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimulator.com"; sid:526397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsn.com"; sid:526398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsourcing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsourcing.com"; sid:526399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspot.com"; sid:526400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatistics.com"; sid:526401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilizing.com"; sid:526402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupports.com"; sid:526403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvive.com"; sid:526404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survivors.com"; sid:526405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalks.com"; sid:526406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidt.com"; sid:526407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteeshirts.com"; sid:526408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginfo.com"; sid:526409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglocations.com"; sid:526410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnearme.com"; sid:526411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestspot.com"; sid:526412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestusa.com"; sid:526413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestus.com"; sid:526414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtogether.com"; sid:526415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.tools"; sid:526416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrap.com"; sid:526417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrap.net"; sid:526418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-truth.com"; sid:526419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-truth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-truth.net"; sid:526420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtshirts.com"; sid:526421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidultrasound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidultrasound.com"; sid:526422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualrun.com"; sid:526423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.care"; sid:526424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscleaners.com"; sid:526425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.healthcare"; sid:526426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusinfo.com"; sid:526427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusmania.com"; sid:526428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussanitizer.com"; sid:526429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustests.com"; sid:526430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisit.com"; sid:526431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoucher.com"; sid:526432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-watch.com"; sid:526433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweather.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweather.com"; sid:526434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscoronavirus.com"; sid:526435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crossoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crossoutcorona.com"; sid:526436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crossroadscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crossroadscorona.com"; sid:526437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid-19.com"; sid:526438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadoscovid-19.com"; sid:526439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadosparaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadosparaelcoronavirus.com"; sid:526440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curarcoronavirus.com"; sid:526441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirusnowusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirusnowusa.com"; sid:526442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcorona.com"; sid:526443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutcorona.com"; sid:526444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutcorona.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutcorona.mobi"; sid:526445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutcorona.net"; sid:526446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuveecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuveecorona.com"; sid:526447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscoronavirus.com"; sid:526448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascoronaviruslawyer.com"; sid:526449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid19lawyer.com"; sid:526450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangercovid-19.com"; sid:526451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datewithcorona.com"; sid:526452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccovid19.com"; sid:526453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddscorona.com"; sid:526454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddsvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddsvscorona.com"; sid:526455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminercoronavirus.com"; sid:526456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovid19.com"; sid:526457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid-19.com"; sid:526458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19.com"; sid:526459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistage-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistage-coronavirus.com"; sid:526460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistage-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistage-covid19.com"; sid:526461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescoronavirus.com"; sid:526462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectercoronavirus.com"; sid:526463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus-covid-19.com"; sid:526464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfektion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfektion-coronavirus.com"; sid:526465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destinationforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destinationforcorona.com"; sid:526466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroycovid.com"; sid:526467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcorona.com"; sid:526468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariodelcoronavirusfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariodelcoronavirusfilm.com"; sid:526469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didintgetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didintgetcoronavirus.com"; sid:526470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diezukunftnachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diezukunftnachcorona.com"; sid:526471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difendersicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difendersicoronavirus.com"; sid:526472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcoronavirus.com"; sid:526473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovid.com"; sid:526474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmdcorona.com"; sid:526475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesbenstillerhavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesbenstillerhavecoronavirus.com"; sid:526476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doestrumphavethecoronavirusyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doestrumphavethecoronavirusyet.com"; sid:526477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19test.com"; sid:526478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domainecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domainecorona.com"; sid:526479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontbeacovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontbeacovidiot.com"; sid:526480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for douknowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"douknowcorona.com"; sid:526481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for douknowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"douknowcovid-19.com"; sid:526482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for douknowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"douknowcovid19.com"; sid:526483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecovid19.com"; sid:526484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouknowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouknowcorona.com"; sid:526485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouknowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouknowcovid-19.com"; sid:526486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouknowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouknowcovid19.com"; sid:526487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcoronavirustest.com"; sid:526488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovid19.com"; sid:526489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovid19test.com"; sid:526490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dukcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dukcovid19live.com"; sid:526491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educovid.com"; sid:526492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effcovid.com"; sid:526493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcorona.net"; sid:526494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminate-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminate-corona.com"; sid:526495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endpandemic.com"; sid:526496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicjokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicjokes.com"; sid:526497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicnews.net"; sid:526498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprepping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprepping.com"; sid:526499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictees.com"; sid:526500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipocoronavirus.com"; sid:526501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecovid.com"; sid:526502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escoronavirus.com"; sid:526503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everybodyvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everybodyvscoronavirus.com"; sid:526504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evitecovid19.com"; sid:526505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcoronatests.com"; sid:526506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsnotfearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsnotfearcorona.com"; sid:526507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsnotfearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsnotfearcoronavirus.com"; sid:526508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsnotfearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsnotfearcovid19.com"; sid:526509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallinginloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallinginloveinthetimeofcorona.com"; sid:526510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid19.com"; sid:526511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid19.com"; sid:526512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.com"; sid:526513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feliciascoronatagebuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feliciascoronatagebuch.com"; sid:526514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight2corona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight2corona.life"; sid:526515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona19.com"; sid:526516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirus19.com"; sid:526517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightoffcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightoffcoronavirus.com"; sid:526518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronahelp.com"; sid:526519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatreatment.com"; sid:526520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finlandcoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finlandcoronastats.com"; sid:526521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcovid.com"; sid:526522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19.com"; sid:526523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for france-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"france-covid19.com"; sid:526524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecovid19.com"; sid:526525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for france-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"france-covid.com"; sid:526526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecovid.com"; sid:526527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for france-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"france-covid.net"; sid:526528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecovid.net"; sid:526529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for franchise-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"franchise-coronavirus.com"; sid:526530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestingsites.com"; sid:526531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustests.com"; sid:526532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19.com"; sid:526533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromcorona.com"; sid:526534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckencorona.com"; sid:526535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingcorona.com"; sid:526536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingcoronavirus.com"; sid:526537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnelcoronavirus.com"; sid:526538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvckcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvckcovid-19.com"; sid:526539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxck-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxck-corona.com"; sid:526540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxcorona.com"; sid:526541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19.com"; sid:526542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ganicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ganicovid-19.com"; sid:526543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geensalariscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geensalariscorona.com"; sid:526544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gegen-corona.com"; sid:526545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsam-gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsam-gegen-corona.net"; sid:526546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generation-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generation-corona.com"; sid:526547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidshot.com"; sid:526548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getridofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getridofcovid.com"; sid:526549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicsurvival.com"; sid:526550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronabirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronabirus.com"; sid:526551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronacirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronacirus.com"; sid:526552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronairus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronairus.com"; sid:526553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaivrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaivrus.com"; sid:526554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirus.net"; sid:526555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirustest.com"; sid:526556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid-19.com"; sid:526557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid19.net"; sid:526558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guamcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guamcoronavirus.com"; sid:526559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guamcovid19.com"; sid:526560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guerracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guerracoronavirus.com"; sid:526561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guidetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guidetocovid19.com"; sid:526562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcorona.today"; sid:526563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcorona.world"; sid:526564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hangoverorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hangoverorcorona.com"; sid:526565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycorona.com"; sid:526566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycoronaday.com"; sid:526567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyofcoronavirus.com"; sid:526568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyofcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyofcoronavirus.net"; sid:526569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyoutcoronavirus.com"; sid:526570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyoutcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyoutcoronavirus.net"; sid:526571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hascorona.com"; sid:526572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagcorona.com"; sid:526573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicoronaupdate.com"; sid:526574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthforcorona.com"; sid:526575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronanow.com"; sid:526576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid-19.com"; sid:526577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid19.com"; sid:526578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfromcoronavirus.com"; sid:526579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpnowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpnowcovid-19.com"; sid:526580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcoronanow.com"; sid:526581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopthecoronavirus.com"; sid:526582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hey-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hey-corona.com"; sid:526583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycorona.net"; sid:526584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highriskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highriskcovid19.com"; sid:526585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holacoronaglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holacoronaglove.com"; sid:526586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homelesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homelesscorona.com"; sid:526587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitforcovid-19.com"; sid:526588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hookingupinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hookingupinthetimeofcorona.com"; sid:526589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hookingupinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hookingupinthetimeofcorona.net"; sid:526590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncorona.com"; sid:526591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcanihelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcanihelpcoronavirus.com"; sid:526592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcoronachangedmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcoronachangedmylife.com"; sid:526593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcoronachangedmylife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcoronachangedmylife.net"; sid:526594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcovid-19changedmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcovid-19changedmylife.com"; sid:526595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcovid-19changedmylife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcovid-19changedmylife.net"; sid:526596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocatchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocatchcoronavirus.com"; sid:526597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how-to-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how-to-coronavirus.com"; sid:526598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodefeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodefeatcoronavirus.com"; sid:526599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopcorona.com"; sid:526600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopcovid19.com"; sid:526601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotreatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotreatcovid-19.com"; sid:526602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hsecovid19.com"; sid:526603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iacovid19.com"; sid:526604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronamask.com"; sid:526605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcovid19.com"; sid:526606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifightcorona.com"; sid:526607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifightcoronavirus.com"; sid:526608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifightcovid19.com"; sid:526609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcovid19.com"; sid:526610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19.com"; sid:526611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imighthavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imighthavecovid19.com"; sid:526612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immune2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immune2corona.com"; sid:526613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immune2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immune2covid19.com"; sid:526614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactofcoronavirus.com"; sid:526615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incontrarsialtempodelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incontrarsialtempodelcorona.com"; sid:526616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovid19.com"; sid:526617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionescoronavirus.com"; sid:526618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionescovid19.com"; sid:526619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indexcovid19.com"; sid:526620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiaagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiaagainstcorona.com"; sid:526621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocorona.net"; sid:526622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacioncovid19.com"; sid:526623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inform-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inform-corona.com"; sid:526624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoscoronavirus.com"; sid:526625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoscovid19.com"; sid:526626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoscovid.com"; sid:526627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insideapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insideapandemic.com"; sid:526628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcorona.com"; sid:526629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronaoveryet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronaoveryet.com"; sid:526630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcorona.com"; sid:526631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcorona.net"; sid:526632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirustshirt.com"; sid:526633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid-19.com"; sid:526634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkimcovid.com"; sid:526635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscovidtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscovidtime.com"; sid:526636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcoronalandscaping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcoronalandscaping.com"; sid:526637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juancovid.com"; sid:526638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kauaicoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kauaicoronaupdate.com"; sid:526639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona19.com"; sid:526640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kimjongcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kimjongcorona.com"; sid:526641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kimscoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kimscoronacare.com"; sid:526642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnesskillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnesskillscovid.com"; sid:526643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnesspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnesspandemic.com"; sid:526644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kissmeiamcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kissmeiamcovidfree.com"; sid:526645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kissmeimcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kissmeimcovidfree.com"; sid:526646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95coronavirus.com"; sid:526647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for krise-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"krise-corona.com"; sid:526648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kscovid19.com"; sid:526649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19.com"; sid:526650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for largeteamdevelopcovid-19testkits.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"largeteamdevelopcovid-19testkits.fail"; sid:526651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnaboutcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnaboutcovid19.today"; sid:526652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lecorona.com"; sid:526653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcovid19.com"; sid:526654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscurecorona.com"; sid:526655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsgetcovidfucked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsgetcovidfucked.com"; sid:526656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstalkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstalkcoronavirus.com"; sid:526657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstalkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstalkcovid-19.com"; sid:526658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid.com"; sid:526659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeginsatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeginsatcovid-19.com"; sid:526660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeginsatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeginsatcovid19.com"; sid:526661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthepandemic.com"; sid:526662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcorona.com"; sid:526663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19.net"; sid:526664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19updates.com"; sid:526665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveinthetimeofcoronavirus.com"; sid:526666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveinthetimeofcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveinthetimeofcoronaviruses.com"; sid:526667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livepidemic.com"; sid:526668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for living-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"living-covid19.com"; sid:526669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthroughcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthroughcovid-19.com"; sid:526670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthroughcovid19.com"; sid:526671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lord-of-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lord-of-corona.com"; sid:526672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-inthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-inthetimeofcorona.com"; sid:526673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luchacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luchacoronavirus.net"; sid:526674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovid19.com"; sid:526675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronavirusgreatagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronavirusgreatagain.com"; sid:526676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingcorona.com"; sid:526677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingcovid.com"; sid:526678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacorona.com"; sid:526679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapadocoronavirus.com"; sid:526680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-covid19.com"; sid:526681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapscoronavirus.com"; sid:526682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maptellswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maptellswuhan.com"; sid:526683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovid19.com"; sid:526684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid.com"; sid:526685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcoronavirus.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcoronavirus.express"; sid:526686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mauicoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mauicoronaupdate.com"; sid:526687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mayormartywalshcoronaviruspublicsafetyevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mayormartywalshcoronaviruspublicsafetyevents.com"; sid:526688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mayormartywalshcovid-19publicsafetyevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mayormartywalshcovid-19publicsafetyevents.com"; sid:526689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mecovid19.com"; sid:526690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetcovid19.com"; sid:526691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memescovid19.com"; sid:526692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minderurencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minderurencorona.com"; sid:526693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigatecorona.com"; sid:526694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronavirustesting.com"; sid:526695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronavirustestingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronavirustestingsites.com"; sid:526696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovid19.com"; sid:526697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for momsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"momsagainstcoronavirus.com"; sid:526698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for momsagainstcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"momsagainstcoronavirus.net"; sid:526699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montecovid.net"; sid:526700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mscforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mscforcoronavirus.com"; sid:526701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mscovid19.com"; sid:526702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtcovid19.com"; sid:526703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacation.com"; sid:526704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronarisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronarisk.com"; sid:526705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronas.com"; sid:526706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasong.com"; sid:526707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaspray.com"; sid:526708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronastory.com"; sid:526709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusregistration.com"; sid:526710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirussong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirussong.com"; sid:526711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustest.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustest.today"; sid:526712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19care.com"; sid:526713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19quarantine.com"; sid:526714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19supplies.com"; sid:526715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19vaccine.com"; sid:526716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidalert.com"; sid:526717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidalert.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidalert.today"; sid:526718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidregistry.com"; sid:526719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidregistry.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidregistry.today"; sid:526720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeinthetimeofcovid19.com"; sid:526721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covidmasks.com"; sid:526722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19.today"; sid:526723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid.com"; sid:526724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19.com"; sid:526725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.center"; sid:526726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.today"; sid:526727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.world"; sid:526728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ndcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ndcovid19.com"; sid:526729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necovid19.com"; sid:526730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyageanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyageanticorona.com"; sid:526731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyage-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyage-coronavirus.com"; sid:526732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronababy.com"; sid:526733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidid.com"; sid:526734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newenglandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newenglandcovid19.com"; sid:526735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscoronavirusau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscoronavirusau.com"; sid:526736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcoronahelp.com"; sid:526737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcovid19.com"; sid:526738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid19.com"; sid:526739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcovid19.com"; sid:526740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.club"; sid:526741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-corona.net"; sid:526742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-covids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-covids.com"; sid:526743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northerncoronagrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northerncoronagrief.com"; sid:526744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norwegiancoronavirusscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norwegiancoronavirusscam.com"; sid:526745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notgetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notgetcoronavirus.com"; sid:526746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascovid-19.com"; sid:526747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus.city"; sid:526748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruscovid-19.com"; sid:526749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruscovid19.com"; sid:526750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruspandemic.com"; sid:526751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus.report"; sid:526752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus.today"; sid:526753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowuhan.com"; sid:526754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvcovid19.com"; sid:526755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaattorney.com"; sid:526756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaattorneys.com"; sid:526757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronalaw.com"; sid:526758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronalawyer.com"; sid:526759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronalawyers.com"; sid:526760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirustesting.com"; sid:526761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19.com"; sid:526762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidcleaning.com"; sid:526763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofertascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofertascoronavirus.com"; sid:526764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofertascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofertascoronavirus.net"; sid:526765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronamasks.com"; sid:526766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusts.com"; sid:526767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidtestkit.com"; sid:526768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidtestkits.com"; sid:526769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcovid19.com"; sid:526770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovid19.com"; sid:526771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcovid19.com"; sid:526772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcoronavirus.com"; sid:526773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcoronavirus.net"; sid:526774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcoronavirus.com"; sid:526775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcoronavirus.net"; sid:526776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingcoronavirus.com"; sid:526777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for owncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"owncorona.com"; sid:526778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovid19.com"; sid:526779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvertising.com"; sid:526780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicast.com"; sid:526781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbenefits.com"; sid:526782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbookclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbookclub.com"; sid:526783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccentral.com"; sid:526784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccentral.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccentral.net"; sid:526785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchallenge.com"; sid:526786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchic.com"; sid:526787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicco19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicco19.com"; sid:526788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdelivery.com"; sid:526789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiaries.com"; sid:526790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-footprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-footprint.com"; sid:526791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimpactfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimpactfund.com"; sid:526792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinnovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinnovations.com"; sid:526793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinovationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinovationfund.com"; sid:526794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclearning.com"; sid:526795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclog.com"; sid:526796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmanagementplan.com"; sid:526797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnews247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnews247.com"; sid:526798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnews.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnews.media"; sid:526799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicninja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicninja.com"; sid:526800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnyc.com"; sid:526801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofhope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofhope.com"; sid:526802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanda.com"; sid:526803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanics.com"; sid:526804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpantrymealroulette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpantrymealroulette.com"; sid:526805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparanoia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparanoia.com"; sid:526806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparenting.com"; sid:526807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartnersbend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartnersbend.com"; sid:526808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-partners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-partners.com"; sid:526809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatrol.com"; sid:526810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaylists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaylists.com"; sid:526811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaymates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaymates.com"; sid:526812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoetrygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoetrygarden.com"; sid:526813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoetrygardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoetrygardens.com"; sid:526814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoets.com"; sid:526815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicportraits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicportraits.com"; sid:526816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepp.com"; sid:526817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionmanagement.com"; sid:526818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionplan.com"; sid:526819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionplanning.com"; sid:526820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionplans.com"; sid:526821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprogeny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprogeny.com"; sid:526822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicqueen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicqueen.com"; sid:526823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriskmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriskmanagement.com"; sid:526824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrumors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrumors.com"; sid:526825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsbox.com"; sid:526826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshelf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshelf.com"; sid:526827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshoppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshoppe.com"; sid:526828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstockup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstockup.com"; sid:526829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstories.com"; sid:526830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstories.net"; sid:526831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-supplies.com"; sid:526832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvival.club"; sid:526833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalguides.com"; sid:526834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalsite.com"; sid:526835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictactical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictactical.com"; sid:526836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-test.com"; sid:526837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-testing.com"; sid:526838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-times.com"; sid:526839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicweed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicweed.com"; sid:526840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworkout.com"; sid:526841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantaucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantaucorona.com"; sid:526842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paranoidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paranoidpandemic.com"; sid:526843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partisanpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partisanpandemic.com"; sid:526844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovidupdates.com"; sid:526845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peaceinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peaceinthepandemic.com"; sid:526846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplevscovid19.com"; sid:526847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcovid-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcovid-19tracker.com"; sid:526848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playlistsforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playlistsforpandemics.com"; sid:526849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcardsfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcardsfromthepandemic.com"; sid:526850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirus.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirus.guru"; sid:526851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirus.today"; sid:526852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.com"; sid:526853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayformecoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayformecoronavirus.biz"; sid:526854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premiumcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premiumcoronamasks.com"; sid:526855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparedpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparedpandemic.com"; sid:526856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparepandemic.com"; sid:526857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparingpandemic.com"; sid:526858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepepidemic.com"; sid:526859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencionsintomastratamientosdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencionsintomastratamientosdelcoronavirus.com"; sid:526860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenircoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenircoronavirus.net"; sid:526861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for problemilegalicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"problemilegalicovid19.com"; sid:526862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectsforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectsforapandemic.com"; sid:526863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccion-coronavirus.com"; sid:526864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovid19.com"; sid:526865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourmoneyfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourmoneyfromcoronavirus.com"; sid:526866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteggersicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteggersicoronavirus.com"; sid:526867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacoronavirus.net"; sid:526868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid-19.com"; sid:526869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseracoronavirus.com"; sid:526870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecovid19.com"; sid:526871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktestcoronavirus.com"; sid:526872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceagainstcorona.com"; sid:526873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raleighbeatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raleighbeatscoronavirus.com"; sid:526874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rassera-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rassera-corona.com"; sid:526875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronadata.com"; sid:526876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realdecreto72020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realdecreto72020covid19.com"; sid:526877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realpandemic.com"; sid:526878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtime-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtime-covid19.com"; sid:526879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtenoproepkrachtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtenoproepkrachtcorona.com"; sid:526880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registercovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registercovid19test.com"; sid:526881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reikicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reikicoronavirus.com"; sid:526882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcoronavirus.com"; sid:526883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remoteworkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remoteworkcovid19.com"; sid:526884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcoronavirussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcoronavirussymptoms.com"; sid:526885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportecoronavirus.com"; sid:526886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistiendoalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistiendoalcoronavirus.com"; sid:526887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respiratorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respiratorcoronavirus.com"; sid:526888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcorona.com"; sid:526889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retocoronavirus.com"; sid:526890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retocoronavirus.net"; sid:526891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricovid19.com"; sid:526892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronasex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronasex.com"; sid:526893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovid-19.com"; sid:526894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe-fromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe-fromcorona.com"; sid:526895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salariscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salariscorona.com"; sid:526896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanacioncoronavirus.com"; sid:526897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocorona.com"; sid:526898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars2-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars2-covid19.com"; sid:526899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccovid19.com"; sid:526900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scrubcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scrubcorona.com"; sid:526901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcovid19.com"; sid:526902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattleinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattleinthetimeofcoronavirus.com"; sid:526903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguroscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguroscoronavirus.com"; sid:526904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendyourenemiescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendyourenemiescoronavirus.com"; sid:526905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seprotegerducoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seprotegerducoronavirus.com"; sid:526906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlersofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlersofwuhan.com"; sid:526907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sheetpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sheetpandemic.com"; sid:526908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidclothing.com"; sid:526909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid.com"; sid:526910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoppingforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoppingforcorona.com"; sid:526911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shrinkinthepandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shrinkinthepandemic2020.com"; sid:526912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutdowncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutdowncorona.com"; sid:526913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutdowncovid19.com"; sid:526914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsofcoronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsofcoronavirusdisease.com"; sid:526915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid-19.com"; sid:526916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid19.com"; sid:526917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid.com"; sid:526918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soberinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soberinthetimeofcorona.com"; sid:526919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivealcovid19.com"; sid:526920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportsandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportsandcorona.com"; sid:526921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staerker-als-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staerker-als-corona.net"; sid:526922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staerkeralscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staerkeralscorona.net"; sid:526923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statistique-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statistique-covid19.com"; sid:526924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellsforcorona.com"; sid:526925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcoronavirus.com"; sid:526926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafear.com"; sid:526927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona.net"; sid:526928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirushop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirushop.com"; sid:526929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusmadrid.com"; sid:526930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopspreadingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopspreadingcorona.com"; sid:526931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecorona19.com"; sid:526932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sueforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sueforcorona.com"; sid:526933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalkitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalkitcorona.com"; sid:526934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid-19.com"; sid:526935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecorona.com"; sid:526936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcoronavirus.com"; sid:526937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcoronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcoronavirusdisease.com"; sid:526938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacticalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacticalpandemic.com"; sid:526939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoutcovid19.com"; sid:526940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taskforcecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taskforcecovid19.com"; sid:526941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcmcovid19.com"; sid:526942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teensagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teensagainstcoronavirus.com"; sid:526943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthcorona.com"; sid:526944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terapiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terapiacoronavirus.com"; sid:526945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcorona19.com"; sid:526946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcorona19.net"; sid:526947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid2019.com"; sid:526948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-for-covid19.com"; sid:526949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingforcovid.com"; sid:526950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit-coronavirus.com"; sid:526951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitforcovid-19.com"; sid:526952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitscovid19.com"; sid:526953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmecovid19.com"; sid:526954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmycorona.com"; sid:526955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirustesting.com"; sid:526956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19lawyer.com"; sid:526957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidtest.com"; sid:526958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankscorona.com"; sid:526959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankswuhan.com"; sid:526960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucorona.com"; sid:526961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyouwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyouwuhan.com"; sid:526962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconomy.com"; sid:526963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-diaries.com"; sid:526964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastore.com"; sid:526965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusinfohub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusinfohub.com"; sid:526966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnetwork.com"; sid:526967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.supplies"; sid:526968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusupdate.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusupdate.center"; sid:526969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid192020.com"; sid:526970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19book.com"; sid:526971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.cat"; sid:526972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19diaries.com"; sid:526973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19doc.com"; sid:526974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19grid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19grid.com"; sid:526975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19grid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19grid.com"; sid:526976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19helpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19helpers.com"; sid:526977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbabies.com"; sid:526978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhub.com"; sid:526979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidians.com"; sid:526980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshot.com"; sid:526981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsite.com"; sid:526982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegoodcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegoodcoronanews.com"; sid:526983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicproject.com"; sid:526984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealpandemic.com"; sid:526985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theusacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theusacovid-19.com"; sid:526986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhancovid-19.com"; sid:526987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thriveinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thriveinthetimeofcoronavirus.com"; sid:526988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeofcorona.com"; sid:526989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timesofcorona.com"; sid:526990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforcoronavirus.com"; sid:526991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsoncoronavirus.com"; sid:526992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncorona.today"; sid:526993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncovid19.com"; sid:526994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronaviruscleaners.com"; sid:526995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackepidemic.com"; sid:526996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackpandemic.com"; sid:526997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tramitescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tramitescoronavirus.com"; sid:526998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tramitescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tramitescoronavirus.net"; sid:526999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatingcorona.com"; sid:527000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpspandemic.com"; sid:527001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tucoronavirus.com"; sid:527002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovid19.com"; sid:527003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronavirustest.com"; sid:527004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19test.com"; sid:527005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimatecoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimatecoronavirusmask.com"; sid:527006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united-against-corona.com"; sid:527007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united-against-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united-against-corona.net"; sid:527008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedagainstcorona.net"; sid:527009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-against-corona.com"; sid:527010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaagainstcorona.com"; sid:527011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirustesting.com"; sid:527012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronasupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronasupply.com"; sid:527013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utcovid19.com"; sid:527014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillscovid19.com"; sid:527015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvstopscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvstopscorona.com"; sid:527016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvstopscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvstopscoronavirus.com"; sid:527017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccination-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccination-corona.com"; sid:527018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationcoronavirus.com"; sid:527019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccination-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccination-covid19.com"; sid:527020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccin-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccin-corona-virus.com"; sid:527021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine4coronavirus.com"; sid:527022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine4covid-19.com"; sid:527023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-corona-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-corona-covid19.com"; sid:527024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineforcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineforcoronavirus.net"; sid:527025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineforcovid19.net"; sid:527026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovid19.com"; sid:527027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxcovid-19.com"; sid:527028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcorona.life"; sid:527029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verdadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verdadcoronavirus.com"; sid:527030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verdadcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verdadcovid-19.com"; sid:527031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verdaddelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verdaddelcoronavirus.com"; sid:527032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vereint-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vereint-gegen-corona.com"; sid:527033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vereintgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vereintgegencorona.com"; sid:527034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vereint-gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vereint-gegen-corona.net"; sid:527035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vereintgegencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vereintgegencorona.net"; sid:527036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verliesinkomstencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verliesinkomstencorona.com"; sid:527037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralcoronapneumonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralcoronapneumonia.com"; sid:527038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteersforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteersforcoronavirus.com"; sid:527039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vpncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vpncovid19.com"; sid:527040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vrbocoronaviruscancellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vrbocoronaviruscancellation.com"; sid:527041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovid19.com"; sid:527042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid19.com"; sid:527043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecorona.com"; sid:527044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecoronavirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecoronavirussurvivors.com"; sid:527045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid19live.com"; sid:527046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleancovid.com"; sid:527047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleanupcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleanupcoronavirus.com"; sid:527048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for werkencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"werkencorona.com"; sid:527049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weshallovercomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weshallovercomecorona.com"; sid:527050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattoweartoanepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattoweartoanepidemic.com"; sid:527051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wicovid19.com"; sid:527052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for woncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"woncorona.com"; sid:527053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-against-corona.com"; sid:527054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldagainstcorona.com"; sid:527055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldnumcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldnumcorona.com"; sid:527056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldvscorona.com"; sid:527057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarcovid19.com"; sid:527058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbaby.com"; sid:527059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbats.com"; sid:527060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfm.net"; sid:527061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfunk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfunk.com"; sid:527062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansanitizer.com"; sid:527063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansaveeu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansaveeu.com"; sid:527064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusadvice.com"; sid:527065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirushealthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirushealthadvice.com"; sid:527066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhiqigou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhiqigou.com"; sid:527067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovid19.com"; sid:527068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wycovid19.com"; sid:527069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-gttingen-gtb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-gttingen-gtb.com"; sid:527070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronanios-09a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronanios-09a.com"; sid:527071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid-19opplring-5ob.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid-19opplring-5ob.net"; sid:527072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidnios-r6a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidnios-r6a.com"; sid:527073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--prevencincoronavirus-i8b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--prevencincoronavirus-i8b.com"; sid:527074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoderrotealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoderrotealcoronavirus.com"; sid:527075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoderrotealcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoderrotealcoronavirus.net"; sid:527076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcoronavirus.net"; sid:527077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronapocalypse.com"; sid:527078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusfears.com"; sid:527079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youtubecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youtubecoronavirus.com"; sid:527080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youtubecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youtubecoronavirus.net"; sid:527081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youtubecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youtubecovid19.com"; sid:527082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youtubecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youtubecovid19.net"; sid:527083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zusammen-gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zusammen-gegen-corona.net"; sid:527084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zusammengegencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zusammengegencorona.net"; sid:527085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 05corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"05corona.com"; sid:527086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0corona.com"; sid:527087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 101coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"101coronavirus.com"; sid:527088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 12thfloorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"12thfloorcovid19.com"; sid:527089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid-19.com"; sid:527090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaoutbreak.com"; sid:527091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicsurvivortshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicsurvivortshirt.com"; sid:527092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360corona.com"; sid:527093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbotsfordcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbotsfordcovidresponse.com"; sid:527094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbycovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbycovidresponse.com"; sid:527095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.party"; sid:527096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.party"; sid:527097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.net"; sid:527098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19book.com"; sid:527099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid19.com"; sid:527100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.net"; sid:527101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftermathcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftermathcoronavirus.com"; sid:527102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agingpandemic.com"; sid:527103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aid4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aid4covid19.com"; sid:527104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albanycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albanycoronavirus.com"; sid:527105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aldburycovid19.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aldburycovid19.support"; sid:527106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19.com"; sid:527107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidhandsanitizer.com"; sid:527108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amacovid.com"; sid:527109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaaftercorona.com"; sid:527110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaaftercovid19.com"; sid:527111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapostcorona.com"; sid:527112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americascoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americascoronaviruslawyer.com"; sid:527113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annuitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annuitycoronavirus.com"; sid:527114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anoroc-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anoroc-against-corona.com"; sid:527115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anorocagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anorocagainstcorona.com"; sid:527116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronahandgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronahandgel.com"; sid:527117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-spray.com"; sid:527118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-spray.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-spray.net"; sid:527119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.club"; sid:527120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusghana.com"; sid:527121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusgh.com"; sid:527122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19drug.com"; sid:527123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19vaccine.com"; sid:527124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscoronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscoronacovid19.com"; sid:527125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscoronacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscoronacovid.com"; sid:527126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivingpandemic.com"; sid:527127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinatimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinatimeofcovid19.com"; sid:527128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofcorona.com"; sid:527129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistsagainstcorona.com"; sid:527130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asesoriaertescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asesoriaertescoronavirus.com"; sid:527131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asesoriaertescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asesoriaertescoronavirus.net"; sid:527132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askaboutcorona.com"; sid:527133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associazionecoronavirus.com"; sid:527134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomewithcorona.com"; sid:527135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcoronavirus.com"; sid:527136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocertificazionecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocertificazionecorona.com"; sid:527137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidingcovid19.com"; sid:527138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awarenesscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awarenesscovid-19.com"; sid:527139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayecorona.net"; sid:527140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backendcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backendcovid19.net"; sid:527141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19.net"; sid:527142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19together.com"; sid:527143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcoronavirus.net"; sid:527144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthecovid.com"; sid:527145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bebascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bebascorona.com"; sid:527146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirusclean.com"; sid:527147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirus.net"; sid:527148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirussafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirussafety.com"; sid:527149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestmaskscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestmaskscoronavirus.com"; sid:527150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestmasksforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestmasksforcoronavirus.com"; sid:527151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoronavirus.com"; sid:527152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoronavirus.net"; sid:527153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.com"; sid:527154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.net"; sid:527155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovid-19.com"; sid:527156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bikethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bikethepandemic.com"; sid:527157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bingcovid.com"; sid:527158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for binghamtoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"binghamtoncoronavirus.com"; sid:527159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bintangcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bintangcorona.com"; sid:527160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackhawkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackhawkcovid19.com"; sid:527161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloggingthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloggingthetimeofcorona.com"; sid:527162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogginthetimeofcorona.com"; sid:527163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloginthetimeofcorona.com"; sid:527164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcorona.com"; sid:527165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingnewscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingnewscoronavirus.com"; sid:527166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bucoronacleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bucoronacleaner.com"; sid:527167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buffalocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buffalocoronavirus.com"; sid:527168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buscorona.com"; sid:527169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessfundingforcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessfundingforcoronarelief.com"; sid:527170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bybycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bybycorona.com"; sid:527171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bycorona.com"; sid:527172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecovid19.com"; sid:527173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caedes-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caedes-covid.com"; sid:527174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caldwellcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caldwellcovid-19.com"; sid:527175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caldwellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caldwellcovid19.com"; sid:527176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caldwellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caldwellcovid.com"; sid:527177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcoronacabinfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcoronacabinfever.com"; sid:527178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for candidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"candidcovid.com"; sid:527179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitalizingoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitalizingoncorona.com"; sid:527180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcovid19patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcovid19patients.com"; sid:527181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcovid.com"; sid:527182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carolinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carolinecovid19.com"; sid:527183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casesofcoronavirus.com"; sid:527184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchthecorona.com"; sid:527185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caterersvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caterersvscoronavirus.com"; sid:527186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cccovid19.com"; sid:527187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cccovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cccovid19.net"; sid:527188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid-19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid-19treatment.com"; sid:527189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlottedentistcoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlottedentistcoronavirusupdate.com"; sid:527190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlottedentistcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlottedentistcoronavirusupdates.com"; sid:527191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chatbotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chatbotcoronavirus.com"; sid:527192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chestercountycovid-19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chestercountycovid-19fund.com"; sid:527193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chestercountycovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chestercountycovid19fund.com"; sid:527194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chestercountycovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chestercountycovid19responsefund.net"; sid:527195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chezcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chezcovid.com"; sid:527196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chezwuhantogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chezwuhantogo.com"; sid:527197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocommunitycovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocommunitycovid19responsefund.com"; sid:527198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocommunitycovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocommunitycovid19responsefund.net"; sid:527199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagoneighborscovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagoneighborscovid19responsefund.com"; sid:527200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagoneighborscovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagoneighborscovid19responsefund.net"; sid:527201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronaviruscure.com"; sid:527202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronavirusvaccine.com"; sid:527203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcoronavirus.com"; sid:527204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncoronavirus.com"; sid:527205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancorona.net"; sid:527206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaning-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaning-coronavirus.com"; sid:527207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cncovid.com"; sid:527208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnycoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnycoronaviruscleaning.com"; sid:527209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coldorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coldorcovid.com"; sid:527210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collab4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collab4covid.com"; sid:527211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collabforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collabforcovid.com"; sid:527212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirussolutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirussolutions.biz"; sid:527213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compolcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compolcoronavirus.com"; sid:527214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concorona.com"; sid:527215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confessionsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confessionsofcorona.com"; sid:527216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercoronawithcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercoronawithcalm.com"; sid:527217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultacoronavirus.com"; sid:527218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcovid-19.com"; sid:527219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncorona.com"; sid:527220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncorona.net"; sid:527221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid-19.com"; sid:527222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid19.com"; sid:527223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid-19.net"; sid:527224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid19.net"; sid:527225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid.com"; sid:527226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornyncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornyncovid.net"; sid:527227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona112.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona112.com"; sid:527228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona14.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona14.com"; sid:527229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona192020.com"; sid:527230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.chat"; sid:527231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.club"; sid:527232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19fact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19fact.com"; sid:527233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19facts.com"; sid:527234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19kit.com"; sid:527235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19law.com"; sid:527236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lawyer.com"; sid:527237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19virustestkit.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19virustestkit.club"; sid:527238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19virustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19virustestkit.com"; sid:527239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1staid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1staid.com"; sid:527240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2k.com"; sid:527241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona55.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona55.com"; sid:527242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona5g.com"; sid:527243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaftermath.com"; sid:527244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ai.com"; sid:527245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairkiller.com"; sid:527246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandlyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandlyme.com"; sid:527247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaangle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaangle.com"; sid:527248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ansteckung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ansteckung.com"; sid:527249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-answers.com"; sid:527250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antworten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antworten.com"; sid:527251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantworten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantworten.com"; sid:527252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasy.com"; sid:527253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasy.net"; sid:527254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ausfall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ausfall.com"; sid:527255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-awareness.com"; sid:527256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababybaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababybaby.com"; sid:527257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-babys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-babys.com"; sid:527258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-band.com"; sid:527259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabartender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabartender.com"; sid:527260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabazaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabazaar.com"; sid:527261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeat.com"; sid:527262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabenefit.com"; sid:527263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabikeweek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabikeweek.com"; sid:527264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabikeweek.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabikeweek.life"; sid:527265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablessing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablessing.com"; sid:527266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablessings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablessings.com"; sid:527267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboarder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboarder.com"; sid:527268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabomb.com"; sid:527269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonedya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonedya.com"; sid:527270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboner.com"; sid:527271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-boredom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-boredom.com"; sid:527272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathingmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathingmask.com"; sid:527273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessinterruption.com"; sid:527274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabyby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabyby.com"; sid:527275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabyebye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabyebye.com"; sid:527276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabinfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabinfever.com"; sid:527277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacallout.com"; sid:527278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalming.com"; sid:527279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalming.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalming.net"; sid:527280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardio.com"; sid:527281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecoaching.com"; sid:527282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarers.com"; sid:527283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacases.net"; sid:527284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-catering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-catering.com"; sid:527285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaterings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaterings.com"; sid:527286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacateringusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacateringusa.com"; sid:527287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-challenge.com"; sid:527288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachatclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachatclub.com"; sid:527289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckin.com"; sid:527290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckme.com"; sid:527291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checkr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checkr.com"; sid:527292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachile.com"; sid:527293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachill.com"; sid:527294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniken.com"; sid:527295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimhelp.com"; sid:527296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaims2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaims2020.com"; sid:527297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimshelp.com"; sid:527298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclases.com"; sid:527299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassattorney.com"; sid:527300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassattorneys.com"; sid:527301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclasses.com"; sid:527302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclasslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclasslaw.com"; sid:527303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclasslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclasslawyer.com"; sid:527304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclasslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclasslawyers.com"; sid:527305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassrooms.com"; sid:527306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaner.com"; sid:527307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanhome.com"; sid:527308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanup.net"; sid:527309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupteam.com"; sid:527310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coaching.com"; sid:527311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocooning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocooning.com"; sid:527312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollab.com"; sid:527313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comfort.com"; sid:527314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-company.com"; sid:527315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensation.net"; sid:527316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfessional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfessional.com"; sid:527317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfidential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfidential.com"; sid:527318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconspiracymovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconspiracymovie.com"; sid:527319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopalyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopalyse.com"; sid:527320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopalyse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopalyse.net"; sid:527321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacope.com"; sid:527322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopia.com"; sid:527323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopolyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopolyse.com"; sid:527324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopolyse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopolyse.net"; sid:527325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacornyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacornyn.com"; sid:527326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacornyn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacornyn.net"; sid:527327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountrymap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountrymap.com"; sid:527328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19herbs.com"; sid:527329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19info.com"; sid:527330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19info.net"; sid:527331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19mask.com"; sid:527332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafts.com"; sid:527333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreativecamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreativecamp.com"; sid:527334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrise.com"; sid:527335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscoach.com"; sid:527336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseattorney.com"; sid:527337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseclaims.com"; sid:527338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiselawyer.com"; sid:527339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiselawyers.com"; sid:527340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrusaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrusaders.com"; sid:527341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaction.net"; sid:527342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactu.com"; sid:527343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureblog.com"; sid:527344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cured.com"; sid:527345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurriculum.com"; sid:527346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacushion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacushion.com"; sid:527347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacyrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacyrus.com"; sid:527348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronada.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronada.club"; sid:527349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatastats.com"; sid:527350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-defence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-defence.com"; sid:527351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefens.com"; sid:527352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensejobs.com"; sid:527353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesgarcons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesgarcons.com"; sid:527354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadezenfekteveilaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadezenfekteveilaclama.com"; sid:527355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectingteam.com"; sid:527356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadontsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadontsurf.com"; sid:527357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadowntime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadowntime.com"; sid:527358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoworkouts.com"; sid:527359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivethrutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivethrutest.com"; sid:527360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelderly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelderly.com"; sid:527361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelderly.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelderly.net"; sid:527362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeliminators.com"; sid:527363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaempathyhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaempathyhotline.com"; sid:527364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemploymentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemploymentlawyer.com"; sid:527365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemploymentsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemploymentsolution.com"; sid:527366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entschaedigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entschaedigung.com"; sid:527367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexch.com"; sid:527368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexecutivecoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexecutivecoaching.com"; sid:527369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexecutivecoaching.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexecutivecoaching.net"; sid:527370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemasks.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemasks.club"; sid:527371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacevisor.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacevisor.biz"; sid:527372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactbot.com"; sid:527373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafairdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafairdale.com"; sid:527374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafan.club"; sid:527375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafedassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafedassistance.com"; sid:527376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafior.com"; sid:527377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirst.com"; sid:527378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirus.com"; sid:527379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafitnesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafitnesschallenge.com"; sid:527380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflash.com"; sid:527381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafluinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafluinfo.com"; sid:527382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerdermittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerdermittel.com"; sid:527383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerdermittel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerdermittel.net"; sid:527384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafonds.com"; sid:527385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafordays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafordays.com"; sid:527386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedate.com"; sid:527387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedates.com"; sid:527388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefacility.com"; sid:527389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehome.com"; sid:527390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriend.com"; sid:527391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaftermath.com"; sid:527392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundclaim.com"; sid:527393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundhelp.com"; sid:527394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafund.net"; sid:527395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-funds.com"; sid:527396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagigs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagigs.com"; sid:527397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaginger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaginger.com"; sid:527398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-go.com"; sid:527399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrams.com"; sid:527400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaharitasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaharitasi.com"; sid:527401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hausaufgaben.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hausaufgaben.com"; sid:527402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahazmat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahazmat.com"; sid:527403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahazmatsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahazmatsuits.com"; sid:527404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heal.com"; sid:527405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-healing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-healing.net"; sid:527406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth.care"; sid:527407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helden.com"; sid:527408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelden.com"; sid:527409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelden.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelden.net"; sid:527410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helpdesk.com"; sid:527411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpersnyc.com"; sid:527412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpinghand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpinghand.com"; sid:527413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahemp.com"; sid:527414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbalist.com"; sid:527415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherb.net"; sid:527416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbskit.com"; sid:527417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbsz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbsz.com"; sid:527418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbz.com"; sid:527419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahinfo.com"; sid:527420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoax2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoax2020.com"; sid:527421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-home.com"; sid:527422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homeschooling.com"; sid:527423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschooling.com"; sid:527424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homeschooling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homeschooling.net"; sid:527425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschooling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschooling.net"; sid:527426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homework.com"; sid:527427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomework.com"; sid:527428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homework.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homework.net"; sid:527429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoodies.com"; sid:527430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahouseclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahouseclean.com"; sid:527431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahp.com"; sid:527432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahp.net"; sid:527433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygiene-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygiene-shop.com"; sid:527434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaid2020.com"; sid:527435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidconcert2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidconcert2020.com"; sid:527436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidconcert.com"; sid:527437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidlive2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidlive2020.com"; sid:527438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidlive.com"; sid:527439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidliveconcert2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidliveconcert2020.com"; sid:527440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunityboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunityboost.com"; sid:527441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immunization.com"; sid:527442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpactboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpactboston.com"; sid:527443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpactnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpactnyc.com"; sid:527444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfen.com"; sid:527445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionattorney.com"; sid:527446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infektion.com"; sid:527447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfographics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfographics.com"; sid:527448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfos.com"; sid:527449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-initiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-initiative.com"; sid:527450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insolvency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insolvency.com"; sid:527451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-invest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-invest.com"; sid:527452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-iraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-iraq.com"; sid:527453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairaq.com"; sid:527454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisleofman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisleofman.com"; sid:527455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisverige.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisverige.com"; sid:527456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaketo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaketo.com"; sid:527457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidblog.com"; sid:527458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kid.com"; sid:527459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakind.com"; sid:527460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakinder.com"; sid:527461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kindness.com"; sid:527462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakittyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakittyz.com"; sid:527463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabinabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabinabox.com"; sid:527464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabinabox.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabinabox.net"; sid:527465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalago.com"; sid:527466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalayoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalayoff.com"; sid:527467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalayoffs.com"; sid:527468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalaid.com"; sid:527469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalertkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalertkits.com"; sid:527470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalevel.com"; sid:527471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-liveticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-liveticker.com"; sid:527472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loesungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loesungen.com"; sid:527473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloesungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloesungen.com"; sid:527474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaatregelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaatregelen.com"; sid:527475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.madrid"; sid:527476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamakeoverchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamakeoverchallenge.com"; sid:527477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamakeover.com"; sid:527478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-man.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-man.com"; sid:527479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapturkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapturkey.com"; sid:527480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarchmadness20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarchmadness20.com"; sid:527481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-market.com"; sid:527482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketingfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketingfestival.com"; sid:527483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarket.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarket.net"; sid:527484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskir.com"; sid:527485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksupply.com"; sid:527486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.world"; sid:527487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamayhem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamayhem.com"; sid:527488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamdlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamdlive.com"; sid:527489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedical.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedical.net"; sid:527490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedtest.com"; sid:527491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemories.com"; sid:527492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamindshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamindshift.com"; sid:527493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamondkapjekopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamondkapjekopen.com"; sid:527494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonologen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonologen.com"; sid:527495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonologues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonologues.com"; sid:527496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamouthmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamouthmask.com"; sid:527497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamumsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamumsolution.com"; sid:527498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamunity.com"; sid:527499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamyths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamyths.com"; sid:527500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanash.com"; sid:527501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanash.net"; sid:527502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanashville.com"; sid:527503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanashville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanashville.net"; sid:527504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewborn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewborn.com"; sid:527505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-news24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-news24.com"; sid:527506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewshub.com"; sid:527507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-newsroom.com"; sid:527508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-news.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-news.world"; sid:527509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanite.com"; sid:527510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoodpakket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoodpakket.com"; sid:527511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanopasaran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanopasaran.com"; sid:527512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanor.com"; sid:527513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotbeer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotbeer.com"; sid:527514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotes.com"; sid:527515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotifications.com"; sid:527516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanyt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanyt.com"; sid:527517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaodds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaodds.com"; sid:527518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofsteel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofsteel.com"; sid:527519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaohio.com"; sid:527520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaohnechance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaohnechance.com"; sid:527521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoke.com"; sid:527522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonly.com"; sid:527523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaontzorgt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaontzorgt.com"; sid:527524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-opfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-opfer.com"; sid:527525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemic2020.com"; sid:527526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparenting.com"; sid:527527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparents.com"; sid:527528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobia.net"; sid:527529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphotos.com"; sid:527530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaylist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaylist.com"; sid:527531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplots.com"; sid:527532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocolyplse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocolyplse.com"; sid:527533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoints.com"; sid:527534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-positive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-positive.com"; sid:527535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositivity.com"; sid:527536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprayers.com"; sid:527537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprediction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprediction.net"; sid:527538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreneurcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreneurcoach.com"; sid:527539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreneur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreneur.com"; sid:527540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionpack.com"; sid:527541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprints.com"; sid:527542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prognose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prognose.com"; sid:527543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprone.com"; sid:527544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsychologie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsychologie.com"; sid:527545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsychology.com"; sid:527546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapublic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapublic.com"; sid:527547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapyarhai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapyarhai.com"; sid:527548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarter.com"; sid:527549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquestions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquestions.net"; sid:527550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarailroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarailroad.com"; sid:527551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtestpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtestpro.com"; sid:527552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredginger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredginger.com"; sid:527553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefchicago.com"; sid:527554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieffunding.com"; sid:527555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremedy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremedy.net"; sid:527556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareportcenter.com"; sid:527557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-resources.com"; sid:527558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresourses.com"; sid:527559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponse.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponse.church"; sid:527560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsejobs.com"; sid:527561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretirement.com"; sid:527562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarightnow.com"; sid:527563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariot.com"; sid:527564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariots.com"; sid:527565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariseup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariseup.com"; sid:527566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroulette.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroulette.net"; sid:527567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaround.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaround.com"; sid:527568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarun.com"; sid:527569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeproducts.com"; sid:527570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetycompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetycompliance.com"; sid:527571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitization.com"; sid:527572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavvy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavvy.com"; sid:527573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavvy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavvy.net"; sid:527574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbaby.com"; sid:527575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.net"; sid:527576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.solutions"; sid:527577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz24.com"; sid:527578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschweiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschweiz.com"; sid:527579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreenings.com"; sid:527580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-se-daro-na.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-se-daro-na.com"; sid:527581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashelf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashelf.com"; sid:527582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield.biz"; sid:527583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shield.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shield.life"; sid:527584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashock2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashock2020.com"; sid:527585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashock.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashock.net"; sid:527586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppingmall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppingmall.com"; sid:527587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashorts.com"; sid:527588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shot.com"; sid:527589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicher.com"; sid:527590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasign.com"; sid:527591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasigns.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasigns.net"; sid:527592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasitters.com"; sid:527593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbizassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbizassist.com"; sid:527594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatus.net"; sid:527595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastinks.com"; sid:527596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopcovid19.com"; sid:527597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-strong.com"; sid:527598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-studies.com"; sid:527599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-study.com"; sid:527600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubsidie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubsidie.com"; sid:527601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesnow.com"; sid:527602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalgear.com"; sid:527603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurviviorsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurviviorsgroup.com"; sid:527604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatales.com"; sid:527605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatapabocas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatapabocas.com"; sid:527606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelemed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelemed.com"; sid:527607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterminator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterminator.net"; sid:527608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestbd.com"; sid:527609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcenter.com"; sid:527610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestplaces.com"; sid:527611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestservices.com"; sid:527612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.today"; sid:527613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathanks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathanks.com"; sid:527614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatic.com"; sid:527615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaticos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaticos.com"; sid:527616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatics.com"; sid:527617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-time.com"; sid:527618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatime.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatime.net"; sid:527619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatinder.com"; sid:527620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatips.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatips.bid"; sid:527621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizer.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizer.life"; sid:527622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaton.com"; sid:527623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoolkit.com"; sid:527624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatote.com"; sid:527625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoughguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoughguy.com"; sid:527626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoys.com"; sid:527627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trauer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trauer.com"; sid:527628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrauer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrauer.com"; sid:527629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelers.com"; sid:527630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravels.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravels.club"; sid:527631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-travels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-travels.com"; sid:527632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-treat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-treat.com"; sid:527633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrendbycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrendbycountry.com"; sid:527634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrendbycountry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrendbycountry.net"; sid:527635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrivia.com"; sid:527636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruths.com"; sid:527637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattire.com"; sid:527638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmenshilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmenshilfe.com"; sid:527639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatestoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatestoday.com"; sid:527640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurbancollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurbancollection.com"; sid:527641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvkiller.com"; sid:527642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav1ruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav1ruslive.com"; sid:527643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinehelp.com"; sid:527644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinenews.com"; sid:527645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavation.com"; sid:527646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavchallenge.com"; sid:527647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventilator.com"; sid:527648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventilators.com"; sid:527649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverileri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverileri.com"; sid:527650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversary.com"; sid:527651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverzekering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverzekering.com"; sid:527652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavets.com"; sid:527653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid19cleaners.com"; sid:527654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviews.com"; sid:527655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral.biz"; sid:527656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral.world"; sid:527657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19account.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19account.com"; sid:527658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19disclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19disclosure.com"; sid:527659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19history.com"; sid:527660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19news.com"; sid:527661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19pharmacy.com"; sid:527662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19prevention.com"; sid:527663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19reports.com"; sid:527664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19solutions.com"; sid:527665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19survival.com"; sid:527666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19updates.com"; sid:527667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.world"; sid:527668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2019.net"; sid:527669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019vaccine.com"; sid:527670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020guide.com"; sid:527671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020info.com"; sid:527672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.solutions"; sid:527673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020solutions.com"; sid:527674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2020.world"; sid:527675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus203.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus203.com"; sid:527676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus205.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus205.com"; sid:527677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus207.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus207.com"; sid:527678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus208.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus208.com"; sid:527679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus20.com"; sid:527680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus217.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus217.com"; sid:527681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus218.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus218.com"; sid:527682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus21.com"; sid:527683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus234.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus234.com"; sid:527684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2k.com"; sid:527685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus302.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus302.com"; sid:527686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus304.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus304.com"; sid:527687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus307.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus307.com"; sid:527688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus30.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus30.com"; sid:527689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus316.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus316.com"; sid:527690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus351.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus351.com"; sid:527691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus352.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus352.com"; sid:527692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus353.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus353.com"; sid:527693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus354.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus354.com"; sid:527694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus356.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus356.com"; sid:527695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus358.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus358.com"; sid:527696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus359.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus359.com"; sid:527697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus36.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus36.com"; sid:527698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus370.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus370.com"; sid:527699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus371.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus371.com"; sid:527700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus372.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus372.com"; sid:527701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus377.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus377.com"; sid:527702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus379.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus379.com"; sid:527703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus380.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus380.com"; sid:527704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus386.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus386.com"; sid:527705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus420.com"; sid:527706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus421.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus421.com"; sid:527707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus479.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus479.com"; sid:527708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus48.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus48.com"; sid:527709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus518.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus518.com"; sid:527710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus56.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus56.com"; sid:527711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus57.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus57.com"; sid:527712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus593.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus593.com"; sid:527713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus601.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus601.com"; sid:527714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus603.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus603.com"; sid:527715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus605.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus605.com"; sid:527716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus616.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus616.com"; sid:527717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus678.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus678.com"; sid:527718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus701.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus701.com"; sid:527719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus703.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus703.com"; sid:527720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus720.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus720.com"; sid:527721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus802.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus802.com"; sid:527722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus803.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus803.com"; sid:527723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus812.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus812.com"; sid:527724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus816.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus816.com"; sid:527725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus901.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus901.com"; sid:527726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus907.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus907.com"; sid:527727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus90.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus90.com"; sid:527728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus913.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus913.com"; sid:527729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus919.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus919.com"; sid:527730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactnow.com"; sid:527731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvertising.com"; sid:527732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadviceline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadviceline.com"; sid:527733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaffiliates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaffiliates.com"; sid:527734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisafetysolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisafetysolution.com"; sid:527735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisafetysolutions.com"; sid:527736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisolution.com"; sid:527737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisolutions.com"; sid:527738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ajournaloftheplagueyear2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ajournaloftheplagueyear2020.com"; sid:527739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbertsons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbertsons.com"; sid:527740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-alert-has.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-alert-has.com"; sid:527741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanniversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanniversary.com"; sid:527742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-antidote.com"; sid:527743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantigermco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantigermco.com"; sid:527744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-apps.com"; sid:527745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-arkansas.com"; sid:527746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaroundme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaroundme.com"; sid:527747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusask.com"; sid:527748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathome.com"; sid:527749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathometestkits.com"; sid:527750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneycalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneycalifornia.com"; sid:527751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-attorney.com"; sid:527752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-attorneys.com"; sid:527753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysfla.com"; sid:527754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysllc.com"; sid:527755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatty.com"; sid:527756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauthor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauthor.com"; sid:527757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaby.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaby.net"; sid:527758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-babys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-babys.com"; sid:527759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabys.com"; sid:527760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusba.com"; sid:527761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbalkan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbalkan.com"; sid:527762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankrun.com"; sid:527763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbanks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbanks.com"; sid:527764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaprogram.com"; sid:527765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbc.com"; sid:527766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbigbanks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbigbanks.com"; sid:527767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbitcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbitcoin.com"; sid:527768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.black"; sid:527769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblakegriffin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblakegriffin.com"; sid:527770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblame.com"; sid:527771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblues.com"; sid:527772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreak.com"; sid:527773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessbailout.com"; sid:527774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-business.com"; sid:527775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessrelief.com"; sid:527776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessrelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessrelieffunding.com"; sid:527777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbutton.com"; sid:527778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuttons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuttons.com"; sid:527779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarepackage.com"; sid:527780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarepackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarepackages.com"; sid:527781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasesintheus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasesintheus.com"; sid:527782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasesinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasesinus.com"; sid:527783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasesmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasesmap.com"; sid:527784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusc.com"; sid:527785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusceopledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusceopledge.com"; sid:527786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-channel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-channel.com"; sid:527787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschaos.com"; sid:527788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschecklist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschecklist.net"; sid:527789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschoral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschoral.com"; sid:527790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschronicles.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschronicles.life"; sid:527791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimhelp.com"; sid:527792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlaw.com"; sid:527793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawyer.com"; sid:527794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawyers.com"; sid:527795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasslawyer.com"; sid:527796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasslawyers.com"; sid:527797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmontreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmontreal.com"; sid:527798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmtl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmtl.com"; sid:527799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuk.com"; sid:527800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearspacesterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearspacesterilization.com"; sid:527801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclt.com"; sid:527802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomfortkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomfortkit.com"; sid:527803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommunication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommunication.com"; sid:527804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcernsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcernsny.com"; sid:527805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfessions.com"; sid:527806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-control.com"; sid:527807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cooking.com"; sid:527808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscooking.com"; sid:527809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselor.com"; sid:527810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19-2020.com"; sid:527811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-alert.com"; sid:527812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19cleaningdisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19cleaningdisinfectionservices.com"; sid:527813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-pandemic.com"; sid:527814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19.solutions"; sid:527815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiselawyer.com"; sid:527816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiselawyers.com"; sid:527817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.clinic"; sid:527818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurfew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurfew.com"; sid:527819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtconsolidators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtconsolidators.com"; sid:527820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtrelief.net"; sid:527821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtsolutions.com"; sid:527822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusden.com"; sid:527823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentistry.com"; sid:527824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesignermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesignermasks.com"; sid:527825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdfwmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdfwmap.com"; sid:527826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirectcremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirectcremation.com"; sid:527827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisclosure.com"; sid:527828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantsupply.com"; sid:527829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdistrictofcolumbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdistrictofcolumbia.com"; sid:527830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorce.com"; sid:527831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdmv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdmv.com"; sid:527832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocusign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocusign.com"; sid:527833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdontsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdontsurf.com"; sid:527834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dr.com"; sid:527835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrip.com"; sid:527836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-drivethrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-drivethrough.com"; sid:527837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethroughs.com"; sid:527838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-drivethrough-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-drivethrough-testing.com"; sid:527839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicimpact.com"; sid:527840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-economy.com"; sid:527841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-education.com"; sid:527842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseliminators.com"; sid:527843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentattorney.com"; sid:527844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentattorneys.com"; sid:527845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentlawyers.com"; sid:527846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenpanama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenpanama.com"; sid:527847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses-journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses-journal.com"; sid:527848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruses.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruses.net"; sid:527849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestee.com"; sid:527850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvaccines.com"; sid:527851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusetfs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusetfs.com"; sid:527852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseyeopener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseyeopener.com"; sid:527853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacials.com"; sid:527854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfairfaxcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfairfaxcounty.com"; sid:527855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilies.com"; sid:527856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-family-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-family-plan.com"; sid:527857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilyplan.com"; sid:527858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighterstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighterstore.com"; sid:527859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialrelief.com"; sid:527860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirst.com"; sid:527861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstsymptoms.com"; sid:527862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fitbit-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fitbit-alert.com"; sid:527863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfitnesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfitnesschallenge.com"; sid:527864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfor.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfor.healthcare"; sid:527865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforkids.com"; sid:527866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree1hrcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree1hrcure.com"; sid:527867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreecamping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreecamping.com"; sid:527868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedevon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedevon.com"; sid:527869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeholiday.com"; sid:527870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeholidayuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeholidayuk.com"; sid:527871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreehotels.com"; sid:527872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreenorthdevon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreenorthdevon.com"; sid:527873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreesummer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreesummer.com"; sid:527874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeuk.com"; sid:527875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundingbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundingbailout.com"; sid:527876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-funds.com"; sid:527877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuneralsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuneralsnyc.com"; sid:527878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfx.com"; sid:527879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgameplan.com"; sid:527880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgay.com"; sid:527881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusghosttown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusghosttown.com"; sid:527882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusghosttowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusghosttowns.com"; sid:527883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgiannis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgiannis.com"; sid:527884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgig.com"; sid:527885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglasses.com"; sid:527886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalcure.com"; sid:527887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoodnews.com"; sid:527888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.gratis - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.gratis"; sid:527889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguide.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguide.international"; sid:527890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-guru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-guru.com"; sid:527891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushalt.com"; sid:527892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthclinic.com"; sid:527893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthinsurance123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthinsurance123.com"; sid:527894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthinsuranceflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthinsuranceflorida.com"; sid:527895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthupdates.com"; sid:527896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-heilmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-heilmittel.com"; sid:527897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpinghands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpinghands.com"; sid:527898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpvirtual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpvirtual.com"; sid:527899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-history.com"; sid:527900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoax2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoax2020.com"; sid:527901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virushoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virushoax.com"; sid:527902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeactivities.com"; sid:527903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-homeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-homeschool.com"; sid:527904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomes.com"; sid:527905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hospital.com"; sid:527906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotel.com"; sid:527907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushowardcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushowardcounty.com"; sid:527908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpactlondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpactlondon.com"; sid:527909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpactondenstists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpactondenstists.com"; sid:527910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-india.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-india.net"; sid:527911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindustrialcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindustrialcleaners.com"; sid:527912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionattorney.com"; sid:527913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionattorneys.com"; sid:527914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionlawyer.com"; sid:527915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionlawyers.com"; sid:527916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.care"; sid:527917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-information.net"; sid:527918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-info.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-info.today"; sid:527919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsanity.com"; sid:527920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceplans.com"; sid:527921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisover.com"; sid:527922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitem.com"; sid:527923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-iwatch-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-iwatch-alert.com"; sid:527924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjanitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjanitor.com"; sid:527925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjanitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjanitors.com"; sid:527926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-jobs.com"; sid:527927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobsupport.com"; sid:527928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusketo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusketo.com"; sid:527929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskevinlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskevinlove.com"; sid:527930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskit.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskit.club"; sid:527931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskit.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskit.world"; sid:527932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskktc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskktc.com"; sid:527933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskroger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskroger.com"; sid:527934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskrogers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskrogers.com"; sid:527935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaidoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaidoff.com"; sid:527936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawblog.com"; sid:527937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawco.com"; sid:527938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruslaw.com"; sid:527939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaw.net"; sid:527940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawreporter.com"; sid:527941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawscalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawscalifornia.com"; sid:527942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawupdates.com"; sid:527943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyercalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyercalifornia.com"; sid:527944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslayoffs.com"; sid:527945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lb.com"; sid:527946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaladvice.com"; sid:527947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleisure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleisure.com"; sid:527948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslessons.com"; sid:527949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslimpieza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslimpieza.com"; sid:527950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivechart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivechart.com"; sid:527951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivepure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivepure.com"; sid:527952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lives.com"; sid:527953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-liveticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-liveticker.com"; sid:527954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloss.com"; sid:527955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloudouncounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloudouncounty.com"; sid:527956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-louisiana.com"; sid:527957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmademedoit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmademedoit.com"; sid:527958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadesimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadesimple.com"; sid:527959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakeover.com"; sid:527960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaptrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaptrack.com"; sid:527961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarkcuban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarkcuban.com"; sid:527962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskintoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskintoronto.com"; sid:527963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-maskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-maskn95.com"; sid:527964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksanitizer.com"; sid:527965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasque.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasque.net"; sid:527966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasterbation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasterbation.com"; sid:527967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaterials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaterials.com"; sid:527968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmcadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmcadebtrelief.com"; sid:527969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmcadebtrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmcadebtrelief.net"; sid:527970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmcarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmcarelief.com"; sid:527971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedclinic.com"; sid:527972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalclinics.com"; sid:527973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalsupply.com"; sid:527974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedsupplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedsupplies.biz"; sid:527975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorabilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorabilia.com"; sid:527976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiracles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiracles.com"; sid:527977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoments.com"; sid:527978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmontgomerycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmontgomerycounty.com"; sid:527979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortalityrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortalityrate.com"; sid:527980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortalityrateintheus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortalityrateintheus.com"; sid:527981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgagehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgagehelp.com"; sid:527982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-movie.com"; sid:527983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmystery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmystery.com"; sid:527984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmysterys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmysterys.com"; sid:527985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyth.com"; sid:527986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95-masks.com"; sid:527987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnavy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnavy.com"; sid:527988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ncov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ncov19.com"; sid:527989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneighbor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneighbor.com"; sid:527990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsandupdates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsandupdates.net"; sid:527991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewschannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewschannel.com"; sid:527992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsinfo.com"; sid:527993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newsletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newsletter.com"; sid:527994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsus.com"; sid:527995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnike.com"; sid:527996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nj.com"; sid:527997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotruf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotruf.com"; sid:527998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-novaregion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-novaregion.com"; sid:527999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovel.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovel.club"; sid:528000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoilremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoilremedy.com"; sid:528001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinehelp.com"; sid:528002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-online-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-online-map.com"; sid:528003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonline.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonline.solutions"; sid:528004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonwheels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonwheels.com"; sid:528005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorder.com"; sid:528006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oubreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oubreak.com"; sid:528007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreaksurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreaksurvivalguide.com"; sid:528008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoverstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoverstock.com"; sid:528009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoverstock.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoverstock.net"; sid:528010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspages.com"; sid:528011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.agency"; sid:528012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicco.com"; sid:528013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemiccure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemiccure.com"; sid:528014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.tips"; sid:528015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicusa.com"; sid:528016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanick.com"; sid:528017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparaguay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparaguay.com"; sid:528018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatients.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatients.net"; sid:528019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusp.com"; sid:528020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspgcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspgcounty.com"; sid:528021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspill.net"; sid:528022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspk.com"; sid:528023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-plan.com"; sid:528024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplatform.com"; sid:528025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-podcast.com"; sid:528026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspope.com"; sid:528027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusporno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusporno.com"; sid:528028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppc.com"; sid:528029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspracticeupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspracticeupdate.com"; sid:528030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayerchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayerchallenge.com"; sid:528031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-preppers.com"; sid:528032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.biz"; sid:528033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprincewilliamcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprincewilliamcounty.com"; sid:528034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromos.com"; sid:528035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionofficer.com"; sid:528036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspulse.com"; sid:528037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspure123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspure123.com"; sid:528038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinecare.com"; sid:528039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinefacts.com"; sid:528040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinemap.com"; sid:528041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinenews.com"; sid:528042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantineupdate.com"; sid:528043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquestionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquestionaire.com"; sid:528044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-recession.com"; sid:528045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-recipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-recipes.com"; sid:528046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecovery.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecovery.world"; sid:528047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefugee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefugee.com"; sid:528048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefugees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefugees.com"; sid:528049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrehabfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrehabfund.com"; sid:528050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefpodcast.com"; sid:528051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefprogram.com"; sid:528052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefproject.com"; sid:528053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remotely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remotely.com"; sid:528054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remotework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remotework.com"; sid:528055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remoteworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remoteworking.com"; sid:528056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponders.com"; sid:528057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestaurants.com"; sid:528058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretail.com"; sid:528059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretailers.com"; sid:528060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretirement.com"; sid:528061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriot.com"; sid:528062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriots.com"; sid:528063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskassessment.com"; sid:528064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.run"; sid:528065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrun.com"; sid:528066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.club"; sid:528067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyinformation.com"; sid:528068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeway.com"; sid:528069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussantabarbara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussantabarbara.com"; sid:528070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscandal.com"; sid:528071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreeninghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreeninghelp.com"; sid:528072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screeningsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screeningsites.com"; sid:528073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreening.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreening.world"; sid:528074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfisolation.com"; sid:528075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-services.com"; sid:528076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussetup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussetup.com"; sid:528077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshenanigans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshenanigans.com"; sid:528078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirtco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirtco.com"; sid:528079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoppingmall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoppingmall.com"; sid:528080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussigns.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussigns.net"; sid:528081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussluts.com"; sid:528082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocks.com"; sid:528083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspike.com"; sid:528084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspotsylvaniacounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspotsylvaniacounty.com"; sid:528085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstate.com"; sid:528086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudentloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudentloans.com"; sid:528087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudentloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudentloans.net"; sid:528088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-studies.com"; sid:528089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-study.com"; sid:528090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesunlimited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesunlimited.com"; sid:528091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupply.co - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupply.co"; sid:528092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyshopping.com"; sid:528093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupport.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupport.club"; sid:528094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportpodcast.com"; sid:528095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportproject.com"; sid:528096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survey.com"; sid:528097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurviors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurviors.com"; sid:528098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalincome.com"; sid:528099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.services"; sid:528100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.solutions"; sid:528101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustats.world"; sid:528102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxcredits.com"; sid:528103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustbtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustbtf.com"; sid:528104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteeshirts.com"; sid:528105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelecare.com"; sid:528106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelehelp.com"; sid:528107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelemedicineonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelemedicineonline.com"; sid:528108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test-alert.com"; sid:528109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestguidelines.com"; sid:528110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingguidelines.com"; sid:528111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglocation.com"; sid:528112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.world"; sid:528113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitamerica.com"; sid:528114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test-kits.com"; sid:528115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test-kits.com"; sid:528116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsathome.com"; sid:528117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesttime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesttime.com"; sid:528118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.tips"; sid:528119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestusa.com"; sid:528120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheend.com"; sid:528121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-the-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-the-facts.com"; sid:528122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheory.com"; sid:528123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthroughoureyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthroughoureyes.com"; sid:528124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimpactondentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimpactondentistry.com"; sid:528125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tips.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tips.net"; sid:528126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustodayusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustodayusa.com"; sid:528127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrace.com"; sid:528128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustransport.com"; sid:528129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrial.com"; sid:528130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrials.com"; sid:528131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrumps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrumps.com"; sid:528132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirust-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirust-shirts.com"; sid:528133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusun19leashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusun19leashed.com"; sid:528134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunleashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunleashed.com"; sid:528135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuntold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuntold.com"; sid:528136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-updates.net"; sid:528137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatesusa.com"; sid:528138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususa2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususa2020.com"; sid:528139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususairforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususairforce.com"; sid:528140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususamap.com"; sid:528141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususarmy.com"; sid:528142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususmc.com"; sid:528143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvlight.com"; sid:528144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvlightpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvlightpurifier.com"; sid:528145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuy.com"; sid:528146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-v19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-v19.com"; sid:528147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusv19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusv19.com"; sid:528148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusv19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusv19.net"; sid:528149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineprogress.com"; sid:528150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineshot.com"; sid:528151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinetrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinetrial.com"; sid:528152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vac.com"; sid:528153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvariant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvariant.com"; sid:528154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusviral.com"; sid:528155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtual.com"; sid:528156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtualrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtualrun.com"; sid:528157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vitamin.com"; sid:528158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvsflufacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvsflufacts.com"; sid:528159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalkboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalkboston.com"; sid:528160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalk.com"; sid:528161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalknewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalknewyork.com"; sid:528162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalknyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalknyc.com"; sid:528163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalksanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalksanfrancisco.com"; sid:528164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswall.com"; sid:528165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashingtondc.com"; sid:528166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswatchlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswatchlist.com"; sid:528167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wear.com"; sid:528168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-work.com"; sid:528169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-work-from-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-work-from-home.com"; sid:528170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyesterday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyesterday.com"; sid:528171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszoom.com"; sid:528172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisor.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisor.biz"; sid:528173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vorbeugen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vorbeugen.net"; sid:528174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalkboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalkboston.com"; sid:528175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalkla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalkla.com"; sid:528176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalklondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalklondon.com"; sid:528177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalknyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalknyc.com"; sid:528178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashhands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashhands.com"; sid:528179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebshop.com"; sid:528180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-we-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-we-help.com"; sid:528181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawehelp.com"; sid:528182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-weltuntergang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-weltuntergang.com"; sid:528183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhistleblower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhistleblower.com"; sid:528184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhyus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhyus.com"; sid:528185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawillpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawillpass.com"; sid:528186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawisdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawisdom.com"; sid:528187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaword.com"; sid:528188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xibar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xibar.com"; sid:528189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazine.com"; sid:528190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrywisecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrywisecorona.com"; sid:528191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrywisecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrywisecoronavirus.com"; sid:528192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covad19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covad19pandemic.com"; sid:528193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covercoronavirus.com"; sid:528194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-18singles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-18singles.com"; sid:528195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18singles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18singles.com"; sid:528196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1900.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1900.com"; sid:528197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2019.com"; sid:528198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2020themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2020themovie.com"; sid:528199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1981.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1981.com"; sid:528200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19account.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19account.com"; sid:528201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-alert.com"; sid:528202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alerts.net"; sid:528203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-analyses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-analyses.com"; sid:528204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analytica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analytica.com"; sid:528205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analytics.com"; sid:528206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anes.com"; sid:528207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anniversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anniversary.com"; sid:528208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assassins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assassins.com"; sid:528209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19athometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19athometest.com"; sid:528210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attack.com"; sid:528211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysfla.com"; sid:528212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19awarenessproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19awarenessproducts.com"; sid:528213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babiess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babiess.com"; sid:528214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baby.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baby.net"; sid:528215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baby-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baby-s.com"; sid:528216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babys.com"; sid:528217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19band.com"; sid:528218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcy.com"; sid:528219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcy.com"; sid:528220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.black"; sid:528221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19book.com"; sid:528222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-breakthechain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-breakthechain.com"; sid:528223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessbailout.com"; sid:528224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business.com"; sid:528225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrelief.com"; sid:528226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrelieffunding.com"; sid:528227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-calc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-calc.com"; sid:528228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-calculator.com"; sid:528229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calculator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calculator.net"; sid:528230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19camera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19camera.com"; sid:528231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casesnearme.com"; sid:528232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casino.com"; sid:528233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cdcguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cdcguidelines.com"; sid:528234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdcinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdcinfo.com"; sid:528235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chaos.com"; sid:528236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkup.net"; sid:528237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19children.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19children.com"; sid:528238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimattorney.com"; sid:528239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimdenial.com"; sid:528240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimlawsuit.com"; sid:528241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimlawyer.com"; sid:528242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionattorney.com"; sid:528243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionattorneys.com"; sid:528244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionlaw.com"; sid:528245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlaw.com"; sid:528246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionlawyer.com"; sid:528247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionlawyers.com"; sid:528248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classattorney.com"; sid:528249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classattorneys.com"; sid:528250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19class.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19class.com"; sid:528251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19class.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19class.com"; sid:528252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classlaw.com"; sid:528253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classlaw.com"; sid:528254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classlawyer.com"; sid:528255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classlawyer.com"; sid:528256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classlawyers.com"; sid:528257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classlawyers.com"; sid:528258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cleaner.com"; sid:528259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cleaners.com"; sid:528260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.cleaning"; sid:528261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningmontreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningmontreal.com"; sid:528262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningtoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningtoronto.com"; sid:528263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanse.com"; sid:528264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleansing.com"; sid:528265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clear.com"; sid:528266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinical.com"; sid:528267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clothing.com"; sid:528268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19colombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19colombia.com"; sid:528269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19community.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19community.care"; sid:528270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comparator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comparator.com"; sid:528271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliant.com"; sid:528272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conspiracies.com"; sid:528273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.contractors"; sid:528274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cornyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cornyn.com"; sid:528275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cornyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cornyn.com"; sid:528276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cornyn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cornyn.net"; sid:528277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cornyn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cornyn.net"; sid:528278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronasvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronasvirus.com"; sid:528279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus-alert.com"; sid:528280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19costarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19costarica.com"; sid:528281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cough.com"; sid:528282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19counseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19counseling.com"; sid:528283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counseling.com"; sid:528284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19countdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19countdown.com"; sid:528285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covid19.com"; sid:528286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cremation.com"; sid:528287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cryptocurrenciesdonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cryptocurrenciesdonations.com"; sid:528288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailyinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailyinfo.com"; sid:528289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dance.com"; sid:528290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19database.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19database.com"; sid:528291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.dating"; sid:528292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deals.com"; sid:528293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-deep-clean-scotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-deep-clean-scotland.com"; sid:528294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dentalupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dentalupdate.com"; sid:528295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desk.com"; sid:528296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectionkit.com"; sid:528297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digital.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digital.agency"; sid:528298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digital.com"; sid:528299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digital.marketing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digital.marketing"; sid:528300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digital.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digital.tips"; sid:528301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterassistance.com"; sid:528302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disaster.com"; sid:528303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discounts.com"; sid:528304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discounts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discounts.net"; sid:528305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19documentary.com"; sid:528306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donations.com"; sid:528307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dontsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dontsurf.com"; sid:528308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-drivethrough-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-drivethrough-testing.com"; sid:528309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dz.com"; sid:528310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecmo.com"; sid:528311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economicimpact.com"; sid:528312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19effect.com"; sid:528313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emploi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emploi.com"; sid:528314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emplois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emplois.com"; sid:528315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentattorney.com"; sid:528316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorney.com"; sid:528317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentattorneys.com"; sid:528318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneys.com"; sid:528319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlawyer.com"; sid:528320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentlawyer.com"; sid:528321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlawyers.com"; sid:528322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentlawyers.com"; sid:528323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19enimagenes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19enimagenes.com"; sid:528324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-entschaedigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-entschaedigung.com"; sid:528325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eos.com"; sid:528326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19espanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19espanol.com"; sid:528327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ether.com"; sid:528328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factbook.com"; sid:528329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facts.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facts.world"; sid:528330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.faith - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.faith"; sid:528331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19family.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19family.com"; sid:528332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fighters.com"; sid:528333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialrelief.com"; sid:528334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19first.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19first.com"; sid:528335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fitbit-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fitbit-alert.com"; sid:528336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fix.com"; sid:528337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.flights"; sid:528338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-flu.com"; sid:528339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fr.com"; sid:528340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeenvironments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeenvironments.com"; sid:528341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fumigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fumigation.com"; sid:528342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundingbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundingbailout.com"; sid:528343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gameplan.com"; sid:528344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gameplan.com"; sid:528345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19games.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19games.com"; sid:528346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gay.com"; sid:528347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19genehostinitiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19genehostinitiative.net"; sid:528348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19givingback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19givingback.com"; sid:528349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-global.com"; sid:528350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-global.com"; sid:528351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glob.com"; sid:528352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.graphics"; sid:528353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gunma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gunma.com"; sid:528354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gwhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gwhealth.com"; sid:528355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gwhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gwhealth.net"; sid:528356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hack.com"; sid:528357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hacks.com"; sid:528358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halt.com"; sid:528359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-has.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-has.com"; sid:528360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareplans.com"; sid:528361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.care"; sid:528362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpinghands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpinghands.com"; sid:528363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpinghands.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpinghands.net"; sid:528364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herbz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herbz.com"; sid:528365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hoax.com"; sid:528366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homes.com"; sid:528367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometest.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometest.today"; sid:528368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ians.com"; sid:528369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idaho.com"; sid:528370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-impfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-impfstoff.com"; sid:528371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19in2020.com"; sid:528372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19indo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19indo.com"; sid:528373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionattorney.com"; sid:528374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionattorneys.com"; sid:528375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionlawyer.com"; sid:528376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infectionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infectionlawyer.com"; sid:528377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionlawyers.com"; sid:528378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infectionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infectionlawyers.com"; sid:528379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.care"; sid:528380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.world"; sid:528381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insanity.com"; sid:528382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instant.com"; sid:528383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceplans.com"; sid:528384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intake.com"; sid:528385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19iocero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19iocero.com"; sid:528386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isover.com"; sid:528387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jerseyshore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jerseyshore.com"; sid:528388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobboard.com"; sid:528389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19job.com"; sid:528390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19job.com"; sid:528391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jobs.com"; sid:528392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19klenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19klenz.com"; sid:528393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lascruces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lascruces.com"; sid:528394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latestnews.com"; sid:528395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legaladvice.com"; sid:528396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lifestyle.com"; sid:528397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19livestat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19livestat.com"; sid:528398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lockdown.com"; sid:528399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-logistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-logistics.com"; sid:528400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19madesimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19madesimple.com"; sid:528401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.marketing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.marketing"; sid:528402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maroc.com"; sid:528403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mask24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mask24.com"; sid:528404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masks.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masks.club"; sid:528405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mayhem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mayhem.com"; sid:528406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mcadebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mcadebt.com"; sid:528407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mcadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mcadebtrelief.com"; sid:528408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mcadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mcadebtrelief.com"; sid:528409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mcadebtrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mcadebtrelief.net"; sid:528410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mcadebtrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mcadebtrelief.net"; sid:528411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-md.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-md.com"; sid:528412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medclinic.com"; sid:528413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalclinic.com"; sid:528414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalsupplies.com"; sid:528415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealthnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealthnews.com"; sid:528416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19merchandise.com"; sid:528417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merchandise.com"; sid:528418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-merch.com"; sid:528419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mh.com"; sid:528420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigation.com"; sid:528421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mouthmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mouthmask.com"; sid:528422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mouthwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mouthwash.com"; sid:528423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-movie.com"; sid:528424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mundial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mundial.com"; sid:528425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19museum.com"; sid:528426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19musicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19musicfestival.com"; sid:528427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutualaidforres.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutualaidforres.net"; sid:528428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nashville.com"; sid:528429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nashville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nashville.net"; sid:528430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturally.com"; sid:528431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19needs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19needs.com"; sid:528432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nettoyagemontreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nettoyagemontreal.com"; sid:528433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newjersey.com"; sid:528434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsfeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsfeeds.com"; sid:528435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsfeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsfeeds.com"; sid:528436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newstoday.com"; sid:528437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsupdates.com"; sid:528438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsupdates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsupdates.net"; sid:528439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nj.com"; sid:528440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinecremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinecremation.com"; sid:528441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinefuneralservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinefuneralservices.com"; sid:528442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsite.com"; sid:528443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organ.com"; sid:528444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-outbreak.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-outbreak.club"; sid:528445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreak.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreak.net"; sid:528446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19out.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19out.com"; sid:528447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overstock.com"; sid:528448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overstock.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overstock.net"; sid:528449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19overview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19overview.com"; sid:528450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ozone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ozone.com"; sid:528451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ozone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ozone.com"; sid:528452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pages.com"; sid:528453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pain.com"; sid:528454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemisi.com"; sid:528455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patient.com"; sid:528456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patients.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patients.net"; sid:528457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patients.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patients.world"; sid:528458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19positive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19positive.com"; sid:528459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prayers.com"; sid:528460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19precautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19precautions.com"; sid:528461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-presse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-presse.com"; sid:528462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pressepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pressepro.com"; sid:528463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proof.com"; sid:528464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psych.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psych.com"; sid:528465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantined.com"; sid:528466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinemap.com"; sid:528467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantine.net"; sid:528468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapid.com"; sid:528469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-realtime.com"; sid:528470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-recession.com"; sid:528471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-recession.com"; sid:528472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.recipes"; sid:528473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recipes.com"; sid:528474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefprogram.com"; sid:528475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsefund.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsefund.biz"; sid:528476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reveal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reveal.com"; sid:528477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskassessment.com"; sid:528478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roke.com"; sid:528479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rules.com"; sid:528480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19run.com"; sid:528481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19run.com"; sid:528482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecremation.com"; sid:528483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeguard.com"; sid:528484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyinformation.com"; sid:528485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyinformation.com"; sid:528486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizeall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizeall.com"; sid:528487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizeall.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizeall.net"; sid:528488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbaloans.com"; sid:528489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scan.com"; sid:528490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scanning.com"; sid:528491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scanning.com"; sid:528492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schools.com"; sid:528493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.singles"; sid:528494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19singles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19singles.com"; sid:528495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smallbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smallbusinessloans.com"; sid:528496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19snapmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19snapmd.com"; sid:528497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sniper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sniper.com"; sid:528498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19snipers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19snipers.com"; sid:528499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.soccer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.soccer"; sid:528500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19software.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19software.com"; sid:528501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19song.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19song.com"; sid:528502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sports.com"; sid:528503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spot.com"; sid:528504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.net"; sid:528505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilization.com"; sid:528506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sticker.com"; sid:528507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stickers.com"; sid:528508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19striketeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19striketeam.com"; sid:528509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strong.com"; sid:528510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.study"; sid:528511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-study.com"; sid:528512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplykit.com"; sid:528513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19surge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19surge.com"; sid:528514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19surgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19surgicalmask.com"; sid:528515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surv.com"; sid:528516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivalkit.com"; sid:528517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalkits.com"; sid:528518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivaltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivaltips.com"; sid:528519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surviver.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surviver.club"; sid:528520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor.biz"; sid:528521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19system.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19system.com"; sid:528522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19systems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19systems.com"; sid:528523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tandt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tandt.com"; sid:528524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-taskforce.com"; sid:528525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teeshirts.com"; sid:528526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-alert.com"; sid:528527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-alert.com"; sid:528528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testbox.com"; sid:528529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingonline.com"; sid:528530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingsites.com"; sid:528531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.world"; sid:528532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testkit.net"; sid:528533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.net"; sid:528534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testonline.com"; sid:528535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.org.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.org.uk"; sid:528536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testspot.com"; sid:528537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19themusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19themusical.com"; sid:528538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theories.com"; sid:528539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thetruth.com"; sid:528540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thetruth.com"; sid:528541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thevirus.com"; sid:528542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thevirus.com"; sid:528543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timeline.com"; sid:528544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timemachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timemachine.com"; sid:528545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19together.com"; sid:528546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tool.com"; sid:528547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tool.net"; sid:528548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackandtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackandtrace.com"; sid:528549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tracker.com"; sid:528550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trials.com"; sid:528551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trumpweak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trumpweak.com"; sid:528552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tunisia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tunisia.com"; sid:528553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tv.net"; sid:528554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unleashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unleashed.com"; sid:528555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-update.com"; sid:528556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-update.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-update.net"; sid:528557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-update.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-update.net"; sid:528558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-update.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-update.today"; sid:528559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uptodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uptodate.com"; sid:528560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usadebtrelief.com"; sid:528561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa.email"; sid:528562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usb.com"; sid:528563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uz.com"; sid:528564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.vacations - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.vacations"; sid:528565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccines.com"; sid:528566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vac.com"; sid:528567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vax.com"; sid:528568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vegas.com"; sid:528569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19venezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19venezuela.com"; sid:528570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.ventures"; sid:528571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virginia.com"; sid:528572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtual.com"; sid:528573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualrun.com"; sid:528574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-alert.com"; sid:528575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusalert.com"; sid:528576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusmap.com"; sid:528577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virus.world"; sid:528578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19volunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19volunteer.com"; sid:528579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.vote - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.vote"; sid:528580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.wine - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.wine"; sid:528581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.wine - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.wine"; sid:528582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wise.com"; sid:528583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workout.com"; sid:528584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldmap.com"; sid:528585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldoutbreak.com"; sid:528586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xempt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xempt.com"; sid:528587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-yamanaka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-yamanaka.com"; sid:528588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019action.com"; sid:528589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019lawsuit.com"; sid:528590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020classroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020classroom.com"; sid:528591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20lockdown.com"; sid:528592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-movie.com"; sid:528593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20quarantine.com"; sid:528594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.world"; sid:528595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3000.com"; sid:528596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid316.faith - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid316.faith"; sid:528597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid316.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid316.network"; sid:528598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid316.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid316.today"; sid:528599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid316.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid316.world"; sid:528600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teen-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teen-update.com"; sid:528601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabate.com"; sid:528602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabate.net"; sid:528603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacation.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacation.life"; sid:528604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccount.com"; sid:528605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionmap.com"; sid:528606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactnow.com"; sid:528607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalabama.com"; sid:528608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaloca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaloca.com"; sid:528609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalt.com"; sid:528610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalt.net"; sid:528611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathometest.com"; sid:528612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattack.com"; sid:528613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-australia.com"; sid:528614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.bet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.bet"; sid:528615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblaster.com"; sid:528616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrand.com"; sid:528617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreak.com"; sid:528618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruption.com"; sid:528619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabinfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabinfever.com"; sid:528620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-canada.com"; sid:528621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecenters.com"; sid:528622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareful.com"; sid:528623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-care.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-care.net"; sid:528624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareusa.com"; sid:528625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasino.com"; sid:528626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasinolaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasinolaw.com"; sid:528627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatastrophe.com"; sid:528628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatering.com"; sid:528629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcautious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcautious.com"; sid:528630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidceopledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidceopledge.com"; sid:528631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchart.com"; sid:528632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckin.com"; sid:528633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.church"; sid:528634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchurch.com"; sid:528635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-claim.com"; sid:528636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclass.com"; sid:528637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleaning.com"; sid:528638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanup.net"; sid:528639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclick.com"; sid:528640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclock.com"; sid:528641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothes.com"; sid:528642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.clothing"; sid:528643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollapse.com"; sid:528644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollective.com"; sid:528645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedy.com"; sid:528646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.company"; sid:528647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensation.com"; sid:528648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconspiracies.com"; sid:528649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontinuity.com"; sid:528650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcope.com"; sid:528651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornyn.com"; sid:528652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornyn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornyn.net"; sid:528653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcough.com"; sid:528654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughdrop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughdrop.com"; sid:528655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounts.com"; sid:528656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouples.com"; sid:528657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouragement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouragement.com"; sid:528658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraft.com"; sid:528659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraft.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraft.net"; sid:528660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrowd.com"; sid:528661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustom.com"; sid:528662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddashboard.com"; sid:528663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeals.com"; sid:528664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddontsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddontsurf.com"; sid:528665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19cleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19cleanse.com"; sid:528666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19health.com"; sid:528667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecare.com"; sid:528668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideclean.com"; sid:528669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecleanse.com"; sid:528670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-effect.com"; sid:528671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidehealth.com"; sid:528672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergency.com"; sid:528673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eomarketingadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eomarketingadvice.com"; sid:528674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideron.com"; sid:528675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-europe.com"; sid:528676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidface.com"; sid:528677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfallen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfallen.com"; sid:528678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfever.com"; sid:528679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirst.com"; sid:528680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfits.com"; sid:528681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesociety.com"; sid:528682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlines.com"; sid:528683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgaming.com"; sid:528684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidginger19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidginger19.com"; sid:528685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealth.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealth.care"; sid:528686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelper.net"; sid:528687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelphotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelphotels.com"; sid:528688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpline.com"; sid:528689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroes.com"; sid:528690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-history.com"; sid:528691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhistory.com"; sid:528692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecompanion.com"; sid:528693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomekits.com"; sid:528694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometests.com"; sid:528695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumor.com"; sid:528696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidials19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidials19.com"; sid:528697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidials.com"; sid:528698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidians.com"; sid:528699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididiots.com"; sid:528700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindex.com"; sid:528701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.care"; sid:528702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisover.com"; sid:528703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidium.net"; sid:528704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidizer.com"; sid:528705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjokes.com"; sid:528706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkarma.com"; sid:528707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkb.com"; sid:528708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkc.com"; sid:528709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkc.net"; sid:528710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids.club"; sid:528711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kids.com"; sid:528712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillersinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillersinc.com"; sid:528713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidland.com"; sid:528714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlink.com"; sid:528715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlive2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlive2020.com"; sid:528716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-live.com"; sid:528717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanassistance.com"; sid:528718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanhelp.com"; sid:528719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlog.com"; sid:528720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketcap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketcap.com"; sid:528721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-md.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-md.com"; sid:528722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-media.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-media.com"; sid:528723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-memorial.com"; sid:528724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmode.com"; sid:528725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.money"; sid:528726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-monitor.com"; sid:528727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnchill.com"; sid:528728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearyou.com"; sid:528729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneeds.com"; sid:528730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews24.com"; sid:528731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteeshirts.com"; sid:528732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninja.com"; sid:528733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnj.com"; sid:528734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoc.com"; sid:528735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocs.com"; sid:528736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol.com"; sid:528737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopenmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopenmap.com"; sid:528738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutreach.com"; sid:528739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpages.com"; sid:528740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pain.com"; sid:528741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpets.com"; sid:528742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpins.com"; sid:528743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidportugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidportugal.com"; sid:528744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayer.com"; sid:528745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayers.com"; sid:528746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.promo - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.promo"; sid:528747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidptreventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidptreventionkit.com"; sid:528748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recession.com"; sid:528749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecession.com"; sid:528750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecipes.com"; sid:528751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffunding.com"; sid:528752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefpodcast.com"; sid:528753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefproject.com"; sid:528754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescue.com"; sid:528755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcelinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcelinks.com"; sid:528756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resources.com"; sid:528757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurant.net"; sid:528758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsa.com"; sid:528759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sanitizer.com"; sid:528760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsave.com"; sid:528761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheep.com"; sid:528762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshelter.com"; sid:528763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshirt.com"; sid:528764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shutdown.com"; sid:528765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsinfronteras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsinfronteras.com"; sid:528766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspace.com"; sid:528767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstayin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstayin.com"; sid:528768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulus.com"; sid:528769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstruggle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstruggle.com"; sid:528770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-study.com"; sid:528771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportpodcast.com"; sid:528772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportproject.com"; sid:528773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportseries.com"; sid:528774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvival.net"; sid:528775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalseries.com"; sid:528776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorguide.com"; sid:528777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-symptoms.com"; sid:528778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-symptoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-symptoms.net"; sid:528779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-talk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-talk.com"; sid:528780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemp.com"; sid:528781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemperature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemperature.com"; sid:528782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestchina.com"; sid:528783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthinktank.com"; sid:528784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtigerteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtigerteam.com"; sid:528785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtools.com"; sid:528786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackercanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackercanada.com"; sid:528787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrial.com"; sid:528788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrials.com"; sid:528789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tunisie.com"; sid:528790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtv.net"; sid:528791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uk.com"; sid:528792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunderground.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunderground.com"; sid:528793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunleashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunleashed.com"; sid:528794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduntold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduntold.com"; sid:528795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurgentcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurgentcare.com"; sid:528796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-usa.com"; sid:528797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinations.com"; sid:528798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelocator.com"; sid:528799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvenezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvenezuela.com"; sid:528800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverify.com"; sid:528801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideo.com"; sid:528802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-alert.com"; sid:528803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusbaby.com"; sid:528804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscheck.com"; sid:528805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfact.com"; sid:528806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfacts.com"; sid:528807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprojections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprojections.com"; sid:528808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustestkit.com"; sid:528809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.vision"; sid:528810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalkout.com"; sid:528811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwallofshame.com"; sid:528812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhistleblower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhistleblower.com"; sid:528813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwipe.com"; sid:528814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwipes.com"; sid:528815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-work.com"; sid:528816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldtour.com"; sid:528817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxx.com"; sid:528818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xxx.com"; sid:528819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyoga.com"; sid:528820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityovercovid19.com"; sid:528821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscovid19.com"; sid:528822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cumberlandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cumberlandcoronavirus.com"; sid:528823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-covid-19.com"; sid:528824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19.net"; sid:528825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid.net"; sid:528826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid-us.com"; sid:528827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcovid.net"; sid:528828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingcovid.com"; sid:528829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronavirusupdates.com"; sid:528830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dashboard-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dashboard-covid19.com"; sid:528831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcovid.com"; sid:528832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demolishcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demolishcoronavirus.com"; sid:528833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designtocombatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designtocombatcovid19.com"; sid:528834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirus.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirus.madrid"; sid:528835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid-19.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid-19.madrid"; sid:528836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionylimpiezacoronavirus.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionylimpiezacoronavirus.madrid"; sid:528837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecter-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecter-coronavirus.com"; sid:528838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroycoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroycoronavirusnow.com"; sid:528839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digital-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digital-vs-corona.com"; sid:528840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovid19.com"; sid:528841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovid.com"; sid:528842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronavirus.com"; sid:528843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dj-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dj-covid.com"; sid:528844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihave-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihave-coronavirus.com"; sid:528845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-covid-19.com"; sid:528846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovid19.net"; sid:528847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcovid-19.com"; sid:528848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpedcovid19.com"; sid:528849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpedthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpedthecoronavirus.com"; sid:528850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dubaicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dubaicoronavirus.com"; sid:528851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dudaslaboralescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dudaslaboralescoronavirus.com"; sid:528852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eboltcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eboltcoronavirus.com"; sid:528853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecccovid19.com"; sid:528854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economicimpactcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economicimpactcoronavirus.com"; sid:528855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronas.com"; sid:528856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronalive.com"; sid:528857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for electionwarzcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"electionwarzcoronavirus.com"; sid:528858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emploi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emploi-covid19.com"; sid:528859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emploicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emploicovid19.com"; sid:528860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emploiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emploiscovid19.com"; sid:528861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidnow.com"; sid:528862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entraidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entraidecovid19.com"; sid:528863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-corona.com"; sid:528864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.photos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.photos"; sid:528865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpreparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpreparation.com"; sid:528866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsale.com"; sid:528867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicshoppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicshoppe.com"; sid:528868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicshopping.com"; sid:528869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.support"; sid:528870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for excelsoinscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"excelsoinscoronavirus.com"; sid:528871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for excovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"excovid.com"; sid:528872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for explaincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"explaincorona.com"; sid:528873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exradico-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exradico-covid.com"; sid:528874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exterminatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exterminatecoronavirus.com"; sid:528875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks-coronavirus.com"; sid:528876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncoronaviruspatientzero.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncoronaviruspatientzero.cloud"; sid:528877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidtestkits.com"; sid:528878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid.com"; sid:528879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fedcoronaassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fedcoronaassistance.com"; sid:528880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fedcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fedcoronarelief.com"; sid:528881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcoronaassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcoronaassistance.com"; sid:528882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcoronarelief.com"; sid:528883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fghcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fghcovid19.com"; sid:528884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fghcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fghcovid.com"; sid:528885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fhcovid19.com"; sid:528886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fhcovid.com"; sid:528887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona19virus.com"; sid:528888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid.com"; sid:528889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingthecorona.com"; sid:528890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightwithcorona.com"; sid:528891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightwithcoronavirus.com"; sid:528892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for figlidelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"figlidelcorona.com"; sid:528893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatest.com"; sid:528894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatester.com"; sid:528895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronatests.com"; sid:528896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19test.com"; sid:528897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19testing.com"; sid:528898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finlandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finlandcoronavirus.com"; sid:528899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcovid19.com"; sid:528900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fooglecoronavirus.com"; sid:528901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestingnearme.com"; sid:528902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19testing.com"; sid:528903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendsintimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendsintimesofcorona.com"; sid:528904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona.net"; sid:528905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid2020.com"; sid:528906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.club"; sid:528907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-covid.com"; sid:528908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingwuhancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingwuhancoronavirus.com"; sid:528909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucoronavirusshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucoronavirusshirt.com"; sid:528910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxckcovid.com"; sid:528911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaycoronavirus.com"; sid:528912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaycovid19.com"; sid:528913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gejalacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gejalacorona.com"; sid:528914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencovid.com"; sid:528915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcovid19.com"; sid:528916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gestoriaertescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gestoriaertescoronavirus.com"; sid:528917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gestoriaertescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gestoriaertescoronavirus.net"; sid:528918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronadone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronadone.com"; sid:528919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusassistance.com"; sid:528920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusmoney.com"; sid:528921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testing.com"; sid:528922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19test.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19test.uk"; sid:528923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19vaccine.com"; sid:528924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycoronavirusvaccine.com"; sid:528925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovidvaccine.com"; sid:528926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreadyforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreadyforcorona.com"; sid:528927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getscreened4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getscreened4covid19.com"; sid:528928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ggooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ggooglecoronavirus.com"; sid:528929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gingercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gingercorona.com"; sid:528930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gingercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gingercovid19.com"; sid:528931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaviruscure.com"; sid:528932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirushoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirushoax.com"; sid:528933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirussafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirussafety.com"; sid:528934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19hoax.com"; sid:528935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.club"; sid:528936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.world"; sid:528937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goglecoronavirus.com"; sid:528938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gogolecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gogolecoronavirus.com"; sid:528939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goiglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goiglecoronavirus.com"; sid:528940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodafetrcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodafetrcorona.com"; sid:528941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodaftercorona.com"; sid:528942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodaftercovid19.com"; sid:528943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcoronabadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcoronabadcorona.com"; sid:528944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcorona.com"; sid:528945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewscorona.com"; sid:528946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gooflecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gooflecoronavirus.com"; sid:528947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googecoronavirus.com"; sid:528948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googelcoronavirus.com"; sid:528949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googglecoronavirus.com"; sid:528950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googkecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googkecoronavirus.com"; sid:528951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlcoronavirus.com"; sid:528952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googleccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googleccoronavirus.com"; sid:528953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaavirus.com"; sid:528954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavarus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavarus.com"; sid:528955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaverus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaverus.com"; sid:528956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavieus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavieus.com"; sid:528957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviirus.com"; sid:528958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviras.com"; sid:528959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavires.com"; sid:528960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviris.com"; sid:528961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviros.com"; sid:528962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirrus.com"; sid:528963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirs.com"; sid:528964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirsu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirsu.com"; sid:528965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirua.com"; sid:528966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviru.com"; sid:528967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirud.com"; sid:528968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviruss.com"; sid:528969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviruus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviruus.com"; sid:528970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirys.com"; sid:528971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavitus.com"; sid:528972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronaviurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronaviurs.com"; sid:528973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavius.com"; sid:528974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavorus.com"; sid:528975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavrius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavrius.com"; sid:528976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavrus.com"; sid:528977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavurus.com"; sid:528978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavvirus.com"; sid:528979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid-19.net"; sid:528980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googleecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googleecoronavirus.com"; sid:528981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googllecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googllecoronavirus.com"; sid:528982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlocoronavirus.com"; sid:528983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlrcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlrcoronavirus.com"; sid:528984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlwcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlwcoronavirus.com"; sid:528985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goohlecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goohlecoronavirus.com"; sid:528986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goolecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goolecoronavirus.com"; sid:528987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goolgecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goolgecoronavirus.com"; sid:528988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goooglecoronavirus.com"; sid:528989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gopglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gopglecoronavirus.com"; sid:528990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotcovid-19.com"; sid:528991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotocovid-19.com"; sid:528992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gsdcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gsdcovidupdates.com"; sid:528993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiadocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiadocorona.com"; sid:528994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackthecovid.com"; sid:528995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handinjurycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handinjurycoronavirus.com"; sid:528996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handpandemic.com"; sid:528997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for has-coronavirus-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"has-coronavirus-alert.com"; sid:528998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haydockcovid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haydockcovid19diaries.com"; sid:528999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecovid-19.com"; sid:529000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpendcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpendcovid.com"; sid:529001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcorona.net"; sid:529002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfundcovid-19.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfundcovid-19.fund"; sid:529003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingtheelderlyduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingtheelderlyduringcoronavirus.com"; sid:529004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid-19.com"; sid:529005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helptheelderlyduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helptheelderlyduringcoronavirus.com"; sid:529006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holisticcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holisticcoronavirus.com"; sid:529007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holisticcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holisticcoronaviruscure.com"; sid:529008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hooglecoronavirus.com"; sid:529009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeinthetimeofcorona.com"; sid:529010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeinthetimeofcovid.com"; sid:529011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horutcorona.com"; sid:529012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelsforcovid.com"; sid:529013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirus.net"; sid:529014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19.com"; sid:529015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcoronavirushurtme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcoronavirushurtme.com"; sid:529016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howitreatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howitreatcovid19.com"; sid:529017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocareforcovid19patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocareforcovid19patients.com"; sid:529018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocleancovid19.com"; sid:529019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtogetcoronavirusrelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtogetcoronavirusrelieffunding.com"; sid:529020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotreatcovid19patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotreatcovid19patients.com"; sid:529021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansvscovid.com"; sid:529022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huroncountyohiocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huroncountyohiocovid19.net"; sid:529023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hybridcovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hybridcovid-19.biz"; sid:529024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hyphycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hyphycoronavirus.com"; sid:529025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hyphycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hyphycovid19.com"; sid:529026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamthecoronavirus.com"; sid:529027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid.com"; sid:529028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icaccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icaccovid19.com"; sid:529029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-coronavirus.com"; sid:529030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid-19.com"; sid:529031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcovid-19.com"; sid:529032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ididcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ididcovid.com"; sid:529033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ididmypartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ididmypartcovid19.com"; sid:529034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotthethecoronablues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotthethecoronablues.com"; sid:529035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iheartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iheartcovid19.com"; sid:529036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcorona.com"; sid:529037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immuneagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immuneagainstcoronavirus.com"; sid:529038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imsurvivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imsurvivingcovid19.com"; sid:529039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacoronavirusupdates.com"; sid:529040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid19.com"; sid:529041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscorona.com"; sid:529042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indocorona.com"; sid:529043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"information-covid19.com"; sid:529044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injurycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injurycoronavirus.com"; sid:529045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injurycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injurycovid19.com"; sid:529046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacorona.com"; sid:529047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacorona.net"; sid:529048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacoronavirus.com"; sid:529049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacovid.com"; sid:529050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceclaimcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceclaimcoronavirus.com"; sid:529051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecoronavirus.com"; sid:529052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for interfaithcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"interfaithcovid19help.com"; sid:529053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcovid-19.com"; sid:529054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcovid19.com"; sid:529055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investmentscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investmentscoronavirus.com"; sid:529056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipandcovid-19.com"; sid:529057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istrumpscoronaviruswebsiteready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istrumpscoronaviruswebsiteready.com"; sid:529058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvided-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvided-covid19.com"; sid:529059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronav.com"; sid:529060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus19.com"; sid:529061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.guru"; sid:529062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirustshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirustshirts.com"; sid:529063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthebigcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthebigcorona2020.com"; sid:529064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthebigcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthebigcorona.com"; sid:529065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecorona2020.com"; sid:529066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaoutbreak.com"; sid:529067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirus2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirus2020.net"; sid:529068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovidpandemic.com"; sid:529069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovidpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovidpanic.com"; sid:529070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jahecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jahecorona.com"; sid:529071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jahecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jahecovid19.com"; sid:529072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jahemerahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jahemerahcorona.com"; sid:529073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jahemerahcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jahemerahcovid19.com"; sid:529074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcovid-19.com"; sid:529075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcovid19.com"; sid:529076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joebidencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joebidencovid-19.com"; sid:529077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johncoronacornyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johncoronacornyn.com"; sid:529078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johncoronacornyn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johncoronacornyn.net"; sid:529079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johncoronacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johncoronacovid.com"; sid:529080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johncoronacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johncoronacovid.net"; sid:529081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juegoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juegoscoronavirus.com"; sid:529082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for just-corona-bro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"just-corona-bro.com"; sid:529083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kabarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kabarcovid19.com"; sid:529084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmandcoronaon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmandcoronaon.com"; sid:529085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcoronaandcarryon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcoronaandcarryon.com"; sid:529086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepingupwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepingupwithcoronavirus.com"; sid:529087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepsafefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepsafefromcoronavirus.com"; sid:529088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kesan-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kesan-covid19.com"; sid:529089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickoutcorona.com"; sid:529090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsvscorona.com"; sid:529091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona-virus.com"; sid:529092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-covid.com"; sid:529093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid.net"; sid:529094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidnotsmallbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidnotsmallbiz.com"; sid:529095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidnotsmallbizgvl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidnotsmallbizgvl.com"; sid:529096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95forcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95forcoronavirus.com"; sid:529097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ktcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ktcovid.com"; sid:529098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kulturstattcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kulturstattcorona.com"; sid:529099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kulturstattcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kulturstattcorona.net"; sid:529100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronahelp.com"; sid:529101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latest-corona-virus-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latest-corona-virus-updates.com"; sid:529102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laughinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laughinthetimeofcorona.com"; sid:529103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnaboutcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnaboutcovid19.net"; sid:529104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learncoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learncoronavirus.life"; sid:529105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebanoncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebanoncorona.net"; sid:529106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebenmitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebenmitcorona.com"; sid:529107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid19.com"; sid:529108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liefdeintijdenvancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liefdeintijdenvancorona.com"; sid:529109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeandloveinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeandloveinthetimeofcoronavirus.com"; sid:529110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeincoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeincoronatimes.com"; sid:529111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeincovid19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeincovid19times.com"; sid:529112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinsurancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinsurancecorona.com"; sid:529113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcorona.net"; sid:529114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifestyleatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifestyleatcoronavirus.com"; sid:529115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcovid19.com"; sid:529116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testing.com"; sid:529117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limeinthetimeofcorona.com"; sid:529118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezascovid19.com"; sid:529119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithwuhan.com"; sid:529120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livzon-covid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livzon-covid19test.com"; sid:529121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loanforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loanforcovid.com"; sid:529122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostmyjobtocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostmyjobtocovid19.com"; sid:529123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacoronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacoronavirusdata.com"; sid:529124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinaglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinaglobalpandemic.com"; sid:529125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronavirusbook.com"; sid:529126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.net"; sid:529127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintimeofcorona.com"; sid:529128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovelifeandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovelifeandcorona.com"; sid:529129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovetravelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovetravelcorona.com"; sid:529130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lunchtimepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lunchtimepandemic.com"; sid:529131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lungsingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lungsingcorona.com"; sid:529132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luttercontrelecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luttercontrelecoronavirus.com"; sid:529133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeincorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeincorona.biz"; sid:529134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malibucoronadelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malibucoronadelivery.com"; sid:529135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malibucoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malibucoronahelp.com"; sid:529136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapadelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapadelcorona.com"; sid:529137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascerinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascerinacorona.com"; sid:529138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascerinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascerinecoronavirus.com"; sid:529139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecoronavirus.net"; sid:529140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskstopscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskstopscoronavirus.com"; sid:529141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskthecorona.com"; sid:529142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-corona.com"; sid:529143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecorona.com"; sid:529144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for me-corona-and-i.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"me-corona-and-i.com"; sid:529145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medecins-libheros-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medecins-libheros-coronavirus.com"; sid:529146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaments-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaments-covid19.com"; sid:529147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentscovid19.com"; sid:529148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecorona.com"; sid:529149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecoronaguide.com"; sid:529150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecoronavirus.com"; sid:529151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecoronavirusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecoronavirusguide.com"; sid:529152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecovid19.com"; sid:529153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecovid19guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecovid19guide.com"; sid:529154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecovid.com"; sid:529155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecovidguide.com"; sid:529156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicosfrentealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicosfrentealcovid.com"; sid:529157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetmepostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetmepostcorona.com"; sid:529158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metacorona.com"; sid:529159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocovid19.com"; sid:529160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid.care"; sid:529161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronatesting.com"; sid:529162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moreviralthancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moreviralthancorona.com"; sid:529163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccovid-19.com"; sid:529164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for motheringinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"motheringinthetimeofcorona.com"; sid:529165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrfinkscoronatasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrfinkscoronatasks.com"; sid:529166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutuelle-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutuelle-corona.com"; sid:529167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutuelle-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutuelle-coronavirus.com"; sid:529168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachecker.com"; sid:529169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafund.com"; sid:529170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakid.com"; sid:529171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaquarantine.com"; sid:529172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasettlement.com"; sid:529173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronashirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronashirt.com"; sid:529174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronastatus.com"; sid:529175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatruth.com"; sid:529176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavac.com"; sid:529177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusattorney.com"; sid:529178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusinfectionstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusinfectionstory.com"; sid:529179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19story.com"; sid:529180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19testing.com"; sid:529181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcash.com"; sid:529182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovideo.com"; sid:529183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myloveinthetimeofcorona.com"; sid:529184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypensionandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypensionandcoronavirus.com"; sid:529185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashcorona.com"; sid:529186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashcorona.net"; sid:529187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecorona.com"; sid:529188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecorona.net"; sid:529189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid-19.com"; sid:529190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19.com"; sid:529191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19.net"; sid:529192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19lawsuit.com"; sid:529193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19-realtime.com"; sid:529194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neuralpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neuralpandemic.com"; sid:529195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronans.com"; sid:529196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidians.com"; sid:529197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsaboutcorona.com"; sid:529198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixthecovid.com"; sid:529199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaday.com"; sid:529200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaparty.com"; sid:529201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiasdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiasdelcorona.com"; sid:529202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusvac.com"; sid:529203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-covid-19.com"; sid:529204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscoronavirusmap.com"; sid:529205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19aid.com"; sid:529206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19.com"; sid:529207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscoronaviruscleaning.com"; sid:529208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oath-covid-19-prepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oath-covid-19-prepare.com"; sid:529209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offcoronavirus.com"; sid:529210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusmovie.com"; sid:529211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid-19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid-19movie.com"; sid:529212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19-movie.com"; sid:529213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19movie.com"; sid:529214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialfuckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialfuckcoronavirus.com"; sid:529215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohne-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohne-corona.com"; sid:529216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecremationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecremationcovid19.com"; sid:529217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ooglecoronavirus.com"; sid:529218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opcovid19.com"; sid:529219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencorona.net"; sid:529220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid.care"; sid:529221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for open-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"open-covid.com"; sid:529222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oqueecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oqueecoronavirus.com"; sid:529223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orthopediccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orthopediccorona.com"; sid:529224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orthopediccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orthopediccoronavirus.com"; sid:529225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orthopediccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orthopediccovid19.com"; sid:529226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomecoronavirusnow.com"; sid:529227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecovid-19.com"; sid:529228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecovid19.com"; sid:529229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonekillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonekillscoronavirus.com"; sid:529230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for palsinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"palsinpandemic.com"; sid:529231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.net"; sid:529232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicacademy.com"; sid:529233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemica.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemica.today"; sid:529234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemica.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemica.world"; sid:529235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbehavior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbehavior.com"; sid:529236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbots.com"; sid:529237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuys.com"; sid:529238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.claims"; sid:529239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.codes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.codes"; sid:529240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccomedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccomedyclub.com"; sid:529241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.cool - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.cool"; sid:529242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccounseling.com"; sid:529243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccountries.com"; sid:529244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccreativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccreativity.com"; sid:529245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrises.com"; sid:529246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdepotonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdepotonline.com"; sid:529247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-diet.com"; sid:529248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdonation.com"; sid:529249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicepidemic.com"; sid:529250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.exchange - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.exchange"; sid:529251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.fail"; sid:529252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfail.com"; sid:529253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfinancial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfinancial.com"; sid:529254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgameplan.com"; sid:529255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.gold"; sid:529256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.house"; sid:529257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinequality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinequality.com"; sid:529258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicing.com"; sid:529259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsure.com"; sid:529260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-life.com"; sid:529261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifeinsurance.com"; sid:529262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicliveblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicliveblog.com"; sid:529263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-live.com"; sid:529264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemorials.com"; sid:529265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnews.net"; sid:529266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoin.com"; sid:529267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicomms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicomms.com"; sid:529268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpaycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpaycheck.com"; sid:529269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaylist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaylist.com"; sid:529270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplumber.com"; sid:529271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpop.com"; sid:529272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpr00f.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpr00f.com"; sid:529273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprayers.com"; sid:529274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpress.com"; sid:529275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.recipes"; sid:529276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicregistration.com"; sid:529277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicretirement.com"; sid:529278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsale.com"; sid:529279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-shop.com"; sid:529280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.singles"; sid:529281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstress.com"; sid:529282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictales.com"; sid:529283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictests.com"; sid:529284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthinking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthinking.com"; sid:529285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-time.com"; sid:529286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictime.com"; sid:529287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictshirt.com"; sid:529288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictshirts.com"; sid:529289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwellness.com"; sid:529290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicyoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicyoga.com"; sid:529291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracovid.com"; sid:529292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paremoscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paremoscovid.net"; sid:529293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentinginthetimeofcorona.com"; sid:529294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peakcampuscovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peakcampuscovid19updates.com"; sid:529295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcorona.com"; sid:529296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petscorona.com"; sid:529297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petscovid19.com"; sid:529298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petscovid.com"; sid:529299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phunkhutrungcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phunkhutrungcovid19.com"; sid:529300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for picassobarcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"picassobarcoronado.com"; sid:529301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plagueyearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plagueyearcovid19.com"; sid:529302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadoscoronavirus.com"; sid:529303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcoronacraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcoronacraft.com"; sid:529304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pmcoronavirus.com"; sid:529305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pocovid.com"; sid:529306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positifcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positifcorona.com"; sid:529307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona.com"; sid:529308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacure.com"; sid:529309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaworld.com"; sid:529310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19america.com"; sid:529311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.world"; sid:529312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidparty.com"; sid:529313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidenttrumpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidenttrumpcovid-19.com"; sid:529314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestacionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestacionescoronavirus.com"; sid:529315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingcoronavirus.net"; sid:529316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingcovid.com"; sid:529317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventionforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventionforcovid19.com"; sid:529318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procoronavirus.net"; sid:529319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prognose-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prognose-corona.com"; sid:529320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocoes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocoes-covid19.com"; sid:529321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectfromcovid19.com"; sid:529322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proudcoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proudcoronasurvivor.com"; sid:529323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsacorona.com"; sid:529324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulse-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulse-covid.com"; sid:529325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsecovid.com"; sid:529326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pvdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pvdcovid19.com"; sid:529327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocorona.net"; sid:529328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronatestkit.com"; sid:529329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19cases.com"; sid:529330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid.com"; sid:529331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidvirus.com"; sid:529332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redgingercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redgingercorona.com"; sid:529333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinigung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinigung-corona.com"; sid:529334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantsvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantsvscoronavirus.com"; sid:529335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcorona.com"; sid:529336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovid19.com"; sid:529337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riseagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riseagainstcorona.com"; sid:529338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochestercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochestercoronavirus.com"; sid:529339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rockyourpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rockyourpandemic.com"; sid:529340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rokecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rokecovid19.com"; sid:529341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roomsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roomsforcovid.com"; sid:529342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rxcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rxcovid-19.com"; sid:529343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronaa.com"; sid:529344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetytipsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetytipsforcoronavirus.com"; sid:529345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saintecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saintecorona.com"; sid:529346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sakitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sakitcorona.com"; sid:529347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocovidhelp.com"; sid:529348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecontrocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecontrocoronavirus.com"; sid:529349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecoronavirus.net"; sid:529350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarsvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarsvscorona.com"; sid:529351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocovid19.com"; sid:529352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sce-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sce-covid.com"; sid:529353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmaske-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmaske-corona.com"; sid:529354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screen4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screen4covid.net"; sid:529355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencorona.com"; sid:529356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningcoronavirus.biz"; sid:529357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segurocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segurocoronavirus.net"; sid:529358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendlovenotcovid19fear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendlovenotcovid19fear.com"; sid:529359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorxcorona.com"; sid:529360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-corona.com"; sid:529361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexcoronavirus.com"; sid:529362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexcovid19.com"; sid:529363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldscorona.com"; sid:529364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanticoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanticoronamasks.com"; sid:529365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldercoronavirus.com"; sid:529366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutdown-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutdown-covid.com"; sid:529367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincovid.com"; sid:529368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for situscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"situscorona.com"; sid:529369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronaassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronaassistance.com"; sid:529370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronarelief.com"; sid:529371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcoronatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcoronatrials.com"; sid:529372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcovid19trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcovid19trials.com"; sid:529373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smtech-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smtech-covid19.com"; sid:529374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smtechcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smtechcovid-19.com"; sid:529375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcoronavirus.com"; sid:529376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcoronavirusresponse.com"; sid:529377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcoronavirusupdate.com"; sid:529378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcovid19.com"; sid:529379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcovid19response.com"; sid:529380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcovid19update.com"; sid:529381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfresponsetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfresponsetocovid19.com"; sid:529382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialcovid.com"; sid:529383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soledadcoronaranch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soledadcoronaranch.com"; sid:529384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecovid19.com"; sid:529385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southorangecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southorangecovid19.com"; sid:529386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soyinmunealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soyinmunealcoronavirus.com"; sid:529387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedtestcovid19.com"; sid:529388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotcovid.com"; sid:529389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayinalivecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayinalivecorona2020.com"; sid:529390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayinalivecoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayinalivecoronasurvivor.com"; sid:529391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafefromcovid19.com"; sid:529392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcomparingcovid19totheflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcomparingcovid19totheflu.com"; sid:529393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.digital"; sid:529394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.foundation"; sid:529395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.life"; sid:529396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronausa.com"; sid:529397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusaragon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusaragon.com"; sid:529398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona.world"; sid:529399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.world"; sid:529400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.international"; sid:529401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19-nagasaki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19-nagasaki.com"; sid:529402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19virus.com"; sid:529403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19.world"; sid:529404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.club"; sid:529405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopnovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopnovelcoronavirus.com"; sid:529406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentloancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentloancoronavirus.com"; sid:529407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentloanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentloanscoronavirus.com"; sid:529408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentloanscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentloanscoronavirus.net"; sid:529409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sueforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sueforcoronavirus.com"; sid:529410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suministroscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suministroscoronavirus.com"; sid:529411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supercovid19.com"; sid:529412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliescovid19.com"; sid:529413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcoronaviruspodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcoronaviruspodcast.com"; sid:529414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid.com"; sid:529415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovidpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovidpodcast.com"; sid:529416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportduringcovid19.com"; sid:529417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surgicalmaskscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surgicalmaskscoronavirus.com"; sid:529418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalguidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalguidecorona.com"; sid:529419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-covid-19.com"; sid:529420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronabikeweek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronabikeweek.com"; sid:529421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronabikeweek.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronabikeweek.life"; sid:529422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona.life"; sid:529423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirus.life"; sid:529424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthebigcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthebigcorona.com"; sid:529425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecorona2020.com"; sid:529426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-the-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-the-pandemic.com"; sid:529427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving-coronavirus.com"; sid:529428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirus.net"; sid:529429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcorona.com"; sid:529430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swabcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swabcorona.com"; sid:529431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syracusecoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syracusecoronaviruscleaning.com"; sid:529432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syracusecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syracusecoronavirus.com"; sid:529433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoutcovid.com"; sid:529434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapabocascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapabocascorona.com"; sid:529435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tech4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tech4covid19.com"; sid:529436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicineforcovid19.com"; sid:529437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicineforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicineforcovid.com"; sid:529438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenhocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenhocovid.com"; sid:529439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminatecovid19.com"; sid:529440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test2coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test2coronavirus.com"; sid:529441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid.com"; sid:529442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testathomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testathomecovid19.com"; sid:529443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid.com"; sid:529444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid.net"; sid:529445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforecovid19.com"; sid:529446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid19.net"; sid:529447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitforcoronavirus.com"; sid:529448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitsforcoronavirus.com"; sid:529449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmecovid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmecovid19.co.uk"; sid:529450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thcovid19.com"; sid:529451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020pandemic.net"; sid:529452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebookofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebookofcorona.com"; sid:529453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabar.com"; sid:529454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabeats.com"; sid:529455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronablog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronablog.net"; sid:529456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronablues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronablues.com"; sid:529457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachronicle.com"; sid:529458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconfessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconfessionals.com"; sid:529459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafix.com"; sid:529460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahelp.com"; sid:529461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahistory.com"; sid:529462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasessions.com"; sid:529463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastats.com"; sid:529464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastory.com"; sid:529465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus100.com"; sid:529466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona-virus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona-virus19.com"; sid:529467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusblues.com"; sid:529468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfight.com"; sid:529469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushistory.com"; sid:529470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.club"; sid:529471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.life"; sid:529472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.today"; sid:529473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.world"; sid:529474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirususa.com"; sid:529475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid15.com"; sid:529476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid-19.com"; sid:529477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19experience.com"; sid:529478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19help.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19help.center"; sid:529479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19nashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19nashville.com"; sid:529480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19outbreak.com"; sid:529481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19shop.com"; sid:529482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiot.com"; sid:529483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkid.com"; sid:529484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkids.com"; sid:529485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkidz.com"; sid:529486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefightcoronavirus.com"; sid:529487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenextcorona.com"; sid:529488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronaviruses.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronaviruses.life"; sid:529489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicchronicles.com"; sid:529490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicshop.com"; sid:529491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcoronavirus.com"; sid:529492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid19.com"; sid:529493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid.com"; sid:529494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhantool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhantool.com"; sid:529495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisiscorona.com"; sid:529496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipstoavoidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipstoavoidcoronavirus.com"; sid:529497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toutsurlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toutsurlecovid19.com"; sid:529498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tpcovid.com"; sid:529499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovid19.com"; sid:529500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackercovid19.com"; sid:529501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trotztcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trotztcorona.com"; sid:529502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovid19cases.com"; sid:529503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpdidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpdidcovid19.com"; sid:529504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumptakescoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumptakescoronavirustest.com"; sid:529505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkiyedecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkiyedecorona.com"; sid:529506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tvcoronavirus.com"; sid:529507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronabuyback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronabuyback.com"; sid:529508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronavirustest.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronavirustest.co.uk"; sid:529509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19test.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19test.co.uk"; sid:529510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandcovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandcovid.care"; sid:529511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontraelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontraelcovid19.com"; sid:529512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for update-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"update-coronavirus.com"; sid:529513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatecovid-19.com"; sid:529514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-covid-19.com"; sid:529515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usagainstcorona.com"; sid:529516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronafund.com"; sid:529517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscases.com"; sid:529518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusresources.com"; sid:529519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19cases.com"; sid:529520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaffancovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaffancovid.today"; sid:529521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcoronavirusupdates.com"; sid:529522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamcovid19.com"; sid:529523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralcovidhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralcovidhandsanitizer.com"; sid:529524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusmapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusmapcorona.com"; sid:529525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamincovid.com"; sid:529526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamins-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamins-for-coronavirus.com"; sid:529527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcoronatesting.com"; sid:529528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washawaycorona.com"; sid:529529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watertowncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watertowncoronavirus.com"; sid:529530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weagainstcorona.com"; sid:529531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleancoronavirus.com"; sid:529532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecuredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecuredcovid19.com"; sid:529533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westoppedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westoppedcovid19.com"; sid:529534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-survived-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-survived-corona.com"; sid:529535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whataboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whataboutcoronavirus.com"; sid:529536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattobuyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattobuyforcoronavirus.com"; sid:529537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherecovid19.com"; sid:529538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherewereyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherewereyoucorona.com"; sid:529539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutcovid-19.com"; sid:529540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutcovid19.com"; sid:529541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcorona.com"; sid:529542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for work-from-home-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"work-from-home-coronavirus.com"; sid:529543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercovid19.com"; sid:529544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercovid.com"; sid:529545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaidagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaidagainstcorona.com"; sid:529546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaidevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaidevscorona.com"; sid:529547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirus19.com"; sid:529548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid2020.com"; sid:529549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemic20.com"; sid:529550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarcovid.com"; sid:529551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidepandemictracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidepandemictracker.com"; sid:529552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbabies.com"; sid:529553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancaishui123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancaishui123.com"; sid:529554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-coronavirus-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-coronavirus-survivor.com"; sid:529555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-coronavirus-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-coronavirus-survivors.com"; sid:529556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandsanitizer.com"; sid:529557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfreezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfreezone.com"; sid:529558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanseofuwu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanseofuwu.com"; sid:529559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviri.com"; sid:529560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-virus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-virus.life"; sid:529561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-virus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-virus.today"; sid:529562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwcovid19.com"; sid:529563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwcovid.com"; sid:529564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwgooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwgooglecoronavirus.com"; sid:529565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid19.com"; sid:529566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronasolidarit-pnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronasolidarit-pnb.com"; sid:529567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirus-tltravail-n5bb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirus-tltravail-n5bb.com"; sid:529568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid-19opplring-5ob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid-19opplring-5ob.com"; sid:529569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--ichhabecoronaberlebt-1ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--ichhabecoronaberlebt-1ec.com"; sid:529570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mdicamentcovid19-bqb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mdicamentcovid19-bqb.com"; sid:529571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mdicamentscovid19-btb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mdicamentscovid19-btb.com"; sid:529572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mdicaments-covid19-bwb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mdicaments-covid19-bwb.com"; sid:529573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mxicovscoronavirus-bwb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mxicovscoronavirus-bwb.com"; sid:529574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xxxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xxxcovid.com"; sid:529575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yacorona.com"; sid:529576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yapaseelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yapaseelcoronavirus.com"; sid:529577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofcovid19.com"; sid:529578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yeswehavenocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yeswehavenocorona.com"; sid:529579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yoga4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yoga4corona.com"; sid:529580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombie-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombie-pandemic.com"; sid:529581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10thingstobuyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10thingstobuyforcoronavirus.com"; sid:529582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1413-8thstcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1413-8thstcoronado.com"; sid:529583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14138thstcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14138thstcoronado.com"; sid:529584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1413eighthstcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1413eighthstcoronado.com"; sid:529585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19coronas.com"; sid:529586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronarecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronarecession.com"; sid:529587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19pandemic.com"; sid:529588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidsurvivor.com"; sid:529589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 217covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"217covid19.com"; sid:529590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2bvividduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2bvividduringcovid.com"; sid:529591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 86covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"86covid19.com"; sid:529592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.com"; sid:529593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona-party.com"; sid:529594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ai-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ai-coronavirus.com"; sid:529595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabama19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabama19coronavirus.com"; sid:529596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronavirus19.com"; sid:529597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovid.com"; sid:529598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for algeriecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"algeriecorona.com"; sid:529599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcoronavirus.net"; sid:529600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anarcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anarcovid19.net"; sid:529601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anarcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anarcovid.net"; sid:529602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andale-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andale-corona.com"; sid:529603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andalecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andalecorona.com"; sid:529604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anovelcoronavirus.com"; sid:529605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaclothingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaclothingco.com"; sid:529606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaclubusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaclubusa.com"; sid:529607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronahats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronahats.com"; sid:529608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruscare.com"; sid:529609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspack.com"; sid:529610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.support"; sid:529611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19kit.com"; sid:529612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19pack.com"; sid:529613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.cloud"; sid:529614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkit.com"; sid:529615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.net"; sid:529616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpack.com"; sid:529617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidote-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidote-coronavirus.com"; sid:529618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid.net"; sid:529619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycoronasept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycoronasept.com"; sid:529620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aotearoaartsandeventsduringthecovid-19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aotearoaartsandeventsduringthecovid-19crisis.com"; sid:529621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applycoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applycoronavirusloan.com"; sid:529622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arabcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arabcovid.net"; sid:529623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arabiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arabiccorona.com"; sid:529624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbidol-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbidol-coronavirus.com"; sid:529625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arrmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arrmcovid19.com"; sid:529626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcoronavirus.net"; sid:529627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistcoronavirus.com"; sid:529628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistcovid19.com"; sid:529629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomewithcovid19.com"; sid:529630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestationcoronavirus.com"; sid:529631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestation-sortie-covid19.fr - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestation-sortie-covid19.fr"; sid:529632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aussiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aussiecovid19.com"; sid:529633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocertificazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocertificazionecoronavirus.com"; sid:529634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcoronavirusnews.com"; sid:529635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovid19.com"; sid:529636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasempresascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasempresascoronavirus.com"; sid:529637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaspymescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaspymescoronavirus.com"; sid:529638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudemoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudemoscovid19.com"; sid:529639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirus19.com"; sid:529640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamascovid.com"; sid:529641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamascovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamascovidresponse.com"; sid:529642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcelonacovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcelonacovidfest.com"; sid:529643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcelonacovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcelonacovidfestival.com"; sid:529644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrierecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrierecoronavirus.com"; sid:529645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastacoronavirus.com"; sid:529646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat2020pandemic.com"; sid:529647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronav.com"; sid:529648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beirholm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beirholm-covid19.com"; sid:529649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berkeleycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berkeleycovid19.com"; sid:529650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bgrdccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bgrdccoronavirus.com"; sid:529651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bgrdccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bgrdccovid19.com"; sid:529652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhcovid.com"; sid:529653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biggestpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biggestpandemics.com"; sid:529654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bilbaocovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bilbaocovidfestival.com"; sid:529655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birminghamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birminghamcovid19.com"; sid:529656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizhelpforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizhelpforcovid19.com"; sid:529657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blamewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blamewuhan.com"; sid:529658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcorona.com"; sid:529659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredcovid.com"; sid:529660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for branchcovidians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"branchcovidians.com"; sid:529661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bravenewcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bravenewcovidworld.com"; sid:529662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklinecovid19.com"; sid:529663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessaftercorona.com"; sid:529664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessaftercovid19.com"; sid:529665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesshelpforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesshelpforcovid19.com"; sid:529666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bustcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bustcorona.net"; sid:529667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19medsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19medsuk.com"; sid:529668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bybycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bybycoronavirus.com"; sid:529669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcorona.com"; sid:529670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmthecovid.com"; sid:529671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcorona.net"; sid:529672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canhrcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canhrcovidnews.com"; sid:529673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscovidstudy.com"; sid:529674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cards4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cards4covid.com"; sid:529675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagaintpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagaintpandemic.com"; sid:529676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsnotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsnotcorona.com"; sid:529677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsnotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsnotcoronavirus.com"; sid:529678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsnotcovid.com"; sid:529679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcorona.com"; sid:529680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carenotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carenotcovid.com"; sid:529681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casescoronavirus.com"; sid:529682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catholicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catholicpandemic.com"; sid:529683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccoronavirusinfo.com"; sid:529684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccoronavirusinformation.com"; sid:529685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid-19info.com"; sid:529686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19info.com"; sid:529687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid-19information.com"; sid:529688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19information.com"; sid:529689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebcoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebcoronatracker.com"; sid:529690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cenlacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cenlacovid19.com"; sid:529691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centroderecursoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centroderecursoscoronavirus.com"; sid:529692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cflcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cflcovid.com"; sid:529693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cfpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cfpcovid19.com"; sid:529694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check4corona.net"; sid:529695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocommunitycovid-19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocommunitycovid-19responsefund.com"; sid:529696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocommunitycovid-19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocommunitycovid-19responsefund.net"; sid:529697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19.com"; sid:529698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19.com"; sid:529699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19responsefund.com"; sid:529700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19responsefund.net"; sid:529701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagoneighborscovid-19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagoneighborscovid-19responsefund.com"; sid:529702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagoneighborscovid-19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagoneighborscovid-19responsefund.net"; sid:529703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicoronavirus.com"; sid:529704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcarecovid19.com"; sid:529705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofcoronacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofcoronacation.com"; sid:529706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofcovidcation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofcovidcation2020.com"; sid:529707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinstraps4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinstraps4corona.com"; sid:529708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christianpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christianpandemic.com"; sid:529709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchofcorona.com"; sid:529710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for class4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"class4corona.com"; sid:529711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid-2020.com"; sid:529712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleansleepcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleansleepcorona.com"; sid:529713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codingforcovid.com"; sid:529714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronacleaners.com"; sid:529715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcoronaco.com"; sid:529716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commenttraitercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commenttraitercovid19.com"; sid:529717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commissionsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commissionsforcorona.com"; sid:529718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovid19supplycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovid19supplycenter.com"; sid:529719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovidinfo.com"; sid:529720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityvscovid.com"; sid:529721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confucius-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confucius-covid19.com"; sid:529722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confuciusoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confuciusoncovid19.com"; sid:529723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid-19.com"; sid:529724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcorona.com"; sid:529725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcoronawithcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcoronawithcalm.com"; sid:529726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultacovid19.com"; sid:529727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultascoronavirus.com"; sid:529728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultascovid19.com"; sid:529729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookinginthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookinginthetimeofcovid.com"; sid:529730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingwithcovid.com"; sid:529731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookinthetimeofcorona.com"; sid:529732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corkcovid19volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corkcovid19volunteers.com"; sid:529733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona12.com"; sid:529734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19busters.com"; sid:529735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cleaner.com"; sid:529736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19clear.com"; sid:529737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19disinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19disinfector.com"; sid:529738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19disinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19disinfectors.com"; sid:529739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19free.com"; sid:529740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19hazmat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19hazmat.com"; sid:529741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.life"; sid:529742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020shirt.com"; sid:529743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabs.com"; sid:529744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabuse.com"; sid:529745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abwehr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abwehr.com"; sid:529746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abwehr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abwehr.net"; sid:529747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactual.com"; sid:529748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-als-chance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-als-chance.com"; sid:529749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandwhine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandwhine.com"; sid:529750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-anxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-anxiety.com"; sid:529751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-babies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-babies.net"; sid:529752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcies.com"; sid:529753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyattorneys.com"; sid:529754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcylaw.com"; sid:529755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bar.com"; sid:529756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabaseballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabaseballleague.com"; sid:529757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabayer.com"; sid:529758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabazar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabazar.com"; sid:529759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabb.com"; sid:529760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabears.com"; sid:529761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiohacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiohacks.com"; sid:529762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiruz.com"; sid:529763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronable.com"; sid:529764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablogger.com"; sid:529765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabodychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabodychallenge.com"; sid:529766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabond.com"; sid:529767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabond.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabond.net"; sid:529768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonds.com"; sid:529769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonds.net"; sid:529770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboost.com"; sid:529771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreakthrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreakthrough.com"; sid:529772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabridgeloan.com"; sid:529773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrightside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrightside.com"; sid:529774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrooklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrooklyn.com"; sid:529775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuse.com"; sid:529776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessadvisors.com"; sid:529777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-businesscontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-businesscontinuity.com"; sid:529778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesscontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesscontinuity.com"; sid:529779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesseffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesseffect.com"; sid:529780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesseffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesseffects.com"; sid:529781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusiness.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusiness.solutions"; sid:529782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-strategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-strategies.com"; sid:529783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersfl.com"; sid:529784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersus.com"; sid:529785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacal.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacal.club"; sid:529786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacal.com"; sid:529787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacal.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacal.today"; sid:529788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanza.com"; sid:529789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarestore.com"; sid:529790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cast.com"; sid:529791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatalog.com"; sid:529792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-catures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-catures.com"; sid:529793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatures.com"; sid:529794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacella.com"; sid:529795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacession.com"; sid:529796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachallenge.net"; sid:529797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachallenges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachallenges.com"; sid:529798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachallenge.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachallenge.world"; sid:529799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chat.com"; sid:529800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachek.com"; sid:529801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-childcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-childcare.com"; sid:529802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachoir.com"; sid:529803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chronicles.com"; sid:529804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimslawyer.com"; sid:529805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsusa.com"; sid:529806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanantigua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanantigua.com"; sid:529807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersnyc.com"; sid:529808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanflorida.com"; sid:529809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanfreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanfreaks.com"; sid:529810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanings.com"; sid:529811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannba.com"; sid:529812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanpros.com"; sid:529813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearance.com"; sid:529814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomeback.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomeback.net"; sid:529815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomments.com"; sid:529816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunications.com"; sid:529817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunities.com"; sid:529818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomp.com"; sid:529819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondition.com"; sid:529820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrolspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrolspray.com"; sid:529821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacon.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacon.world"; sid:529822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookout.com"; sid:529823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacootiefreezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacootiefreezone.com"; sid:529824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacooties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacooties.com"; sid:529825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoupon.com"; sid:529826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourage.com"; sid:529827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouragecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouragecommunity.com"; sid:529828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19symptoms.com"; sid:529829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid-19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid-19-test.com"; sid:529830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid-19-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid-19-usa.com"; sid:529831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19vaccine.com"; sid:529832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid-19-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid-19-virus.com"; sid:529833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19virustest.com"; sid:529834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid2019virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid2019virus.com"; sid:529835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafter.com"; sid:529836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafters.com"; sid:529837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrawl.com"; sid:529838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrawls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrawls.com"; sid:529839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrawlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrawlz.com"; sid:529840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis2020.com"; sid:529841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisusa.com"; sid:529842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crusher.com"; sid:529843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacur.com"; sid:529844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurenews.com"; sid:529845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurfew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurfew.com"; sid:529846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacycle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacycle.com"; sid:529847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacycles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacycles.com"; sid:529848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadab.com"; sid:529849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dance.com"; sid:529850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadankorunmak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadankorunmak.com"; sid:529851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadawn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadawn.com"; sid:529852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaday.net"; sid:529853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeaths.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeaths.net"; sid:529854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtrelief.com"; sid:529855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademands.com"; sid:529856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadenver.com"; sid:529857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadepo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadepo.com"; sid:529858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadepression2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadepression2020.com"; sid:529859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-derfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-derfilm.com"; sid:529860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesignermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesignermask.com"; sid:529861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesignermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesignermasks.com"; sid:529862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadezenfekteilaci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadezenfekteilaci.com"; sid:529863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisco.com"; sid:529864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease.world"; sid:529865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfector.com"; sid:529866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectors.com"; sid:529867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadispensibles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadispensibles.com"; sid:529868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisputeresoution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisputeresoution.com"; sid:529869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-divorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-divorce.com"; sid:529870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyer.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyer.legal"; sid:529871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyernearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyernearme.com"; sid:529872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyernj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyernj.com"; sid:529873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyernjnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyernjnearme.com"; sid:529874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-divorcenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-divorcenj.com"; sid:529875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcenj.com"; sid:529876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorces.com"; sid:529877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-doc.com"; sid:529878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofirehousebarandgrill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofirehousebarandgrill.com"; sid:529879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadose.com"; sid:529880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dr.com"; sid:529881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadumb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadumb.com"; sid:529882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadvice.com"; sid:529883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dz.com"; sid:529884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ebook.com"; sid:529885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaedu.com"; sid:529886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyfunds.com"; sid:529887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencymoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencymoney.com"; sid:529888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaending.com"; sid:529889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepidemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepidemicvirus.com"; sid:529890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaequip.com"; sid:529891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-exit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-exit.com"; sid:529892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextrafun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextrafun.com"; sid:529893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextranewsletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextranewsletter.com"; sid:529894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemasks.net"; sid:529895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafad.com"; sid:529896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilies.com"; sid:529897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinance.net"; sid:529898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialhelp.com"; sid:529899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancing.com"; sid:529900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finanzhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finanzhilfe.com"; sid:529901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflux.com"; sid:529902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoerdermittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoerdermittel.com"; sid:529903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafool.com"; sid:529904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafools.com"; sid:529905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforgood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforgood.com"; sid:529906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforhalloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforhalloween.com"; sid:529907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforo.com"; sid:529908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fragebogen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fragebogen.com"; sid:529909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefl.com"; sid:529910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeindia.com"; sid:529911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeparty.com"; sid:529912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeproducts.com"; sid:529913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesociety.com"; sid:529914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeze.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeze.today"; sid:529915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrieght.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrieght.com"; sid:529916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuel.com"; sid:529917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuels.com"; sid:529918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-galerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-galerie.com"; sid:529919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagame.net"; sid:529920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagang.com"; sid:529921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagard.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagard.life"; sid:529922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagiveaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagiveaway.com"; sid:529923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagiveaways.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagiveaways.com"; sid:529924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoesviral2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoesviral2020.com"; sid:529925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagogo.com"; sid:529926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrant.com"; sid:529927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreenzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreenzone.com"; sid:529928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguides.com"; sid:529929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaha.com"; sid:529930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hamster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hamster.com"; sid:529931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahamster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahamster.com"; sid:529932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahardship.com"; sid:529933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahardshiploan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahardshiploan.com"; sid:529934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahazmatfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahazmatfl.com"; sid:529935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupplies.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupplies.co.uk"; sid:529936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-healthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-healthy.com"; sid:529937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthy.com"; sid:529938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheld.com"; sid:529939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-help24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-help24.com"; sid:529940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helpline.com"; sid:529941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelponline.com"; sid:529942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.biz"; sid:529943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.biz"; sid:529944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfen.com"; sid:529945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfen.com"; sid:529946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahireus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahireus.com"; sid:529947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-holidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-holidays.com"; sid:529948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomesafety.com"; sid:529949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hosting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hosting.net"; sid:529950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hotlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hotlines.com"; sid:529951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotlines.com"; sid:529952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahunts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahunts.com"; sid:529953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahypnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahypnosis.com"; sid:529954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaian.com"; sid:529955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaians.com"; sid:529956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immun.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immun.net"; sid:529957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpactsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpactsurvey.com"; sid:529958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimusa.com"; sid:529959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainbangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainbangladesh.com"; sid:529960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincommunity.com"; sid:529961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfoapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfoapp.com"; sid:529962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainform.com"; sid:529963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfoupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfoupdate.com"; sid:529964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainisa.com"; sid:529965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjections.com"; sid:529966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainternship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainternship.com"; sid:529967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitems.com"; sid:529968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaj2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaj2.net"; sid:529969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajail.com"; sid:529970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajournals.com"; sid:529971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaartje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaartje.com"; sid:529972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidcare.com"; sid:529973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidscamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidscamp.com"; sid:529974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidscare.com"; sid:529975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kids.net"; sid:529976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakids.net"; sid:529977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killed-my-job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killed-my-job.com"; sid:529978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.tools"; sid:529979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kind.com"; sid:529980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kinder.com"; sid:529981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindnesss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindnesss.com"; sid:529982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kind.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kind.net"; sid:529983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakind.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakind.net"; sid:529984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kommunikation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kommunikation.com"; sid:529985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrank.com"; sid:529986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakris.com"; sid:529987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise.dental"; sid:529988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise.dental"; sid:529989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise-meistern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise-meistern.com"; sid:529990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalasvegas.com"; sid:529991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lawsuit.com"; sid:529992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuit.net"; sid:529993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lawsuits.com"; sid:529994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lawyer.com"; sid:529995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lawyers.com"; sid:529996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-leadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-leadership.com"; sid:529997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleads.com"; sid:529998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleaguebaseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleaguebaseball.com"; sid:529999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleague.com"; sid:530000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegislation.com"; sid:530001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalijn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalijn.com"; sid:530002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-litigation.com"; sid:530003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveshow.com"; sid:530004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivestream.com"; sid:530005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loans.com"; sid:530006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalondon.com"; sid:530007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalosses.com"; sid:530008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalosshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalosshelp.com"; sid:530009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalosstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalosstexas.com"; sid:530010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalosstx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalosstx.com"; sid:530011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalovers.com"; sid:530012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaids.com"; sid:530013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamamas.com"; sid:530014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapnow.com"; sid:530015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapsite.com"; sid:530016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarket2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarket2020.com"; sid:530017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-marketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-marketing.com"; sid:530018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketstv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketstv.com"; sid:530019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarkettv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarkettv.com"; sid:530020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasked.com"; sid:530021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask-usa.com"; sid:530022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamed24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamed24.com"; sid:530023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedcare.com"; sid:530024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalclaims.com"; sid:530025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameditatiom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameditatiom.com"; sid:530026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamena.com"; sid:530027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-method.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-method.com"; sid:530028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamicrobetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamicrobetesting.com"; sid:530029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamigos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamigos.com"; sid:530030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamigos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamigos.net"; sid:530031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilf.com"; sid:530032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionaire.com"; sid:530033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamode.com"; sid:530034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoderna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoderna.com"; sid:530035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoodtalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoodtalk.com"; sid:530036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagerelief.com"; sid:530037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoveona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoveona.com"; sid:530038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamused.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamused.com"; sid:530039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanannies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanannies.com"; sid:530040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanannyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanannyco.com"; sid:530041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nanny.com"; sid:530042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronananny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronananny.com"; sid:530043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronananny.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronananny.net"; sid:530044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanannys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanannys.com"; sid:530045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nation.com"; sid:530046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nation.net"; sid:530047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanationstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanationstreet.com"; sid:530048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanc.com"; sid:530049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews2020.com"; sid:530050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsone.com"; sid:530051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsonline.com"; sid:530052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoia.com"; sid:530053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanongrata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanongrata.com"; sid:530054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanosweat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanosweat.com"; sid:530055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notfallpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notfallpass.com"; sid:530056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notkredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notkredit.com"; sid:530057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoffers.com"; sid:530058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonusa.com"; sid:530059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopensource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopensource.com"; sid:530060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorder.com"; sid:530061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreaksurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreaksurvival.com"; sid:530062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandamic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandamic.com"; sid:530063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemic.life"; sid:530064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapause.com"; sid:530065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-phobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-phobia.com"; sid:530066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-phobie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-phobie.com"; sid:530067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobie.com"; sid:530068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-platform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-platform.com"; sid:530069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapod.com"; sid:530070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolocalypse.com"; sid:530071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolocalypse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolocalypse.net"; sid:530072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-portal.com"; sid:530073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaport.com"; sid:530074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapp.net"; sid:530075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapq.com"; sid:530076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprank.com"; sid:530077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprize.com"; sid:530078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprojection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprojection.com"; sid:530079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionasap.com"; sid:530080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiontoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiontoday.com"; sid:530081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionusa.com"; sid:530082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsa.com"; sid:530083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsyche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsyche.com"; sid:530084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quarantaene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quarantaene.com"; sid:530085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinesucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinesucks.com"; sid:530086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-radiata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-radiata.com"; sid:530087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraw.com"; sid:530088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaray.com"; sid:530089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarays.com"; sid:530090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareassurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareassurance.com"; sid:530091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtstipps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtstipps.com"; sid:530092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredalert.com"; sid:530093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-refunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-refunds.com"; sid:530094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabcenter.com"; sid:530095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.net"; sid:530096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefnow.com"; sid:530097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefplan.com"; sid:530098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareporters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareporters.com"; sid:530099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresource.com"; sid:530100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevival.com"; sid:530101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarwanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarwanda.com"; sid:530102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafenow.com"; sid:530103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetynet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetynet.com"; sid:530104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysigns.com"; sid:530105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-salud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-salud.com"; sid:530106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasandsliders.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasandsliders.biz"; sid:530107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasani.com"; sid:530108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizing.com"; sid:530109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavings.com"; sid:530110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schaden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schaden.com"; sid:530111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschooling.com"; sid:530112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschoolupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschoolupdates.com"; sid:530113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascrubbing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascrubbing.com"; sid:530114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdiaries.com"; sid:530115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasepush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasepush.com"; sid:530116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasgottalent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasgottalent.com"; sid:530117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashame.com"; sid:530118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shield.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shield.net"; sid:530119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoponline.com"; sid:530120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasia.com"; sid:530121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasituation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasituation.com"; sid:530122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskill.com"; sid:530123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskills.com"; sid:530124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslay.com"; sid:530125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialdistancing.com"; sid:530126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoluciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoluciones.com"; sid:530127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoul.com"; sid:530128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeyer.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeyer.care"; sid:530129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeyer.com"; sid:530130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeyer.net"; sid:530131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasponsible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasponsible.com"; sid:530132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasquads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasquads.com"; sid:530133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatistics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatistics.net"; sid:530134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatsusa.com"; sid:530135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-steril.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-steril.com"; sid:530136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-steril.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-steril.net"; sid:530137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockup.com"; sid:530138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stornierung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stornierung.com"; sid:530139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-storno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-storno.com"; sid:530140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastorno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastorno.com"; sid:530141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrophe.com"; sid:530142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunshine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunshine.com"; sid:530143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportonline.com"; sid:530144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportpage.com"; sid:530145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalapparel.com"; sid:530146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalclub.com"; sid:530147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalclub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalclub.net"; sid:530148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivals.com"; sid:530149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorapparel2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorapparel2020.com"; sid:530150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivor.net"; sid:530151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivors.net"; sid:530152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasweepteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasweepteam.com"; sid:530153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataine.com"; sid:530154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatard.com"; sid:530155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateers.com"; sid:530156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-temperature-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-temperature-testing-kit.com"; sid:530157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatermometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatermometer.com"; sid:530158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestal.com"; sid:530159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.care"; sid:530160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesteasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesteasy.com"; sid:530161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglasvegas.com"; sid:530162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingusa.com"; sid:530163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingvegas.com"; sid:530164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestresults.com"; sid:530165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestshop.com"; sid:530166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateststore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateststore.com"; sid:530167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestvegas.com"; sid:530168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestyap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestyap.com"; sid:530169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapycenter.com"; sid:530170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatime.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatime.life"; sid:530171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimez.com"; sid:530172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tipp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tipp.com"; sid:530173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronative.com"; sid:530174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatodo.com"; sid:530175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoledo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoledo.com"; sid:530176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatopia.com"; sid:530177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatorah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatorah.com"; sid:530178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrail.com"; sid:530179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-travel.com"; sid:530180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatribune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatribune.com"; sid:530181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruther.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruther.com"; sid:530182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruthers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruthers.com"; sid:530183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tshirt.com"; sid:530184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tube.com"; sid:530185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauae.com"; sid:530186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauniverse.com"; sid:530187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauniversityapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauniversityapparel.com"; sid:530188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunusa.com"; sid:530189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatenow.com"; sid:530190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronautensils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronautensils.com"; sid:530191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvlight.com"; sid:530192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav101.com"; sid:530193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v19.com"; sid:530194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.life"; sid:530195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinex.com"; sid:530196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavant.com"; sid:530197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxx.com"; sid:530198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavee.com"; sid:530199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverses.com"; sid:530200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveteren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveteren.com"; sid:530201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfirm.com"; sid:530202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictomfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictomfoundation.com"; sid:530203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidus.com"; sid:530204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavious.com"; sid:530205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisnow.com"; sid:530206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris-sd.com"; sid:530207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisusa.com"; sid:530208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviriusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviriusnow.com"; sid:530209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirius-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirius-sd.com"; sid:530210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirmask.com"; sid:530211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousnow.com"; sid:530212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirrusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirrusnewsnow.com"; sid:530213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsnow.com"; sid:530214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsus.com"; sid:530215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtual.com"; sid:530216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtue.com"; sid:530217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru5.com"; sid:530218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruislive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruislive.com"; sid:530219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruisnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruisnow.com"; sid:530220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19alabama.com"; sid:530221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19cleaning.com"; sid:530222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19cleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19cleansing.com"; sid:530223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19decontamination.com"; sid:530224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19fraud.com"; sid:530225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19live.com"; sid:530226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19truth.com"; sid:530227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-2019.net"; sid:530228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019pandemic.com"; sid:530229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2020.net"; sid:530230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020-online.com"; sid:530231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020shirt.com"; sid:530232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus24x7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus24x7.com"; sid:530233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus5g.com"; sid:530234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabuse.com"; sid:530235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvicecentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvicecentre.com"; sid:530236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ai.com"; sid:530237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandyourchurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandyourchurch.com"; sid:530238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanonymous.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanonymous.club"; sid:530239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanswercenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanswercenter.com"; sid:530240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-anxiety-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-anxiety-therapy.com"; sid:530241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapocalypse2020.com"; sid:530242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarchive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarchive.net"; sid:530243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusass.com"; sid:530244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistanceloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistanceloan.com"; sid:530245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-assist.com"; sid:530246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattackworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattackworld.com"; sid:530247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabyboom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabyboom.net"; sid:530248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabysafe.com"; sid:530249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabywipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabywipes.com"; sid:530250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutusa.com"; sid:530251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyattorneys.com"; sid:530252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarriers.com"; sid:530253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbb.com"; sid:530254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusberatung.com"; sid:530255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodpressure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodpressure.com"; sid:530256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bot.com"; sid:530257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreast.com"; sid:530258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscontinuity.com"; sid:530259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessgrant.com"; sid:530260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbystates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbystates.com"; sid:530261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscabinfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscabinfever.com"; sid:530262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscamgirl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscamgirl.com"; sid:530263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cancer-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cancer-registry.com"; sid:530264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cares.com"; sid:530265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscelebs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscelebs.net"; sid:530266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cerrajero-electricista-fontanero-urgencias-ibiza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cerrajero-electricista-fontanero-urgencias-ibiza.com"; sid:530267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.chat"; sid:530268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschatnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschatnow.com"; sid:530269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschatsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschatsnow.com"; sid:530270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschina1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschina1.com"; sid:530271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschronicle.com"; sid:530272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassifieds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassifieds.com"; sid:530273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clean.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clean.co.uk"; sid:530274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaning-company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaning-company.com"; sid:530275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningfl.com"; sid:530276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningprocess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningprocess.com"; sid:530277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaning-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaning-services.com"; sid:530278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleans.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleans.co.uk"; sid:530279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleansingfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleansingfl.com"; sid:530280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cleanup.com"; sid:530281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupusa.com"; sid:530282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosuresupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosuresupdate.com"; sid:530283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothing.net"; sid:530284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscodex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscodex.com"; sid:530285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscodex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscodex.net"; sid:530286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomfort.com"; sid:530287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommandcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommandcenter.com"; sid:530288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensations.com"; sid:530289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcierge.com"; sid:530290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsumerdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsumerdebt.com"; sid:530291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsumerdebtusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsumerdebtusa.com"; sid:530292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscovid-19.com"; sid:530293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-tests.com"; sid:530294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid2019vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid2019vaccine.com"; sid:530295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovidvaccine.com"; sid:530296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cpas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cpas.com"; sid:530297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrawl.com"; sid:530298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrawls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrawls.com"; sid:530299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrawlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrawlz.com"; sid:530300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisispr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisispr.com"; sid:530301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrowdfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrowdfunding.com"; sid:530302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrude.com"; sid:530303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrudeoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrudeoil.com"; sid:530304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.cruises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.cruises"; sid:530305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureco.com"; sid:530306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurediscovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurediscovered.com"; sid:530307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdance.com"; sid:530308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdashboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdashboard.net"; sid:530309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdashboardsouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdashboardsouthafrica.com"; sid:530310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatingadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatingadvice.com"; sid:530311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-deadpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-deadpool.com"; sid:530312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathpool.com"; sid:530313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtconsultants.com"; sid:530314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtforgiveness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtforgiveness.com"; sid:530315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeepdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeepdisinfection.com"; sid:530316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefencetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefencetips.com"; sid:530317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeliveries.com"; sid:530318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeliveryservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeliveryservice.com"; sid:530319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdenmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdenmark.com"; sid:530320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-detection.com"; sid:530321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-diary.com"; sid:530322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiary.net"; sid:530323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterloan.com"; sid:530324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease.cloud"; sid:530325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantspray.com"; sid:530326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantwipes.com"; sid:530327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrive-thru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrive-thru.com"; sid:530328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusds.com"; sid:530329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselftest.com"; sid:530330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencysystem.com"; sid:530331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusempresas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusempresas.com"; sid:530332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendofdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendofdays.com"; sid:530333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenecuador.com"; sid:530334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusensinou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusensinou.com"; sid:530335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusentitlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusentitlement.com"; sid:530336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemia.com"; sid:530337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusequip.com"; sid:530338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-equipment.com"; sid:530339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruse-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruse-sd.com"; sid:530340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessentialoils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessentialoils.com"; sid:530341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessurvivors.com"; sid:530342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruset.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruset.support"; sid:530343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexplainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexplainer.com"; sid:530344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsnow.com"; sid:530345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsnow.net"; sid:530346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsonly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsonly.com"; sid:530347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfailure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfailure.com"; sid:530348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaqsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaqsnow.com"; sid:530349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaqsnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaqsnow.net"; sid:530350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarnborough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarnborough.com"; sid:530351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastcash.com"; sid:530352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-film.com"; sid:530353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinanceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinanceprotection.com"; sid:530354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialadvice.com"; sid:530355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialhelp.com"; sid:530356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialplanning.com"; sid:530357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialprotection.com"; sid:530358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirm.com"; sid:530359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridalawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridalawfirm.com"; sid:530360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridalawyer.com"; sid:530361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-foerdermittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-foerdermittel.com"; sid:530362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsdelivery.com"; sid:530363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforex.com"; sid:530364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforhealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforhealthcare.com"; sid:530365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusformusicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusformusicians.com"; sid:530366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforthewin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforthewin.com"; sid:530367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-games.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-games.com"; sid:530368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgerms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgerms.com"; sid:530369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusget.com"; sid:530370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgigs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgigs.com"; sid:530371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrants.net"; sid:530372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgriefandcomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgriefandcomfort.com"; sid:530373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroupon.com"; sid:530374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroupons.com"; sid:530375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguideformusicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguideformusicians.com"; sid:530376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandlotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandlotion.com"; sid:530377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealers.com"; sid:530378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp2020.com"; sid:530379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelper.net"; sid:530380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelptoday.com"; sid:530381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-here.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-here.com"; sid:530382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushn.com"; sid:530383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeloan.com"; sid:530384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomepage.com"; sid:530385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomesolution.com"; sid:530386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hometest.com"; sid:530387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushourlynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushourlynews.com"; sid:530388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousearrest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousearrest.com"; sid:530389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousing.com"; sid:530390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushq.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushq.pro"; sid:530391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushtestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushtestsites.com"; sid:530392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpactproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpactproject.com"; sid:530393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpacts.com"; sid:530394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionaid.com"; sid:530395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionhelp.com"; sid:530396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionhelp.net"; sid:530397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinpakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinpakistan.com"; sid:530398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinusnearme.com"; sid:530399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusis.com"; sid:530400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskital.com"; sid:530401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskit.life"; sid:530402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawcenter.com"; sid:530403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawoffice.com"; sid:530404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawoffices.com"; sid:530405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitcenter.com"; sid:530406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitclaim.com"; sid:530407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitclaims.com"; sid:530408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalexpert.com"; sid:530409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalexperts.com"; sid:530410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalproblem.com"; sid:530411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalproblems.com"; sid:530412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslehighvalley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslehighvalley.com"; sid:530413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslending.com"; sid:530414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslitigation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslitigation.net"; sid:530415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivemaps.com"; sid:530416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivemaptracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivemaptracker.com"; sid:530417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live.net"; sid:530418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveup.com"; sid:530419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lockdowns.com"; sid:530420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslondon.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslondon.support"; sid:530421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-map.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-map.world"; sid:530422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapworldwide.com"; sid:530423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-maroc.com"; sid:530424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask4u.com"; sid:530425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-masks.net"; sid:530426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaths.com"; sid:530427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmauritius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmauritius.com"; sid:530428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicaldebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicaldebt.com"; sid:530429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalinsurance.com"; sid:530430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedrx.com"; sid:530431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedvisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedvisit.com"; sid:530432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeter.net"; sid:530433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmobileinfirmary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmobileinfirmary.com"; sid:530434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mobile-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mobile-screening.com"; sid:530435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mobile-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mobile-testing.com"; sid:530436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoney.net"; sid:530437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmow.com"; sid:530438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusician.com"; sid:530439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnapratica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnapratica.com"; sid:530440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnavigator.com"; sid:530441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnes.com"; sid:530442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewdiscoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewdiscoveries.com"; sid:530443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewenow.com"; sid:530444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewmap.com"; sid:530445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewniw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewniw.com"; sid:530446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.club"; sid:530447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsco.com"; sid:530448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.media"; sid:530449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsmx.com"; sid:530450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnos.com"; sid:530451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnown.com"; sid:530452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewss.com"; sid:530453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewssnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewssnow.com"; sid:530454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnkw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnkw.com"; sid:530455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoe.com"; sid:530456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovels.com"; sid:530457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnow.net"; sid:530458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnpo.com"; sid:530459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnpw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnpw.com"; sid:530460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnrwsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnrwsnow.com"; sid:530461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnwesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnwesnow.com"; sid:530462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnz.com"; sid:530463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusology.com"; sid:530464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusomg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusomg.com"; sid:530465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinedoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinedoctors.com"; sid:530466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoptions.com"; sid:530467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusos.com"; sid:530468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusoutbreak.com"; sid:530469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspain.com"; sid:530470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandemicupdates.com"; sid:530471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeoplesearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeoplesearch.com"; sid:530472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspickup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspickup.com"; sid:530473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspodium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspodium.com"; sid:530474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayers.net"; sid:530475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevension.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevension.com"; sid:530476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-product.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-product.com"; sid:530477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-product.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-product.net"; sid:530478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionequipment.com"; sid:530479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectiveequipment.com"; sid:530480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublix.com"; sid:530481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqanda.com"; sid:530482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-quiz.com"; sid:530483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrace.com"; sid:530484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtestkits.com"; sid:530485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrebates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrebates.com"; sid:530486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrefinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrefinance.com"; sid:530487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreport.net"; sid:530488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseact.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseact.biz"; sid:530489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-response.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-response.finance"; sid:530490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponsepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponsepackage.com"; sid:530491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestaurantrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestaurantrescue.com"; sid:530492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrichmond.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrichmond.support"; sid:530493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-russia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-russia.net"; sid:530494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafesex.com"; sid:530495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysigns.com"; sid:530496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizerspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizerspray.com"; sid:530497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizingservices.com"; sid:530498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscandals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscandals.com"; sid:530499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschoolupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschoolupdates.com"; sid:530500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreener.com"; sid:530501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreeningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreeningservices.com"; sid:530502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecurehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecurehome.com"; sid:530503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.shoes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.shoes"; sid:530504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshow.com"; sid:530505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussiouxfalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussiouxfalls.com"; sid:530506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmart.com"; sid:530507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocialdistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocialdistance.com"; sid:530508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolicitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolicitor.com"; sid:530509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolidarityfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolidarityfoundation.com"; sid:530510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstayhealthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstayhealthy.com"; sid:530511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstructures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstructures.com"; sid:530512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudentloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudentloan.com"; sid:530513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportseries.com"; sid:530514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalguides.com"; sid:530515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalmanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalmanual.com"; sid:530516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalmanual.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalmanual.net"; sid:530517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvival.net"; sid:530518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalplaybook.com"; sid:530519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-surviveandprosper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-surviveandprosper.com"; sid:530520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.club"; sid:530521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorglobal.com"; sid:530522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivors.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivors.club"; sid:530523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomfree.com"; sid:530524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusszn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusszn.com"; sid:530525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustakeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustakeout.com"; sid:530526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustakibi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustakibi.com"; sid:530527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaskforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaskforce.net"; sid:530528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxamnesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxamnesty.com"; sid:530529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxamnestyprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxamnestyprogram.com"; sid:530530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxbreak.com"; sid:530531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxes.com"; sid:530532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestal.com"; sid:530533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfacility.com"; sid:530534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingboston.com"; sid:530535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testingkit.com"; sid:530536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testingkits.com"; sid:530537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglasvegas.com"; sid:530538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnashville.com"; sid:530539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnyc.com"; sid:530540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingresults.com"; sid:530541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit.life"; sid:530542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitohio.com"; sid:530543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlasvegas.com"; sid:530544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnashville.com"; sid:530545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestohio.com"; sid:530546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustests.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustests.biz"; sid:530547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsnearme.com"; sid:530548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test-usa.com"; sid:530549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapistlondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapistlondon.com"; sid:530550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapist-nassaucounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapist-nassaucounty.com"; sid:530551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapistnassaucounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapistnassaucounty.com"; sid:530552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapistnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapistnewyork.com"; sid:530553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapist-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapist-nyc.com"; sid:530554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapistnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapistnyc.com"; sid:530555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapybethesda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapybethesda.com"; sid:530556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapychicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapychicago.com"; sid:530557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapy.com"; sid:530558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapydallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapydallas.com"; sid:530559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapylosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapylosangeles.com"; sid:530560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapymaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapymaryland.com"; sid:530561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapy-nassaucounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapy-nassaucounty.com"; sid:530562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapynassaucounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapynassaucounty.com"; sid:530563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapy-newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapy-newyork.com"; sid:530564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapynewyork.com"; sid:530565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapy-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapy-nyc.com"; sid:530566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapynyc.com"; sid:530567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapypotomac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapypotomac.com"; sid:530568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapysanfransisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapysanfransisco.com"; sid:530569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapyseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapyseattle.com"; sid:530570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapywashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapywashingtondc.com"; sid:530571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustips.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustips.pro"; sid:530572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustogo.com"; sid:530573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackerworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackerworldwide.com"; sid:530574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusua.com"; sid:530575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemployment.com"; sid:530576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusu.net"; sid:530577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunicef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunicef.com"; sid:530578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaclinic.com"; sid:530579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaclinics.com"; sid:530580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususahospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususahospital.com"; sid:530581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususahospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususahospitals.com"; sid:530582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususamd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususamd.com"; sid:530583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususareports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususareports.com"; sid:530584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususarx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususarx.com"; sid:530585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususastudent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususastudent.com"; sid:530586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususastudentloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususastudentloans.com"; sid:530587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususastudents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususastudents.com"; sid:530588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususasupplies.com"; sid:530589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.club"; sid:530590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelawsuit.com"; sid:530591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinetrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinetrials.com"; sid:530592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.world"; sid:530593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvault.com"; sid:530594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvault.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvault.net"; sid:530595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirusnewsnow.com"; sid:530596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-warning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-warning.com"; sid:530597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswawa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswawa.com"; sid:530598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wholesale.com"; sid:530599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkathome.com"; sid:530600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkerscomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkerscomp.com"; sid:530601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldview.com"; sid:530602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswsmax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswsmax.com"; sid:530603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.xn--6frz82g - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.xn--6frz82g"; sid:530604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirysnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirysnewsnow.com"; sid:530605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisusnow.com"; sid:530606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitusnow.com"; sid:530607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviusnow.com"; sid:530608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviver.com"; sid:530609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviver.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviver.net"; sid:530610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivers.com"; sid:530611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivers.net"; sid:530612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlag.com"; sid:530613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlawfirm.com"; sid:530614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlawsuit.com"; sid:530615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlawsuits.com"; sid:530616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavore.com"; sid:530617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorusnow.com"; sid:530618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavriusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavriusnewsnow.com"; sid:530619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalrus.com"; sid:530620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawant.com"; sid:530621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawants.com"; sid:530622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawetgeving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawetgeving.com"; sid:530623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wiki.com"; sid:530624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawin.com"; sid:530625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawinyourbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawinyourbeach.com"; sid:530626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithkids.com"; sid:530627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-woke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-woke.com"; sid:530628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxe.com"; sid:530629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19247.com"; sid:530630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1984.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1984.com"; sid:530631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advice.net"; sid:530632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afterparty.com"; sid:530633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agp.com"; sid:530634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidkits.com"; sid:530635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aiduk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aiduk.com"; sid:530636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alabama.com"; sid:530637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19america.com"; sid:530638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andthechurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andthechurch.com"; sid:530639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19apocalypse.com"; sid:530640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19approvedfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19approvedfun.com"; sid:530641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19archive.com"; sid:530642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19archive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19archive.net"; sid:530643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assistance.com"; sid:530644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aus.com"; sid:530645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babies.net"; sid:530646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babysafe.com"; sid:530647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19badactors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19badactors.com"; sid:530648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bahamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bahamas.com"; sid:530649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylaw.com"; sid:530650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bar.com"; sid:530651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19basics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19basics.com"; sid:530652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bcp.com"; sid:530653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.bet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.bet"; sid:530654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biztools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biztools.com"; sid:530655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19block.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19block.com"; sid:530656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blues.com"; sid:530657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19books.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19books.com"; sid:530658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bored.com"; sid:530659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19brewing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19brewing.com"; sid:530660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19brief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19brief.com"; sid:530661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brief.com"; sid:530662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19briefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19briefs.com"; sid:530663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19briefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19briefs.com"; sid:530664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessclosure.com"; sid:530665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessesopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessesopen.com"; sid:530666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessplan.com"; sid:530667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessplans.com"; sid:530668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessresources.com"; sid:530669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesstools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesstools.com"; sid:530670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-california.com"; sid:530671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-care.com"; sid:530672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19careproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19careproducts.com"; sid:530673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19case.com"; sid:530674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casesnyc.com"; sid:530675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casestories.com"; sid:530676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19c.com"; sid:530677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19celebrities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19celebrities.com"; sid:530678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-checker.com"; sid:530679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-childcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-childcare.com"; sid:530680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19childcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19childcare.com"; sid:530681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-claims.com"; sid:530682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.today"; sid:530683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningprocess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningprocess.com"; sid:530684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningpros.com"; sid:530685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningservice.com"; sid:530686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningservices.com"; sid:530687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningusa.com"; sid:530688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanpro.com"; sid:530689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanpros.com"; sid:530690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicusa.com"; sid:530691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.clothing"; sid:530692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coach.com"; sid:530693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coaching.com"; sid:530694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communications.com"; sid:530695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19con.com"; sid:530696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consumerdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consumerdebt.com"; sid:530697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cooking.com"; sid:530698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19county.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19county.com"; sid:530699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.coupons - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.coupons"; sid:530700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coworking.com"; sid:530701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cpa.com"; sid:530702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cra-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cra-updates.com"; sid:530703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crawl.com"; sid:530704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crawls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crawls.com"; sid:530705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crawlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crawlz.com"; sid:530706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.credit"; sid:530707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crew.com"; sid:530708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cubandrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cubandrugs.com"; sid:530709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureuk.com"; sid:530710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19custody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19custody.com"; sid:530711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cvm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cvm.com"; sid:530712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailydigest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailydigest.com"; sid:530713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19day.com"; sid:530714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathtoll.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathtoll.net"; sid:530715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19debtrelief.com"; sid:530716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrelief.com"; sid:530717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalemergency.com"; sid:530718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalresources.com"; sid:530719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19depression.com"; sid:530720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designhack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designhack.com"; sid:530721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnose.com"; sid:530722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-diagnoser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-diagnoser.com"; sid:530723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19directory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19directory.net"; sid:530724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterplan.com"; sid:530725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterplans.com"; sid:530726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfection.com"; sid:530727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disputeresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disputeresolution.com"; sid:530728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divorce.com"; sid:530729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.domains - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.domains"; sid:530730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethrutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethrutesting.com"; sid:530731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ef.com"; sid:530732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19egypt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19egypt.com"; sid:530733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-email.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-email.com"; sid:530734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyroom.com"; sid:530735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentlaw.com"; sid:530736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19end.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19end.com"; sid:530737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ending.com"; sid:530738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equation.com"; sid:530739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equipment.com"; sid:530740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialoils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialoils.com"; sid:530741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19essentials.com"; sid:530742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.exchange - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.exchange"; sid:530743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19explainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19explainer.com"; sid:530744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expo.com"; sid:530745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsnow.com"; sid:530746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsnow.net"; sid:530747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.fail"; sid:530748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familylaw.com"; sid:530749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faqsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faqsnow.com"; sid:530750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faqsnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faqsnow.net"; sid:530751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastcash.com"; sid:530752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastcash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastcash.net"; sid:530753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastfacts.com"; sid:530754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.film"; sid:530755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19findlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19findlawyer.com"; sid:530756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firedepartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firedepartments.com"; sid:530757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fitness.com"; sid:530758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fraud.com"; sid:530759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freshstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freshstart.com"; sid:530760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19game.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19game.net"; sid:530761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gethelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gethelp.com"; sid:530762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19getlegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19getlegalhelp.com"; sid:530763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.gratis - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.gratis"; sid:530764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-healthcare-administration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-healthcare-administration.com"; sid:530765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthnews.com"; sid:530766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helponline.com"; sid:530767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroes.com"; sid:530768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroes.net"; sid:530769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesupplies.com"; sid:530770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hometest.com"; sid:530771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19home-test.com"; sid:530772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest.net"; sid:530773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospital-guideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospital-guideline.com"; sid:530774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitalguideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitalguideline.com"; sid:530775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hospitalguideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hospitalguideline.com"; sid:530776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospital-guideline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospital-guideline.net"; sid:530777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitalguideline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitalguideline.net"; sid:530778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospital-guideline.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospital-guideline.wales"; sid:530779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitalguideline.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitalguideline.wales"; sid:530780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hospitalguideline.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hospitalguideline.wales"; sid:530781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hotline.com"; sid:530782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotspot.com"; sid:530783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotspots.com"; sid:530784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-how-long-does-infection-last.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-how-long-does-infection-last.biz"; sid:530785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howlongdoesinfectionlast.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howlongdoesinfectionlast.biz"; sid:530786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humor.com"; sid:530787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immune.com"; sid:530788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19in2020.com"; sid:530789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19india.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19india.net"; sid:530790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indonesia.com"; sid:530791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.industries - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.industries"; sid:530792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.business"; sid:530793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhometest.com"; sid:530794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injection.com"; sid:530795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inlaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inlaos.com"; sid:530796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insure.com"; sid:530797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isolationpods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isolationpods.com"; sid:530798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isolationrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isolationrooms.com"; sid:530799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19journey.com"; sid:530800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kids.com"; sid:530801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-kit.com"; sid:530802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiti.com"; sid:530803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labkit.com"; sid:530804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.land - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.land"; sid:530805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lasvegas.com"; sid:530806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law-ca.com"; sid:530807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law-ca.com"; sid:530808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laws.com"; sid:530809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitclaims.com"; sid:530810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuit.net"; sid:530811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lebanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lebanon.com"; sid:530812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvisors.com"; sid:530813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvisors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvisors.net"; sid:530814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalexpert.com"; sid:530815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalexperts.com"; sid:530816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaloffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaloffices.com"; sid:530817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalsupport.com"; sid:530818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalworkflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalworkflow.com"; sid:530819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19life.com"; sid:530820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19litigation.com"; sid:530821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-litigation.com"; sid:530822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigation.com"; sid:530823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-live.com"; sid:530824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.loans"; sid:530825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-loans.com"; sid:530826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketing.com"; sid:530827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maske.com"; sid:530828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masks.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masks.co.uk"; sid:530829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mauritius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mauritius.com"; sid:530830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicaldebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicaldebt.com"; sid:530831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicaments.com"; sid:530832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicaments.com"; sid:530833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorials.com"; sid:530834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mentalhealth.com"; sid:530835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mentalhealthsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mentalhealthsupport.com"; sid:530836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19messengers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19messengers.com"; sid:530837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mobile-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mobile-screening.com"; sid:530838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mobile-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mobile-testing.com"; sid:530839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortgagerelief.com"; sid:530840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagerelief.com"; sid:530841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19music.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19music.com"; sid:530842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mystory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mystory.com"; sid:530843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mythbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mythbusters.com"; sid:530844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mythbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mythbusters.com"; sid:530845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19networks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19networks.com"; sid:530846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsalerts.com"; sid:530847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsalerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsalerts.net"; sid:530848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ni.com"; sid:530849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nz.com"; sid:530850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-office-home-disinfectant-service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-office-home-disinfectant-service.com"; sid:530851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19over60.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19over60.com"; sid:530852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pain.com"; sid:530853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic2020.biz"; sid:530854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pastor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pastor.com"; sid:530855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patent.com"; sid:530856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ph.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ph.watch"; sid:530857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plumber.com"; sid:530858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pocus.com"; sid:530859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19postiive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19postiive.com"; sid:530860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pray.com"; sid:530861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19predictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19predictions.com"; sid:530862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19print.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19print.com"; sid:530863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19products.com"; sid:530864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prosupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prosupport.com"; sid:530865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protocol.com"; sid:530866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protocol.com"; sid:530867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocols.com"; sid:530868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qatar.com"; sid:530869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinesucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinesucks.com"; sid:530870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarentine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarentine.com"; sid:530871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-quiz.com"; sid:530872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19race.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19race.com"; sid:530873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkit.com"; sid:530874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkits.com"; sid:530875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkits.com"; sid:530876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rave.com"; sid:530877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raves.com"; sid:530878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realdata.com"; sid:530879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestateupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestateupdate.com"; sid:530880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoup.com"; sid:530881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reflections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reflections.com"; sid:530882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-removal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-removal.com"; sid:530883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19removalpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19removalpro.com"; sid:530884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-report.com"; sid:530885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reporting.com"; sid:530886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resistance.com"; sid:530887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respirators.com"; sid:530888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsecrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsecrew.com"; sid:530889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseteam.com"; sid:530890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskcalculator.com"; sid:530891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rn.com"; sid:530892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rn.com"; sid:530893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeclean.com"; sid:530894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeguards.com"; sid:530895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeoffice.com"; sid:530896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.care"; sid:530897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyplan.com"; sid:530898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyplans.com"; sid:530899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanitize.com"; sid:530900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sbaloans.com"; sid:530901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaloans.com"; sid:530902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schoolclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schoolclosings.com"; sid:530903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolclosings.com"; sid:530904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schoolclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schoolclosure.com"; sid:530905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schoolclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schoolclosures.com"; sid:530906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schoolsclosing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schoolsclosing.com"; sid:530907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningtests.com"; sid:530908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfisolation.com"; sid:530909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfquarantine.com"; sid:530910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfquarentine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfquarentine.com"; sid:530911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-selftest.com"; sid:530912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sf.com"; sid:530913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sf.net"; sid:530914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shelter.com"; sid:530915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shirts.com"; sid:530916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sim.com"; sid:530917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simulator.com"; sid:530918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayhome.com"; sid:530919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilize.com"; sid:530920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stesting.com"; sid:530921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stopped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stopped.com"; sid:530922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19storiesfromthefrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19storiesfromthefrontline.com"; sid:530923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stuck.com"; sid:530924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stuff.com"; sid:530925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplycompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplycompany.com"; sid:530926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.life"; sid:530927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportuk.com"; sid:530928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survey.com"; sid:530929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-survival.com"; sid:530930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors.club"; sid:530931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sverige.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sverige.com"; sid:530932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-swabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-swabtest.com"; sid:530933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19szn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19szn.com"; sid:530934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19talk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19talk.com"; sid:530935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tax.com"; sid:530936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tea.com"; sid:530937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teams.com"; sid:530938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-telehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-telehealth.com"; sid:530939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tennessee.com"; sid:530940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testathome.com"; sid:530941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tester.com"; sid:530942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testi.com"; sid:530943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testit.com"; sid:530944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testkit.com"; sid:530945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-kits.com"; sid:530946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlocation.com"; sid:530947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlocationsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlocationsusa.com"; sid:530948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testresult.com"; sid:530949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testresults.com"; sid:530950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsnearme.com"; sid:530951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test.today"; sid:530952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toolkit.com"; sid:530953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topnews.com"; sid:530954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trace.com"; sid:530955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trackerworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trackerworldwide.com"; sid:530956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trials.com"; sid:530957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tu.com"; sid:530958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ukaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ukaid.com"; sid:530959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ultrasound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ultrasound.com"; sid:530960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-unites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-unites.com"; sid:530961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19universal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19universal.com"; sid:530962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usaclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usaclinic.com"; sid:530963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usaclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usaclinics.com"; sid:530964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usanews.com"; sid:530965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usarx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usarx.com"; sid:530966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usarx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usarx.com"; sid:530967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usasupplies.com"; sid:530968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usaupdate.com"; sid:530969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usaupdates.com"; sid:530970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usdata.com"; sid:530971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelawsuit.com"; sid:530972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.today"; sid:530973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetrial.com"; sid:530974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetrials.com"; sid:530975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.world"; sid:530976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusalert.com"; sid:530977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.claims"; sid:530978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscontrol.com"; sid:530979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushometestkit.com"; sid:530980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virus-test.com"; sid:530981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustestingkit.com"; sid:530982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19volunteers.com"; sid:530983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19volunteers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19volunteers.net"; sid:530984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vulnerabilityindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vulnerabilityindex.com"; sid:530985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19war.com"; sid:530986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19water.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19water.com"; sid:530987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wear.com"; sid:530988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wear.com"; sid:530989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wereok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wereok.com"; sid:530990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wereok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wereok.com"; sid:530991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wipes.com"; sid:530992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wirral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wirral.com"; sid:530993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workout.com"; sid:530994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workouts.com"; sid:530995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yardim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yardim.com"; sid:530996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019pandemic.com"; sid:530997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019system.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019system.com"; sid:530998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019vaccine.com"; sid:530999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020stories.com"; sid:531000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20prep.com"; sid:531001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20virus.com"; sid:531002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid242.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid242.com"; sid:531003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-28.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-28.com"; sid:531004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid316.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid316.com"; sid:531005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid33.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid33.com"; sid:531006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid365.com"; sid:531007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-411.com"; sid:531008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4you.com"; sid:531009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-69.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-69.com"; sid:531010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccountants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccountants.com"; sid:531011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaine.com"; sid:531012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidair.com"; sid:531013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairfilter.com"; sid:531014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalabama19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalabama19.com"; sid:531015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamerican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamerican.com"; sid:531016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamericanteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamericanteen.com"; sid:531017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarity19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarity19.com"; sid:531018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassists.com"; sid:531019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavity.com"; sid:531020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaware.com"; sid:531021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaworld.com"; sid:531022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidax.com"; sid:531023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-babies.com"; sid:531024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabies.net"; sid:531025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbahamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbahamas.com"; sid:531026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailout.com"; sid:531027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcies.com"; sid:531028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyattorney.com"; sid:531029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcy.com"; sid:531030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcylaw.com"; sid:531031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbar.com"; sid:531032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbets.com"; sid:531033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbit.com"; sid:531034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblockchain.com"; sid:531035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblues.com"; sid:531036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrief.com"; sid:531037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbriefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbriefs.com"; sid:531038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbryant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbryant.com"; sid:531039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuffalo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuffalo.com"; sid:531040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusiness.com"; sid:531041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscontinuity.com"; sid:531042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusiness.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusiness.solutions"; sid:531043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssolutions.com"; sid:531044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersfl.com"; sid:531045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabana.com"; sid:531046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare757.com"; sid:531047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarryout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarryout.com"; sid:531048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cat"; sid:531049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcation2020.com"; sid:531050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcationcuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcationcuties.com"; sid:531051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcdc.com"; sid:531052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checker.com"; sid:531053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checklist.com"; sid:531054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checklists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checklists.com"; sid:531055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecklists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecklists.com"; sid:531056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcl.com"; sid:531057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners2020.com"; sid:531058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning.net"; sid:531059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanings.com"; sid:531060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningusa.com"; sid:531061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanmt.com"; sid:531062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearkit.com"; sid:531063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclub.com"; sid:531064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodex.com"; sid:531065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodex.net"; sid:531066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedyclub.com"; sid:531067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommando.com"; sid:531068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunications.com"; sid:531069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityorganizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityorganizers.com"; sid:531070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomp.com"; sid:531071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcerts.com"; sid:531072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfessions.com"; sid:531073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconversations.com"; sid:531074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-count.com"; sid:531075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourage.com"; sid:531076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouragecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouragecommunity.com"; sid:531077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourier.com"; sid:531078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourses.com"; sid:531079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcpa.com"; sid:531080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraziness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraziness.com"; sid:531081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraziness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraziness.net"; sid:531082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrew.com"; sid:531083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrush.com"; sid:531084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurenow.com"; sid:531085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcycle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcycle.com"; sid:531086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcycles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcycles.com"; sid:531087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-daily.com"; sid:531088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.date"; sid:531089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.dating"; sid:531090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeath.com"; sid:531091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebt.com"; sid:531092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtrelief.com"; sid:531093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddepot.com"; sid:531094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnostics.com"; sid:531095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnostics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnostics.net"; sid:531096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diciannove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diciannove.com"; sid:531097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisaster.com"; sid:531098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiseaseupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiseaseupdates.com"; sid:531099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dr.com"; sid:531100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddr.com"; sid:531101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrop.com"; sid:531102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelderhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelderhelp.com"; sid:531103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidend.com"; sid:531104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendstrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendstrump.com"; sid:531105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentially.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentially.com"; sid:531106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eo19.com"; sid:531107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideochallenge.com"; sid:531108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideochallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideochallenge.net"; sid:531109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocorner.com"; sid:531110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo.life"; sid:531111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentials.com"; sid:531112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentials.net"; sid:531113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetect.com"; sid:531114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevent.com"; sid:531115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexperience.com"; sid:531116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidezenfektan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidezenfektan.com"; sid:531117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fit.com"; sid:531118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflooring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflooring.com"; sid:531119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflorida.com"; sid:531120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfly.com"; sid:531121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-forecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-forecast.com"; sid:531122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrance.com"; sid:531123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfy.com"; sid:531124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeorgia.com"; sid:531125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgh.com"; sid:531126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoodnews.com"; sid:531127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreen.com"; sid:531128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandbook.com"; sid:531129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhazmat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhazmat.com"; sid:531130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhit.com"; sid:531131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestingkit.com"; sid:531132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidial.com"; sid:531133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiary.com"; sid:531134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-icu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-icu.com"; sid:531135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien-19.cat"; sid:531136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien19.cat"; sid:531137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien-19.com"; sid:531138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien19.com"; sid:531139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien19.net"; sid:531140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidien19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidien19.pro"; sid:531141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.net"; sid:531142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsights.com"; sid:531143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insurance-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insurance-claims.com"; sid:531144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaims.com"; sid:531145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinteriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinteriors.com"; sid:531146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-invest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-invest.com"; sid:531147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocracy.com"; sid:531148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidious19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidious19.com"; sid:531149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-iq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-iq.com"; sid:531150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjustice.com"; sid:531151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidcamp.com"; sid:531152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidscamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidscamp.com"; sid:531153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleen.com"; sid:531154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabtesting.com"; sid:531155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlangford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlangford.com"; sid:531156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw.net"; sid:531157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawoffices.com"; sid:531158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalhelp.com"; sid:531159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalproblem.com"; sid:531160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifestyle.com"; sid:531161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlift.com"; sid:531162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlives.com"; sid:531163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.loan"; sid:531164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlove.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlove.net"; sid:531165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaponline.com"; sid:531166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.world"; sid:531167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarkets.com"; sid:531168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskk.com"; sid:531169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmediation.com"; sid:531170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-merch.com"; sid:531171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicnight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicnight.com"; sid:531172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmillennial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmillennial.com"; sid:531173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovies.com"; sid:531174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews1.com"; sid:531175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsonline.com"; sid:531176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenlaw.com"; sid:531177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoscam.com"; sid:531178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotice.com"; sid:531179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoncall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoncall.com"; sid:531180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlineshop.com"; sid:531181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopportunities.com"; sid:531182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopps.com"; sid:531183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpa.com"; sid:531184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpain.com"; sid:531185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharm.com"; sid:531186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpin.com"; sid:531187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpivot.com"; sid:531188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplus.com"; sid:531189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-positive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-positive.com"; sid:531190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpredict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpredict.com"; sid:531191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprojection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprojection.com"; sid:531192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprojections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprojections.com"; sid:531193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprojects.com"; sid:531194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromask.com"; sid:531195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotected.com"; sid:531196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotocol.com"; sid:531197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotocol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotocol.net"; sid:531198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublicutility.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublicutility.care"; sid:531199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinesucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinesucks.com"; sid:531200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-quest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-quest.com"; sid:531201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquiz.com"; sid:531202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrace.com"; sid:531203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidra.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidra.net"; sid:531204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-realtime.com"; sid:531205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotelearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotelearning.com"; sid:531206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremoval.com"; sid:531207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremovalpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremovalpro.com"; sid:531208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresiliency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresiliency.com"; sid:531209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespirators.com"; sid:531210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsenyc.com"; sid:531211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.world"; sid:531212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresults.com"; sid:531213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrights.com"; sid:531214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidris.com"; sid:531215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrun.com"; sid:531216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrwanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrwanda.com"; sid:531217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestore.com"; sid:531218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbaloans.com"; sid:531219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscare.com"; sid:531220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsearch.com"; sid:531221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseason.com"; sid:531222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-selftest.com"; sid:531223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsell.com"; sid:531224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlement.com"; sid:531225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsex.com"; sid:531226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsf.com"; sid:531227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsf.net"; sid:531228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shirts.com"; sid:531229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshmovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshmovid.com"; sid:531230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshow.com"; sid:531231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsick.com"; sid:531232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsim.com"; sid:531233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimulation.com"; sid:531234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsl.com"; sid:531235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusiness.com"; sid:531236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinesshelp.com"; sid:531237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoft.com"; sid:531238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sos.com"; sid:531239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstart.com"; sid:531240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-station.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-station.com"; sid:531241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.net"; sid:531242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stayhome.com"; sid:531243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterile.com"; sid:531244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrongclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrongclothing.com"; sid:531245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudio.com"; sid:531246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummer.com"; sid:531247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplieseurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplieseurope.com"; sid:531248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor2020.com"; sid:531249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivors.net"; sid:531250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtab.com"; sid:531251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tester.com"; sid:531252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.guru"; sid:531253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testkit.com"; sid:531254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestonline.com"; sid:531255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsnearme.com"; sid:531256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtime.com"; sid:531257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-toi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-toi.com"; sid:531258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrace.com"; sid:531259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracker.net"; sid:531260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trials.com"; sid:531261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-twenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-twenty.com"; sid:531262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduary.com"; sid:531263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidubi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidubi.com"; sid:531264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduncovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduncovered.com"; sid:531265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidu.net"; sid:531266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidutah.com"; sid:531267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduver.com"; sid:531268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvant.com"; sid:531269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verify.com"; sid:531270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvids.com"; sid:531271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslaw.com"; sid:531272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslaw.net"; sid:531273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusworld.com"; sid:531274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviz.com"; sid:531275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvulnerabilityindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvulnerabilityindex.com"; sid:531276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarriors.com"; sid:531277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwire.com"; sid:531278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxxx.com"; sid:531279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-zero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-zero.com"; sid:531280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpr-covid19.com"; sid:531281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cprcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cprcovid19.com"; sid:531282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craftycovidcation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craftycovidcation2020.com"; sid:531283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craftycovidcation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craftycovidcation.com"; sid:531284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creative-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creative-corona.com"; sid:531285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativecoronacooperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativecoronacooperation.com"; sid:531286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativecoronacorporation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativecoronacorporation.com"; sid:531287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisedocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisedocoronavirus.com"; sid:531288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisicovid.com"; sid:531289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisispreppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisispreppandemic.com"; sid:531290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisingwithcorona.com"; sid:531291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crush-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crush-corona.com"; sid:531292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcoronausa.com"; sid:531293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuaftercorona.com"; sid:531294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultofcorona.com"; sid:531295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona.today"; sid:531296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona-virus.com"; sid:531297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronaviruss.com"; sid:531298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingthecoronavirus.com"; sid:531299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cv19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cv19pandemic.com"; sid:531300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacorona.com"; sid:531301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daily-corona-call.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daily-corona-call.com"; sid:531302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datcorona.com"; sid:531303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringcoronavirus.com"; sid:531304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringpandemic.com"; sid:531305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddscovid.com"; sid:531306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcoronavirusdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcoronavirusdiary.com"; sid:531307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathguildpandemicsessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathguildpandemicsessions.com"; sid:531308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovid.com"; sid:531309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decreticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decreticovid19.com"; sid:531310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decretocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decretocoronavirus.com"; sid:531311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decretocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decretocovid19.com"; sid:531312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistrycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistrycoronavirus.com"; sid:531313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcoronavirus.com"; sid:531314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcoronavirus.net"; sid:531315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid19.com"; sid:531316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid19.net"; sid:531317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid.com"; sid:531318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcovid.com"; sid:531319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid.net"; sid:531320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcovid.net"; sid:531321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despedidosporelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despedidosporelcoronavirus.com"; sid:531322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuesdecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuesdecorona.com"; sid:531323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosingcovid19.com"; sid:531324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diazcoronadowuilfredo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diazcoronadowuilfredo.com"; sid:531325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didyougetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didyougetcorona.com"; sid:531326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diecoronafamilienchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diecoronafamilienchallenge.com"; sid:531327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalgegencorona.com"; sid:531328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalgegencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalgegencorona.net"; sid:531329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digital-pandemic.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digital-pandemic.academy"; sid:531330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digital-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digital-pandemic.com"; sid:531331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diningduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diningduringcorona.com"; sid:531332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discoveryfirstantibodycombatcovid-19.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discoveryfirstantibodycombatcovid-19.exposed"; sid:531333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectioncoronavirus.com"; sid:531334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disneyworldcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disneyworldcoronavirus.com"; sid:531335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorcecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorcecorona.com"; sid:531336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diytestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diytestcorona.com"; sid:531337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for docsoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"docsoncoronavirus.com"; sid:531338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctor-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctor-corona.com"; sid:531339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doestrumphavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doestrumphavecorona.com"; sid:531340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-corona.net"; sid:531341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-coronavirus-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-coronavirus-symptoms.com"; sid:531342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavefuckingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavefuckingcorona.com"; sid:531343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dollarcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dollarcoronakit.com"; sid:531344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dollarcoronakit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dollarcoronakit.net"; sid:531345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacoronavirus.com"; sid:531346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetofightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetofightcoronavirus.com"; sid:531347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtaawuhancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtaawuhancoronavirus.com"; sid:531348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtaawuhancoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtaawuhancoronavirus.net"; sid:531349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccorona.com"; sid:531350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccorona.net"; sid:531351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-corona-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-corona-prevention.com"; sid:531352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronaprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronaprevention.com"; sid:531353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-corona-prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-corona-prevention.net"; sid:531354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronaprevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronaprevention.net"; sid:531355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-coronavirus.com"; sid:531356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronavirus.com"; sid:531357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-coronavirus.net"; sid:531358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronavirus.net"; sid:531359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid19.com"; sid:531360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19.com"; sid:531361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid19.net"; sid:531362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19.net"; sid:531363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid-19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid-19prevention.com"; sid:531364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19prevention.com"; sid:531365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid-19prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid-19prevention.net"; sid:531366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19prevention.net"; sid:531367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid.com"; sid:531368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid.com"; sid:531369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid.net"; sid:531370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid.net"; sid:531371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-coronavirus.com"; sid:531372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccoronavirus.com"; sid:531373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-coronavirus.net"; sid:531374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccoronavirus.net"; sid:531375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-covid.com"; sid:531376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccovid.com"; sid:531377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-covid.net"; sid:531378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccovid.net"; sid:531379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccwuhanvirus.com"; sid:531380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccwuhanvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccwuhanvirus.net"; sid:531381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duetocovid19.com"; sid:531382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcorona.com"; sid:531383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcorona.net"; sid:531384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dustycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dustycorona.com"; sid:531385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dzcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dzcovid.com"; sid:531386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e2covid19.com"; sid:531387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eastcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eastcorona.com"; sid:531388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19test.com"; sid:531389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-coronas.com"; sid:531390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edhcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edhcoronavirusupdates.com"; sid:531391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edumarking-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edumarking-covid.com"; sid:531392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronareport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronareport.com"; sid:531393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenzacovid19.com"; sid:531394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emploi-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emploi-covid-19.com"; sid:531395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeelbkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeelbkcovid19.com"; sid:531396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endurecoronavirus.com"; sid:531397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccurve.com"; sid:531398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdelivery.com"; sid:531399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicon.com"; sid:531400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicoutfitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicoutfitters.com"; sid:531401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprepper.com"; sid:531402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicvirus.com"; sid:531403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eqcovid19.com"; sid:531404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ertecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ertecoronavirus.com"; sid:531405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eusobreviviocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eusobreviviocorona.com"; sid:531406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcovid.com"; sid:531407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facethepandemic.com"; sid:531408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faqcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faqcoronavirus.net"; sid:531409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faqcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faqcovid19.net"; sid:531410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidtest.com"; sid:531411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcoronaclean.com"; sid:531412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-coronavirus.com"; sid:531413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccoronavirus.com"; sid:531414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-coronavirus.net"; sid:531415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccoronavirus.net"; sid:531416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-covid.com"; sid:531417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccovid.com"; sid:531418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-covid.net"; sid:531419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccovid.net"; sid:531420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona2020.com"; sid:531421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.club"; sid:531422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusonline.com"; sid:531423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.zone"; sid:531424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid192020.com"; sid:531425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19app.com"; sid:531426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid19virus.com"; sid:531427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidchallenge.com"; sid:531428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightwithcovid19.com"; sid:531429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmicorona.com"; sid:531430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filminthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filminthetimeofcorona.com"; sid:531431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidjobs.com"; sid:531432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitcovid.com"; sid:531433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flatteningapandemicscurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flatteningapandemicscurve.com"; sid:531434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flatteningthepandemiccurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flatteningthepandemiccurve.com"; sid:531435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattenthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattenthecoronavirus.com"; sid:531436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronabusters.com"; sid:531437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flucorona.com"; sid:531438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foerdermittel-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foerdermittel-corona.com"; sid:531439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcemajeurcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcemajeurcorona.com"; sid:531440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forocorona.com"; sid:531441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forum-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forum-coronavirus.com"; sid:531442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronamoney.com"; sid:531443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirus.works - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirus.works"; sid:531444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19money.com"; sid:531445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidmoney.com"; sid:531446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtest.com"; sid:531447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freemaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freemaskforcoronavirus.com"; sid:531448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freemaskforcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freemaskforcoronavirus.net"; sid:531449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendsofcovid19.com"; sid:531450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontlinecovidprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontlinecovidprep.com"; sid:531451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronamask.com"; sid:531452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-corona-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-corona-shop.com"; sid:531453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.biz"; sid:531454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19.net"; sid:531455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.net"; sid:531456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckoffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckoffcorona.com"; sid:531457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckoffcoronaviruswall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckoffcoronaviruswall.com"; sid:531458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecovid19.com"; sid:531459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid-19.com"; sid:531460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucoronavirus.net"; sid:531461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid-19.com"; sid:531462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid19.net"; sid:531463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gameofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gameofcovid19.com"; sid:531464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamersvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamersvscovid19.com"; sid:531465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsamgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsamgegencorona.com"; sid:531466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gen-corona.com"; sid:531467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencovid19.com"; sid:531468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid.com"; sid:531469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getawayfromcoronacooties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getawayfromcoronacooties.com"; sid:531470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronarapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronarapidtest.com"; sid:531471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronastop28.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronastop28.com"; sid:531472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavaccine.com"; sid:531473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusnovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusnovel.com"; sid:531474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusrelief.com"; sid:531475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19rapidtest.com"; sid:531476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoviddone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoviddone.com"; sid:531477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidex.com"; sid:531478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettestedforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettestedforcoronavirus.com"; sid:531479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getwellcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getwellcoronavirus.com"; sid:531480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gfycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gfycovid19.com"; sid:531481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirus19.com"; sid:531482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusoutbreak.com"; sid:531483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19.net"; sid:531484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicconsortium.com"; sid:531485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronaavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronaavirus.com"; sid:531486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.wtf"; sid:531487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godshealingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godshealingcoronavirus.com"; sid:531488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodjujupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodjujupandemic.com"; sid:531489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotthecorona.com"; sid:531490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govcovid19.com"; sid:531491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gpcovid.com"; sid:531492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grcoronavirus.com"; sid:531493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterpandemic.com"; sid:531494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatestpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatestpandemic.com"; sid:531495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groundtravelduringcoronavirusepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groundtravelduringcoronavirusepidemic.com"; sid:531496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupemorneaucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupemorneaucovid19.com"; sid:531497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtcountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtcountycovid19.com"; sid:531498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gwcfcovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gwcfcovid19fund.com"; sid:531499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gwcfcovid19fund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gwcfcovid19fund.net"; sid:531500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hablacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hablacoronavirus.com"; sid:531501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hamiltoncovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hamiltoncovidclinic.com"; sid:531502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcpcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcpcovid19test.com"; sid:531503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatkillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatkillscovid19.com"; sid:531504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatkillscovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatkillscovidvirus.com"; sid:531505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellocoronavirus.com"; sid:531506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellocoronaviruse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellocoronaviruse.com"; sid:531507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfundcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfundcovid-19.com"; sid:531508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfundcovid19.com"; sid:531509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid.com"; sid:531510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highriskcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highriskcovid.com"; sid:531511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hilfe-corona.com"; sid:531512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofpandemics.com"; sid:531513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holdmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holdmycorona.com"; sid:531514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestforcovid.com"; sid:531515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitcoronavirus.com"; sid:531516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeduringcorona.com"; sid:531517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcanitellifihavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcanitellifihavecoronavirus.com"; sid:531518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcanmybusinesssurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcanmybusinesssurvivethecoronavirus.com"; sid:531519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcovid19.com"; sid:531520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedthecoronavirus.com"; sid:531521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howmanycoronavictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howmanycoronavictim.com"; sid:531522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howpreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howpreventcoronavirus.com"; sid:531523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocopewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocopewithcovid19.com"; sid:531524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopcovid.com"; sid:531525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopthecoronavirus.com"; sid:531526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostopthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostopthecovid-19.com"; sid:531527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurviveacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurviveacoronavirus.com"; sid:531528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huroncountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huroncountycovid.com"; sid:531529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypnosiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypnosiscorona.com"; sid:531530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronafree.com"; sid:531531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibizacovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibizacovidfest.com"; sid:531532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibizacovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibizacovidfestival.com"; sid:531533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcorona.club"; sid:531534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcorona.today"; sid:531535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcoronavirus.com"; sid:531536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikoverleefdecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikoverleefdecorona.com"; sid:531537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imoutofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imoutofcorona.com"; sid:531538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impots-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impots-covid19.com"; sid:531539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovid.com"; sid:531540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoempresascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoempresascoronavirus.com"; sid:531541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infooncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infooncovid19.com"; sid:531542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacioncoronavirusmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacioncoronavirusmexico.com"; sid:531543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiative-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiative-gegen-corona.com"; sid:531544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiativegegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiativegegencorona.com"; sid:531545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiative-gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiative-gegen-corona.net"; sid:531546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiativegegencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiativegegencorona.net"; sid:531547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumoscoronavirus.com"; sid:531548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecovid19.com"; sid:531549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurecovid19.com"; sid:531550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurecovid.com"; sid:531551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcovid.com"; sid:531552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipsostrackingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipsostrackingcoronavirus.com"; sid:531553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irintheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irintheageofcorona.com"; sid:531554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irishcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irishcovidresponse.com"; sid:531555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusover.com"; sid:531556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iseverythingstillcanceledbecausecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iseverythingstillcanceledbecausecoronavirus.com"; sid:531557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvidedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvidedcovid19.com"; sid:531558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecoronavirus2020.com"; sid:531559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecoronavirus.com"; sid:531560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived2020covid19.com"; sid:531561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survivedcorona.com"; sid:531562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronatshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronatshirt.com"; sid:531563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus2020.biz"; sid:531564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusapocalypse2020.com"; sid:531565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusapocalypse.com"; sid:531566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.club"; sid:531567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survivedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survivedcoronavirus.com"; sid:531568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirustwenty20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirustwenty20.com"; sid:531569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.biz"; sid:531570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19withouttoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19withouttoiletpaper.com"; sid:531571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19withouttp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19withouttp.com"; sid:531572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronaapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronaapocalypse.com"; sid:531573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusapocalypse2020.com"; sid:531574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusapocalypse.com"; sid:531575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusapparel.com"; sid:531576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusshirts.com"; sid:531577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirustshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirustshirts.com"; sid:531578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italianinaticoronati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italianinaticoronati.com"; sid:531579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itiscoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itiscoronatime.com"; sid:531580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatimechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatimechallenge.com"; sid:531581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatime.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatime.club"; sid:531582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsthecoronavirus.com"; sid:531583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecovid19.com"; sid:531584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jenesuispascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jenesuispascorona.com"; sid:531585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuis-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuis-corona.com"; sid:531586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuiscorona.com"; sid:531587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuisscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuisscorona.com"; sid:531588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesusabovecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesusabovecorona.com"; sid:531589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johncovid.com"; sid:531590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnnycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnnycovid.com"; sid:531591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jpeuxpasjaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jpeuxpasjaicorona.com"; sid:531592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justiceaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justiceaftercovid.com"; sid:531593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jw-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jw-covid-19.com"; sid:531594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletra-cureforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletra-cureforcoronavirus.com"; sid:531595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletra-treatmentforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletra-treatmentforcoronavirus.com"; sid:531596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccoronaviruscleaners.com"; sid:531597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepupwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepupwithcovid.com"; sid:531598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khcovid19.com"; sid:531599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khonkaenstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khonkaenstopcovid.com"; sid:531600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickthecorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickthecorona.club"; sid:531601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidcoronavirus.com"; sid:531602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidcovid19.com"; sid:531603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsandcorona.com"; sid:531604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronagerms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronagerms.com"; sid:531605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronamask.com"; sid:531606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronaviruslaw.com"; sid:531607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-covid-19.com"; sid:531608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovid19.com"; sid:531609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovid19news.com"; sid:531610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnathomeduringthecovid-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnathomeduringthecovid-19pandemic.com"; sid:531611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learncovid19.com"; sid:531612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcovid19.com"; sid:531613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lettersaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lettersaboutcovid19.com"; sid:531614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lex-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lex-corona.com"; sid:531615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid-19.com"; sid:531616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforecovid-19.com"; sid:531617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforecovid19.com"; sid:531618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebetweencoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebetweencoronas.com"; sid:531619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeyondcorona.com"; sid:531620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecorona.com"; sid:531621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringcovid19.com"; sid:531622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-in-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-in-pandemic.com"; sid:531623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimesofcorona.com"; sid:531624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimesofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimesofcorona.net"; sid:531625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostcovid19.com"; sid:531626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronacount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronacount.com"; sid:531627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronacounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronacounts.com"; sid:531628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livefromcovid19.com"; sid:531629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostincorona.com"; sid:531630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacoronaviruslaw.com"; sid:531631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinpandemic.com"; sid:531632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.life"; sid:531633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid20.com"; sid:531634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.company"; sid:531635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.guru"; sid:531636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimesofcorona.com"; sid:531637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovepandemic.com"; sid:531638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lynchburgcovid19cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lynchburgcovid19cleanup.com"; sid:531639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcovidfest.com"; sid:531640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcovidfestival.com"; sid:531641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madridcovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madridcovidfest.com"; sid:531642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madridcovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madridcovidfestival.com"; sid:531643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malagacovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malagacovidfestival.com"; sid:531644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascoronavirus.com"; sid:531645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manejoycrontroldelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manejoycrontroldelcoronavirus.com"; sid:531646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for margatecovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"margatecovidsupport.com"; sid:531647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marocovid19.com"; sid:531648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherine-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherine-covid19.com"; sid:531649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid19.com"; sid:531650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskanti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskanti-covid19.com"; sid:531651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maycovidba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maycovidba.com"; sid:531652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medecins-liberaux-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medecins-liberaux-coronavirus.com"; sid:531653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicarecovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicarecovidcheck.com"; sid:531654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcoronavirus.com"; sid:531655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicleancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicleancoronavirus.com"; sid:531656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memes-covid19.com"; sid:531657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memocorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memocorona.club"; sid:531658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memocovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memocovid19.club"; sid:531659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menanglawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menanglawancorona.com"; sid:531660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidfest.com"; sid:531661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidfestival.com"; sid:531662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid-care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid-care.com"; sid:531663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidcare.com"; sid:531664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidcares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidcares.com"; sid:531665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwcovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwcovidsitters.com"; sid:531666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovidresponse.com"; sid:531667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtest.com"; sid:531668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccofightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccofightscorona.com"; sid:531669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcovid.com"; sid:531670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ms-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ms-coronavirus.com"; sid:531671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ms-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ms-covid-19.com"; sid:531672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mspcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mspcovidhelp.com"; sid:531673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundocoronavirus.com"; sid:531674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicianguidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicianguidecoronavirus.com"; sid:531675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicianguidetocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicianguidetocoronavirus.com"; sid:531676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicianscoronavirusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicianscoronavirusguide.com"; sid:531677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicianscoronavirusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicianscoronavirusplan.com"; sid:531678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicianscoronavirussurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicianscoronavirussurvivalguide.com"; sid:531679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiciansguidetocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiciansguidetocoronavirus.com"; sid:531680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiciansguidetocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiciansguidetocoronavirus.net"; sid:531681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicxcorona.com"; sid:531682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mxcovid19.com"; sid:531683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona2020.com"; sid:531684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacase.com"; sid:531685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafashion.com"; sid:531686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapodcast.com"; sid:531687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruscure.com"; sid:531688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusdiary.com"; sid:531689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusquarantine.com"; sid:531690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestingcenter.com"; sid:531691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustesting.com"; sid:531692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.events"; sid:531693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrisk.com"; sid:531694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstory.com"; sid:531695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymymymycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymymymycorona.com"; sid:531696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynovelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynovelcorona.com"; sid:531697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynovelcoronavirus.com"; sid:531698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynovelcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynovelcoronaviruses.com"; sid:531699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmasksale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmasksale.com"; sid:531700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95saleforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95saleforcoronavirus.com"; sid:531701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nannycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nannycorona.com"; sid:531702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naticoronati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naticoronati.com"; sid:531703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronaday.com"; sid:531704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbapostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbapostcorona.com"; sid:531705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neutralizarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neutralizarcoronavirus.com"; sid:531706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadaepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadaepidemic.com"; sid:531707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadaepidemiclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadaepidemiclaw.com"; sid:531708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcastlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcastlecovid19.com"; sid:531709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovideconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovideconomy.com"; sid:531710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidfitness.com"; sid:531711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidsports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidsports.com"; sid:531712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidworld.com"; sid:531713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid.com"; sid:531714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nncovid-19.com"; sid:531715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiasdocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiasdocoronavirus.com"; sid:531716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notocovid.com"; sid:531717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notocovid.net"; sid:531718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nottodaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nottodaycorona.com"; sid:531719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruscovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruscovid2019.com"; sid:531720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusfacemask.com"; sid:531721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-coronavirus.com"; sid:531722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccoronavirus.com"; sid:531723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-coronavirus.net"; sid:531724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccoronavirus.net"; sid:531725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-covid.com"; sid:531726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccovid.com"; sid:531727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-covid.net"; sid:531728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccovid.net"; sid:531729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvepidemic.com"; sid:531730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronalawyer.com"; sid:531731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusshirt.com"; sid:531732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirustshirt.com"; sid:531733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcorona.com"; sid:531734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondetemcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondetemcorona.com"; sid:531735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlybycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlybycorona.com"; sid:531736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for open-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"open-corona.com"; sid:531737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid19.care"; sid:531738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outbreakofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outbreakofcoronavirus.com"; sid:531739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcovid.com"; sid:531740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packanticovid.com"; sid:531741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacoronaviruscovid19.com"; sid:531742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020tees.com"; sid:531743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaamerica.com"; sid:531744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaids.com"; sid:531745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalerts.net"; sid:531746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicattorney.com"; sid:531747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbabies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbabies.net"; sid:531748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccart.com"; sid:531749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclean.com"; sid:531750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclean.net"; sid:531751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccleans.com"; sid:531752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccommunications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccommunications.com"; sid:531753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconnect.com"; sid:531754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrisis.com"; sid:531755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdatingprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdatingprotocol.com"; sid:531756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdisease.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdisease.net"; sid:531757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdr.com"; sid:531758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfamily.com"; sid:531759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfears.com"; sid:531760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfood.com"; sid:531761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoodie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoodie.com"; sid:531762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforidiots.com"; sid:531763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichero.com"; sid:531764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichistory.com"; sid:531765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinnovationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinnovationfund.com"; sid:531766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclean.com"; sid:531767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclemon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclemon.com"; sid:531768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicloan.com"; sid:531769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicloans.com"; sid:531770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmadness.com"; sid:531771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmag.com"; sid:531772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmania.com"; sid:531773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedics.com"; sid:531774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnowwhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnowwhat.com"; sid:531775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnurse.com"; sid:531776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoflove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoflove.com"; sid:531777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconline.com"; sid:531778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutbreak.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutbreak.net"; sid:531779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pals.com"; sid:531780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpandemonium.com"; sid:531781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparents.com"; sid:531782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonality.com"; sid:531783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pioneers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pioneers.com"; sid:531784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoker.com"; sid:531785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpondering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpondering.com"; sid:531786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprep.net"; sid:531787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofits.com"; sid:531788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprogress.com"; sid:531789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofbiz.com"; sid:531790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prose.com"; sid:531791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprosperityplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprosperityplan.com"; sid:531792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpundits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpundits.com"; sid:531793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecession.com"; sid:531794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecession.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecession.net"; sid:531795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicregulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicregulation.com"; sid:531796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsalesandsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsalesandsupplies.com"; sid:531797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsecure.com"; sid:531798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-shop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-shop.net"; sid:531799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-survival-ebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-survival-ebook.com"; sid:531800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictees.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictees.net"; sid:531801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictheater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictheater.com"; sid:531802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictimez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictimez.com"; sid:531803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwellbeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwellbeing.com"; sid:531804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pastcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pastcorona.com"; sid:531805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pastorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pastorcovid19.com"; sid:531806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perthcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perthcoronavirus.com"; sid:531807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pestcontrolcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pestcontrolcoronavirus.com"; sid:531808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pestcontrolcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pestcontrolcoronavirus.net"; sid:531809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmcorona.com"; sid:531810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmcovid.com"; sid:531811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcovid19.com"; sid:531812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetcovid.com"; sid:531813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planningforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planningforcoronavirus.com"; sid:531814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planningforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planningforcovid19.com"; sid:531815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pocuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pocuscovid19.com"; sid:531816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for polcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"polcovid.com"; sid:531817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for porncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"porncovid.com"; sid:531818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for porracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"porracoronavirus.com"; sid:531819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for posicovidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"posicovidity.com"; sid:531820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronanyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronanyc.com"; sid:531821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasociety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasociety.net"; sid:531822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-coronavirus.com"; sid:531823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovideconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovideconomy.com"; sid:531824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworld.com"; sid:531825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicparty.com"; sid:531826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for powellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"powellcovid.com"; sid:531827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicalpandemic.com"; sid:531828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerpandemic.com"; sid:531829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforcovid19.com"; sid:531830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-coronavirus.com"; sid:531831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnantinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnantinapandemic.com"; sid:531832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventionofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventionofcorona.com"; sid:531833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventscorona.com"; sid:531834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventscovid19.com"; sid:531835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procorona.com"; sid:531836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pro-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pro-coronavirus.com"; sid:531837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procoronavirustest.com"; sid:531838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectagainstcovid19.com"; sid:531839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcorona.com"; sid:531840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcoronavirus.com"; sid:531841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulverizadorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulverizadorcovid19.com"; sid:531842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocoronavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocoronavir.com"; sid:531843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ragingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ragingcorona.com"; sid:531844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid-19test.com"; sid:531845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtest.com"; sid:531846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcovid2019.com"; sid:531847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdc-trackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdc-trackcovid.com"; sid:531848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19news.com"; sid:531849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoronavirus.com"; sid:531850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercorona.com"; sid:531851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovid-19.com"; sid:531852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovid19.com"; sid:531853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovid.com"; sid:531854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecovid.com"; sid:531855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportingoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportingoncovid19.com"; sid:531856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rheumcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rheumcovid.com"; sid:531857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rheumcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rheumcovid.net"; sid:531858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rocorona.com"; sid:531859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romanticpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romanticpandemic.com"; sid:531860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runagainstcorona.com"; sid:531861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcoronavirus.com"; sid:531862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcovid.com"; sid:531863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safesexcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safesexcorona.com"; sid:531864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safesexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safesexcoronavirus.com"; sid:531865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safestcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safestcoronamask.com"; sid:531866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saintcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saintcorona.com"; sid:531867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycovid-19testing.com"; sid:531868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycovid19testing.com"; sid:531869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecoronavirus.com"; sid:531870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwyoucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwyoucoronavirus.com"; sid:531871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seasonsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seasonsofcorona.com"; sid:531872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seeuaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seeuaftercorona.com"; sid:531873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seeyouaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seeyouaftercorona.com"; sid:531874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seinformecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seinformecoronavirus.com"; sid:531875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfloveinthetimeofcorona.com"; sid:531876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestkitcoronavirus.com"; sid:531877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for setcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"setcoronavirus.com"; sid:531878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sevillacovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sevillacovidfestival.com"; sid:531879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexcovid.com"; sid:531880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcovidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcovidmd.com"; sid:531881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shareacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shareacorona.com"; sid:531882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sheldoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sheldoncovid19.com"; sid:531883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shellcovid-19jic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shellcovid-19jic.com"; sid:531884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecoronavirus.com"; sid:531885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singleinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singleinthetimeofcorona.com"; sid:531886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siouxfallscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siouxfallscoronavirus.com"; sid:531887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slidersandcoronas.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slidersandcoronas.biz"; sid:531888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcorona.com"; sid:531889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcoronavirus.com"; sid:531890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smashcorona.com"; sid:531891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soberduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soberduringcorona.com"; sid:531892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialmediapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialmediapandemic.com"; sid:531893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidaritecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidaritecovid.com"; sid:531894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for songsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"songsforcoronavirus.com"; sid:531895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscoronavirus.net"; sid:531896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid-19.com"; sid:531897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid.net"; sid:531898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spandemic.com"; sid:531899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadloveintimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadloveintimeofcorona.com"; sid:531900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotthecoronavirus.com"; sid:531901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stateofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stateofcorona.com"; sid:531902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statistics-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statistics-coronavirus.com"; sid:531903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statscorona.com"; sid:531904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawaycovid.com"; sid:531905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stazecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stazecovidrelief.com"; sid:531906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stcaths-covid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stcaths-covid19news.com"; sid:531907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stocksandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stocksandcorona.com"; sid:531908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopbeingacoronamoana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopbeingacoronamoana.com"; sid:531909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus-compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus-compass.com"; sid:531910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19bot.com"; sid:531911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.cloud"; sid:531912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidbot.com"; sid:531913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcovid19.com"; sid:531914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppons-le-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppons-le-coronavirus.com"; sid:531915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovidspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovidspread.com"; sid:531916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storecoronavirus.com"; sid:531917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesofcovid19.com"; sid:531918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stronger-than-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stronger-than-corona.com"; sid:531919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcoronavirus.com"; sid:531920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suadcorona.com"; sid:531921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suministroscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suministroscovid19.com"; sid:531922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for support-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"support-corona.com"; sid:531923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcorona.com"; sid:531924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportduringcorona.com"; sid:531925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalcorona.com"; sid:531926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivantducoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivantducoronavirus.com"; sid:531927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivantducovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivantducovid19.com"; sid:531928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecorona.life"; sid:531929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronapandemic.com"; sid:531930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronapandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronapandemic.life"; sid:531931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirusapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirusapocalypse2020.com"; sid:531932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirusapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirusapocalypse.com"; sid:531933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirus.club"; sid:531934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronaviruspandemic.com"; sid:531935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcoronavirustshirt.com"; sid:531936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid2020.com"; sid:531937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedpandemic2020.com"; sid:531938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcorona-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcorona-2020.com"; sid:531939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecorona.com"; sid:531940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sutherlincoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sutherlincoronarelief.com"; sid:531941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for svmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"svmcovid19.com"; sid:531942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swissliving-coronaschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swissliving-coronaschutz.com"; sid:531943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptoms-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptoms-of-coronavirus.com"; sid:531944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoutcorona.com"; sid:531945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesfromcorona.com"; sid:531946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesofcorona.com"; sid:531947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamrinetelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamrinetelcorona.com"; sid:531948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tangocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tangocorona.com"; sid:531949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tastelesscoronavirusads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tastelesscoronavirusads.com"; sid:531950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taylorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taylorcovid.com"; sid:531951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcoronaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcoronaid.com"; sid:531952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid19.com"; sid:531953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennesseecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennesseecovid.com"; sid:531954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusonline.com"; sid:531955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecorona.com"; sid:531956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecoronavirus.com"; sid:531957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecovid-19.com"; sid:531958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecovid19.com"; sid:531959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testerapidocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testerapidocoronavirus.com"; sid:531960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testerapidocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testerapidocovid-19.com"; sid:531961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testerapidocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testerapidocovid19.com"; sid:531962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-for-coronavirus.com"; sid:531963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcoronaviruses.com"; sid:531964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingforcovid19.com"; sid:531965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascorona.com"; sid:531966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thanetcoronavirusassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thanetcoronavirusassistance.com"; sid:531967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecalmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecalmcovid.com"; sid:531968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacam.com"; sid:531969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacare.com"; sid:531970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacarecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacarecompany.com"; sid:531971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachat.com"; sid:531972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclass.com"; sid:531973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacleanse.com"; sid:531974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacrawl.com"; sid:531975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries.net"; sid:531976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakids.com"; sid:531977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalifestyle.com"; sid:531978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamama.com"; sid:531979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanation.com"; sid:531980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanovel.com"; sid:531981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronarecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronarecession.com"; sid:531982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.biz"; sid:531983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusblogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusblogger.com"; sid:531984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbooks.com"; sid:531985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiary.com"; sid:531986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfilm.com"; sid:531987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslife.com"; sid:531988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslifestyle.com"; sid:531989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus.net"; sid:531990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnewsupdate.com"; sid:531991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.com"; sid:531992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovels.com"; sid:531993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspage.com"; sid:531994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusstories.com"; sid:531995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswar.com"; sid:531996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawiki.com"; sid:531997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19blues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19blues.com"; sid:531998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19film.com"; sid:531999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19testkit.com"; sid:532000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19virustest.com"; sid:532001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchallenge.com"; sid:532002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidevent.com"; sid:532003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfacts.com"; sid:532004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlifestyle.com"; sid:532005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshow.com"; sid:532006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwiki.com"; sid:532007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecureforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecureforcorona.com"; sid:532008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecureforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecureforcovid19.com"; sid:532009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themovieaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themovieaboutcoronavirus.com"; sid:532010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronaes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronaes.com"; sid:532011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-novel-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-novel-corona-virus.com"; sid:532012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronaviruses.com"; sid:532013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicchronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicchronicles.net"; sid:532014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpack.com"; sid:532015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicstore.com"; sid:532016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepositivepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepositivepandemic.com"; sid:532017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcoronaworld.com"; sid:532018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetestkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetestkitcoronavirus.com"; sid:532019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanwirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanwirus.com"; sid:532020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for think-about-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"think-about-corona.com"; sid:532021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisiscovid19.com"; sid:532022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thurvivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thurvivecoronavirus.com"; sid:532023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timecorona.com"; sid:532024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeinthelifeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeinthelifeofcorona.com"; sid:532025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timetocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timetocorona.com"; sid:532026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcoronavirus.com"; sid:532027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpaperforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpaperforcoronavirus.com"; sid:532028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tpforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tpforcoronavirus.com"; sid:532029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for track-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"track-covid-19.com"; sid:532030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19.net"; sid:532031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traitercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traitercovid19.com"; sid:532032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treat-corona.com"; sid:532033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtpandemic.com"; sid:532034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tsunamicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tsunamicoronavirus.com"; sid:532035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tudosobreocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tudosobreocoronavirus.com"; sid:532036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turcovid19.com"; sid:532037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkiyecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkiyecoronavirus.com"; sid:532038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turnbackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turnbackcorona.com"; sid:532039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tx4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tx4coronavirus.com"; sid:532040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubi4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubi4covid.com"; sid:532041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ugramcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ugramcorona.net"; sid:532042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimasnoticiasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimasnoticiasdelcoronavirus.com"; sid:532043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultrasoundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultrasoundcovid19.com"; sid:532044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undocorona.com"; sid:532045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undocovid19.com"; sid:532046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporelcoronavirusencasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporelcoronavirusencasa.com"; sid:532047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniticontroilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniticontroilcovid19.com"; sid:532048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upyourscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upyourscovid.com"; sid:532049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusonline.com"; sid:532050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirussupplies.com"; sid:532051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirustests.com"; sid:532052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19map.com"; sid:532053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19tests.com"; sid:532054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemic.net"; sid:532055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronacure.com"; sid:532056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-covid-19.com"; sid:532057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19data.com"; sid:532058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemic.net"; sid:532059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationcovid-19.com"; sid:532060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-coronavirus.net"; sid:532061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccines4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccines4coronavirus.com"; sid:532062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinescorona.com"; sid:532063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacorona.com"; sid:532064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valenciacovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valenciacovidfest.com"; sid:532065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valenciacovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valenciacovidfestival.com"; sid:532066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vamanoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vamanoscorona.com"; sid:532067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascoronavirus.com"; sid:532068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovid19.com"; sid:532069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vircovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vircovid.com"; sid:532070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronabar.com"; sid:532071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcorona.com"; sid:532072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronaindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronaindonesia.com"; sid:532073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteersforpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteersforpandemic2020.com"; sid:532074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteersforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteersforpandemic.com"; sid:532075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscovid.com"; sid:532076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watch-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watch-coronavirus.com"; sid:532077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovid19.com"; sid:532078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecanstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecanstopcovid19.com"; sid:532079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westcorona.com"; sid:532080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecovid19.com"; sid:532081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewincoronavirus.com"; sid:532082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewincovid.com"; sid:532083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcorona.com"; sid:532084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatevercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatevercoronavirus.com"; sid:532085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for what-is-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"what-is-covid-19.com"; sid:532086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whois-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whois-corona.com"; sid:532087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoscorona.com"; sid:532088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willidiefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willidiefromcovid19.com"; sid:532089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for womenscovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"womenscovidchallenge.com"; sid:532090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercorona.com"; sid:532091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcorona.com"; sid:532092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcovid.com"; sid:532093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingfromhomeduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingfromhomeduringcoronavirus.com"; sid:532094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingmusiciansguidetocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingmusiciansguidetocoronavirus.com"; sid:532095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingoutfromhomeduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingoutfromhomeduringcoronavirus.com"; sid:532096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldafterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldafterpandemic.com"; sid:532097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaday.com"; sid:532098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarcorona.com"; sid:532099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronaday.com"; sid:532100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancocktailparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancocktailparty.com"; sid:532101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanexpress.com"; sid:532102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanflutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanflutest.com"; sid:532103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanflutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanflutesting.com"; sid:532104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhigh5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhigh5.com"; sid:532105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhighfive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhighfive.com"; sid:532106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus.center"; sid:532107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruswipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruswipes.com"; sid:532108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwilli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwilli.com"; sid:532109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyewang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyewang.com"; sid:532110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyijiang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyijiang.com"; sid:532111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronainusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronainusa.com"; sid:532112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovid9teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovid9teen.com"; sid:532113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-kndigung-6vb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-kndigung-6vb.com"; sid:532114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-kndigung-6vb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-kndigung-6vb.net"; sid:532115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-mdicament-jtb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-mdicament-jtb.com"; sid:532116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19mdicaments-itb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19mdicaments-itb.com"; sid:532117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-mdicaments-jwb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-mdicaments-jwb.com"; sid:532118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for y2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"y2corona.com"; sid:532119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youhavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youhavecoronavirus.com"; sid:532120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youranticoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youranticoronamask.com"; sid:532121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800coronavirus.com"; sid:532122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidvaccine.com"; sid:532123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidvac.com"; sid:532124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1minutecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1minutecoronatest.com"; sid:532125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronablog.com"; sid:532126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronapandemic.com"; sid:532127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusstats.com"; sid:532128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-19pandemic.com"; sid:532129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidlive.com"; sid:532130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021coronavirus.com"; sid:532131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronavirus.com"; sid:532132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronavirus.net"; sid:532133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accucovid19.com"; sid:532134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actagainstcoronavirus.com"; sid:532135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actionaginstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actionaginstcovid19.com"; sid:532136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepandemicplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepandemicplanner.com"; sid:532137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adayinthelifeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adayinthelifeofcovid-19.com"; sid:532138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid-19.com"; sid:532139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid19.com"; sid:532140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosdelcoronavirus.com"; sid:532141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporelcoronavirus.com"; sid:532142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporelcovid19.com"; sid:532143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthecoronavirus.com"; sid:532144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aide-parentale-scolaire-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aide-parentale-scolaire-covid-19.com"; sid:532145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aide-scolaire-parentale-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aide-scolaire-parentale-covid-19.com"; sid:532146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovid.com"; sid:532147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidvirus.com"; sid:532148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albertacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albertacovid.com"; sid:532149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronafree.com"; sid:532150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allocoronavirus.com"; sid:532151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anchoragecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anchoragecovid19.com"; sid:532152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angainstcovid.com"; sid:532153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angainstcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angainstcovid.net"; sid:532154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antesdelcoronavirus.com"; sid:532155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona24.com"; sid:532156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaabusinessowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaabusinessowner.com"; sid:532157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronagermsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronagermsupply.com"; sid:532158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavaccination.com"; sid:532159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.biz"; sid:532160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicpodcast.com"; sid:532161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid19rapidtest.com"; sid:532162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprilpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprilpandemic.com"; sid:532163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronavirusrelief.com"; sid:532164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arosycoronasfunebres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arosycoronasfunebres.com"; sid:532165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofcovid.com"; sid:532166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artofcovid19.com"; sid:532167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arubacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arubacovid19.com"; sid:532168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assbycorona.com"; sid:532169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistancecoronavirus.com"; sid:532170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacoronaviruscleaning.com"; sid:532171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlanta-covid19-testing-sites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlanta-covid19-testing-sites.com"; sid:532172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestation-coronavirus.com"; sid:532173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestation-covid19.com"; sid:532174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestations-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestations-coronavirus.com"; sid:532175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autonomocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autonomocoronavirus.com"; sid:532176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidingcovid.com"; sid:532177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b4corona.com"; sid:532178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babiesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babiesofcorona.com"; sid:532179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babybycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babybycorona.com"; sid:532180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecovid19.com"; sid:532181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecovid.com"; sid:532182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptfromcoronavirus.com"; sid:532183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batonrougecoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batonrougecoronaviruscleaning.com"; sid:532184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecreekcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecreekcovid-19.com"; sid:532185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlingcancerintheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlingcancerintheageofcovid.com"; sid:532186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19now.com"; sid:532187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19.world"; sid:532188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becausecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becausecorona.com"; sid:532189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becausecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becausecovid19.com"; sid:532190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcoronavirus.com"; sid:532191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamasks.net"; sid:532192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestjokesaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestjokesaboutcoronavirus.com"; sid:532193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid-19.com"; sid:532194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid19.com"; sid:532195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biopandemic.com"; sid:532196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizsurvivingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizsurvivingcoronavirus.com"; sid:532197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for block-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"block-corona.com"; sid:532198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodybycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodybycorona.com"; sid:532199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodycorona.com"; sid:532200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredbecauseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredbecauseofcorona.com"; sid:532201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessrecordcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessrecordcovid19.com"; sid:532202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronafacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronafacemasks.com"; sid:532203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronamasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronamasks.net"; sid:532204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaprotection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaprotection.net"; sid:532205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirustestkits.com"; sid:532206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19supplies.com"; sid:532207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecovid19.com"; sid:532208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caeduscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caeduscovid.net"; sid:532209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafe-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafe-corona.net"; sid:532210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19law.com"; sid:532211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19lawyer.com"; sid:532212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmdespitecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmdespitecorona.com"; sid:532213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmingthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmingthecorona.com"; sid:532214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaignagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaignagainstcovid.com"; sid:532215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacoronavirusvaccine.com"; sid:532216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cansadodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cansadodelcoronavirus.com"; sid:532217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcovid-19.com"; sid:532218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcovid19.com"; sid:532219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carepidemic.com"; sid:532220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casesofcoronaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casesofcoronaus.com"; sid:532221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casesofcoronavirusus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casesofcoronavirusus.com"; sid:532222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casocoronavirus.com"; sid:532223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalogcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalogcorona.com"; sid:532224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcovid-19.com"; sid:532225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcovid.com"; sid:532226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccemscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccemscovid19.com"; sid:532227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceapprovedcovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceapprovedcovidrapidtest.com"; sid:532228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcarecovid19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcarecovid19plan.com"; sid:532229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofcorona.com"; sid:532230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clarksoncoronashoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clarksoncoronashoppers.com"; sid:532231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid-19.com"; sid:532232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanautocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanautocovid19.com"; sid:532233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanautocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanautocovid19.net"; sid:532234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronavirusnaples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronavirusnaples.com"; sid:532235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcovid.com"; sid:532236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cliniciansagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cliniciansagainstcovid.com"; sid:532237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedforcovid19.com"; sid:532238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codiv-19-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codiv-19-corona.com"; sid:532239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codiv19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codiv19corona.com"; sid:532240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinpandemic.com"; sid:532241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronaconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronaconcerns.com"; sid:532242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona.life"; sid:532243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona.net"; sid:532244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona.world"; sid:532245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combattingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combattingcorona.com"; sid:532246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combattingcoronaconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combattingcoronaconcerns.com"; sid:532247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comedyfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comedyfromcorona.com"; sid:532248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitiesagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitiesagainstcovid.com"; sid:532249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovid.com"; sid:532250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityovercorona.com"; sid:532251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companiesagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companiesagainstcovid.com"; sid:532252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companies-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companies-vs-corona.com"; sid:532253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionforcovid.com"; sid:532254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionnotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionnotcorona.com"; sid:532255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionnotcovid.com"; sid:532256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conceivedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conceivedbycorona.com"; sid:532257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concertforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concertforcoronavirus.com"; sid:532258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concertsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concertsforcoronavirus.com"; sid:532259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercoronaconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercoronaconcerns.com"; sid:532260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcoronaconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcoronaconcerns.com"; sid:532261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcoronatraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcoronatraining.com"; sid:532262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractorsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractorsagainstcorona.com"; sid:532263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractorsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractorsagainstcoronavirus.com"; sid:532264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractorsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractorsagainstcovid19.com"; sid:532265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contractorsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contractorsagainstcovid.com"; sid:532266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingwithcorona.com"; sid:532267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingcorona.com"; sid:532268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovidcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovidcourse.com"; sid:532269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona111.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona111.com"; sid:532270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stickingplaster.com"; sid:532271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stickingplaster.net"; sid:532272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19usa.com"; sid:532273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.world"; sid:532274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona237.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona237.com"; sid:532275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-3d.com"; sid:532276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid20.com"; sid:532277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid20.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid20.fund"; sid:532278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid20.net"; sid:532279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid757.com"; sid:532280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandme.com"; sid:532281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapp.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapp.life"; sid:532282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apps.com"; sid:532283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-attitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-attitude.com"; sid:532284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaauction.com"; sid:532285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies2020.com"; sid:532286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyinfo.com"; sid:532287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bath-tissue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bath-tissue.com"; sid:532288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabearmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabearmarket.com"; sid:532289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeast.com"; sid:532290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabill.com"; sid:532291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabition.com"; sid:532292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabk.com"; sid:532293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablock19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablock19.com"; sid:532294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabloodtest.com"; sid:532295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabody2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabody2020.com"; sid:532296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabookclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabookclub.com"; sid:532297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-boomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-boomers.com"; sid:532298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabooty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabooty.com"; sid:532299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborealis.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborealis.science"; sid:532300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboston2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboston2020.com"; sid:532301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreath.com"; sid:532302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabug-stomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabug-stomp.com"; sid:532303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuns.com"; sid:532304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuys.com"; sid:532305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacallab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacallab.com"; sid:532306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacal.net"; sid:532307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacando.com"; sid:532308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacargo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacargo.com"; sid:532309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation.net"; sid:532310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentury.com"; sid:532311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaception.com"; sid:532312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachain.net"; sid:532313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chart.com"; sid:532314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachollo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachollo.com"; sid:532315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachris.com"; sid:532316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachristmasbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachristmasbaby.com"; sid:532317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicals.com"; sid:532318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicle.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicle.fyi"; sid:532319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles2020.com"; sid:532320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles2020.net"; sid:532321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles.net"; sid:532322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacircus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacircus.com"; sid:532323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimline.com"; sid:532324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-claims.com"; sid:532325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsfirm.com"; sid:532326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsfirm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsfirm.net"; sid:532327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsmanagement.com"; sid:532328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.biz"; sid:532329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannyc.com"; sid:532330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleanse.com"; sid:532331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclutter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclutter.com"; sid:532332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoach.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoach.net"; sid:532333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-code.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-code.com"; sid:532334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoders.com"; sid:532335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollective.com"; sid:532336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomics.com"; sid:532337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconception.com"; sid:532338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopingcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopingcourse.com"; sid:532339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacount.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacount.world"; sid:532340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoup.com"; sid:532341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19-test.com"; sid:532342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrap.com"; sid:532343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraycray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraycray.com"; sid:532344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreditloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreditloan.com"; sid:532345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis2019.com"; sid:532346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisbook.com"; sid:532347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscommunications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscommunications.com"; sid:532348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacz.com"; sid:532349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadanceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadanceproject.com"; sid:532350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-days.com"; sid:532351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaysmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaysmovie.com"; sid:532352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaze.com"; sid:532353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeadpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeadpool.com"; sid:532354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeal.com"; sid:532355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-debt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-debt.com"; sid:532356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtcrisis.com"; sid:532357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademic.net"; sid:532358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-depot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-depot.net"; sid:532359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscussion.com"; sid:532360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-disinfect.com"; sid:532361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorce.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorce.club"; sid:532362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadochex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadochex.com"; sid:532363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonor.com"; sid:532364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadown.com"; sid:532365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoyourpart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoyourpart.com"; sid:532366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadragon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadragon.com"; sid:532367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrugtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrugtest.com"; sid:532368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadurum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadurum.com"; sid:532369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaearnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaearnings.com"; sid:532370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaendgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaendgame.com"; sid:532371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaentschaedigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaentschaedigung.com"; sid:532372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeq.com"; sid:532373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaes.com"; sid:532374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaesportsleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaesportsleague.com"; sid:532375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ethos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ethos.com"; sid:532376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeum.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeum.club"; sid:532377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeum.com"; sid:532378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeum.net"; sid:532379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexitparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexitparty.com"; sid:532380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexposurelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexposurelaw.com"; sid:532381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemask.net"; sid:532382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakevirus.com"; sid:532383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakevirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakevirusvaccine.com"; sid:532384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fallout.com"; sid:532385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafic.com"; sid:532386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.net"; sid:532387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafigures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafigures.com"; sid:532388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fitness.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fitness.club"; sid:532389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fitness.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fitness.tips"; sid:532390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflip.com"; sid:532391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflow.com"; sid:532392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerdermittelhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerdermittelhilfe.com"; sid:532393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoggers.com"; sid:532394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafogging.com"; sid:532395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafraud.com"; sid:532396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrauds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrauds.com"; sid:532397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafr.com"; sid:532398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefacemasks.com"; sid:532399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreela.com"; sid:532400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemcallen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemcallen.com"; sid:532401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemusic.com"; sid:532402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreenyc.com"; sid:532403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetourism.com"; sid:532404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeworld.com"; sid:532405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeze.com"; sid:532406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagards.com"; sid:532407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageo.com"; sid:532408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagetaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagetaway.com"; sid:532409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaghana.com"; sid:532410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobal.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobal.world"; sid:532411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoodnews.com"; sid:532412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagossip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagossip.com"; sid:532413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguide.net"; sid:532414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunlukleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunlukleri.com"; sid:532415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcaresupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcaresupplies.com"; sid:532416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcoverage.com"; sid:532417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthguide.com"; sid:532418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthplan.com"; sid:532419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthshop.com"; sid:532420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupp.com"; sid:532421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.center"; sid:532422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpcenter.com"; sid:532423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpcenter.net"; sid:532424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdesk.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdesk.co.uk"; sid:532425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdesk.org.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdesk.org.uk"; sid:532426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpdesk.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpdesk.uk"; sid:532427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpishere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpishere.com"; sid:532428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpnetwork.com"; sid:532429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpnetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpnetwork.net"; sid:532430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfebayreuth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfebayreuth.com"; sid:532431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahips.com"; sid:532432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahk.com"; sid:532433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholidayclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholidayclaim.com"; sid:532434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholidayclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholidayclaims.com"; sid:532435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homeopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homeopathy.com"; sid:532436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometest.net"; sid:532437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeworkout.com"; sid:532438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeworkouts.com"; sid:532439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahour.com"; sid:532440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahunters.com"; sid:532441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygieneartikel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygieneartikel.com"; sid:532442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaial.com"; sid:532443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaicanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaicanhelp.com"; sid:532444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-india.com"; sid:532445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuries.com"; sid:532446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjury.com"; sid:532447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-in-numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-in-numbers.com"; sid:532448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainworld.com"; sid:532449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaireland.com"; sid:532450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisolations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisolations.com"; sid:532451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajokes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajokes.net"; sid:532452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakid.net"; sid:532453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsnow.com"; sid:532454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsusa.com"; sid:532455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidznow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidznow.com"; sid:532456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillernyc.com"; sid:532457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillers.biz"; sid:532458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakingdom.com"; sid:532459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiti.com"; sid:532460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitsusa.com"; sid:532461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kongress.com"; sid:532462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kongress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kongress.net"; sid:532463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakonzerte.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakonzerte.club"; sid:532464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakratie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakratie.com"; sid:532465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrisebesiegen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrisebesiegen.com"; sid:532466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise.net"; sid:532467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise-unternehmenretten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise-unternehmenretten.com"; sid:532468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kuendigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kuendigung.com"; sid:532469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalap.com"; sid:532470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-leaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-leaders.com"; sid:532471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalrights.com"; sid:532472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalupdates.com"; sid:532473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalemonade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalemonade.com"; sid:532474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessonsbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessonsbook.com"; sid:532475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessonsthebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessonsthebook.com"; sid:532476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lieferservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lieferservice.net"; sid:532477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifetips.com"; sid:532478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalinks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalinks.net"; sid:532479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalist.net"; sid:532480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live19.com"; sid:532481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivecam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivecam.com"; sid:532482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivetracker.com"; sid:532483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalized.com"; sid:532484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loan.com"; sid:532485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-logistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-logistics.com"; sid:532486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalu.com"; sid:532487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalung.com"; sid:532488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalvirus.com"; sid:532489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyse.com"; sid:532490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronam2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronam2.com"; sid:532491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanifest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanifest.com"; sid:532492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamap-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamap-ny.com"; sid:532493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapp.com"; sid:532494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketcrash.com"; sid:532495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-marketing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-marketing.net"; sid:532496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskhome.com"; sid:532497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksforkids.com"; sid:532498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksn95.com"; sid:532499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskuk.com"; sid:532500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamass.com"; sid:532501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasterclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasterclass.com"; sid:532502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatata.net"; sid:532503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamath.com"; sid:532504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamazes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamazes.com"; sid:532505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilk.com"; sid:532506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionaireweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionaireweb.com"; sid:532507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamis.com"; sid:532508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonolouges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonolouges.com"; sid:532509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoron.com"; sid:532510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagepayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagepayment.com"; sid:532511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagerates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagerates.com"; sid:532512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamullet.com"; sid:532513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamullets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamullets.com"; sid:532514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusiciansinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusiciansinfo.com"; sid:532515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronananri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronananri.com"; sid:532516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanarratives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanarratives.com"; sid:532517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronandme.com"; sid:532518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewscenter.com"; sid:532519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsupdate.com"; sid:532520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-noodfonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-noodfonds.com"; sid:532521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotices.com"; sid:532522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanowwhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanowwhat.com"; sid:532523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaochrona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaochrona.com"; sid:532524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaomega3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaomega3.com"; sid:532525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaomega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaomega.com"; sid:532526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonesteptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonesteptest.com"; sid:532527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakinfo.com"; sid:532528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-over-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-over-party.com"; sid:532529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaloozaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaloozaonline.com"; sid:532530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaloza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaloza.com"; sid:532531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicguide.com"; sid:532532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pandemic.net"; sid:532533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pandemic.world"; sid:532534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemie.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemie.world"; sid:532535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparty.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparty.today"; sid:532536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pass.com"; sid:532537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pass.net"; sid:532538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayment.com"; sid:532539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeak.com"; sid:532540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapero.com"; sid:532541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaping.com"; sid:532542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplague.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplague.net"; sid:532543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplasma.com"; sid:532544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapl.com"; sid:532545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolitan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolitan.com"; sid:532546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolitan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolitan.net"; sid:532547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-positiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-positiv.com"; sid:532548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapparel.com"; sid:532549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprison.com"; sid:532550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproject.net"; sid:532551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmybiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmybiz.com"; sid:532552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmybusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmybusiness.com"; sid:532553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionshop.com"; sid:532554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protector.net"; sid:532555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprov.com"; sid:532556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-purge-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-purge-party.com"; sid:532557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqc70.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqc70.com"; sid:532558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantine2020.com"; sid:532559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantineanxietycounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantineanxietycounseling.com"; sid:532560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinecomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinecomedy.com"; sid:532561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinecounselingandtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinecounselingandtherapy.com"; sid:532562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinecounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinecounseling.com"; sid:532563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinecouplestherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinecouplestherapy.com"; sid:532564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantineparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantineparty.com"; sid:532565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquick.com"; sid:532566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquick.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquick.net"; sid:532567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquizz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquizz.com"; sid:532568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarabic.com"; sid:532569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidresults.com"; sid:532570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtesting.com"; sid:532571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtestkits.com"; sid:532572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareaction.com"; sid:532573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rebound.com"; sid:532574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefugee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefugee.com"; sid:532575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefunds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefunds.net"; sid:532576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rehab.com"; sid:532577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremoval.com"; sid:532578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremover.com"; sid:532579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremover.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremover.net"; sid:532580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareopening.com"; sid:532581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepel.com"; sid:532582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsewichita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsewichita.com"; sid:532583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarrativ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarrativ.com"; sid:532584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafedining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafedining.com"; sid:532585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasane.com"; sid:532586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitation.net"; sid:532587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanity.com"; sid:532588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschade.com"; sid:532589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschildren.com"; sid:532590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltest.net"; sid:532591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascholing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascholing.com"; sid:532592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschoolday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschoolday.com"; sid:532593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-screen.com"; sid:532594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreens.com"; sid:532595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-seelsorge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-seelsorge.net"; sid:532596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfcheck.com"; sid:532597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-service.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-service.center"; sid:532598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashifa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashifa.com"; sid:532599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppers.com"; sid:532600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashutdowclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashutdowclaim.com"; sid:532601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashutdownattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashutdownattorney.com"; sid:532602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasickness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasickness.net"; sid:532603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasilta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasilta.com"; sid:532604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingapore.com"; sid:532605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskin.com"; sid:532606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslist.com"; sid:532607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslovensko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslovensko.com"; sid:532608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-solutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-solutions.net"; sid:532609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprayer.com"; sid:532610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilize.com"; sid:532611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastickingplaster.com"; sid:532612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastickingplaster.net"; sid:532613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastocks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastocks.net"; sid:532614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoryhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoryhub.com"; sid:532615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong.world"; sid:532616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubsidies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubsidies.com"; sid:532617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasummons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasummons.com"; sid:532618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliez.com"; sid:532619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupport.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupport.house"; sid:532620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivalkit.com"; sid:532621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasux.com"; sid:532622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvirus-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvirus-relief.com"; sid:532623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswap.com"; sid:532624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymphony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymphony.com"; sid:532625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomstest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomstest.net"; sid:532626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxcredit.com"; sid:532627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxhelpers.com"; sid:532628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxsolution.com"; sid:532629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-t.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-t.club"; sid:532630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelahealth.com"; sid:532631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelmed.com"; sid:532632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatent.com"; sid:532633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterminal.com"; sid:532634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatespit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatespit.com"; sid:532635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestenzuhause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestenzuhause.com"; sid:532636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatester.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatester.net"; sid:532637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestforyou.com"; sid:532638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglocator.com"; sid:532639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingny.com"; sid:532640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlocator.com"; sid:532641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-ny.com"; sid:532642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestresult.com"; sid:532643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsny.com"; sid:532644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsonucu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsonucu.com"; sid:532645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsonucu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsonucu.net"; sid:532646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestus.com"; sid:532647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-thuistest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-thuistest.com"; sid:532648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatime-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatime-2020.com"; sid:532649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimeitis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimeitis.com"; sid:532650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimepass.com"; sid:532651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-times.com"; sid:532652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.fyi"; sid:532653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationuniversity.com"; sid:532654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatix.com"; sid:532655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-today.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-today.net"; sid:532656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatodays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatodays.com"; sid:532657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatose.com"; sid:532658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatower.com"; sid:532659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trauma.com"; sid:532660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrauma.com"; sid:532661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveller.com"; sid:532662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreason.com"; sid:532663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trends.com"; sid:532664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronat-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronat-shirt.com"; sid:532665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tshirts.com"; sid:532666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaup.com"; sid:532667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdate.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdate.fyi"; sid:532668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupd.com"; sid:532669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausa2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausa2020.com"; sid:532670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausa2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausa2020.net"; sid:532671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausa.net"; sid:532672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavalve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavalve.com"; sid:532673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveer.com"; sid:532674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideo.net"; sid:532675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinfo.com"; sid:532676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviolations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviolations.com"; sid:532677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviraid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviraid.com"; sid:532678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirales.com"; sid:532679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralsessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralsessions.com"; sid:532680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir-cure.com"; sid:532681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavircure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavircure.com"; sid:532682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirologia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirologia.com"; sid:532683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsnewsnow.com"; sid:532684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirucovid19.com"; sid:532685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirunow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirunow.com"; sid:532686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.biz"; sid:532687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19kit.com"; sid:532688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus2019.com"; sid:532689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.us"; sid:532690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020blog.com"; sid:532691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020forum.com"; sid:532692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020information.com"; sid:532693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2021.com"; sid:532694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus24hourdisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus24hourdisinfectant.com"; sid:532695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus3d.com"; sid:532696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus51.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus51.com"; sid:532697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus559.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus559.com"; sid:532698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus591.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus591.com"; sid:532699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus62.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus62.com"; sid:532700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus64.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus64.com"; sid:532701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus65.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus65.com"; sid:532702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus831.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus831.com"; sid:532703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus855.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus855.com"; sid:532704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus856.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus856.com"; sid:532705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus92.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus92.com"; sid:532706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus94.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus94.com"; sid:532707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccounting.com"; sid:532708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-activities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-activities.com"; sid:532709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadventure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadventure.com"; sid:532710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-algerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-algerie.com"; sid:532711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamendment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamendment.com"; sid:532712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusammo.com"; sid:532713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusammunition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusammunition.com"; sid:532714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandchurchplanting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandchurchplanting.com"; sid:532715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-and-me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-and-me.com"; sid:532716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandroid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandroid.com"; sid:532717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-answers.com"; sid:532718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibody.com"; sid:532719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapandemic.com"; sid:532720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarcade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarcade.com"; sid:532721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ar.com"; sid:532722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaroundtheworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaroundtheworld.net"; sid:532723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattacks.com"; sid:532724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaby2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaby2020.com"; sid:532725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyrelief.com"; sid:532726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbd.com"; sid:532727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeach.com"; sid:532728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeacon.com"; sid:532729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbernanke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbernanke.com"; sid:532730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbigdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbigdata.com"; sid:532731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtype.com"; sid:532732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbocaraton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbocaraton.com"; sid:532733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbodybuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbodybuilding.com"; sid:532734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbond.com"; sid:532735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboom.com"; sid:532736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbootcamp.com"; sid:532737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboredom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboredom.com"; sid:532738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbounceback.com"; sid:532739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbounce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbounce.com"; sid:532740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboutique.com"; sid:532741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbraclet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbraclet.com"; sid:532742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbr.com"; sid:532743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbristoldentalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbristoldentalemergency.com"; sid:532744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbroadway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbroadway.com"; sid:532745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessattorney.com"; sid:532746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessbankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessbankrupt.com"; sid:532747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscenter.com"; sid:532748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessdebthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessdebthelp.com"; sid:532749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessdebtrelief.com"; sid:532750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessguide.com"; sid:532751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionloan.com"; sid:532752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-buster.com"; sid:532753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbustersus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbustersus.com"; sid:532754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscamisetas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscamisetas.com"; sid:532755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasesupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasesupdate.com"; sid:532756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasos.com"; sid:532757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbot.com"; sid:532758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscelebrity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscelebrity.com"; sid:532759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-class-action.com"; sid:532760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassroom.com"; sid:532761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscleaningcompany.com"; sid:532762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningflorida.com"; sid:532763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnaples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnaples.com"; sid:532764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaningservices.com"; sid:532765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtampa.com"; sid:532766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnashville.com"; sid:532767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosingbell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosingbell.com"; sid:532768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscocooning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscocooning.com"; sid:532769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedyclub.com"; sid:532770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommand.com"; sid:532771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompassion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompassion.com"; sid:532772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnector.com"; sid:532773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontractor.com"; sid:532774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontrols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontrols.com"; sid:532775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscountdown.com"; sid:532776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscourt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscourt.com"; sid:532777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19pandemic.com"; sid:532778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19-pandemic.com"; sid:532779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscramer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscramer.com"; sid:532780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisisclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisisclaims.com"; sid:532781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscritic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscritic.com"; sid:532782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrowd.com"; sid:532783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusctscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusctscan.com"; sid:532784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuban.com"; sid:532785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.services"; sid:532786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurevac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurevac.com"; sid:532787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureweb.com"; sid:532788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscycle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscycle.com"; sid:532789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscz.com"; sid:532790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtreliefsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtreliefsolutions.com"; sid:532791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtsolution.com"; sid:532792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdemocracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdemocracy.com"; sid:532793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdemocrat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdemocrat.com"; sid:532794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.dental"; sid:532795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdental.com"; sid:532796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentalemergency.com"; sid:532797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfeccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfeccion.com"; sid:532798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-desinfektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-desinfektion.com"; sid:532799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdevelop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdevelop.com"; sid:532800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdigitalselftestandtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdigitalselftestandtracker.com"; sid:532801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.directory"; sid:532802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2021.com"; sid:532803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfections.com"; sid:532804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdji.com"; sid:532805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.domains - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.domains"; sid:532806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdream.com"; sid:532807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrs.com"; sid:532808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearlysymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearlysymptoms.com"; sid:532809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearthquake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearthquake.com"; sid:532810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecommerce.com"; sid:532811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselbowbump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselbowbump.com"; sid:532812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectorate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectorate.com"; sid:532813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencydental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencydental.com"; sid:532814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencydentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencydentist.com"; sid:532815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencydentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencydentists.com"; sid:532816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyloans.com"; sid:532817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusengineer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusengineer.com"; sid:532818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusentertainment.com"; sid:532819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruserrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruserrands.com"; sid:532820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruserrandsminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruserrandsminneapolis.com"; sid:532821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruservices.com"; sid:532822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexclusive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexclusive.com"; sid:532823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-explained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-explained.com"; sid:532824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfallout.com"; sid:532825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastmoney.com"; sid:532826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfauchi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfauchi.com"; sid:532827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfedex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfedex.com"; sid:532828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfestlv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfestlv.com"; sid:532829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfile.com"; sid:532830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirearm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirearm.com"; sid:532831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfishing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfishing.com"; sid:532832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflip.com"; sid:532833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfootage.com"; sid:532834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforce.com"; sid:532835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusformula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusformula.com"; sid:532836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfort.com"; sid:532837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreelance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreelance.com"; sid:532838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreereport.com"; sid:532839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreereport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreereport.net"; sid:532840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeworld.com"; sid:532841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfriend.com"; sid:532842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfriends.com"; sid:532843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfromchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfromchina.com"; sid:532844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusftlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusftlauderdale.com"; sid:532845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-funding.com"; sid:532846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgameover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgameover.com"; sid:532847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgames.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgames.net"; sid:532848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgapyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgapyear.com"; sid:532849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgh.com"; sid:532850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgobankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgobankrupt.com"; sid:532851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-good-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-good-news.com"; sid:532852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernment.com"; sid:532853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgraduation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgraduation.com"; sid:532854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgraphics.com"; sid:532855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreenclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreenclean.com"; sid:532856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroups.com"; sid:532857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguid.com"; sid:532858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgun.com"; sid:532859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandgun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandgun.com"; sid:532860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandwashchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandwashchallenge.com"; sid:532861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandyman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandyman.com"; sid:532862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazmat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazmat.com"; sid:532863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushbot.com"; sid:532864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealchance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealchance.com"; sid:532865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthkit.net"; sid:532866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheathkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheathkit.com"; sid:532867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp247.com"; sid:532868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpforbusiness.com"; sid:532869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpfordebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpfordebt.com"; sid:532870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpprogram.com"; sid:532871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.services"; sid:532872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheroes.net"; sid:532873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoax.net"; sid:532874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomedepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomedepot.com"; sid:532875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushug.com"; sid:532876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushugs.com"; sid:532877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hypnose-meditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hypnose-meditation.com"; sid:532878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-impfstoff.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-impfstoff.net"; sid:532879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinforma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinforma.com"; sid:532880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinquire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinquire.com"; sid:532881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinspiration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinspiration.com"; sid:532882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-insurance-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-insurance-claim.com"; sid:532883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceinfo.com"; sid:532884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinterview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinterview.com"; sid:532885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusism.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusism.net"; sid:532886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusist.net"; sid:532887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjimcramer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjimcramer.com"; sid:532888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobsearch.com"; sid:532889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjoke.com"; sid:532890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-jokes.com"; sid:532891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjournals.com"; sid:532892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjupiter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjupiter.com"; sid:532893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskd.com"; sid:532894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskevindurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskevindurant.com"; sid:532895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskey.com"; sid:532896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeyinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeyinfo.com"; sid:532897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskidsactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskidsactivities.com"; sid:532898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskits.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskits.world"; sid:532899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknife.com"; sid:532900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-krankheit-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-krankheit-2019.com"; sid:532901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabkit.com"; sid:532902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslastnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslastnews.com"; sid:532903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaughs.com"; sid:532904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmnj.com"; sid:532905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmny.com"; sid:532906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirms.net"; sid:532907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslead.com"; sid:532908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleaked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleaked.com"; sid:532909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusledger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusledger.com"; sid:532910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalinfo.com"; sid:532911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalnj.com"; sid:532912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalny.com"; sid:532913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalrights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalrights.net"; sid:532914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsources.com"; sid:532915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslesson.com"; sid:532916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliberty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliberty.com"; sid:532917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifespan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifespan.com"; sid:532918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslink.net"; sid:532919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslondondentalemergencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslondondentalemergencies.com"; sid:532920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloser.com"; sid:532921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosses.com"; sid:532922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslowes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslowes.com"; sid:532923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmachete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmachete.com"; sid:532924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadmoney.com"; sid:532925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmain.com"; sid:532926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarijuana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarijuana.com"; sid:532927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-masks-sanitizers-gloves-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-masks-sanitizers-gloves-supplies.com"; sid:532928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasterclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasterclass.com"; sid:532929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaven.com"; sid:532930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmayhem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmayhem.com"; sid:532931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmcconnell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmcconnell.com"; sid:532932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicaments.com"; sid:532933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medtreatment.com"; sid:532934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeister.com"; sid:532935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorialday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorialday.com"; sid:532936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmentalillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmentalillness.com"; sid:532937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmessages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmessages.com"; sid:532938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmnuchin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmnuchin.com"; sid:532939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgagerelief.com"; sid:532940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmultifamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmultifamily.com"; sid:532941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95masksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95masksupply.com"; sid:532942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnao.com"; sid:532943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalprotection.com"; sid:532944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-negative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-negative.com"; sid:532945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnerd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnerd.com"; sid:532946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnoe.com"; sid:532947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews1.com"; sid:532948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.biz"; sid:532949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewscast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewscast.com"; sid:532950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsinfotv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsinfotv.com"; sid:532951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewslocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewslocal.com"; sid:532952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewssummary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewssummary.com"; sid:532953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusniw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusniw.com"; sid:532954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnr95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnr95mask.com"; sid:532955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnyse.com"; sid:532956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoaxaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoaxaca.com"; sid:532957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficials.com"; sid:532958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruson.com"; sid:532959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopeningbell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopeningbell.com"; sid:532960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopinion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopinion.com"; sid:532961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopoly.com"; sid:532962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusotc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusotc.com"; sid:532963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreaksurvivalplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreaksurvivalplan.com"; sid:532964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreak.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreak.tips"; sid:532965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoxygen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoxygen.com"; sid:532966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicguide.com"; sid:532967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatreon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatreon.com"; sid:532968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatrol.com"; sid:532969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayday.com"; sid:532970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayment.com"; sid:532971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspestcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspestcontrol.com"; sid:532972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pill.com"; sid:532973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspistol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspistol.com"; sid:532974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplush.com"; sid:532975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolice.com"; sid:532976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-porn.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-porn.world"; sid:532977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspowell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspowell.com"; sid:532978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspower.com"; sid:532979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprecautionarymeasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprecautionarymeasure.com"; sid:532980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventhome.com"; sid:532981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionaustin.com"; sid:532982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproclean.com"; sid:532983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproductreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproductreviews.com"; sid:532984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromises.com"; sid:532985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspropertysale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspropertysale.com"; sid:532986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionsecrets.com"; sid:532987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspundit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspundit.com"; sid:532988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-qna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-qna.com"; sid:532989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantineincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantineincome.com"; sid:532990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquote.com"; sid:532991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrah.com"; sid:532992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusread.com"; sid:532993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatesale.com"; sid:532994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealm.com"; sid:532995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrebound.com"; sid:532996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregulation.com"; sid:532997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.fund"; sid:532998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffunds.com"; sid:532999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieflawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieflawyers.com"; sid:533000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefprograms.com"; sid:533001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotework.com"; sid:533002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremoteworkingjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremoteworkingjobs.com"; sid:533003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrepublican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrepublican.com"; sid:533004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrescuepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrescuepackage.com"; sid:533005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrescueplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrescueplan.com"; sid:533006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrescueplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrescueplans.com"; sid:533007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-response.com"; sid:533008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponsejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponsejobs.com"; sid:533009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseloan.com"; sid:533010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-response.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-response.net"; sid:533011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresume.com"; sid:533012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrevolver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrevolver.com"; sid:533013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrifle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrifle.com"; sid:533014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrobinhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrobinhood.com"; sid:533015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafedentist.com"; sid:533016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafedentistry.com"; sid:533017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafedentists.com"; sid:533018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeemergencydentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeemergencydentist.com"; sid:533019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetygroup.com"; sid:533020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyservice.com"; sid:533021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussafetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussafetyservices.com"; sid:533022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safetyservices.com"; sid:533023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety-services.com"; sid:533024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalisburydentalemergencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalisburydentalemergencies.com"; sid:533025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalisburydentalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalisburydentalemergency.com"; sid:533026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitationservice.com"; sid:533027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanitizing.com"; sid:533028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschooling.com"; sid:533029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscore.com"; sid:533030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscout.com"; sid:533031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselloff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselloff.com"; sid:533032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenator.com"; sid:533033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusservicesminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusservicesminneapolis.com"; sid:533034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshock.com"; sid:533035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshutdownattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshutdownattorney.com"; sid:533036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussignage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussignage.net"; sid:533037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusskill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusskill.com"; sid:533038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusskills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusskills.com"; sid:533039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinesscenter.com"; sid:533040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussneltest.com"; sid:533041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussources.com"; sid:533042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspeeches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspeeches.com"; sid:533043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspringbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspringbreak.com"; sid:533044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussquawk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussquawk.com"; sid:533045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstarbucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstarbucks.com"; sid:533046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstats.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstats.today"; sid:533047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstickingplaster.com"; sid:533048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstickingplaster.net"; sid:533049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stimulus.com"; sid:533050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstinks.com"; sid:533051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstuart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstuart.com"; sid:533052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportsystem.com"; sid:533053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurreydentalemergencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurreydentalemergencies.com"; sid:533054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurreydentalemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurreydentalemergency.com"; sid:533055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivaltshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivaltshirt.com"; sid:533056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.net"; sid:533057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivors.net"; sid:533058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustablet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustablet.com"; sid:533059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustalent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustalent.com"; sid:533060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-talk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-talk.net"; sid:533061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxation.com"; sid:533062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxsolutions.com"; sid:533063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteacher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteacher.com"; sid:533064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechnology.com"; sid:533065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustees2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustees2020.com"; sid:533066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingarizona.com"; sid:533067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcenter.net"; sid:533068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcentres.com"; sid:533069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustf.com"; sid:533070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapeutics.com"; sid:533071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustips.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustips.bid"; sid:533072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackingapp.com"; sid:533073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tr.com"; sid:533074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-trend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-trend.com"; sid:533075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustriviagame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustriviagame.com"; sid:533076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.world"; sid:533077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusups.com"; sid:533078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususps.com"; sid:533079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacc.com"; sid:533080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine2021.com"; sid:533081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinetest.com"; sid:533082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinetesting.com"; sid:533083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinetests.com"; sid:533084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaluation.com"; sid:533085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusventure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusventure.com"; sid:533086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoter.com"; sid:533087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoters.com"; sid:533088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoting.com"; sid:533089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvx.com"; sid:533090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-waermebildkamera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-waermebildkamera.com"; sid:533091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebdesign.com"; sid:533092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweddinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweddinghelp.com"; sid:533093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweightloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweightloss.com"; sid:533094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswerks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswerks.com"; sid:533095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestpalmbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestpalmbeach.com"; sid:533096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswillnotwin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswillnotwin.com"; sid:533097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswine.com"; sid:533098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wire.com"; sid:533099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswish.com"; sid:533100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswithalime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswithalime.com"; sid:533101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswoman.com"; sid:533102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkoptions.com"; sid:533103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworks.com"; sid:533104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldcup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldcup.com"; sid:533105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyellen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyellen.com"; sid:533106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszones.com"; sid:533107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruus.com"; sid:533108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirvaccine.com"; sid:533109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavkits.com"; sid:533110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavodka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavodka.com"; sid:533111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteers.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteers.network"; sid:533112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vorbeugung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vorbeugung.com"; sid:533113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorusnews.com"; sid:533114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavouchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavouchers.com"; sid:533115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatch247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatch247.com"; sid:533116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweerstand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweerstand.com"; sid:533117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhisper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhisper.com"; sid:533118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhispers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhispers.com"; sid:533119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawinter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawinter.com"; sid:533120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-witz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-witz.com"; sid:533121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawitz.com"; sid:533122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-witze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-witze.com"; sid:533123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawitze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawitze.com"; sid:533124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawitze.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawitze.net"; sid:533125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-witz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-witz.net"; sid:533126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawood.com"; sid:533127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-workout.com"; sid:533128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworlds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworlds.com"; sid:533129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworld.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworld.today"; sid:533130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoga.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoga.net"; sid:533131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zelftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zelftest.com"; sid:533132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronistsofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronistsofwuhan.com"; sid:533133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counselingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counselingcoronavirus.com"; sid:533134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countcoronavirus.com"; sid:533135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countycovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countycovidsurvey.com"; sid:533136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couriersagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couriersagainstcovid.com"; sid:533137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covad-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covad-19pandemic.com"; sid:533138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid191.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid191.com"; sid:533139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1969.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1969.com"; sid:533140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19911.com"; sid:533141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-act.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-act.today"; sid:533142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19affectedworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19affectedworkers.com"; sid:533143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aftermath.com"; sid:533144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid2020.com"; sid:533145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aid2020.com"; sid:533146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid2020.net"; sid:533147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aid2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aid2020.net"; sid:533148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid20.com"; sid:533149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aid20.com"; sid:533150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aid20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aid20.net"; sid:533151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andmy.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andmy.life"; sid:533152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-answers.com"; sid:533153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytest.com"; sid:533154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytests.com"; sid:533155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirus.club"; sid:533156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artsfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artsfestival.com"; sid:533157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-attorney.com"; sid:533158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19baby2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19baby2020.com"; sid:533159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bbs.com"; sid:533160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bc.net"; sid:533161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bd.com"; sid:533162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizassist.com"; sid:533163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizhelp.com"; sid:533164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bk.com"; sid:533165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-board.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-board.com"; sid:533166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-board.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-board.com"; sid:533167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bot.com"; sid:533168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-brasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-brasil.com"; sid:533169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breakingnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breakingnews.com"; sid:533170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bullies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bullies.com"; sid:533171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bundle.com"; sid:533172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bundle.com"; sid:533173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessattorney.com"; sid:533174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscenter.com"; sid:533175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesshelp.com"; sid:533176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruption.com"; sid:533177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssupport.com"; sid:533178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-buster.com"; sid:533179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-buster.com"; sid:533180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-busters.com"; sid:533181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busters.com"; sid:533182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bw.com"; sid:533183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ca.com"; sid:533184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calc.net"; sid:533185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calm.com"; sid:533186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cantkeepusdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cantkeepusdown.com"; sid:533187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certifiedcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certifiedcleaner.com"; sid:533188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedcleaner.com"; sid:533189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challenge.net"; sid:533190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chapters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chapters.com"; sid:533191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-chat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-chat.com"; sid:533192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19christians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19christians.com"; sid:533193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cipalgerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cipalgerie.com"; sid:533194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-claims.com"; sid:533195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.services"; sid:533196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clean.net"; sid:533197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cleanup.com"; sid:533198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cleanup.com"; sid:533199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clear.com"; sid:533200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicaltrials.com"; sid:533201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coach.com"; sid:533202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19college.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19college.com"; sid:533203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1-9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1-9.com"; sid:533204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communitysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communitysupport.com"; sid:533205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companion.com"; sid:533206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantplumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantplumber.com"; sid:533207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consciousliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consciousliving.com"; sid:533208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultant.com"; sid:533209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contain.com"; sid:533210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19craze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19craze.com"; sid:533211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19critical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19critical.com"; sid:533212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ct.com"; sid:533213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19culture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19culture.com"; sid:533214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cures.net"; sid:533215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curevac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curevac.com"; sid:533216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curevac.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curevac.net"; sid:533217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dairi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dairi.com"; sid:533218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19damage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19damage.com"; sid:533219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathcalculator.com"; sid:533220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deliveries.com"; sid:533221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deliveries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deliveries.net"; sid:533222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.dental"; sid:533223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desinfection.com"; sid:533224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detector.com"; sid:533225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diabetes.com"; sid:533226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diary.com"; sid:533227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diet.com"; sid:533228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diploma.com"; sid:533229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.direct"; sid:533230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfection.net"; sid:533231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doctor.net"; sid:533232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dotace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dotace.com"; sid:533233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugcure.com"; sid:533234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19easytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19easytest.com"; sid:533235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edu.net"; sid:533236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emergencyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emergencyrelief.com"; sid:533237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyrelief.com"; sid:533238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19estateplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19estateplanning.com"; sid:533239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eye.com"; sid:533240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eye.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eye.net"; sid:533241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familyactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familyactivities.com"; sid:533242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-feed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-feed.com"; sid:533243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmfestival.com"; sid:533244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.finance"; sid:533245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialhelp.com"; sid:533246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fogger.com"; sid:533247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fondy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fondy.com"; sid:533248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19footage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19footage.com"; sid:533249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19friends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19friends.com"; sid:533250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontliners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontliners.com"; sid:533251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fuckyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fuckyou.com"; sid:533252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.gallery"; sid:533253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gays.com"; sid:533254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-generation.com"; sid:533255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19georiga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19georiga.com"; sid:533256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glbr.com"; sid:533257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalsafety.com"; sid:533258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19golf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19golf.com"; sid:533259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-gov.com"; sid:533260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmenthelp.com"; sid:533261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19grads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19grads.com"; sid:533262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grads.com"; sid:533263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guide.net"; sid:533264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guru.com"; sid:533265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gy.com"; sid:533266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handcleaner.com"; sid:533267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harita.com"; sid:533268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hbot.com"; sid:533269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19help.net"; sid:533270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecare.com"; sid:533271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hometesting.com"; sid:533272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19household.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19household.com"; sid:533273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19household.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19household.com"; sid:533274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19housingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19housingsolutions.com"; sid:533275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hr.com"; sid:533276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ideas.com"; sid:533277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ie.com"; sid:533278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunization.com"; sid:533279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunization.com"; sid:533280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunizations.com"; sid:533281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunizations.com"; sid:533282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impacts.com"; sid:533283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19income.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19income.com"; sid:533284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ineedworknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ineedworknow.com"; sid:533285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-info.net"; sid:533286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innovations.com"; sid:533287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innovations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innovations.net"; sid:533288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insights.com"; sid:533289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-insurance-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-insurance-claim.com"; sid:533290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-in.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-in.world"; sid:533291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19israel.com"; sid:533292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iv.com"; sid:533293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ivtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ivtherapy.com"; sid:533294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobinjury.com"; sid:533295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k-12academy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k-12academy.com"; sid:533296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keysacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keysacademy.com"; sid:533297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kingsport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kingsport.com"; sid:533298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitchen.com"; sid:533299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labkits.com"; sid:533300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmnj.com"; sid:533301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmny.com"; sid:533302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.net"; sid:533303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawteam.com"; sid:533304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19learnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19learnings.com"; sid:533305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19learnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19learnings.com"; sid:533306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalconsultants.com"; sid:533307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalnj.com"; sid:533308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalny.com"; sid:533309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalpartners.com"; sid:533310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalservices.com"; sid:533311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lesbians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lesbians.com"; sid:533312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lesson.com"; sid:533313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lessons.com"; sid:533314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lessons.com"; sid:533315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19linksters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19linksters.com"; sid:533316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lists.com"; sid:533317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19liveaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19liveaid.com"; sid:533318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestats.com"; sid:533319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-live-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-live-updates.com"; sid:533320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19living.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19living.com"; sid:533321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lockdown.com"; sid:533322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lockdown.com"; sid:533323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loss.com"; sid:533324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19losses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19losses.com"; sid:533325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19management.com"; sid:533326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19management.com"; sid:533327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19man.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19man.com"; sid:533328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manual.com"; sid:533329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maplive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maplive.com"; sid:533330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mask.net"; sid:533331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mask.net"; sid:533332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mdrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mdrn.com"; sid:533333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mdrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mdrn.com"; sid:533334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medcheck.com"; sid:533335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medical-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medical-supply.com"; sid:533336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicaltreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicaltreatment.com"; sid:533337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meditation.com"; sid:533338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meditations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meditations.com"; sid:533339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medtreatment.com"; sid:533340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorial.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorial.world"; sid:533341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19minnnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19minnnesota.com"; sid:533342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19model.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19model.com"; sid:533343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19model.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19model.net"; sid:533344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moms.com"; sid:533345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortalitycalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortalitycalculator.com"; sid:533346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagepayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagepayment.com"; sid:533347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-movie.com"; sid:533348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movies.com"; sid:533349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movies.net"; sid:533350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nashville.com"; sid:533351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19negative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19negative.com"; sid:533352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-negative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-negative.com"; sid:533353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19negative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19negative.com"; sid:533354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nepal.com"; sid:533355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsfeed.com"; sid:533356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsfeed.com"; sid:533357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nobrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nobrasil.com"; sid:533358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notes.com"; sid:533359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19official.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19official.com"; sid:533360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onesteptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onesteptesting.com"; sid:533361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicdata.com"; sid:533362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicoutbreak.com"; sid:533363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemics.com"; sid:533364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicupdate.com"; sid:533365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemic.world"; sid:533366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.partners"; sid:533367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.partners"; sid:533368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19patient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19patient.com"; sid:533369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19payment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19payment.com"; sid:533370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pep.com"; sid:533371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.pet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.pet"; sid:533372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pet.com"; sid:533373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19possibilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19possibilities.com"; sid:533374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19posters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19posters.com"; sid:533375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ppe.com"; sid:533376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepkit.com"; sid:533377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventiondallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventiondallas.com"; sid:533378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventionhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventionhouston.com"; sid:533379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proactive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proactive.com"; sid:533380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proclean.com"; sid:533381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pro.com"; sid:533382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.productions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.productions"; sid:533383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protech.com"; sid:533384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-protect.com"; sid:533385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protected.com"; sid:533386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionproduct.com"; sid:533387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protective.com"; sid:533388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ptsd.com"; sid:533389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qa.com"; sid:533390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-qna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-qna.com"; sid:533391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinenews.com"; sid:533392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarentinesurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarentinesurvivor.com"; sid:533393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarentinesurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarentinesurvivor.net"; sid:533394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quickcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quickcash.com"; sid:533395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapid-test.com"; sid:533396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapid-test.com"; sid:533397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtesting.com"; sid:533398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtesting.com"; sid:533399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rate.com"; sid:533400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rd.com"; sid:533401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recovery.net"; sid:533402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refugee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refugee.com"; sid:533403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehab.com"; sid:533404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehab.net"; sid:533405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief2020.com"; sid:533406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relieffund.com"; sid:533407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-research.com"; sid:533408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resoursecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resoursecenter.com"; sid:533409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-responsefund.com"; sid:533410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ressources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ressources.com"; sid:533411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rip.com"; sid:533412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-risk-rate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-risk-rate.com"; sid:533413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rules.com"; sid:533414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rxs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rxs.com"; sid:533415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19save.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19save.com"; sid:533416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scam.com"; sid:533417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolfunding.com"; sid:533418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningkit.com"; sid:533419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-s.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-s.email"; sid:533420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-s.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-s.email"; sid:533421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlements.com"; sid:533422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shelters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shelters.com"; sid:533423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sl.com"; sid:533424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessloans.com"; sid:533425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soapkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soapkit.com"; sid:533426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sol.com"; sid:533427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.net"; sid:533428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19staffwellbeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19staffwellbeing.com"; sid:533429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stayathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stayathome.com"; sid:533430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stcharlesco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stcharlesco.com"; sid:533431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stickingplaster.com"; sid:533432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stickingplaster.net"; sid:533433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulus.com"; sid:533434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stinks.com"; sid:533435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockmarket.com"; sid:533436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalcalculator.com"; sid:533437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survivors.com"; sid:533438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sux.com"; sid:533439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxes.com"; sid:533440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxhelp.com"; sid:533441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teaching.com"; sid:533442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teachings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teachings.com"; sid:533443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing-us.com"; sid:533444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testpro.com"; sid:533445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testregistry.com"; sid:533446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsignup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsignup.com"; sid:533447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tests.net"; sid:533448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-us.com"; sid:533449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-texas.com"; sid:533450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thefacts.com"; sid:533451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapper.com"; sid:533452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tickets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tickets.com"; sid:533453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tn.com"; sid:533454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tour.com"; sid:533455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.trading - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.trading"; sid:533456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trans.com"; sid:533457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-treatments-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-treatments-us.com"; sid:533458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-t-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-t-shirt.com"; sid:533459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19t-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19t-shirt.com"; sid:533460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-t-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-t-shirts.com"; sid:533461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tx.com"; sid:533462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ug.com"; sid:533463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatesbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatesbystate.com"; sid:533464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-usa-sc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-usa-sc.com"; sid:533465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us-testing.com"; sid:533466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetest.com"; sid:533467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetesting.com"; sid:533468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetests.com"; sid:533469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.world"; sid:533470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vac.com"; sid:533471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vac.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vac.net"; sid:533472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verified.com"; sid:533473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualpossibilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualpossibilities.com"; sid:533474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushelp.com"; sid:533475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virus.life"; sid:533476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusprevention.com"; sid:533477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussymptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussymptom.com"; sid:533478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vis.com"; sid:533479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viz.com"; sid:533480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vouchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vouchers.com"; sid:533481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vzla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vzla.com"; sid:533482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warning.net"; sid:533483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weblive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weblive.com"; sid:533484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19werks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19werks.com"; sid:533485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19winter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19winter.com"; sid:533486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19winter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19winter.com"; sid:533487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workers.com"; sid:533488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workinjury.com"; sid:533489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19x.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19x.net"; sid:533490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x.net"; sid:533491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-x-rays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-x-rays.com"; sid:533492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yoga.com"; sid:533493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1nine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1nine.com"; sid:533494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019analysis.com"; sid:533495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019testing.com"; sid:533496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019usa.com"; sid:533497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20help.com"; sid:533498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20usa.com"; sid:533499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20vaccine.com"; sid:533500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.world"; sid:533501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21questions.com"; sid:533502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21vaccine.com"; sid:533503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid226.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid226.com"; sid:533504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4life.com"; sid:533505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid69sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid69sex.com"; sid:533506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionnetwork.com"; sid:533507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid20.com"; sid:533508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid20.net"; sid:533509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalive.com"; sid:533510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytest.com"; sid:533511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarity.com"; sid:533512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidart.com"; sid:533513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatimes.com"; sid:533514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaus.com"; sid:533515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyboomers.com"; sid:533516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidball.com"; sid:533517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbangkokaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbangkokaid.com"; sid:533518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbition.com"; sid:533519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbk.com"; sid:533520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblock19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblock19.com"; sid:533521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-board.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-board.com"; sid:533522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbond.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbond.cloud"; sid:533523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbond.com"; sid:533524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonds.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonds.cloud"; sid:533525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonds.com"; sid:533526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonds.net"; sid:533527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreath.com"; sid:533528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessloan.com"; sid:533529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessloans.com"; sid:533530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-buster.com"; sid:533531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalendar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalendar.com"; sid:533532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamps.com"; sid:533533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.com"; sid:533534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcards.com"; sid:533535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareers.com"; sid:533536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregear.com"; sid:533537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcargo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcargo.com"; sid:533538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcash.net"; sid:533539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidceo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidceo.com"; sid:533540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchains.com"; sid:533541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chat.com"; sid:533542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcirrhosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcirrhosis.com"; sid:533543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclasses.com"; sid:533544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcompany.com"; sid:533545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoaching.com"; sid:533546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedy.club"; sid:533547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomics.com"; sid:533548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommun.com"; sid:533549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanion.com"; sid:533550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant.com"; sid:533551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnection.com"; sid:533552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnections.com"; sid:533553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnects.com"; sid:533554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcon.net"; sid:533555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consortium.com"; sid:533556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconspiracy2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconspiracy2020.com"; sid:533557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractors.com"; sid:533558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoping.com"; sid:533559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopingcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopingcourse.com"; sid:533560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounsel.com"; sid:533561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverage.com"; sid:533562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcritical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcritical.com"; sid:533563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiselawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiselawsuits.com"; sid:533564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurevac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurevac.com"; sid:533565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurves.com"; sid:533566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcyber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcyber.com"; sid:533567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dash.com"; sid:533568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-day.com"; sid:533569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidday.com"; sid:533570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddb.com"; sid:533571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsolutions.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsolutions.mobi"; sid:533572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecon.com"; sid:533573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddepression.com"; sid:533574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidderm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidderm.com"; sid:533575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-desinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-desinfection.com"; sid:533576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetails.com"; sid:533577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiabetes.com"; sid:533578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiet.com"; sid:533579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfect.com"; sid:533580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfection.com"; sid:533581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctors.com"; sid:533582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideffect.com"; sid:533583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo40.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo40.com"; sid:533584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eo.com"; sid:533585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideonetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideonetwork.com"; sid:533586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidep.com"; sid:533587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideq.com"; sid:533588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidess.com"; sid:533589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexposure.com"; sid:533590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactor.com"; sid:533591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarmtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarmtech.com"; sid:533592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmfestival.com"; sid:533593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.com"; sid:533594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforkids.com"; sid:533595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforlove.com"; sid:533596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgroceries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgroceries.com"; sid:533597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhackathon.com"; sid:533598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhalt.com"; sid:533599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-helpline.com"; sid:533600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnashville.com"; sid:533601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnow.com"; sid:533602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpri.com"; sid:533603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherohelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherohelp.com"; sid:533604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomepack.com"; sid:533605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometest.net"; sid:533606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitals.com"; sid:533607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hub.com"; sid:533608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiangeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiangeneration.com"; sid:533609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiaries.com"; sid:533610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ie.com"; sid:533611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidie.com"; sid:533612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidie.net"; sid:533613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidil.com"; sid:533614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidillness.com"; sid:533615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactmeter.com"; sid:533616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhospitality.com"; sid:533617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinitiative.com"; sid:533618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnov.com"; sid:533619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspiration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspiration.com"; sid:533620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthekitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthekitchen.com"; sid:533621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjob.com"; sid:533622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjo.com"; sid:533623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-k9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-k9.com"; sid:533624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkaraoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkaraoke.com"; sid:533625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitchen.com"; sid:533626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kits.com"; sid:533627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidklean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidklean.com"; sid:533628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkush.com"; sid:533629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawalerts.com"; sid:533630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawgroup.com"; sid:533631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawoffice.com"; sid:533632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlayoffs.com"; sid:533633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalexpert.com"; sid:533634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalexperts.com"; sid:533635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalupdates.com"; sid:533636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlessons.com"; sid:533637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivestream.com"; sid:533638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliving.com"; sid:533639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocations.com"; sid:533640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlung.com"; sid:533641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmail.com"; sid:533642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmala.com"; sid:533643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.marketing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.marketing"; sid:533644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskart.com"; sid:533645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskd.com"; sid:533646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.today"; sid:533647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmena.com"; sid:533648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeter.net"; sid:533649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmichigan.com"; sid:533650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmommy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmommy.com"; sid:533651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoms.com"; sid:533652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnameandshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnameandshame.com"; sid:533653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnecessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnecessities.com"; sid:533654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneighbourhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneighbourhood.com"; sid:533655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneighbourhood.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneighbourhood.net"; sid:533656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnepal.com"; sid:533657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews19.com"; sid:533658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsfeed.com"; sid:533659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnom.com"; sid:533660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoctor.com"; sid:533661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidohio.com"; sid:533662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidon-demand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidon-demand.com"; sid:533663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidondemand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidondemand.com"; sid:533664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopocalypse.com"; sid:533665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidover.com"; sid:533666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparents.com"; sid:533667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassport.com"; sid:533668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatients.com"; sid:533669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayments.com"; sid:533670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeopleimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeopleimpact.com"; sid:533671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.pink - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.pink"; sid:533672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplague.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplague.net"; sid:533673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplugin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplugin.com"; sid:533674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpool.com"; sid:533675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpostcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpostcard.com"; sid:533676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayerva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayerva.com"; sid:533677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepkit.com"; sid:533678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepkit.net"; sid:533679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotec.com"; sid:533680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectors.com"; sid:533681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidptgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidptgroup.com"; sid:533682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqa.com"; sid:533683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquebec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquebec.com"; sid:533684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickcash.com"; sid:533685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquicktest.com"; sid:533686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreaction.com"; sid:533687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreality.com"; sid:533688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.recipes"; sid:533689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrental.com"; sid:533690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreopening.com"; sid:533691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearch.net"; sid:533692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresolution.com"; sid:533693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsecollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsecollective.com"; sid:533694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsehub.com"; sid:533695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsenetwork.com"; sid:533696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseteam.com"; sid:533697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizing.com"; sid:533698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfhelp.com"; sid:533699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniors.com"; sid:533700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementprogram.com"; sid:533701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshare.com"; sid:533702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshift.com"; sid:533703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsickness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsickness.com"; sid:533704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsickness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsickness.net"; sid:533705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskin.com"; sid:533706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinesscenter.com"; sid:533707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstate.com"; sid:533708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstates.com"; sid:533709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstayhome.com"; sid:533710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilize.com"; sid:533711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories.net"; sid:533712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummons.com"; sid:533713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.supplies"; sid:533714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-supplies.com"; sid:533715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplycenter.com"; sid:533716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-support.com"; sid:533717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport.net"; sid:533718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportyxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportyxe.com"; sid:533719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvey.com"; sid:533720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvey.net"; sid:533721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-symp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-symp.com"; sid:533722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.taxi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.taxi"; sid:533723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtech.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtech.fyi"; sid:533724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.technology"; sid:533725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtested.com"; sid:533726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcenters.com"; sid:533727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestings.com"; sid:533728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-online.com"; sid:533729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpro.com"; sid:533730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.today"; sid:533731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidticket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidticket.com"; sid:533732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtickets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtickets.com"; sid:533733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtienda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtienda.com"; sid:533734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtieto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtieto.com"; sid:533735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tp.com"; sid:533736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackermap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackermap.com"; sid:533737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveldeals.com"; sid:533738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelkit.com"; sid:533739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduk.net"; sid:533740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdates.net"; sid:533741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvac19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvac19.com"; sid:533742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvent.com"; sid:533743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilator.com"; sid:533744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvid.club"; sid:533745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviolations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviolations.com"; sid:533746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviral.com"; sid:533747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruspatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruspatch.com"; sid:533748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussymptoms.com"; sid:533749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.today"; sid:533750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-warrior.com"; sid:533751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchdog.com"; sid:533752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidway.com"; sid:533753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwerks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwerks.com"; sid:533754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinter.com"; sid:533755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwithme.com"; sid:533756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkfromhome.com"; sid:533757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworlwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworlwide.com"; sid:533758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xx.com"; sid:533759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyear.com"; sid:533760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpacovid19.com"; sid:533761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpacovid19.net"; sid:533762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycoronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycoronatees.com"; sid:533763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovid19.com"; sid:533764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronicasenlaepocadelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronicasenlaepocadelcoronavirus.com"; sid:533765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcorona.club"; sid:533766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csgocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csgocorona.com"; sid:533767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubretedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubretedelcovid19.com"; sid:533768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4corona.net"; sid:533769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-covid19.com"; sid:533770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19.life"; sid:533771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19.world"; sid:533772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidnow.com"; sid:533773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureofcorona.com"; sid:533774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curevaccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curevaccoronavirus.com"; sid:533775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curevaccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curevaccovid19.com"; sid:533776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damncorona.com"; sid:533777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data-covid19.com"; sid:533778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofcoronavirus.com"; sid:533779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofthecoronavirus.com"; sid:533780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayaftercorona.com"; sid:533781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcorona.com"; sid:533782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtcoronavirus.com"; sid:533783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliveroocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliveroocovid19.com"; sid:533784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistagecovid19.com"; sid:533785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccaocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccaocoronavirus.com"; sid:533786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuesdelcoronavirus.com"; sid:533787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuesdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuesdelcovid19.com"; sid:533788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfccoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfccoronavirusupdate.com"; sid:533789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diaryofapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diaryofapandemic.com"; sid:533790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discoduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discoduringcovid.com"; sid:533791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectautocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectautocovid19.com"; sid:533792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectautocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectautocovid19.net"; sid:533793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcarcovid19.com"; sid:533794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcarcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcarcovid19.net"; sid:533795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfect-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfect-covid19.com"; sid:533796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovid-19.com"; sid:533797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfect-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfect-covid19.net"; sid:533798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfecting-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfecting-coronavirus.com"; sid:533799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfestacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfestacioncovid19.com"; sid:533800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemycoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemycoronacheck.com"; sid:533801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemycovid19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemycovid19check.com"; sid:533802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donationscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donationscovid19.net"; sid:533803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for downloadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"downloadcoronavirus.com"; sid:533804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dr-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dr-covid.com"; sid:533805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duplessiscoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duplessiscoronavirusupdate.com"; sid:533806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for durgscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"durgscoronavirus.com"; sid:533807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for durgsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"durgsforcoronavirus.com"; sid:533808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dz-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dz-covid19.com"; sid:533809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eastvillage-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eastvillage-covid19.com"; sid:533810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19.com"; sid:533811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronavirustest.com"; sid:533812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid.com"; sid:533813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eftercorona.com"; sid:533814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ehcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ehcovid.com"; sid:533815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminarcoronavirus.com"; sid:533816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eloircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eloircorona.com"; sid:533817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emplois-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emplois-covid-19.com"; sid:533818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirus-retail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirus-retail.com"; sid:533819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcovid19.com"; sid:533820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epcovid.com"; sid:533821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicclothing.com"; sid:533822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceducation.com"; sid:533823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicguide.com"; sid:533824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicinfo.com"; sid:533825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicinformation.com"; sid:533826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsprotection.com"; sid:533827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europecovid19.com"; sid:533828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evadecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evadecorona.com"; sid:533829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evcovid19.com"; sid:533830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evocovid.com"; sid:533831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facts-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facts-covid-19.com"; sid:533832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fairbankscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fairbankscovid19.com"; sid:533833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallpandemic.com"; sid:533834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faq-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faq-coronavirus.com"; sid:533835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for favipiravircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"favipiravircovid19.com"; sid:533836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffcovidinfo.com"; sid:533837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovids19.com"; sid:533838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.world"; sid:533839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fighting-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fighting-covid.com"; sid:533840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialcorona.com"; sid:533841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid.com"; sid:533842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidrisk.com"; sid:533843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidtesting.com"; sid:533844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingcommunityincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingcommunityincovid.com"; sid:533845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcoronavirus.com"; sid:533846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedovercovid.com"; sid:533847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstaidforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstaidforcoronavirus.com"; sid:533848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcoronaviruspatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcoronaviruspatient.com"; sid:533849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitduringcorona.com"; sid:533850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronaviruslawyer.com"; sid:533851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidlawsuits.com"; sid:533852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fluglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fluglobalpandemic.com"; sid:533853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foracorona.com"; sid:533854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foracoronavirus.com"; sid:533855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free1covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free1covid19.com"; sid:533856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free1covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free1covid.com"; sid:533857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusmoney.com"; sid:533858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusreport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusreport.net"; sid:533859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcorona.com"; sid:533860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeofcorona.com"; sid:533861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendshipinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendshipinthetimesofcorona.com"; sid:533862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckpandemic.com"; sid:533863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid19.today"; sid:533864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukcoronavirus.com"; sid:533865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funcoronacomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funcoronacomedy.com"; sid:533866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundacioncbgranadavscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundacioncbgranadavscovid-19.com"; sid:533867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fyoucorona.com"; sid:533868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generation-covid-19.com"; sid:533869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidclean.com"; sid:533870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettingthroughcorona.com"; sid:533871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gfycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gfycorona.com"; sid:533872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giftcardsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giftcardsagainstcorona.com"; sid:533873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gig4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gig4covid.com"; sid:533874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusawards.com"; sid:533875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19tracker.com"; sid:533876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalflupandemic.com"; sid:533877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicflu.com"; sid:533878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicusa.com"; sid:533879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicviral.com"; sid:533880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalviralpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalviralpandemic.com"; sid:533881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.life"; sid:533882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gofundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gofundcovid19.com"; sid:533883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gogocorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gogocorona.net"; sid:533884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goingcovid.com"; sid:533885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gonecovid.com"; sid:533886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbaduglycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbaduglycovid19.com"; sid:533887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewscoronavirus.com"; sid:533888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid.com"; sid:533889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotpandemic.com"; sid:533890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotucovid.com"; sid:533891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guerirducoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guerirducoronavirus.com"; sid:533892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guerra-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guerra-coronavirus.com"; sid:533893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid19.net"; sid:533894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hammamlif-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hammamlif-covid19.com"; sid:533895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveicoronavirus.com"; sid:533896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthandcoronavirus.com"; sid:533897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatcovid.com"; sid:533898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidnow.com"; sid:533899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpdeskcoronaschade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpdeskcoronaschade.com"; sid:533900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpduringcoronavirus.com"; sid:533901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcovid.com"; sid:533902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfromcorona.com"; sid:533903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfromcovid-19.com"; sid:533904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helphealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helphealcoronavirus.com"; sid:533905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpinghandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpinghandcovid-19.com"; sid:533906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpline-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpline-corona.com"; sid:533907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofcorona.com"; sid:533908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofcovid-19.com"; sid:533909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronatests.com"; sid:533910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtestkit.com"; sid:533911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeschoolingduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeschoolingduringcoronavirus.com"; sid:533912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronaviruscleaning.com"; sid:533913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdidusurvivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdidusurvivecorona.com"; sid:533914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howiscorona.com"; sid:533915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcorona.com"; sid:533916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid19.club"; sid:533917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid-19.com"; sid:533918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid19.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid19.guru"; sid:533919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid-19.net"; sid:533920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid-20.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid-20.club"; sid:533921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecovid.com"; sid:533922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivethecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivethecoronavirus.net"; sid:533923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howwesurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howwesurvivedcorona.com"; sid:533924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansofcovid.com"; sid:533925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygienecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygienecorona.com"; sid:533926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hylantcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hylantcoronavirusinfo.com"; sid:533927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronaaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronaaware.com"; sid:533928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcorona-virus.com"; sid:533929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icbcbeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icbcbeatcoronavirus.com"; sid:533930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcorona.net"; sid:533931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactocorona.com"; sid:533932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactpandemic.com"; sid:533933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacoronadebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacoronadebtrelief.com"; sid:533934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacoronavirusdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacoronavirusdebtrelief.com"; sid:533935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocoronavirusbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocoronavirusbr.com"; sid:533936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcorona.com"; sid:533937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intouchwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intouchwithcovid19.com"; sid:533938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancovid-19.com"; sid:533939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ireport-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ireport-covid.com"; sid:533940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ireport-covid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ireport-covid.life"; sid:533941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ireport-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ireport-covid.net"; sid:533942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusstillathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusstillathing.com"; sid:533943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19overyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19overyet.com"; sid:533944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvidedcovid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvidedcovid19.co.uk"; sid:533945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-coronavirus.com"; sid:533946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronaviruses.com"; sid:533947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for janpati2020coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"janpati2020coronavirus.com"; sid:533948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincovidcleanup.com"; sid:533949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jointhecovidfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jointhecovidfight.com"; sid:533950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalsfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalsfromcovid.com"; sid:533951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontraelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontraelcovid19.com"; sid:533952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccovid.com"; sid:533953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.com"; sid:533954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidcovid.com"; sid:533955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kids-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kids-against-corona.com"; sid:533956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsagainstcorona.com"; sid:533957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscoronamask.com"; sid:533958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kilcorona.com"; sid:533959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona2020.com"; sid:533960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercovid19.com"; sid:533961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcountycoronaresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcountycoronaresources.com"; sid:533962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingscovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingscovidinfo.com"; sid:533963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowcovid19.com"; sid:533964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kolhacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kolhacovid.com"; sid:533965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koreaincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koreaincorona.com"; sid:533966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronaviruscovid19.com"; sid:533967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for krcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"krcovid.com"; sid:533968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kscovid.com"; sid:533969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamourintimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamourintimesofcorona.com"; sid:533970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestnewscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestnewscoronavirus.com"; sid:533971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadingthroughcorona.com"; sid:533972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningpandemic.com"; sid:533973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leipzigergegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leipzigergegencorona.com"; sid:533974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leipziggegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leipziggegencorona.com"; sid:533975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letcoronago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letcoronago.com"; sid:533976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lidoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lidoncovid19.com"; sid:533977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirus.net"; sid:533978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirus.today"; sid:533979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterpandemic.com"; sid:533980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterthecoronavirus.com"; sid:533981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinapandemic.com"; sid:533982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeintheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeintheageofcovid.com"; sid:533983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeintimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeintimeofcorona.com"; sid:533984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifestylecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifestylecorona.com"; sid:533985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeundercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeundercovid.com"; sid:533986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcoronavirus19.com"; sid:533987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcovid-19.com"; sid:533988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livefromcorona.com"; sid:533989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveupdatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveupdatecoronavirus.com"; sid:533990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingcovid.com"; sid:533991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid-19.com"; sid:533992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronacare.com"; sid:533993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid.com"; sid:533994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longislandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longislandcoronavirus.com"; sid:533995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacoronaclaims.com"; sid:533996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacovid19claims.com"; sid:533997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveincoronavirus.com"; sid:533998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveincovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveincovidtimes.com"; sid:533999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcovid19.com"; sid:534000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofthecoronavirus.com"; sid:534001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.club"; sid:534002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.tips"; sid:534003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-coronavirus.com"; sid:534004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.club"; sid:534005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintimesofcorona.com"; sid:534006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lowereastside-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lowereastside-covid19.com"; sid:534007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovidhelp.com"; sid:534008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lwecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lwecorona.com"; sid:534009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macorona.maison - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macorona.maison"; sid:534010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madatcorona.com"; sid:534011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for magiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"magiacovid.com"; sid:534012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malaysianpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malaysianpandemic.com"; sid:534013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparacoronavirus.com"; sid:534014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasanticovid19.com"; sid:534015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manajemencovid-dirs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manajemencovid-dirs.net"; sid:534016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingpandemic.com"; sid:534017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovid19.com"; sid:534018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masihcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masihcorona.com"; sid:534019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-covid19.com"; sid:534020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscorona.com"; sid:534021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscoronavirus.com"; sid:534022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchedintoapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchedintoapandemic.com"; sid:534023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid19tracker.com"; sid:534024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineinapandemic.com"; sid:534025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memescoronavirus.com"; sid:534026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memesdelcoronavirus.com"; sid:534027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memphiscoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memphiscoronaviruscleaning.com"; sid:534028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metacrilatocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metacrilatocoronavirus.com"; sid:534029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mhscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mhscovid19.com"; sid:534030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronaviruscleaning.com"; sid:534031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwcovidsitter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwcovidsitter.com"; sid:534032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncoronafreeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncoronafreeworld.com"; sid:534033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncoronavirus.com"; sid:534034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacoronavirus.com"; sid:534035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacoronavirusvaccine.com"; sid:534036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for momcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"momcovid.com"; sid:534037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monattestationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monattestationcovid.com"; sid:534038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monmasqueanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monmasqueanticovid19.com"; sid:534039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moviecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moviecovid19.com"; sid:534040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicinthetimeofcovid.com"; sid:534041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myanmarfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myanmarfightcovid19.com"; sid:534042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myattscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myattscorona.com"; sid:534043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona19body.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona19body.com"; sid:534044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona19booty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona19booty.com"; sid:534045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona2021.com"; sid:534046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.biz"; sid:534047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabody.com"; sid:534048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacleaners.com"; sid:534049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacomedy.com"; sid:534050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiaspora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiaspora.com"; sid:534051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaexperience.com"; sid:534052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahq.com"; sid:534053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusanswers.com"; sid:534054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusclassroom.com"; sid:534055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusfacemask.com"; sid:534056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushq.com"; sid:534057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruslife.com"; sid:534058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19hq.com"; sid:534059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19quarantine.com"; sid:534060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddiary.com"; sid:534061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlab.com"; sid:534062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid.life"; sid:534063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmd.com"; sid:534064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidpassport.com"; sid:534065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidpatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidpatch.com"; sid:534066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstatus.com"; sid:534067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfirstpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfirstpandemic2020.com"; sid:534068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysterycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysterycorona.com"; sid:534069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytowncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytowncovid-19.com"; sid:534070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncsdcoronavirusresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncsdcoronavirusresource.com"; sid:534071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neanhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neanhcovid19.com"; sid:534072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcovid19.com"; sid:534073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19.net"; sid:534074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid2020.com"; sid:534075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-covid.com"; sid:534076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscoronaviruscleaning.com"; sid:534077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nfcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nfcovid.com"; sid:534078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nifcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nifcovid19.com"; sid:534079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus2020.com"; sid:534080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirus-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirus-survivor.com"; sid:534081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirus-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirus-survivors.com"; sid:534082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovid19cure.com"; sid:534083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novopandemicplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novopandemicplus.com"; sid:534084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronafinancialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronafinancialhelp.com"; sid:534085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offercovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offercovid19help.com"; sid:534086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronacure.com"; sid:534087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for official-covid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"official-covid19-test.com"; sid:534088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19test.com"; sid:534089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officiallycoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officiallycoronatime.com"; sid:534090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcorona.com"; sid:534091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondernemerschaptijdenscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondernemerschaptijdenscorona.com"; sid:534092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinepandemic.com"; sid:534093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcorona.com"; sid:534094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcoronavirus.com"; sid:534095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovid.com"; sid:534096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcovid19resources.com"; sid:534097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronastories.com"; sid:534098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19info.com"; sid:534099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-alert.com"; sid:534100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapital.com"; sid:534101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-as-practice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-as-practice.com"; sid:534102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicatthedisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicatthedisco.com"; sid:534103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicattorneys.com"; sid:534104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbrewing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbrewing.com"; sid:534105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbundle.com"; sid:534106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuy.com"; sid:534107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuying.com"; sid:534108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccapital.com"; sid:534109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccasino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccasino.com"; sid:534110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclothingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclothingco.com"; sid:534111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccommand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccommand.com"; sid:534112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccorp.com"; sid:534113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrate.com"; sid:534114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrates.com"; sid:534115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccreations.com"; sid:534116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccurse.com"; sid:534117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cycles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cycles.com"; sid:534118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeath.com"; sid:534119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeaths.com"; sid:534120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeutsch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeutsch.com"; sid:534121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdisaster.com"; sid:534122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceducation.com"; sid:534123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfaith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfaith.com"; sid:534124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoods.com"; sid:534125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfunds.com"; sid:534126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglobally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglobally.com"; sid:534127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgloves.com"; sid:534128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgo.com"; sid:534129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthsolutions.com"; sid:534130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthstatus.com"; sid:534131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthstatusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthstatusmap.com"; sid:534132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichs.com"; sid:534133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichsm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichsm.com"; sid:534134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicillness.com"; sid:534135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinspired.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinspired.com"; sid:534136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestments.com"; sid:534137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclives.com"; sid:534138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.loans"; sid:534139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-love.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-love.com"; sid:534140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclumber.com"; sid:534141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicly.com"; sid:534142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-marketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-marketing.com"; sid:534143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmojo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmojo.com"; sid:534144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-motorcycles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-motorcycles.com"; sid:534145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofcovid-19.com"; sid:534146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicology.com"; sid:534147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpantry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpantry.net"; sid:534148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartner.com"; sid:534149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartyof5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartyof5.com"; sid:534150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphonepals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphonepals.com"; sid:534151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanning.net"; sid:534152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaybook.net"; sid:534153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofs.com"; sid:534154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprosperity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprosperity.com"; sid:534155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionfund.com"; sid:534156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpub.com"; sid:534157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicqa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicqa.com"; sid:534158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreality.com"; sid:534159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrebrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrebrand.com"; sid:534160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicregion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicregion.com"; sid:534161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics202x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics202x.com"; sid:534162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscapital.com"; sid:534163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsigns.com"; sid:534164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsimulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsimulator.com"; sid:534165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsquad.com"; sid:534166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstateofmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstateofmind.com"; sid:534167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stats.com"; sid:534168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.today"; sid:534169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategies.com"; sid:534170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategies.net"; sid:534171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictherapy.com"; sid:534172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthoughts.com"; sid:534173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictruth.com"; sid:534174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicventures.com"; sid:534175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviral.com"; sid:534176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwealth.com"; sid:534177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicy.com"; sid:534178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicyelpreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicyelpreviews.com"; sid:534179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandypandemic.com"; sid:534180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panepidemic.com"; sid:534181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicpandemicservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicpandemicservices.com"; sid:534182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentthroughpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentthroughpandemic.com"; sid:534183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paterson-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paterson-coronavirus.com"; sid:534184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patientzerowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patientzerowuhan.com"; sid:534185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pegasuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pegasuscorona.com"; sid:534186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penningapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penningapandemic.com"; sid:534187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaciecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaciecoronavirus.com"; sid:534188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcovid.com"; sid:534189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pikecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pikecovid19.com"; sid:534190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovid.com"; sid:534191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pleasurepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pleasurepandemic.com"; sid:534192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiglassanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiglassanticoronavirus.com"; sid:534193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plieagainstpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plieagainstpandemics.com"; sid:534194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-coronasociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-coronasociety.com"; sid:534195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasyndrome.com"; sid:534196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.club"; sid:534197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poundagainstpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poundagainstpandemics.com"; sid:534198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pray4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pray4corona.com"; sid:534199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepandemicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepandemicplan.com"; sid:534200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevcovid19.com"; sid:534201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirus.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirus.uk"; sid:534202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.club"; sid:534203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.life"; sid:534204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid-19.net"; sid:534205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.net"; sid:534206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.network"; sid:534207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.today"; sid:534208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.world"; sid:534209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingpandemics.com"; sid:534210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for project-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"project-covid.com"; sid:534211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionmaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionmaskcorona.com"; sid:534212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmeagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmeagainstcorona.com"; sid:534213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologosfrentealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologosfrentealcovid.com"; sid:534214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psy-solidaires-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psy-solidaires-covid.com"; sid:534215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qsafe-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qsafe-covid19.com"; sid:534216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qsafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qsafecovid19.com"; sid:534217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quashcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quashcoronavirus.com"; sid:534218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quashcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quashcovid19.com"; sid:534219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queuesafe-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queuesafe-covid19.com"; sid:534220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queuesafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queuesafecovid19.com"; sid:534221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raleighbeatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raleighbeatscovid19.com"; sid:534222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidscreen.com"; sid:534223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidscreens.com"; sid:534224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtests.com"; sid:534225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtests.net"; sid:534226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronaestimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronaestimate.com"; sid:534227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtechcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtechcovid19help.com"; sid:534228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecoronagraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecoronagraphs.com"; sid:534229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recorona.com"; sid:534230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovercoronavirus.com"; sid:534231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovercovid.com"; sid:534232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcoronavirus.com"; sid:534233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remember-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remember-coronavirus.com"; sid:534234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repo4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repo4covid19.com"; sid:534235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repository4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repository4covid19.com"; sid:534236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for researchcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"researchcovid-19.com"; sid:534237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romania-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romania-coronavirus.com"; sid:534238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rosscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rosscovid.com"; sid:534239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ru-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ru-coronavirus.com"; sid:534240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rumahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rumahcorona.com"; sid:534241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovid19.com"; sid:534242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefromcovid-19.com"; sid:534243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safenowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safenowcoronavirus.com"; sid:534244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeshoppingduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeshoppingduringcoronavirus.com"; sid:534245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazione-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazione-coronavirus.com"; sid:534246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecovid19.com"; sid:534247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecorona.net"; sid:534248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovid.com"; sid:534249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizercorona.com"; sid:534250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid-2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid-2.net"; sid:534251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid.com"; sid:534252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynotocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynotocovid.com"; sid:534253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavloans.com"; sid:534254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcoronavirus.club"; sid:534255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcovid-19.com"; sid:534256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcovid19.com"; sid:534257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scurrycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scurrycovid.com"; sid:534258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sd26covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sd26covid19.com"; sid:534259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secure-accovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secure-accovid.com"; sid:534260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendmeacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendmeacovid19test.com"; sid:534261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendmeacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendmeacovidtest.com"; sid:534262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendmethecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendmethecovid19test.com"; sid:534263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendmethecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendmethecovidtest.com"; sid:534264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seriserwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seriserwuhan.com"; sid:534265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgna-covid-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgna-covid-response.com"; sid:534266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shelterinplacecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shelterinplacecoronavirus.com"; sid:534267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shelterinplacecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shelterinplacecovid19.com"; sid:534268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronaapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronaapparel.com"; sid:534269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldisendacovid19.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldisendacovid19.email"; sid:534270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldisentacovid19email.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldisentacovid19email.com"; sid:534271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shpcovid19.com"; sid:534272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sielcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sielcovid19.com"; sid:534273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalcovid.com"; sid:534274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsforcoronavirus.com"; sid:534275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsforcovid19.com"; sid:534276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartpandemicprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartpandemicprep.com"; sid:534277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidarioscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidarioscovid19.com"; sid:534278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solution-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solution-coronavirus.com"; sid:534279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionsforcovid.com"; sid:534280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionsforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionsforcovid.net"; sid:534281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscoronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscoronavirus.pro"; sid:534282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-pandemic.com"; sid:534283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sospandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sospandemic.com"; sid:534284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportspandemic.com"; sid:534285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spotcorona.com"; sid:534286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotcovid-19.com"; sid:534287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsvscovid19.com"; sid:534288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stateofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stateofcovid.com"; sid:534289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycoronavirussafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycoronavirussafe.com"; sid:534290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stealthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stealthcorona.com"; sid:534291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stealthcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stealthcoronavirus.com"; sid:534292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stockpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stockpandemic.com"; sid:534293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona2020.com"; sid:534294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona-in-europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona-in-europe.com"; sid:534295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronapandemic.com"; sid:534296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusinfo.com"; sid:534297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19today.com"; sid:534298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid2020.com"; sid:534299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.net"; sid:534300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopitcorona.com"; sid:534301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-pandemic.com"; sid:534302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppandemics.com"; sid:534303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storyofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storyofcovid19.com"; sid:534304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportbusinesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportbusinesscovid19.com"; sid:534305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalcovid-19.com"; sid:534306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecorona.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecorona.media"; sid:534307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovid19.net"; sid:534308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid19.net"; sid:534309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirus2020.com"; sid:534310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecoronapocolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecoronapocolypse.com"; sid:534311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorofthecorona.com"; sid:534312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcorona.com"; sid:534313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcoronaflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcoronaflu.com"; sid:534314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcorona-virus.com"; sid:534315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcovid19flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcovid19flu.com"; sid:534316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcovid-19virus.com"; sid:534317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacklecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacklecovid.com"; sid:534318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tailsofcorona.dog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tailsofcorona.dog"; sid:534319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takipcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takipcorona.com"; sid:534320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesofcovid-19.com"; sid:534321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapin-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapin-covid.com"; sid:534322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid19survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid19survivor.net"; sid:534323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techhealthcovid.com"; sid:534324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techhealthforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techhealthforcovid.com"; sid:534325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecommutingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecommutingcovid19.com"; sid:534326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid.com"; sid:534327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellcoronabye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellcoronabye.com"; sid:534328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellcorona.com"; sid:534329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirus19.com"; sid:534330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidnow.com"; sid:534331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-for-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-for-covid-19.com"; sid:534332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovids19.com"; sid:534333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmeforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmeforcoronavirus.com"; sid:534334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testonlinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testonlinecovid-19.com"; sid:534335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texasbackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texasbackcovid19.com"; sid:534336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidcheck.com"; sid:534337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thailandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thailandcovid19.com"; sid:534338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theartofwaroncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theartofwaroncoronavirus.com"; sid:534339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona19-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona19-virus.com"; sid:534340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachronicles.net"; sid:534341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacopingcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacopingcourse.com"; sid:534342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacreative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacreative.com"; sid:534343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadepression.com"; sid:534344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafreeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafreeze.com"; sid:534345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahour.com"; sid:534346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronajournal.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronajournal.fyi"; sid:534347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakitchen.com"; sid:534348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalight.com"; sid:534349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-logs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-logs.com"; sid:534350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapodcast.com"; sid:534351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapodcast.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapodcast.life"; sid:534352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapodcast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapodcast.net"; sid:534353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapuzzle.com"; sid:534354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashow.com"; sid:534355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatimesjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatimesjournal.com"; sid:534356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscharity.com"; sid:534357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruschronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruschronicles.com"; sid:534358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusclassroom.com"; sid:534359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusconspiracy.com"; sid:534360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdepression.com"; sid:534361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdisinfectant.com"; sid:534362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruseconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruseconomy.com"; sid:534363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushackathon.com"; sid:534364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruskids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruskids.com"; sid:534365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusshop.com"; sid:534366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusworkout.com"; sid:534367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19conspiracy.com"; sid:534368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19daily.com"; sid:534369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19diet.com"; sid:534370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19fund.com"; sid:534371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19initiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19initiative.com"; sid:534372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19initiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19initiative.net"; sid:534373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.life"; sid:534374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19relief.com"; sid:534375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19shot.com"; sid:534376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19solution.com"; sid:534377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19tracker.com"; sid:534378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19workout.com"; sid:534379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchronicle.com"; sid:534380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconspiracy.com"; sid:534381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcopingcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcopingcourse.com"; sid:534382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddaily.com"; sid:534383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddailylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddailylife.com"; sid:534384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddiary.com"; sid:534385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddiet.com"; sid:534386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovideconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovideconomy.com"; sid:534387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinitiative.com"; sid:534388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinitiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinitiative.net"; sid:534389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlocal.com"; sid:534390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmask.com"; sid:534391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmom.com"; sid:534392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnews.com"; sid:534393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnews.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnews.today"; sid:534394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidoperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidoperation.com"; sid:534395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshop.com"; sid:534396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstore.com"; sid:534397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtestkit.com"; sid:534398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtheory.com"; sid:534399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwarrior.com"; sid:534400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidway.com"; sid:534401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedailycoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedailycoronanews.com"; sid:534402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedailycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedailycoronavirus.com"; sid:534403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.club"; sid:534404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.email"; sid:534405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.life"; sid:534406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.network"; sid:534407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.services"; sid:534408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.world"; sid:534409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatpandemic2020.com"; sid:534410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehappycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehappycorona.com"; sid:534411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelocalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelocalcovid.com"; sid:534412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themomcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themomcovid.com"; sid:534413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemic2020.com"; sid:534414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapycoronavirus.com"; sid:534415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimeofcorona.com"; sid:534416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiscovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiscovidlife.com"; sid:534417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tips-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tips-coronavirus.com"; sid:534418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayscovid.com"; sid:534419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontraelcoronavirus.com"; sid:534420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontraelcovid.com"; sid:534421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronamasks.com"; sid:534422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronamasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronamasks.net"; sid:534423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocoronavirustherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocoronavirustherapy.com"; sid:534424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocovid19.com"; sid:534425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontointheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontointheageofcovid.com"; sid:534426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovid.com"; sid:534427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcoronaviruses.com"; sid:534428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trade-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trade-corona.com"; sid:534429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traselcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traselcoronavirus.com"; sid:534430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treating-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treating-corona.com"; sid:534431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentofcorona.com"; sid:534432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronavirusvaccine.com"; sid:534433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpvscorona.com"; sid:534434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tsepcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tsepcoronavirus.com"; sid:534435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuvcovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuvcovid19rapidtest.com"; sid:534436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucovid.com"; sid:534437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcorona.com"; sid:534438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronafacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronafacemask.com"; sid:534439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronahometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronahometest.com"; sid:534440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronamask.com"; sid:534441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronastats.com"; sid:534442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uk-coronavirus-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uk-coronavirus-advice.com"; sid:534443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukpandemic.com"; sid:534444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimate-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimate-corona.com"; sid:534445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undercovid.com"; sid:534446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniteagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniteagainstcorona.com"; sid:534447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatesofamericacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatesofamericacovid19.com"; sid:534448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unityduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unityduringpandemic.com"; sid:534449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us2020pandemic.com"; sid:534450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us2020pandemic.net"; sid:534451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscheck.com"; sid:534452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemic2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemic2020.net"; sid:534453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usvscoronavirus.com"; sid:534454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uwcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uwcovidresponse.com"; sid:534455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationcovid19.net"; sid:534456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid-19fundraisingforresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid-19fundraisingforresearch.com"; sid:534457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid-19.net"; sid:534458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinacontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinacontracorona.com"; sid:534459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinacorona.com"; sid:534460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencercovid19.com"; sid:534461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilator-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilator-coronavirus.com"; sid:534462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorcoronavirus.com"; sid:534463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verdadescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verdadescoronavirus.com"; sid:534464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizon19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizon19covid.com"; sid:534465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizon-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizon-covid19.com"; sid:534466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncovid-19.com"; sid:534467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncovid19.com"; sid:534468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for video-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"video-coronavirus.com"; sid:534469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for violoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"violoncoronavirus.com"; sid:534470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacovid19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacovid19sanitize.com"; sid:534471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualcorona.com"; sid:534472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viva-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viva-corona.com"; sid:534473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteercorona.com"; sid:534474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warncovid-19.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warncovid-19.services"; sid:534475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warroomcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warroomcorona.com"; sid:534476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warroomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warroomcoronavirus.com"; sid:534477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washawaycovid19.com"; sid:534478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waystosurvivecovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waystosurvivecovid20.com"; sid:534479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesccovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesccovid19.net"; sid:534480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wfh-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wfh-covid-19.com"; sid:534481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wfhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wfhcovid19.com"; sid:534482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoifihavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoifihavecorona.com"; sid:534483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereismycoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereismycoronacheck.com"; sid:534484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereismycoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereismycoronaviruscheck.com"; sid:534485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheresmycoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheresmycoronaviruscheck.com"; sid:534486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheresthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheresthecorona.com"; sid:534487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocoronavirusinfo.com"; sid:534488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocoronavirusinformation.com"; sid:534489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid-19info.com"; sid:534490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid19info.com"; sid:534491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid-19information.com"; sid:534492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid19information.com"; sid:534493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascorona.net"; sid:534494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wigegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wigegencorona.com"; sid:534495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wiki-ncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wiki-ncovid19.com"; sid:534496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willicatchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willicatchcorona.com"; sid:534497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willicatchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willicatchcoronavirus.com"; sid:534498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winterpandemic.com"; sid:534499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthecovid.com"; sid:534500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wirgegecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wirgegecorona.com"; sid:534501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wirgegncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wirgegncorona.com"; sid:534502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisdompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisdompandemic.com"; sid:534503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for work-remotely-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"work-remotely-covid19.com"; sid:534504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workremotelycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workremotelycovid19.com"; sid:534505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronacure.com"; sid:534506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronainfo.com"; sid:534507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronasvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronasvirus.com"; sid:534508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaviruses.com"; sid:534509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirususa.com"; sid:534510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19.com"; sid:534511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worstepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worstepidemic.com"; sid:534512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worstpandemic.com"; sid:534513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wowcorona.com"; sid:534514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpcovidcounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpcovidcounter.com"; sid:534515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuflupandemic.com"; sid:534516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan2020.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan2020.win"; sid:534517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanarms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanarms.com"; sid:534518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbat.com"; sid:534519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancrews.com"; sid:534520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangb.com"; sid:534521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmarket.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmarket.net"; sid:534522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpatientzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpatientzero.com"; sid:534523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-virus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-virus.biz"; sid:534524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwenyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwenyi.com"; sid:534525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwhiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwhiskey.com"; sid:534526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwhisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwhisky.com"; sid:534527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xijinping-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xijinping-covid-19.com"; sid:534528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-entschdigung-swb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-entschdigung-swb.com"; sid:534529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronaentschdigung-wtb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronaentschdigung-wtb.com"; sid:534530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-firmen-untersttzung-j0c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-firmen-untersttzung-j0c.com"; sid:534531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--desinfecaocoronavirus-83b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--desinfecaocoronavirus-83b.com"; sid:534532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--frdermittel-corona-d3b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--frdermittel-corona-d3b.com"; sid:534533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofcoronavirus.com"; sid:534534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yotuvecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yotuvecoronavirus.com"; sid:534535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yotuvecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yotuvecoronavirus.net"; sid:534536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronalawyer.com"; sid:534537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronastories.com"; sid:534538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yousurvivedthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yousurvivedthecoronavirus.com"; sid:534539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yovivielcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yovivielcoronavirus.com"; sid:534540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yovivielcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yovivielcoronavirus.net"; sid:534541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeal4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeal4coronavirus.com"; sid:534542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeal4coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeal4coronavirus.net"; sid:534543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zendesk-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zendesk-covid.com"; sid:534544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10mincovidtest.com"; sid:534545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14daycoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14daycoronachallenge.com"; sid:534546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidtest.com"; sid:534547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19nocovidminutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19nocovidminutes.com"; sid:534548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-19.com"; sid:534549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidvirus.com"; sid:534550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020globalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020globalcovid19.com"; sid:534551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020globalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020globalcovid.com"; sid:534552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020homecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020homecorona.com"; sid:534553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020theyearofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020theyearofcovid-19.com"; sid:534554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21stcenturypandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21stcenturypandemicsurvivor.com"; sid:534555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 503covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"503covid.com"; sid:534556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 772coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"772coronavirus.com"; sid:534557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abingdoncoronaresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abingdoncoronaresponse.com"; sid:534558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for academycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"academycorona.com"; sid:534559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronavirus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronavirus-covid-19.com"; sid:534560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aecovid.com"; sid:534561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affectedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affectedbycorona.com"; sid:534562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.net"; sid:534563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-coronavirus.com"; sid:534564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19.biz"; sid:534565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcoronashop.com"; sid:534566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ai4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ai4covid.com"; sid:534567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidforcorona.com"; sid:534568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aiforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aiforcovid.com"; sid:534569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-coronavirus.com"; sid:534570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertscoronavirus.com"; sid:534571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronanews.com"; sid:534572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcountycoronaviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcountycoronaviruscleanup.com"; sid:534573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronabusters.com"; sid:534574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaversuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaversuscorona.com"; sid:534575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amisickwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amisickwithcorona.com"; sid:534576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amisickwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amisickwithcovid19.com"; sid:534577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amourauxtempsducorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amourauxtempsducorona.com"; sid:534578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for animalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"animalcovid19.com"; sid:534579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamaster.com"; sid:534580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronashop.com"; sid:534581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronasupplies.com"; sid:534582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronasupplies.com"; sid:534583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronathings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronathings.com"; sid:534584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavid-19.com"; sid:534585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusla.com"; sid:534586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkits.com"; sid:534587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.pro"; sid:534588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.pro"; sid:534589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antisepticos-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antisepticos-coronavirus.com"; sid:534590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antisepticos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antisepticos-covid19.com"; sid:534591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingbutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingbutcorona.com"; sid:534592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anywheremathactivitiesforparentsamidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anywheremathactivitiesforparentsamidcovid-19.com"; sid:534593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apscovid-19.com"; sid:534594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyouacoronavirusasshole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyouacoronavirusasshole.com"; sid:534595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofcovid19.com"; sid:534596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artpandemic.com"; sid:534597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcovid19.com"; sid:534598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assocovid19.com"; sid:534599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athome-coronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athome-coronavirustest.com"; sid:534600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athome-coronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athome-coronavirustesting.com"; sid:534601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcovidhoops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcovidhoops.com"; sid:534602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autodealercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autodealercovid.com"; sid:534603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotestcoronavirus.com"; sid:534604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for averiascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"averiascoronavirus.com"; sid:534605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avigancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avigancovid.com"; sid:534606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidecoronavirus.com"; sid:534607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacomercioscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacomercioscoronavirus.com"; sid:534608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babiesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babiesofcoronavirus.com"; sid:534609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecovid-19.com"; sid:534610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcyaftercorona.com"; sid:534611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcycorona.com"; sid:534612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcycoronavirus.com"; sid:534613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcycovid19.com"; sid:534614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayhealthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayhealthcovid19.com"; sid:534615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayhealthcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayhealthcovid19.net"; sid:534616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bccovid.com"; sid:534617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcorona.com"; sid:534618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid19.com"; sid:534619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidnow.com"; sid:534620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belleviewcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belleviewcovid19.com"; sid:534621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beoutcorona.com"; sid:534622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronasalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronasalivatest.com"; sid:534623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bienestarencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bienestarencovid19.com"; sid:534624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgateswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgateswuhan.com"; sid:534625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biobestcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biobestcovid19testing.com"; sid:534626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biowarpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biowarpandemic.com"; sid:534627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blokkx-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blokkx-covid19.com"; sid:534628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bogalusacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bogalusacovid19.com"; sid:534629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bossiercovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bossiercovidrelief.com"; sid:534630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcorona.com"; sid:534631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovid.com"; sid:534632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for britishcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"britishcovid19.com"; sid:534633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildcoronavirushospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildcoronavirushospital.com"; sid:534634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulletproofyourselffromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulletproofyourselffromcoronavirus.com"; sid:534635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessbattlescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessbattlescorona.com"; sid:534636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessideascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessideascovid19.com"; sid:534637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessrecoveryaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessrecoveryaftercovid-19.com"; sid:534638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronacheck.com"; sid:534639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronachecknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronachecknow.com"; sid:534640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronatestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronatestnow.com"; sid:534641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidtest.com"; sid:534642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebye-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebye-corona.com"; sid:534643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabusinesscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabusinesscoronavirus.com"; sid:534644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabusinessesaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabusinessesaftercovid-19.com"; sid:534645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabusinessessurvivingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabusinessessurvivingcovid-19.com"; sid:534646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabusinessrecoveryaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabusinessrecoveryaftercoronavirus.com"; sid:534647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabusinessrecoverycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabusinessrecoverycoronavirus.com"; sid:534648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronaloan.com"; sid:534649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronaviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronaviruscleanup.com"; sid:534650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cairnscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cairnscoronavirus.com"; sid:534651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiabusinesscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiabusinesscoronavirus.com"; sid:534652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiabusinessesaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiabusinessesaftercovid-19.com"; sid:534653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiabusinessessurvivingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiabusinessessurvivingcovid-19.com"; sid:534654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiabusinessrecoveryaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiabusinessrecoveryaftercoronavirus.com"; sid:534655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiabusinessrecoverycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiabusinessrecoverycoronavirus.com"; sid:534656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaloan.com"; sid:534657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidassistance.com"; sid:534658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidhelpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidhelpcenter.com"; sid:534659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidreliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidreliefcenter.com"; sid:534660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidrelief.com"; sid:534661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callmecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callmecovid.com"; sid:534662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmduringcovid.com"; sid:534663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canada-alert-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canada-alert-covid19.com"; sid:534664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstcovid19.com"; sid:534665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsforcovid.com"; sid:534666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecoronavirus.com"; sid:534667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caronacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caronacovid.com"; sid:534668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartascorona.com"; sid:534669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19.com"; sid:534670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronasafe.com"; sid:534671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronasafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronasafe.net"; sid:534672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cesdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cesdacovid19.com"; sid:534673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengecovid19.com"; sid:534674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengingcorona.com"; sid:534675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charcovid19.com"; sid:534676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecorona.com"; sid:534677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheerscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheerscorona.com"; sid:534678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19cleaning.com"; sid:534679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronamedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronamedical.com"; sid:534680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirus.net"; sid:534681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesewuhanvirus.com"; sid:534682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-cureforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-cureforcoronavirus.com"; sid:534683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-treatmentforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-treatmentforcoronavirus.com"; sid:534684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclingcoronavirus.com"; sid:534685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chupacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chupacorona.com"; sid:534686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovid19.com"; sid:534687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncovid.com"; sid:534688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean4covid.com"; sid:534689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanmycorona.com"; sid:534690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleansecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleansecorona.com"; sid:534691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleansecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleansecovid19.com"; sid:534692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovidalocacaducul.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovidalocacaducul.net"; sid:534693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codevscovid19.com"; sid:534694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecorona.com"; sid:534695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colormecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colormecovid.com"; sid:534696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatthecoronavirus.com"; sid:534697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitypandemicsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitypandemicsupport.com"; sid:534698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comoprevenircoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comoprevenircoronavirus.com"; sid:534699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concertcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concertcorona.com"; sid:534700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecoronatesting.com"; sid:534701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectduringcovid19.com"; sid:534702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copewithcovid19.com"; sid:534703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coping-withcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coping-withcorona.com"; sid:534704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornaviruspandemictherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornaviruspandemictherapy.com"; sid:534705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona10minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona10minutetest.com"; sid:534706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19attorney.com"; sid:534707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cleaners.com"; sid:534708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19disinfectant.com"; sid:534709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19grants.com"; sid:534710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19hometest.com"; sid:534711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19justice.com"; sid:534712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19shop.com"; sid:534713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19virus.com"; sid:534714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19virusremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19virusremedy.com"; sid:534715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvocate.com"; sid:534716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaah.com"; sid:534717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid2020.com"; sid:534718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaangsthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaangsthilfe.com"; sid:534719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaap.com"; sid:534720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbeit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbeit.com"; sid:534721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaargentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaargentina.com"; sid:534722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassistanceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassistanceprogram.com"; sid:534723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-awards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-awards.com"; sid:534724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawards.com"; sid:534725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-b2b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-b2b.com"; sid:534726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bankruptcy.com"; sid:534727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beratung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beratung.net"; sid:534728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeschermkapjes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeschermkapjes.com"; sid:534729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabloodtests.com"; sid:534730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessaffect.com"; sid:534731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessaffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessaffects.com"; sid:534732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessrelief.com"; sid:534733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessstrategy.com"; sid:534734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesssupport.com"; sid:534735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesssurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesssurvival.com"; sid:534736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesstaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesstaxcredit.com"; sid:534737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabux.com"; sid:534738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuy.com"; sid:534739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabin.com"; sid:534740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cafe.com"; sid:534741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-calculator.com"; sid:534742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacallers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacallers.com"; sid:534743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamgirls.com"; sid:534744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanarias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanarias.com"; sid:534745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanceled2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanceled2020.com"; sid:534746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cancellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cancellation.com"; sid:534747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancellation.com"; sid:534748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cancellation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cancellation.net"; sid:534749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancellation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancellation.net"; sid:534750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancelled2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancelled2020.com"; sid:534751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-care.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-care.net"; sid:534752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarenm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarenm.com"; sid:534753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasestudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasestudy.com"; sid:534754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasestudy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasestudy.net"; sid:534755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashcure.com"; sid:534756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacash.net"; sid:534757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasts.com"; sid:534758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationtime.com"; sid:534759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacave2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacave2020.com"; sid:534760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaves.com"; sid:534761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacavetwentytwenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacavetwentytwenty.com"; sid:534762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacensus.com"; sid:534763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachanceme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachanceme.com"; sid:534764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecktests.com"; sid:534765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachezsoi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachezsoi.com"; sid:534766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniken.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniken.net"; sid:534767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaciao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaciao.com"; sid:534768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsline.com"; sid:534769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclapback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclapback.com"; sid:534770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclap.com"; sid:534771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassical.com"; sid:534772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassof2020.com"; sid:534773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearmask.com"; sid:534774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclinicaltrials.com"; sid:534775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktailclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktailclub.com"; sid:534776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombo.com"; sid:534777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomparison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomparison.com"; sid:534778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcertcalendar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcertcalendar.com"; sid:534779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcertcalendar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcertcalendar.net"; sid:534780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainmentcooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainmentcooking.com"; sid:534781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoveragelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoveragelaw.com"; sid:534782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19pamdemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19pamdemic.com"; sid:534783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrack19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrack19.com"; sid:534784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crafters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crafters.com"; sid:534785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraftersmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraftersmarketplace.com"; sid:534786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrime.com"; sid:534787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisismanagement.com"; sid:534788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis.net"; sid:534789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacsr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacsr.com"; sid:534790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaction.com"; sid:534791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacura.com"; sid:534792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurerelief.com"; sid:534793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadamages.com"; sid:534794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-data.com"; sid:534795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatascraper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatascraper.com"; sid:534796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatscraper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatscraper.com"; sid:534797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-daze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-daze.com"; sid:534798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtaid.com"; sid:534799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtassistance.com"; sid:534800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebthelp.com"; sid:534801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtlegalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtlegalaid.com"; sid:534802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtlegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtlegal.com"; sid:534803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetectionkit.com"; sid:534804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadied.com"; sid:534805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-digital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-digital.com"; sid:534806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisco.net"; sid:534807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-discounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-discounts.com"; sid:534808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscover.com"; sid:534809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasetestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasetestkit.com"; sid:534810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadna.com"; sid:534811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocopper.com"; sid:534812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoctor.net"; sid:534813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoestexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoestexas.com"; sid:534814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoktor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoktor.com"; sid:534815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonnie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonnie.com"; sid:534816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonors.com"; sid:534817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronads.com"; sid:534818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeco.com"; sid:534819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeg.com"; sid:534820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelementary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelementary.com"; sid:534821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyusa.com"; sid:534822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeruption.com"; sid:534823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaestilo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaestilo.com"; sid:534824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexodus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexodus.com"; sid:534825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacilities.com"; sid:534826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fake-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fake-news.com"; sid:534827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafarm.com"; sid:534828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashions.com"; sid:534829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeverinvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeverinvest.com"; sid:534830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafilters.com"; sid:534831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafitmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafitmom.com"; sid:534832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-flightrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-flightrefund.com"; sid:534833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-flugerstattung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-flugerstattung.com"; sid:534834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerdermittel.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerdermittel.biz"; sid:534835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerderung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerderung.com"; sid:534836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforlaypeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforlaypeople.com"; sid:534837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrage.net"; sid:534838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecheck.com"; sid:534839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedays.com"; sid:534840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesince2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesince2020.com"; sid:534841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreestuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreestuff.com"; sid:534842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetest.com"; sid:534843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundraiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundraiser.com"; sid:534844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundraising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundraising.com"; sid:534845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagapyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagapyear.com"; sid:534846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-garden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-garden.com"; sid:534847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagarden.com"; sid:534848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagen.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagen.biz"; sid:534849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronager.com"; sid:534850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagers.com"; sid:534851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaghty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaghty.com"; sid:534852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalmap.com"; sid:534853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoals.com"; sid:534854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagohome.com"; sid:534855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gone.com"; sid:534856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrads.com"; sid:534857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaber.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaber.net"; sid:534858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahacking.com"; sid:534859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hacks.com"; sid:534860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahacks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahacks.net"; sid:534861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahairsalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahairsalon.com"; sid:534862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcrisis.com"; sid:534863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helfer.com"; sid:534864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelphub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelphub.com"; sid:534865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpmap.com"; sid:534866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroes.net"; sid:534867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeeducation.com"; sid:534868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomehomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomehomeschooling.com"; sid:534869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschoolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschoolers.com"; sid:534870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschoolers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschoolers.net"; sid:534871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschool.net"; sid:534872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homies.com"; sid:534873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoody.com"; sid:534874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahostage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahostage.com"; sid:534875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahowto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahowto.com"; sid:534876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahukuku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahukuku.com"; sid:534877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiahelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiahelpline.com"; sid:534878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfection.net"; sid:534879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjurylaw.com"; sid:534880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-injury-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-injury-lawyers.com"; sid:534881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainmemorial.com"; sid:534882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainpakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainpakistan.com"; sid:534883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsolvency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsolvency.com"; sid:534884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainstruct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainstruct.com"; sid:534885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsulationtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsulationtv.com"; sid:534886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterest.com"; sid:534887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterview.com"; sid:534888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisolationeffecthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisolationeffecthelp.com"; sid:534889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisover.com"; sid:534890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajmana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajmana.com"; sid:534891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajulega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajulega.com"; sid:534892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajunction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajunction.com"; sid:534893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarate.com"; sid:534894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsus.com"; sid:534895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilledmyseason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilledmyseason.com"; sid:534896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitplus.com"; sid:534897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitusa.com"; sid:534898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitus.com"; sid:534899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakompensation.com"; sid:534900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kredithilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kredithilfe.com"; sid:534901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalanddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalanddiaries.com"; sid:534902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatamwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatamwatch.com"; sid:534903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaugh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaugh.com"; sid:534904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawco.com"; sid:534905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawhouston.com"; sid:534906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuithouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuithouston.com"; sid:534907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyersblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyersblog.com"; sid:534908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalgroup.com"; sid:534909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalhelp.net"; sid:534910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifehacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifehacks.com"; sid:534911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliser.com"; sid:534912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalism.com"; sid:534913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigator.com"; sid:534914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivecast.com"; sid:534915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveconcert.com"; sid:534916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivedata.com"; sid:534917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivestatus.com"; sid:534918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalizer.com"; sid:534919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalk.com"; sid:534920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalonely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalonely.com"; sid:534921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloops.com"; sid:534922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapstat.com"; sid:534923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarathon.com"; sid:534924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaroc.com"; sid:534925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr101.com"; sid:534926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr10.com"; sid:534927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr11.com"; sid:534928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr1.com"; sid:534929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr21.com"; sid:534930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr2.com"; sid:534931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr31.com"; sid:534932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr3.com"; sid:534933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr41.com"; sid:534934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr4.com"; sid:534935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr51.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr51.com"; sid:534936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr5.com"; sid:534937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr61.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr61.com"; sid:534938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr6.com"; sid:534939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr71.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr71.com"; sid:534940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr7.com"; sid:534941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr81.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr81.com"; sid:534942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr8.com"; sid:534943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr91.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr91.com"; sid:534944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masr9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masr9.com"; sid:534945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasr.com"; sid:534946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaster.com"; sid:534947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemoirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemoirs.com"; sid:534948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorials.com"; sid:534949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coroname.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coroname.net"; sid:534950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-merch.com"; sid:534951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamindchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamindchange.com"; sid:534952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamommy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamommy.com"; sid:534953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-money.com"; sid:534954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanabestaanden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanabestaanden.com"; sid:534955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanahikaruna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanahikaruna.com"; sid:534956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanavigate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanavigate.com"; sid:534957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoticias.com"; sid:534958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanova.com"; sid:534959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanovena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanovena.com"; sid:534960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanursing.com"; sid:534961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-offer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-offer.com"; sid:534962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoke.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoke.net"; sid:534963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlinestudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlinestudies.com"; sid:534964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ossi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ossi.com"; sid:534965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicpodcast.com"; sid:534966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyline.com"; sid:534967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayments.com"; sid:534968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayroll.com"; sid:534969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersona.com"; sid:534970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaperu.com"; sid:534971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositivenews.com"; sid:534972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositivepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositivepeople.com"; sid:534973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapromo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapromo.com"; sid:534974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionhealth.com"; sid:534975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaptsd.com"; sid:534976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapunch.com"; sid:534977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapure.com"; sid:534978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurge.com"; sid:534979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurify.com"; sid:534980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquake.com"; sid:534981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarentine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarentine.com"; sid:534982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicklook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicklook.com"; sid:534983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicklook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicklook.net"; sid:534984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradar.net"; sid:534985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recoveries.com"; sid:534986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoverytaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoverytaskforce.com"; sid:534987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredbead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredbead.com"; sid:534988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelatives.com"; sid:534989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareleifmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareleifmoney.com"; sid:534990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefassistance.com"; sid:534991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefbubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefbubbles.com"; sid:534992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefgroup.com"; sid:534993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefprogram.com"; sid:534994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremedydaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremedydaddy.com"; sid:534995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremedydude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremedydude.com"; sid:534996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremidydude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremidydude.com"; sid:534997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareport24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareport24.com"; sid:534998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarescueloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarescueloan.com"; sid:534999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsible.com"; sid:535000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevolt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevolt.com"; sid:535001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarinse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarinse.com"; sid:535002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroads.com"; sid:535003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaromance.com"; sid:535004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartgallery.com"; sid:535005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-run.com"; sid:535006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafekit.com"; sid:535007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyco.com"; sid:535008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysupplies.com"; sid:535009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanatorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanatorium.com"; sid:535010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitationcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitationcompany.com"; sid:535011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizing.net"; sid:535012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascenario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascenario.com"; sid:535013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascenarios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascenarios.com"; sid:535014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschoollearn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschoollearn.com"; sid:535015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz24.com"; sid:535016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzmittel.com"; sid:535017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzscheibe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzscheibe.com"; sid:535018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzscheibe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzscheibe.com"; sid:535019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzwand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzwand.com"; sid:535020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascloset.com"; sid:535021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseasonschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseasonschool.com"; sid:535022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasedarona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasedarona.com"; sid:535023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasensus.com"; sid:535024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseries.com"; sid:535025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sex.com"; sid:535026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasguied.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasguied.bid"; sid:535027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashed.com"; sid:535028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoot.com"; sid:535029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashopping.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashopping.net"; sid:535030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shutdown.com"; sid:535031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingle.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingle.co.uk"; sid:535032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmackdown.com"; sid:535033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbizrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbizrelief.com"; sid:535034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbusinessloan.com"; sid:535035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbusinessloans.com"; sid:535036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbusinessreflief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbusinessreflief.com"; sid:535037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmb.com"; sid:535038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sokuhou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sokuhou.com"; sid:535039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoldier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoldier.com"; sid:535040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoldiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoldiers.com"; sid:535041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthcounty.com"; sid:535042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeed.com"; sid:535043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-staatshaftung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-staatshaftung.com"; sid:535044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastagnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastagnation.com"; sid:535045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastaycation2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastaycation2020.com"; sid:535046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastaycation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastaycation.com"; sid:535047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaster.com"; sid:535048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastickersposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastickersposters.com"; sid:535049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluspackage.com"; sid:535050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluspayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluspayment.com"; sid:535051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluspayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluspayments.com"; sid:535052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopping.com"; sid:535053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastore.net"; sid:535054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong20.com"; sid:535055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong.net"; sid:535056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasty.com"; sid:535057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-supply.com"; sid:535058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupport.net"; sid:535059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorusa.com"; sid:535060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasutra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasutra.com"; sid:535061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswabtest.com"; sid:535062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasweep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasweep.com"; sid:535063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakeover.com"; sid:535064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatal.com"; sid:535065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatask.com"; sid:535066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxrefund.com"; sid:535067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateaching.com"; sid:535068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateamsix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateamsix.com"; sid:535069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tes.com"; sid:535070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmiami.com"; sid:535071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathonturkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathonturkiye.com"; sid:535072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatin.com"; sid:535073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizing.com"; sid:535074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatomy.com"; sid:535075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatory.com"; sid:535076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatotals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatotals.com"; sid:535077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatots.com"; sid:535078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatourism.com"; sid:535079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackrd.com"; sid:535080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrainer.com"; sid:535081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelguide.com"; sid:535082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-travelrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-travelrefund.com"; sid:535083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelrestrictions.com"; sid:535084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrend.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrend.net"; sid:535085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrialstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrialstoday.com"; sid:535086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronature.com"; sid:535087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatwerk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatwerk.com"; sid:535088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauncensored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauncensored.com"; sid:535089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateus.com"; sid:535090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausahelp.com"; sid:535091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaut.com"; sid:535092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinate.com"; sid:535093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinate.com"; sid:535094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinatie.com"; sid:535095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccination.net"; sid:535096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavarious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavarious.com"; sid:535097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavclaims.com"; sid:535098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavention.com"; sid:535099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimshelp.com"; sid:535100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictory.net"; sid:535101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidas.com"; sid:535102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-video.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-video.com"; sid:535103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavii.com"; sid:535104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralpodcast.com"; sid:535105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirasdeepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirasdeepcleaning.com"; sid:535106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus10protecion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus10protecion.com"; sid:535107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19drug.com"; sid:535108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19treatment.com"; sid:535109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19vaccine.com"; sid:535110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020cure.com"; sid:535111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-24.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-24.net"; sid:535112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvocaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvocaat.com"; sid:535113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidflorida.com"; sid:535114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidnewyork.com"; sid:535115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidny.com"; sid:535116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-amazon-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-amazon-report.com"; sid:535117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandasthma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandasthma.com"; sid:535118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandus.com"; sid:535119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasisi.com"; sid:535120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassisting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassisting.com"; sid:535121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassitance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassitance.com"; sid:535122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasylumhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasylumhandbook.com"; sid:535123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlas.com"; sid:535124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyflorida.com"; sid:535125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneynyc.com"; sid:535126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauto.com"; sid:535127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautoindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautoindustry.com"; sid:535128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautomobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautomobile.com"; sid:535129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautomobiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautomobiles.com"; sid:535130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankinglaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankinglaw.com"; sid:535131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyattorney.com"; sid:535132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyflorida.com"; sid:535133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcylaw.com"; sid:535134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcylawyers.com"; sid:535135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcymiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcymiami.com"; sid:535136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcy.net"; sid:535137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbearmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbearmarket.com"; sid:535138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbermuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbermuda.com"; sid:535139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirthdefect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirthdefect.com"; sid:535140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirthdefects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirthdefects.com"; sid:535141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbizhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbizhelp.com"; sid:535142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblog.net"; sid:535143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbooster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbooster.com"; sid:535144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakup.com"; sid:535145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrightside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrightside.com"; sid:535146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbullmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbullmarket.com"; sid:535147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesshelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesshelpers.com"; sid:535148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloans.net"; sid:535149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessrescue.com"; sid:535150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessssupport.com"; sid:535151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuynowinflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuynowinflorida.com"; sid:535152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuysellfloridahomessafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuysellfloridahomessafely.com"; sid:535153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscairns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscairns.com"; sid:535154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter.com"; sid:535155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-charity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-charity.com"; sid:535156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschatter.com"; sid:535157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheckstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheckstation.com"; sid:535158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschemicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschemicals.com"; sid:535159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-children-families-helping-n-disasters-nterrorism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-children-families-helping-n-disasters-nterrorism.com"; sid:535160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-children-families-helping-n-disasters-nterrorism.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-children-families-helping-n-disasters-nterrorism.net"; sid:535161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschina19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschina19.com"; sid:535162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschloroquine.com"; sid:535163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschrysalis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschrysalis.com"; sid:535164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanercompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanercompany.com"; sid:535165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningchemicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningchemicals.com"; sid:535166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningchicago.com"; sid:535167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning-company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning-company.com"; sid:535168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningequipment.com"; sid:535169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningkits.com"; sid:535170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmiami.com"; sid:535171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsolution.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsolution.net"; sid:535172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleared.com"; sid:535173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearing.com"; sid:535174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinicaltrials.com"; sid:535175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscol.com"; sid:535176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomeback.com"; sid:535177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedytour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedytour.com"; sid:535178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedytours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedytours.com"; sid:535179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommons.com"; sid:535180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommons.net"; sid:535181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommunity.net"; sid:535182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanies.com"; sid:535183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliance.com"; sid:535184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfidential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfidential.com"; sid:535185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-conspiracy.com"; sid:535186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontent.com"; sid:535187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselors.com"; sid:535188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19tests.com"; sid:535189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreatives.com"; sid:535190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreativity.com"; sid:535191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrypto.com"; sid:535192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuarentena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuarentena.com"; sid:535193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatasets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatasets.com"; sid:535194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdates.com"; sid:535195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dating.com"; sid:535196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatings.com"; sid:535197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathcases.com"; sid:535198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtreliefflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtreliefflorida.com"; sid:535199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationpros.com"; sid:535200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-desinfektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-desinfektion.com"; sid:535201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdestroy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdestroy.com"; sid:535202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetail.com"; sid:535203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-device.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-device.com"; sid:535204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnostic.com"; sid:535205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdielaughing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdielaughing.com"; sid:535206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirectory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirectory.net"; sid:535207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterloanhelp.com"; sid:535208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-disinfection.com"; sid:535209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdistributions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdistributions.com"; sid:535210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdna.com"; sid:535211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonald.com"; sid:535212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdunya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdunya.com"; sid:535213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearnmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearnmoney.com"; sid:535214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecocleaning.com"; sid:535215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentlawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentlawyers.net"; sid:535216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusencordoba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusencordoba.com"; sid:535217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusequipmentrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusequipmentrentals.com"; sid:535218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses-covid-19.com"; sid:535219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesliveaid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesliveaid2020.com"; sid:535220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesq.com"; sid:535221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesreimbursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesreimbursement.com"; sid:535222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesschumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesschumer.com"; sid:535223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacilitycleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacilitycleanup.com"; sid:535224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfalseeconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfalseeconomy.com"; sid:535225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-financialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-financialhelp.com"; sid:535226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialhelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialhelper.com"; sid:535227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancing.com"; sid:535228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridahomesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridahomesales.com"; sid:535229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridarealestateanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridarealestateanswers.com"; sid:535230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridarealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridarealestate.com"; sid:535231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfluvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfluvaccine.com"; sid:535232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundinghelp.com"; sid:535233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgallery.com"; sid:535234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgametour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgametour.com"; sid:535235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgear19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgear19.com"; sid:535236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalimpact.com"; sid:535237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-goodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-goodnews.com"; sid:535238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoodnewsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoodnewsstories.com"; sid:535239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgulfcoasthomesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgulfcoasthomesales.com"; sid:535240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushalloffame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushalloffame.com"; sid:535241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappening.com"; sid:535242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappening.net"; sid:535243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthaides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthaides.com"; sid:535244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthsecrets.com"; sid:535245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushedge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushedge.com"; sid:535246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushedgefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushedgefund.com"; sid:535247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushedgefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushedgefunds.com"; sid:535248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpmemphis.com"; sid:535249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushit.com"; sid:535250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebasedbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebasedbusiness.com"; sid:535251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschoolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschoolers.com"; sid:535252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschoolers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschoolers.net"; sid:535253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschooling.com"; sid:535254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschooling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschooling.net"; sid:535255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushost.com"; sid:535256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushub.net"; sid:535257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushumour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushumour.com"; sid:535258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmuneboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmuneboost.com"; sid:535259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitytest.com"; sid:535260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpeach.com"; sid:535261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpeachtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpeachtrump.com"; sid:535262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincairns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincairns.com"; sid:535263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusind.com"; sid:535264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusineedmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusineedmoney.com"; sid:535265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfluenza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfluenza.com"; sid:535266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfusion.com"; sid:535267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfusion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfusion.net"; sid:535268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsd.com"; sid:535269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintl.com"; sid:535270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestigation.com"; sid:535271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinworld.com"; sid:535272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisopods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisopods.com"; sid:535273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-israel.com"; sid:535274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitalianews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitalianews.com"; sid:535275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjacksonville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjacksonville.net"; sid:535276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjamiedimon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjamiedimon.com"; sid:535277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobloss.com"; sid:535278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjudgment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjudgment.com"; sid:535279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-killers.com"; sid:535280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillers.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillers.pro"; sid:535281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslakewoodranchhomesforsalesafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslakewoodranchhomesforsalesafely.com"; sid:535282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawtampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawtampa.com"; sid:535283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyermiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyermiami.com"; sid:535284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawyers.net"; sid:535285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyertampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyertampa.com"; sid:535286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyertampa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyertampa.net"; sid:535287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslayoffs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslayoffs.net"; sid:535288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaldebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaldebtrelief.com"; sid:535289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaltaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaltaskforce.com"; sid:535290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslessonslearned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslessonslearned.com"; sid:535291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslitigator.com"; sid:535292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslitigators.com"; sid:535293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveaid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveaid20.com"; sid:535294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveaid20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveaid20.net"; sid:535295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivestatus.com"; sid:535296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanconsultant.com"; sid:535297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloan.net"; sid:535298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloansnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloansnow.com"; sid:535299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusluv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusluv.com"; sid:535300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaps.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaps.pro"; sid:535301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmax.com"; sid:535302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medicament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medicament.com"; sid:535303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicament.com"; sid:535304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medicaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medicaments.com"; sid:535305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeditating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeditating.com"; sid:535306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemo.com"; sid:535307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemo.net"; sid:535308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmendoza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmendoza.com"; sid:535309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmijas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmijas.com"; sid:535310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmikepence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmikepence.com"; sid:535311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmish.com"; sid:535312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmixtape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmixtape.com"; sid:535313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.net"; sid:535314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.pro"; sid:535315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgagelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgagelaw.com"; sid:535316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusms.net"; sid:535317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalhealth.com"; sid:535318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewshawk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewshawk.com"; sid:535319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnearme.com"; sid:535320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnz.net"; sid:535321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruso2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruso2.com"; sid:535322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffschoolideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffschoolideas.com"; sid:535323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetesting.com"; sid:535324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopscenter.com"; sid:535325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreaknews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreaknews.com"; sid:535326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutrage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutrage.com"; sid:535327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oxygen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oxygen.com"; sid:535328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspak.com"; sid:535329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspalmcoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspalmcoast.com"; sid:535330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicsupplies.com"; sid:535331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparttimework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparttimework.com"; sid:535332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayments.com"; sid:535333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaymentsnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaymentsnewyork.com"; sid:535334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspay.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspay.net"; sid:535335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeak.com"; sid:535336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspe.com"; sid:535337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeterschiff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeterschiff.com"; sid:535338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphysicianresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphysicianresource.com"; sid:535339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspicture.com"; sid:535340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspins.com"; sid:535341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspods.com"; sid:535342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspool.com"; sid:535343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprivateequity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprivateequity.com"; sid:535344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprogram.com"; sid:535345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprojectprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprojectprotect.com"; sid:535346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantine2020.com"; sid:535347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-quicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-quicktest.com"; sid:535348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrally.com"; sid:535349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreading.com"; sid:535350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecovered.com"; sid:535351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveries.com"; sid:535352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverytampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverytampa.com"; sid:535353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreit.com"; sid:535354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreits.com"; sid:535355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefpayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefpayment.com"; sid:535356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefpayments.com"; sid:535357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefs.com"; sid:535358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrepairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrepairs.com"; sid:535359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-research.com"; sid:535360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchteam.com"; sid:535361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresumes.com"; sid:535362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrevenuerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrevenuerecovery.com"; sid:535363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrounds.com"; sid:535364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafecheck.com"; sid:535365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetycheck.com"; sid:535366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetylist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetylist.com"; sid:535367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussarasota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussarasota.com"; sid:535368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussarasotahomesforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussarasotahomesforsale.com"; sid:535369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussarasotahomesforsalesafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussarasotahomesforsalesafely.com"; sid:535370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscandel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscandel.com"; sid:535371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschiff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschiff.com"; sid:535372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschumer.com"; sid:535373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussectors.com"; sid:535374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfchecktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfchecktest.com"; sid:535375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfswab.com"; sid:535376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseniornews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseniornews.com"; sid:535377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussensus.com"; sid:535378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirts.net"; sid:535379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussiestakeyhomesforsalesafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussiestakeyhomesforsalesafely.com"; sid:535380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussimptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussimptom.com"; sid:535381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussingles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussingles.com"; sid:535382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstaugustine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstaugustine.com"; sid:535383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stayathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stayathome.com"; sid:535384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstayingstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstayingstrong.com"; sid:535385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstemcell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstemcell.com"; sid:535386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstemcelltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstemcelltherapy.com"; sid:535387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluspackage.com"; sid:535388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstl.com"; sid:535389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstress.net"; sid:535390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrikeforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrikeforce.com"; sid:535391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstudies.com"; sid:535392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuckstshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuckstshirts.com"; sid:535393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupports.com"; sid:535394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalapp.com"; sid:535395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survival-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survival-guide.com"; sid:535396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorcommunity.com"; sid:535397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswabtest.com"; sid:535398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-symptome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-symptome.net"; sid:535399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustakeover.com"; sid:535400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxrefund.com"; sid:535401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxsettlement.com"; sid:535402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustec.com"; sid:535403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelecom.com"; sid:535404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustemperature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustemperature.com"; sid:535405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustemporarywork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustemporarywork.com"; sid:535406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestonline.net"; sid:535407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthedonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthedonald.com"; sid:535408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapist.com"; sid:535409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapists.com"; sid:535410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustherapy.com"; sid:535411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimecapsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimecapsule.com"; sid:535412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustogether.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustogether.net"; sid:535413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustotals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustotals.com"; sid:535414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrumptower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrumptower.com"; sid:535415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusukmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusukmap.com"; sid:535416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunchartedterritory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunchartedterritory.com"; sid:535417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunite.com"; sid:535418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateinfo.com"; sid:535419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateinfo.net"; sid:535420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccinate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccinate.com"; sid:535421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvc.com"; sid:535422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvenicehomesforsalesafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvenicehomesforsalesafely.com"; sid:535423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusventurecapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusventurecapital.com"; sid:535424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvstheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvstheworld.com"; sid:535425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarroom.com"; sid:535426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld1st.com"; sid:535427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld1st-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld1st-test.com"; sid:535428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld1sttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld1sttest.com"; sid:535429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld1sttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld1sttests.com"; sid:535430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldbesttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldbesttest.com"; sid:535431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-world-tour-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-world-tour-2020.com"; sid:535432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswuhan2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswuhan2020.com"; sid:535433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxplained.com"; sid:535434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxxxx.com"; sid:535435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyly.com"; sid:535436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavision2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavision2020.com"; sid:535437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivialite.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivialite.net"; sid:535438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoice.net"; sid:535439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoidanceclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoidanceclub.com"; sid:535440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-volunteers.com"; sid:535441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijtest.com"; sid:535442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavstexas.com"; sid:535443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawasjetzt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawasjetzt.com"; sid:535444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaways.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaways.com"; sid:535445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhy.com"; sid:535446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawomen.com"; sid:535447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkoutclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkoutclub.com"; sid:535448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldcrisis.com"; sid:535449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldpeace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldpeace.com"; sid:535450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldpeace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldpeace.net"; sid:535451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawristband.com"; sid:535452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxion.com"; sid:535453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet110.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet110.com"; sid:535454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet11.com"; sid:535455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet1.com"; sid:535456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet20.com"; sid:535457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet2.com"; sid:535458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet31.com"; sid:535459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet3.com"; sid:535460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet41.com"; sid:535461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet4.com"; sid:535462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet52.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet52.com"; sid:535463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet5.com"; sid:535464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet61.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet61.com"; sid:535465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet6.com"; sid:535466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet71.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet71.com"; sid:535467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet7.com"; sid:535468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet81.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet81.com"; sid:535469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet8.com"; sid:535470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet91.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet91.com"; sid:535471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet9.com"; sid:535472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xleet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xleet.com"; sid:535473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxo.com"; sid:535474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxxxcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxxxcam.com"; sid:535475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zombies.com"; sid:535476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coughcoronavirus.com"; sid:535477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countdowncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countdowncorona.com"; sid:535478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covarestaurantsunitetofightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covarestaurantsunitetofightcovid19.com"; sid:535479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10rheum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10rheum.com"; sid:535480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-17.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-17.com"; sid:535481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020end.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020end.com"; sid:535482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid193.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid193.com"; sid:535483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-3d.com"; sid:535484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1984.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1984.net"; sid:535485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-911.com"; sid:535486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19about.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19about.com"; sid:535487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19action.com"; sid:535488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aircleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aircleaner.com"; sid:535489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airpurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airpurification.com"; sid:535490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airpurification.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airpurification.net"; sid:535491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aitech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aitech.com"; sid:535492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andchill.com"; sid:535493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19angels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19angels.com"; sid:535494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19animal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19animal.com"; sid:535495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aovivo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aovivo.com"; sid:535496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apparelshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apparelshop.com"; sid:535497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19asisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19asisi.com"; sid:535498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assess.com"; sid:535499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bayarea-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bayarea-support.com"; sid:535500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beratung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beratung.com"; sid:535501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bind.com"; sid:535502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bioclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bioclean.com"; sid:535503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizrelief.com"; sid:535504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bk.com"; sid:535505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtestkit.com"; sid:535506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtests.com"; sid:535507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bot.com"; sid:535508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bournemouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bournemouth.com"; sid:535509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bridgeloan.com"; sid:535510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brightside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brightside.com"; sid:535511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bucketlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bucketlist.com"; sid:535512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bugun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bugun.com"; sid:535513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloan.com"; sid:535514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloans.com"; sid:535515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buys.com"; sid:535516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cam.com"; sid:535517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capital.com"; sid:535518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careapp.com"; sid:535519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careky.com"; sid:535520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cash.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cash.pro"; sid:535521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chapelhill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chapelhill.com"; sid:535522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cheatsheet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cheatsheet.com"; sid:535523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19china2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19china2020.com"; sid:535524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chloroquine.com"; sid:535525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chloroquine.com"; sid:535526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupco.com"; sid:535527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupco.net"; sid:535528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicaltrial.com"; sid:535529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clinic.com"; sid:535530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cmog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cmog.com"; sid:535531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coaching.com"; sid:535532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comeback.com"; sid:535533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connections.com"; sid:535534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19content.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19content.com"; sid:535535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19continuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19continuity.com"; sid:535536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cuddlebuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cuddlebuddy.com"; sid:535537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cultureevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cultureevolution.com"; sid:535538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curves.com"; sid:535539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cz.com"; sid:535540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dashboard.com"; sid:535541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-dataexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-dataexchange.com"; sid:535542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dataexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dataexchange.com"; sid:535543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19days.com"; sid:535544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathsworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathsworldwide.com"; sid:535545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtassistance.com"; sid:535546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debthelp.com"; sid:535547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationexperts.com"; sid:535548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationservices.com"; sid:535549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentist.com"; sid:535550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentistry.com"; sid:535551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19design.com"; sid:535552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designexchange.com"; sid:535553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19devices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19devices.com"; sid:535554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dezenfektan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dezenfektan.com"; sid:535555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diet19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diet19.com"; sid:535556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digest.com"; sid:535557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectantingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectantingservices.com"; sid:535558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectants.com"; sid:535559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfection.com"; sid:535560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfection.net"; sid:535561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfection.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfection.pro"; sid:535562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dna.com"; sid:535563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dna.com"; sid:535564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dotace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dotace.com"; sid:535565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19driver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19driver.com"; sid:535566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drivers.com"; sid:535567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivers.com"; sid:535568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earnmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earnmoney.com"; sid:535569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlawyers.net"; sid:535570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-end.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-end.com"; sid:535571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19erase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19erase.com"; sid:535572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19esq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19esq.com"; sid:535573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familyhacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familyhacks.com"; sid:535574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fiji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fiji.com"; sid:535575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fiji.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fiji.net"; sid:535576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filters.com"; sid:535577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialaid.com"; sid:535578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialaiddocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialaiddocs.com"; sid:535579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fluvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fluvaccine.com"; sid:535580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fond.com"; sid:535581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19form.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19form.com"; sid:535582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19friendsandfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19friendsandfamily.com"; sid:535583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19frontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19frontline.com"; sid:535584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fun.com"; sid:535585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19garance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19garance.com"; sid:535586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gels.com"; sid:535587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalcrisis.com"; sid:535588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalmap.com"; sid:535589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gloves.com"; sid:535590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gloves.com"; sid:535591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19goodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19goodnews.com"; sid:535592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19goodnewsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19goodnewsstories.com"; sid:535593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goodnewsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goodnewsstories.com"; sid:535594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grant.com"; sid:535595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gt.com"; sid:535596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gymgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gymgear.com"; sid:535597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19headlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19headlines.com"; sid:535598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcaresystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcaresystem.com"; sid:535599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthdiaries.com"; sid:535600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthliteracyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthliteracyproject.com"; sid:535601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthnetwork.com"; sid:535602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsystem.com"; sid:535603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.biz"; sid:535604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpfund.com"; sid:535605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpr.com"; sid:535606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herbs.com"; sid:535607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroes.com"; sid:535608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecareservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecareservices.com"; sid:535609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19home.com"; sid:535610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschool.com"; sid:535611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschoolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschoolers.com"; sid:535612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschoolers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschoolers.net"; sid:535613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschooling.com"; sid:535614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschooling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschooling.net"; sid:535615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeschool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeschool.net"; sid:535616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hyd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hyd.com"; sid:535617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hydroxychloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hydroxychloroquine.com"; sid:535618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19i-ch4ase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19i-ch4ase.com"; sid:535619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-icu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-icu.net"; sid:535620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19idaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19idaho.com"; sid:535621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19il.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19il.com"; sid:535622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuneboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuneboost.com"; sid:535623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunebooster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunebooster.com"; sid:535624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-infections.com"; sid:535625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-info-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-info-center.com"; sid:535626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infocenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infocenter.com"; sid:535627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informa.com"; sid:535628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informasite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informasite.com"; sid:535629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-infos.com"; sid:535630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infusion.com"; sid:535631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infusion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infusion.net"; sid:535632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inindia.com"; sid:535633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injury.com"; sid:535634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injurylawyers.com"; sid:535635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-injury-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-injury-lawyers.com"; sid:535636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ins.com"; sid:535637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttests.com"; sid:535638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-international.com"; sid:535639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inworld.com"; sid:535640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iqvia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iqvia.com"; sid:535641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isolation.com"; sid:535642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobloss.com"; sid:535643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jo.com"; sid:535644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19journal.com"; sid:535645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19justice.com"; sid:535646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepcalm.com"; sid:535647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kidsbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kidsbook.com"; sid:535648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-killers.com"; sid:535649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kit.net"; sid:535650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-la.com"; sid:535651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawblog.com"; sid:535652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.net"; sid:535653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawoffice.com"; sid:535654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuithouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuithouston.com"; sid:535655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lawyers.com"; sid:535656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawyers.com"; sid:535657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19layoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19layoff.com"; sid:535658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lbs.com"; sid:535659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19learning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19learning.com"; sid:535660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalaid.com"; sid:535661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legends.com"; sid:535662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lessonslearned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lessonslearned.com"; sid:535663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigator.com"; sid:535664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigators.com"; sid:535665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livinghistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livinghistory.com"; sid:535666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19location.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19location.com"; sid:535667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19locations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19locations.com"; sid:535668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loveletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loveletters.com"; sid:535669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loveletters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loveletters.net"; sid:535670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mademe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mademe.com"; sid:535671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19madrid.com"; sid:535672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maids.com"; sid:535673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makemoney.com"; sid:535674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manufacturer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manufacturer.com"; sid:535675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manufacturers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manufacturers.com"; sid:535676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-map.net"; sid:535677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-map-tunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-map-tunisie.com"; sid:535678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marsaskala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marsaskala.com"; sid:535679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mc.net"; sid:535680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicina.com"; sid:535681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicina.com"; sid:535682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mn.com"; sid:535683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobiletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobiletest.com"; sid:535684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-money.com"; sid:535685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgage.com"; sid:535686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgageloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgageloans.com"; sid:535687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgage.net"; sid:535688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgageoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgageoptions.com"; sid:535689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgages.com"; sid:535690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19motionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19motionpicture.com"; sid:535691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ms.net"; sid:535692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msp.com"; sid:535693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mugs.com"; sid:535694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19my.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19my.com"; sid:535695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newshawk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newshawk.com"; sid:535696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsletter.com"; sid:535697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19next.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19next.com"; sid:535698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ng.com"; sid:535699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nutrition.com"; sid:535700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nutrition.com"; sid:535701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nv.com"; sid:535702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19office.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19office.com"; sid:535703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offschoolideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offschoolideas.com"; sid:535704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19on.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19on.com"; sid:535705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinetest.com"; sid:535706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinetesting.com"; sid:535707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-org.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-org.com"; sid:535708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreakinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreakinfo.com"; sid:535709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreaknews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreaknews.com"; sid:535710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemia.com"; sid:535711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parttimework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parttimework.com"; sid:535712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payroll.com"; sid:535713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-people.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-people.com"; sid:535714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19percentage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19percentage.com"; sid:535715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photo.com"; sid:535716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicianinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicianinfo.com"; sid:535717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19physicianresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19physicianresources.com"; sid:535718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicianresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicianresources.com"; sid:535719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19picture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19picture.com"; sid:535720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19poll.com"; sid:535721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pounds.com"; sid:535722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pros.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pros.net"; sid:535723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionmask.com"; sid:535724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionsupplies.com"; sid:535725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiveequipment.com"; sid:535726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19provider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19provider.com"; sid:535727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pure.com"; sid:535728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19purge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19purge.com"; sid:535729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qualify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qualify.com"; sid:535730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapidtest.com"; sid:535731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recovered.com"; sid:535732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveries.com"; sid:535733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-refund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-refund.com"; sid:535734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-registry.com"; sid:535735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefloans.com"; sid:535736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefloans.com"; sid:535737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefloans.net"; sid:535738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefpayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefpayment.com"; sid:535739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefpayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefpayment.com"; sid:535740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefpayments.com"; sid:535741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchteam.com"; sid:535742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseact.com"; sid:535743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-response.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-response.net"; sid:535744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rheum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rheum.com"; sid:535745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rights.com"; sid:535746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ri.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ri.net"; sid:535747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rinse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rinse.com"; sid:535748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ro.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ro.info"; sid:535749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19room.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19room.com"; sid:535750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rotaryresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rotaryresponse.com"; sid:535751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19route.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19route.com"; sid:535752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sac.com"; sid:535753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyresources.com"; sid:535754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysupplies.com"; sid:535755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saratoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saratoga.com"; sid:535756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sas.com"; sid:535757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbahelp.com"; sid:535758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbaloansnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbaloansnow.com"; sid:535759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scenarios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scenarios.com"; sid:535760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfemployed.com"; sid:535761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19self-isolate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19self-isolate.com"; sid:535762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19self-isolate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19self-isolate.com"; sid:535763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfswab.com"; sid:535764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seniornews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seniornews.com"; sid:535765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19servicepros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19servicepros.com"; sid:535766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19services.com"; sid:535767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shirtco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shirtco.com"; sid:535768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19si.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19si.com"; sid:535769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19si.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19si.com"; sid:535770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-situation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-situation.com"; sid:535771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-situation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-situation.net"; sid:535772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sl.com"; sid:535773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessrelief.com"; sid:535774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sos.com"; sid:535775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stat.com"; sid:535776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19staysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19staysafe.com"; sid:535777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19staysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19staysafe.com"; sid:535778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimuluspayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimuluspayments.com"; sid:535779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluspayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluspayments.com"; sid:535780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storiesofsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storiesofsurvival.com"; sid:535781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19story.com"; sid:535782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stpaul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stpaul.com"; sid:535783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stress-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stress-test.com"; sid:535784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suministros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suministros.com"; sid:535785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suministros.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suministros.net"; sid:535786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportforbusinesses.com"; sid:535787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survival.net"; sid:535788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalsolution.com"; sid:535789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sverige.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sverige.com"; sid:535790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swabtest.com"; sid:535791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sweden.com"; sid:535792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sweden.com"; sid:535793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-symptoms.com"; sid:535794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19takeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19takeover.com"; sid:535795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19t.com"; sid:535796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19team.com"; sid:535797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19te.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19te.com"; sid:535798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tees.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tees.net"; sid:535799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19temps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19temps.com"; sid:535800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testimonials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testimonials.com"; sid:535801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingsite.com"; sid:535802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-kit.com"; sid:535803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testpack.com"; sid:535804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testsite.com"; sid:535805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tfv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tfv.com"; sid:535806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thebeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thebeast.com"; sid:535807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermometers.com"; sid:535808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19threat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19threat.com"; sid:535809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tips.com"; sid:535810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tmg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tmg.com"; sid:535811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tr.com"; sid:535812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-trials.com"; sid:535813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialsreport.com"; sid:535814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemployment.com"; sid:535815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unite.com"; sid:535816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unite.com"; sid:535817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vacuna.com"; sid:535818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxdev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxdev.com"; sid:535819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxdev.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxdev.net"; sid:535820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-virus-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-virus-check.com"; sid:535821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusclaim.com"; sid:535822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusclaim.net"; sid:535823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusclaims.com"; sid:535824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-virus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-virus-test.com"; sid:535825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitamininfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitamininfusion.com"; sid:535826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vsflu.com"; sid:535827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vstheflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vstheflu.com"; sid:535828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wallofshame.com"; sid:535829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warroom.com"; sid:535830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wash.com"; sid:535831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19webscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19webscreen.com"; sid:535832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19webtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19webtest.com"; sid:535833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weko.com"; sid:535834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worker.com"; sid:535835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workfromhome.com"; sid:535836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xx.com"; sid:535837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yourstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yourstories.com"; sid:535838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019com.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019com.com"; sid:535839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019money.com"; sid:535840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020t.com"; sid:535841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020tee.com"; sid:535842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20testing.com"; sid:535843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2.com"; sid:535844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2test.com"; sid:535845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid42.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid42.com"; sid:535846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid503.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid503.com"; sid:535847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-88.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-88.com"; sid:535848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactive.com"; sid:535849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadjusting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadjusting.com"; sid:535850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvisory.com"; sid:535851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcalm.com"; sid:535852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandyossarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandyossarian.com"; sid:535853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibody.com"; sid:535854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-anti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-anti.com"; sid:535855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantidote.com"; sid:535856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarebuild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarebuild.com"; sid:535857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarebuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarebuilding.com"; sid:535858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidargentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidargentina.com"; sid:535859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarticles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarticles.com"; sid:535860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidascending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidascending.com"; sid:535861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistance4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistance4you.com"; sid:535862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistanceforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistanceforyou.com"; sid:535863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistant.com"; sid:535864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidau.com"; sid:535865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautotest.com"; sid:535866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbangla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbangla.com"; sid:535867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeer.com"; sid:535868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidberevement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidberevement.com"; sid:535869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet.net"; sid:535870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioclean.com"; sid:535871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbox.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbox.net"; sid:535872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslaw.com"; sid:535873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessplanning.com"; sid:535874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrelief.com"; sid:535875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-busters.com"; sid:535876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabaret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabaret.com"; sid:535877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanholder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanholder.com"; sid:535878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantbeatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantbeatus.com"; sid:535879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareer.com"; sid:535880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareky.com"; sid:535881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepacks.com"; sid:535882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarerooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarerooms.com"; sid:535883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatcam.com"; sid:535884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcc.com"; sid:535885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-charity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-charity.com"; sid:535886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchesed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchesed.com"; sid:535887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmas.com"; sid:535888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chronicles.com"; sid:535889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassroom.com"; sid:535890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningspecialist.com"; sid:535891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleans.com"; sid:535892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinical.com"; sid:535893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinical.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinical.net"; sid:535894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoalition.com"; sid:535895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolombia.com"; sid:535896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorado.com"; sid:535897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcom.com"; sid:535898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedies.com"; sid:535899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedy.net"; sid:535900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcom.net"; sid:535901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance.com"; sid:535902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfidential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfidential.com"; sid:535903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnected.com"; sid:535904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractors.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractors.co.uk"; sid:535905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookclub.com"; sid:535906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooking2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooking2020.com"; sid:535907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookingclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookingclub.com"; sid:535908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookout.com"; sid:535909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronatest.com"; sid:535910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostumes.com"; sid:535911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounselling.com"; sid:535912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveragelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveragelaw.com"; sid:535913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-creative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-creative.com"; sid:535914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreative.com"; sid:535915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuddlebuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuddlebuddy.com"; sid:535916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureusa.com"; sid:535917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-curve.com"; sid:535918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-czechia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-czechia.com"; sid:535919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd--19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd--19.com"; sid:535920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatascience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatascience.com"; sid:535921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-date.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-date.com"; sid:535922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeaths.com"; sid:535923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtassistance.com"; sid:535924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtconsolidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtconsolidation.com"; sid:535925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebthelp.com"; sid:535926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtprotection.com"; sid:535927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsolutions.com"; sid:535928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsolutions.net"; sid:535929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diaries.com"; sid:535930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diary.com"; sid:535931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfecting.com"; sid:535932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddying.com"; sid:535933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomicinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomicinjury.com"; sid:535934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecuador.com"; sid:535935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidem.com"; sid:535936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo-19.net"; sid:535937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19.net"; sid:535938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo2020.com"; sid:535939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideochat19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideochat19.com"; sid:535940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideochat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideochat.com"; sid:535941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoproject.com"; sid:535942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoton.com"; sid:535943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideotv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideotv.com"; sid:535944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescape.com"; sid:535945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapes.com"; sid:535946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexplorer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexplorer.com"; sid:535947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpress.com"; sid:535948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyreliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyreliefcenter.com"; sid:535949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashion.com"; sid:535950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialassistance.com"; sid:535951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstresponse.com"; sid:535952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-focus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-focus.com"; sid:535953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfocus.com"; sid:535954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfooddrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfooddrive.com"; sid:535955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebaby.com"; sid:535956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebaby.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebaby.net"; sid:535957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesince2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesince2020.com"; sid:535958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworld.com"; sid:535959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeddon.com"; sid:535960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-generation.com"; sid:535961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovernmentloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovernmentloans.com"; sid:535962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrant.com"; sid:535963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguru.com"; sid:535964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhangouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhangouts.com"; sid:535965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhappyhour.com"; sid:535966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheadline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheadline.com"; sid:535967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheadlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheadlines.com"; sid:535968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealing.com"; sid:535969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp4you.com"; sid:535970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhere.com"; sid:535971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhilfe.com"; sid:535972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschool.com"; sid:535973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschoolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschoolers.com"; sid:535974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschoolers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschoolers.net"; sid:535975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschooling.com"; sid:535976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschooling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschooling.net"; sid:535977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschool.net"; sid:535978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiet19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiet19.com"; sid:535979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidifference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidifference.com"; sid:535980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindonesia.com"; sid:535981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfocenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfocenter.com"; sid:535982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfos.com"; sid:535983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidining.com"; sid:535984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-injury-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-injury-lawyers.com"; sid:535985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinparis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinparis.com"; sid:535986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insurance.com"; sid:535987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsure.com"; sid:535988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocy.com"; sid:535989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiom.com"; sid:535990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioms.com"; sid:535991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot-19.com"; sid:535992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot19.com"; sid:535993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotic.com"; sid:535994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiowa.com"; sid:535995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisco.com"; sid:535996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidist.com"; sid:535997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobloss.com"; sid:535998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kid.com"; sid:535999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-killer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-killer.net"; sid:536000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitchenaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitchenaid.com"; sid:536001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlasuite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlasuite.com"; sid:536002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawblog.com"; sid:536003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawhouston.com"; sid:536004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuithouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuithouston.com"; sid:536005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlbs.com"; sid:536006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearning.com"; sid:536007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalresources.com"; sid:536008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloancenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloancenter.com"; sid:536009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans24.com"; sid:536010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlodging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlodging.com"; sid:536011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloss.com"; sid:536012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmademe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmademe.com"; sid:536013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaplive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaplive.com"; sid:536014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksonline.com"; sid:536015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-medicine.com"; sid:536016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodel.com"; sid:536017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-money.com"; sid:536018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonitoring.com"; sid:536019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mx.com"; sid:536020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneighbour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneighbour.com"; sid:536021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnetwork.com"; sid:536022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnetworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnetworks.com"; sid:536023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsbox.com"; sid:536024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewstoday.com"; sid:536025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nma.com"; sid:536026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnot.com"; sid:536027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covido2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covido2.com"; sid:536028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoke.com"; sid:536029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-one-nine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-one-nine.com"; sid:536030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoperations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoperations.com"; sid:536031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidown.com"; sid:536032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatrol.com"; sid:536033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayroll.com"; sid:536034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacology.com"; sid:536035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphoto.com"; sid:536036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphysicianresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphysicianresource.com"; sid:536037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplay.com"; sid:536038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoker.com"; sid:536039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolice.com"; sid:536040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpounds.com"; sid:536041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppe.com"; sid:536042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivate.com"; sid:536043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-projects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-projects.com"; sid:536044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapid.com"; sid:536045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreboot.com"; sid:536046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebuild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebuild.com"; sid:536047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebuilding.com"; sid:536048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecession2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecession2020.com"; sid:536049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecipes.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecipes.co.uk"; sid:536050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovered.com"; sid:536051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveries.com"; sid:536052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovering.com"; sid:536053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredbead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredbead.com"; sid:536054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief4u.com"; sid:536055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief4you.com"; sid:536056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefbubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefbubbles.com"; sid:536057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcenter.com"; sid:536058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefloan.com"; sid:536059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefloan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefloan.net"; sid:536060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefloans.com"; sid:536061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefloans.net"; sid:536062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremediation.com"; sid:536063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremedies.com"; sid:536064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse19.com"; sid:536065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseact.com"; sid:536066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsible.com"; sid:536067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-results.com"; sid:536068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrising.com"; sid:536069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroom.com"; sid:536070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroom.net"; sid:536071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrounds.com"; sid:536072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroute.com"; sid:536073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsadness.com"; sid:536074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysigns.com"; sid:536075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsan.com"; sid:536076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsc.com"; sid:536077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfassessment.com"; sid:536078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsense.net"; sid:536079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserve.com"; sid:536080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop24.com"; sid:536081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsideoflife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsideoflife.com"; sid:536082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsituation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsituation.com"; sid:536083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslots.com"; sid:536084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinessloan.com"; sid:536085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinessloans.com"; sid:536086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinessrelief.com"; sid:536087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartest.com"; sid:536088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoc.com"; sid:536089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialdistancing.com"; sid:536090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspain.com"; sid:536091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsshield.com"; sid:536092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstays.com"; sid:536093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstockup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstockup.com"; sid:536094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopper.com"; sid:536095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrength.com"; sid:536096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstress.com"; sid:536097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudy.com"; sid:536098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport4u.com"; sid:536099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport4you.com"; sid:536100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-support.net"; sid:536101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsv.com"; sid:536102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswitch.com"; sid:536103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtale.com"; sid:536104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteeshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteeshirt.com"; sid:536105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtell.com"; sid:536106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemps.com"; sid:536107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfinder.com"; sid:536108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testingkit.com"; sid:536109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testkits.com"; sid:536110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnearme.com"; sid:536111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestservices.com"; sid:536112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-thailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-thailand.com"; sid:536113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapist.com"; sid:536114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtizer.com"; sid:536115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtool.com"; sid:536116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtorygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtorygarden.com"; sid:536117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtotals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtotals.com"; sid:536118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrade.com"; sid:536119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduals.com"; sid:536120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemployment.com"; sid:536121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-update.com"; sid:536122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-updates.com"; sid:536123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilator.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilator.co.uk"; sid:536124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvid.com"; sid:536125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoices.com"; sid:536126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoices.net"; sid:536127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaco.com"; sid:536128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldcharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldcharts.com"; sid:536129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidza.com"; sid:536130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzombie.com"; sid:536131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativecovid.com"; sid:536132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesvscorona.com"; sid:536133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityforcovid.com"; sid:536134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditocovid-bancohipotecario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditocovid-bancohipotecario.com"; sid:536135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctrcovid19.com"; sid:536136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cura-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cura-corona.com"; sid:536137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcovid19.com"; sid:536138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyacovid19.com"; sid:536139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damncorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damncorona19.com"; sid:536140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofcorona.com"; sid:536141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofcorona.net"; sid:536142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccovidsitters.com"; sid:536143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcoronavirus.com"; sid:536144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtrelief4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtrelief4coronavirus.com"; sid:536145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtreliefforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtreliefforcoronavirus.com"; sid:536146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deconcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deconcorona.com"; sid:536147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminationcovid19.com"; sid:536148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronafier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronafier.com"; sid:536149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronater.com"; sid:536150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcorona.com"; sid:536151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliveroocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliveroocovid-19.com"; sid:536152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliverycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliverycovid-19.com"; sid:536153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliverycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliverycovid19.com"; sid:536154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalhelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalhelpcoronavirus.com"; sid:536155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistrycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistrycovid-19.com"; sid:536156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistrycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistrycovid19.com"; sid:536157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistrycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistrycovid.com"; sid:536158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistryduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistryduringcovid19.com"; sid:536159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denunciacovidmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denunciacovidmexico.com"; sid:536160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcoronavirus.biz"; sid:536161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid19.biz"; sid:536162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depository-trust-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depository-trust-covid.biz"; sid:536163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depositorytrustcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depositorytrustcovid.biz"; sid:536164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantes-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantes-coronavirus.com"; sid:536165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantes-covid19.com"; sid:536166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroy-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroy-corona.net"; sid:536167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticocoronavirus.com"; sid:536168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dietcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dietcovid.net"; sid:536169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovercovid19.com"; sid:536170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovercovid.com"; sid:536171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectforcoronavirus.com"; sid:536172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectforcovid-19.com"; sid:536173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doitforcovid19.com"; sid:536174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doitforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doitforcovid.com"; sid:536175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcovid19.com"; sid:536176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dresscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dresscovid19.com"; sid:536177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtaawuhancoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtaawuhancoronavirus.biz"; sid:536178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccorona.biz"; sid:536179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-corona-prevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-corona-prevention.biz"; sid:536180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronaprevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronaprevention.biz"; sid:536181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-coronavirus.biz"; sid:536182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccoronavirus.biz"; sid:536183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid19.biz"; sid:536184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19.biz"; sid:536185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid-19prevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid-19prevention.biz"; sid:536186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid19prevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid19prevention.biz"; sid:536187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcc-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcc-covid.biz"; sid:536188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtcccovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtcccovid.biz"; sid:536189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-coronavirus.biz"; sid:536190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccoronavirus.biz"; sid:536191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtc-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtc-covid.biz"; sid:536192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccovid.biz"; sid:536193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dtccwuhanvirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dtccwuhanvirus.biz"; sid:536194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dzcorona.com"; sid:536195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eastbaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eastbaycorona.com"; sid:536196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatingleanduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatingleanduringcovid19.com"; sid:536197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronabar.com"; sid:536198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronasupplies.com"; sid:536199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid19dentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid19dentist.com"; sid:536200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencyvcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencyvcovid-19.com"; sid:536201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for energeticcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"energeticcoronavirus.com"; sid:536202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for energyhealingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"energyhealingcovid19.com"; sid:536203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epcovid19.com"; sid:536204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicaid.com"; sid:536205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicattorney.com"; sid:536206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-news.com"; sid:536207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicworld.com"; sid:536208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecovid.com"; sid:536209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercoronasupplies.com"; sid:536210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercoronavirus.com"; sid:536211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esbrietcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esbrietcovid-19.com"; sid:536212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escudolegalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escudolegalcovid19.com"; sid:536213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estudiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estudiocoronavirus.com"; sid:536214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceofcoronavirus.com"; sid:536215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid.com"; sid:536216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facingcoronavirustogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facingcoronavirustogether.com"; sid:536217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faktacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faktacorona.com"; sid:536218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faktacorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faktacorona.net"; sid:536219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronacleaning.com"; sid:536220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronamasks.com"; sid:536221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fck-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fck-covid.com"; sid:536222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearcoronavirus.com"; sid:536223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearcovid19.com"; sid:536224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcorona.com"; sid:536225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcoronaviruspayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcoronaviruspayments.com"; sid:536226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fevercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fevercoronavirus.com"; sid:536227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-coronavirus.biz"; sid:536228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccoronavirus.biz"; sid:536229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficc-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficc-covid.biz"; sid:536230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficccovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficccovid.biz"; sid:536231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaathome.com"; sid:536232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-corona.net"; sid:536233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronawithhope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronawithhope.com"; sid:536234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid19.net"; sid:536235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19today.com"; sid:536236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.net"; sid:536237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fighting-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fighting-corona.com"; sid:536238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filtercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filtercovid19.com"; sid:536239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fisiocovidlinares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fisiocovidlinares.com"; sid:536240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixthecoronavirus.com"; sid:536241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattenthecoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattenthecoronacurve.com"; sid:536242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronalaw.com"; sid:536243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronalawyer.com"; sid:536244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronaloan.com"; sid:536245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidcare.com"; sid:536246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid.com"; sid:536247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidlaw.com"; sid:536248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidlawyer.com"; sid:536249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaloan.com"; sid:536250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruscleaning.com"; sid:536251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19cleaning.com"; sid:536252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forocovid.com"; sid:536253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirus.biz"; sid:536254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19screen.com"; sid:536255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19tests.com"; sid:536256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronafestival.com"; sid:536257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirusfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirusfestival.com"; sid:536258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurepandemics.com"; sid:536259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxckcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxckcovid-19.com"; sid:536260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gameovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gameovercorona.com"; sid:536261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geomaticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geomaticovid.com"; sid:536262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaclean.com"; sid:536263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronalerts.com"; sid:536264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronashot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronashot.com"; sid:536265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronashots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronashots.com"; sid:536266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatests.com"; sid:536267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidrelief.com"; sid:536268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtest.com"; sid:536269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getfitthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getfitthroughcovid.com"; sid:536270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getfitthroughcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getfitthroughcovid.net"; sid:536271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getridofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getridofcovid19.com"; sid:536272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-corona-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-corona-aid.com"; sid:536273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaaid.com"; sid:536274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronacrisis.com"; sid:536275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19live.com"; sid:536276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicrelief.com"; sid:536277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona-virus.com"; sid:536278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godsresponsetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godsresponsetocovid19.com"; sid:536279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godsresponsetocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godsresponsetocovid19.net"; sid:536280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govfinancialaidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govfinancialaidcoronavirus.com"; sid:536281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govpaymentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govpaymentcorona.com"; sid:536282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govpaymentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govpaymentcoronavirus.com"; sid:536283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govtcoronavirus.com"; sid:536284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grandviewcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grandviewcovid19.com"; sid:536285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencovidclean.com"; sid:536286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupedeveillecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupedeveillecovid.com"; sid:536287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for growinamarillo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"growinamarillo-covid19.com"; sid:536288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackathontechagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackathontechagainstcoronavirus.com"; sid:536289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackathontechagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackathontechagainstcovid19.com"; sid:536290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackthecorona.com"; sid:536291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hadcorona.com"; sid:536292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hadcovid.com"; sid:536293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltecoronavirus.com"; sid:536294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltecovid19.com"; sid:536295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycoronaending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycoronaending.com"; sid:536296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycovidday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycovidday.com"; sid:536297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harriscountycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harriscountycoronavirus.com"; sid:536298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harriscountycoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harriscountycoronavirus.net"; sid:536299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hascovid.com"; sid:536300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcoronavirus.com"; sid:536301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaicovid19.com"; sid:536302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovidnineteen.com"; sid:536303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcsecovid19.com"; sid:536304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcsecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcsecovid19.net"; sid:536305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for headlinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"headlinecorona.com"; sid:536306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthduringcoronavirus.com"; sid:536307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hipandemic.com"; sid:536308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiringduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiringduringcoronavirus.com"; sid:536309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hitcovid19.com"; sid:536310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcovid.com"; sid:536311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honolulucoronavirustherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honolulucoronavirustherapy.com"; sid:536312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcoronavirus.com"; sid:536313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostcorona.com"; sid:536314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostcoronavirus.com"; sid:536315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronacure.com"; sid:536316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronatreatment.com"; sid:536317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houston-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houston-coronavirus.com"; sid:536318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronaviruses.com"; sid:536319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houston-covid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houston-covid19testing.com"; sid:536320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19-testing.com"; sid:536321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19testing.com"; sid:536322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19tests.com"; sid:536323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid.com"; sid:536324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-test.com"; sid:536325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidtest.com"; sid:536326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidtests.com"; sid:536327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoisurvivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoisurvivecoronavirus.com"; sid:536328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomanagecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomanagecorona.com"; sid:536329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostartabusinessduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostartabusinessduringapandemic.com"; sid:536330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huckcorona.com"; sid:536331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huckcovid19.com"; sid:536332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydcovid19.com"; sid:536333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcoronavirus2020.com"; sid:536334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid2020.com"; sid:536335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocoronavirusinfo.com"; sid:536336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocoronavirusinformation.com"; sid:536337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid-19info.com"; sid:536338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid19info.com"; sid:536339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid-19information.com"; sid:536340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid19information.com"; sid:536341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for id-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"id-covid19.com"; sid:536342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideasepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideasepidemic.com"; sid:536343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid.com"; sid:536344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecovid.com"; sid:536345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19info.com"; sid:536346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilivedthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilivedthroughcoronavirus.com"; sid:536347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilivedthroughcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilivedthroughcovid-19.com"; sid:536348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilyouthprisonscovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilyouthprisonscovidresponse.com"; sid:536349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronafree.com"; sid:536350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronasurvivor.com"; sid:536351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactoeconomicocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactoeconomicocoronavirus.com"; sid:536352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactoeconomicocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactoeconomicocovid-19.com"; sid:536353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for influenzapandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"influenzapandemics.com"; sid:536354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-coronavirus.net"; sid:536355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inside-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inside-corona.com"; sid:536356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inside-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inside-corona.net"; sid:536357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecovid19.com"; sid:536358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecovid.com"; sid:536359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurepandemic.com"; sid:536360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimesofcorona.com"; sid:536361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimesofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimesofcorona.net"; sid:536362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipccovid.com"; sid:536363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona19.com"; sid:536364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-covid19.com"; sid:536365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19in2020.com"; sid:536366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-2019.com"; sid:536367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid2019.com"; sid:536368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsnotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsnotcoronavirus.com"; sid:536369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeblokcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeblokcorona.com"; sid:536370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeblokcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeblokcovid19.com"; sid:536371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsduringcoronavirus.com"; sid:536372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalofepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalofepidemics.com"; sid:536373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karunanotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karunanotcorona.com"; sid:536374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccoviddonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccoviddonations.com"; sid:536375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmandcoronaviruson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmandcoronaviruson.com"; sid:536376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ketamineforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ketamineforcoronavirus.com"; sid:536377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ketamineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ketamineforcovid19.com"; sid:536378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kid-covid.com"; sid:536379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsconquercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsconquercovid.com"; sid:536380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kikcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kikcorona.com"; sid:536381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killingcoronaviruswithkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killingcoronaviruswithkindness.com"; sid:536382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killingcoronawithkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killingcoronawithkindness.com"; sid:536383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killingthecoronaviruswithkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killingthecoronaviruswithkindness.com"; sid:536384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindseedcoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindseedcoronatestkit.com"; sid:536385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid19.net"; sid:536386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid.com"; sid:536387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for klapcoronadewerelduit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"klapcoronadewerelduit.com"; sid:536388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95-prevent-epidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95-prevent-epidemics.com"; sid:536389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kreweofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kreweofcorona.com"; sid:536390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2coronavirus.com"; sid:536391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacocorona.com"; sid:536392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19match.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19match.com"; sid:536393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-covid-19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-covid-19-test.com"; sid:536394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lainthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lainthetimeofcorona.com"; sid:536395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lakewoodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lakewoodcovid19.com"; sid:536396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnduringcorona.com"; sid:536397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningduringcorona.com"; sid:536398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningduringcovid19.com"; sid:536399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letterstocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letterstocovid.com"; sid:536400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterapandemic.com"; sid:536401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19.biz"; sid:536402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringcoronavirus.com"; sid:536403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifehopecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifehopecoronatest.com"; sid:536404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostcorona.com"; sid:536405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for listenwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"listenwithcorona.com"; sid:536406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for live-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"live-corona.com"; sid:536407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for live-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"live-covid19.com"; sid:536408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinginatimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinginatimeofcorona.com"; sid:536409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livoniacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livoniacovid19.com"; sid:536410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loanscoronavirus.com"; sid:536411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid19.com"; sid:536412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locoronaremos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locoronaremos.com"; sid:536413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovid19.com"; sid:536414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loteriacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loteriacorona.com"; sid:536415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacovidrelief.com"; sid:536416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveandcovid19.com"; sid:536417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveandlifeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveandlifeinthetimeofcorona.com"; sid:536418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveduringcoronavirus.com"; sid:536419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinacoronaclimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinacoronaclimate.com"; sid:536420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcorona.com"; sid:536421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveincovid.com"; sid:536422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcoronavirus.net"; sid:536423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcovid.com"; sid:536424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthecovidzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthecovidzone.com"; sid:536425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronav.com"; sid:536426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovelifecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovelifecorona.com"; sid:536427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovinginthetimeofcorona.com"; sid:536428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaprotectoracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaprotectoracoronavirus.com"; sid:536429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managecorona.com"; sid:536430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managecovid.com"; sid:536431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingcoronastress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingcoronastress.com"; sid:536432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapadelcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapadelcoronavirus2020.com"; sid:536433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinacorona.com"; sid:536434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherina-corona-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherina-corona-virus.net"; sid:536435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecorona.com"; sid:536436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskeranticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskeranticorona.com"; sid:536437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona101.com"; sid:536438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona10.com"; sid:536439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona1.com"; sid:536440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona21.com"; sid:536441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona2.com"; sid:536442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona31.com"; sid:536443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona3.com"; sid:536444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona41.com"; sid:536445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona4.com"; sid:536446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona51.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona51.com"; sid:536447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona5.com"; sid:536448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona61.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona61.com"; sid:536449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona6.com"; sid:536450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona71.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona71.com"; sid:536451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona7.com"; sid:536452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona81.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona81.com"; sid:536453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona8.com"; sid:536454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona91.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona91.com"; sid:536455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona9.com"; sid:536456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masry-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masry-corona.com"; sid:536457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mclennancountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mclennancountycovid.com"; sid:536458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicine-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicine-covid19.com"; sid:536459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobile-coronavirus-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobile-coronavirus-testing.com"; sid:536460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovid.com"; sid:536461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for molitvacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"molitvacoronavirus.com"; sid:536462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mt2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mt2corona.com"; sid:536463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvcovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvcovid19fund.com"; sid:536464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvcovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvcovidfund.com"; sid:536465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacalm.com"; sid:536466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacash.com"; sid:536467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahacks.com"; sid:536468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahelper.com"; sid:536469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronamoney.com"; sid:536470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapak.com"; sid:536471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-results.com"; sid:536472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaresults.com"; sid:536473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusclaim.net"; sid:536474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19plan.com"; sid:536475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19response.com"; sid:536476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddiet.com"; sid:536477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidkid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidkid.com"; sid:536478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlife.com"; sid:536479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlife.net"; sid:536480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidresults.com"; sid:536481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfloridacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfloridacovid.com"; sid:536482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymymycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymymycorona.com"; sid:536483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemiclife.com"; sid:536484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicpantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicpantry.com"; sid:536485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicpantry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicpantry.net"; sid:536486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nachcorona.com"; sid:536487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nachcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nachcovid-19.com"; sid:536488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nasalcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nasalcovid19test.com"; sid:536489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcovid19.com"; sid:536490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatecorona.com"; sid:536491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatecovid19.com"; sid:536492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacovid.com"; sid:536493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-coronavirusmask.com"; sid:536494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaloan.com"; sid:536495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronalivesnever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronalivesnever.com"; sid:536496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidspray.com"; sid:536497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecorona19.com"; sid:536498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notesofcorona.com"; sid:536499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novalcorona.com"; sid:536500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novalcoronamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novalcoronamed.com"; sid:536501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novalcoronavirusmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novalcoronavirusmed.com"; sid:536502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novalcovid19.com"; sid:536503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novocoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novocoronaviruscovid19.com"; sid:536504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-coronavirus.biz"; sid:536505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccoronavirus.biz"; sid:536506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscc-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscc-covid.biz"; sid:536507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscccovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscccovid.biz"; sid:536508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntucoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntucoronavirusinformation.com"; sid:536509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaloan.com"; sid:536510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oceansidecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oceansidecovid-19.com"; sid:536511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offcovid19.com"; sid:536512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronacheck.com"; sid:536513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronavirusboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronavirusboomer.com"; sid:536514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onepandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onepandemiccookbook.com"; sid:536515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringcoronavirus.com"; sid:536516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringcovid19.com"; sid:536517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringpandemic.com"; sid:536518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringpandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringpandemicrecovery.com"; sid:536519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openuptocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openuptocorona.com"; sid:536520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opioidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opioidpandemic.com"; sid:536521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocoronaviruscleaning.com"; sid:536522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid-19cleaning.com"; sid:536523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for othersidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"othersidecorona.com"; sid:536524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid-19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid-19response.com"; sid:536525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlifeincoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlifeincoronatime.com"; sid:536526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for out-hustle-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"out-hustle-covid.com"; sid:536527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcamecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcamecorona.com"; sid:536528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecoronavirus.com"; sid:536529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paddlecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paddlecoronavirus.com"; sid:536530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-19.com"; sid:536531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic360.com"; sid:536532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic365.com"; sid:536533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalbum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalbum.com"; sid:536534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemican.com"; sid:536535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandprepperkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandprepperkits.com"; sid:536536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicangel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicangel.com"; sid:536537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboardgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboardgames.com"; sid:536538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbooks.com"; sid:536539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccards.com"; sid:536540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccare2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccare2020.com"; sid:536541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareprovider2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareprovider2020.com"; sid:536542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareprovider.com"; sid:536543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchannel.com"; sid:536544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccluster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccluster.com"; sid:536545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclusters.com"; sid:536546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccondition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccondition.com"; sid:536547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccounselling.com"; sid:536548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrash.com"; sid:536549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccurrency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccurrency.com"; sid:536550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeathtoll.com"; sid:536551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdebthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdebthelp.com"; sid:536552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdebtrelief.com"; sid:536553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefenseagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefenseagency.com"; sid:536554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-diaries.com"; sid:536555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdisasterkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdisasterkits.com"; sid:536556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomy.com"; sid:536557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicedu.com"; sid:536558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicelections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicelections.com"; sid:536559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemporium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemporium.com"; sid:536560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicevents.com"; sid:536561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfact.com"; sid:536562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirebarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirebarrier.com"; sid:536563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirstaid.com"; sid:536564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflulaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflulaw.com"; sid:536565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfunding.com"; sid:536566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfuture.com"; sid:536567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgrowth.com"; sid:536568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichack.com"; sid:536569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichacks.com"; sid:536570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichope.com"; sid:536571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicincome.com"; sid:536572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicindemnity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicindemnity.com"; sid:536573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinjury.com"; sid:536574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawfirm.com"; sid:536575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclaws.com"; sid:536576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclockdown.com"; sid:536577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmanagementstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmanagementstrategies.com"; sid:536578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeal.com"; sid:536579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeals.com"; sid:536580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnations.com"; sid:536581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewslive.com"; sid:536582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofpossibilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofpossibilities.com"; sid:536583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofpossibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofpossibility.com"; sid:536584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicorp.com"; sid:536585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicorps.com"; sid:536586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpastimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpastimes.com"; sid:536587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpenguins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpenguins.com"; sid:536588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparationkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparationkits.com"; sid:536589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepco.com"; sid:536590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprevent.com"; sid:536591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprivacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprivacy.com"; sid:536592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproductivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproductivity.com"; sid:536593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofyourincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofyourincome.com"; sid:536594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprovider2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprovider2020.com"; sid:536595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpussy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpussy.com"; sid:536596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuzzles.com"; sid:536597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecipe.com"; sid:536598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecovery.com"; sid:536599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefbubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefbubbles.com"; sid:536600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseteam.com"; sid:536601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrt.com"; sid:536602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicschool.com"; sid:536603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicslife.com"; sid:536604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solution.com"; sid:536605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspecialist.com"; sid:536606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspread.com"; sid:536607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstaffing.com"; sid:536608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstores.com"; sid:536609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstory.com"; sid:536610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstressmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstressmanagement.com"; sid:536611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstress.net"; sid:536612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stress-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stress-test.com"; sid:536613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsummit.com"; sid:536614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplier.com"; sid:536615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportfund.com"; sid:536616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportfunds.com"; sid:536617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsure.com"; sid:536618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalbook.com"; sid:536619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivaltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivaltips.com"; sid:536620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictaskforce.com"; sid:536621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictelehealth.com"; sid:536622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictelemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictelemedicine.com"; sid:536623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictherapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictherapists.com"; sid:536624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthermal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthermal.com"; sid:536625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoolbox.com"; sid:536626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicuniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicuniverse.com"; sid:536627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusdrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusdrug.com"; sid:536628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruslawfirm.com"; sid:536629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwise.com"; sid:536630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicworldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicworldcovid.com"; sid:536631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantaucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantaucovid19.com"; sid:536632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantrypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantrypandemic.com"; sid:536633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentinginapandemic.com"; sid:536634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partythecoronaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partythecoronaway.com"; sid:536635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peacefulpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peacefulpandemic.com"; sid:536636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedulicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedulicorona.com"; sid:536637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petacorona.com"; sid:536638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmabel-test-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmabel-test-coronavirus.com"; sid:536639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacy4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacy4corona.com"; sid:536640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciancovidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciancovidcenter.com"; sid:536641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pill4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pill4covid19.com"; sid:536642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburgcovid19.com"; sid:536643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plancovid19.com"; sid:536644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plancovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plancovid19.net"; sid:536645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaism.com"; sid:536646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastressdisorder.com"; sid:536647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastressdisorder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastressdisorder.net"; sid:536648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasupport.com"; sid:536649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasupport.net"; sid:536650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaviruseconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaviruseconomy.com"; sid:536651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusworld.com"; sid:536652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.net"; sid:536653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstressdisorder.com"; sid:536654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstressdisorder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstressdisorder.net"; sid:536655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsupport.com"; sid:536656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsupport.net"; sid:536657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemic.com"; sid:536658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayeragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayeragainstcoronavirus.com"; sid:536659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prcoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prcoronavirusmap.com"; sid:536660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precoronaera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precoronaera.com"; sid:536661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precoronavalue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precoronavalue.com"; sid:536662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparecorona.com"; sid:536663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princesscorona.com"; sid:536664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovid.com"; sid:536665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proformula-coronavirus-hu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proformula-coronavirus-hu.com"; sid:536666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proformula-coronavirus-nl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proformula-coronavirus-nl.com"; sid:536667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovideo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovideo19.com"; sid:536668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purgecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purgecorona.com"; sid:536669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pussycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pussycoronavirus.com"; sid:536670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qhrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qhrcovid19.com"; sid:536671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinedcorona.com"; sid:536672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinescovid19.com"; sid:536673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queima-de-estoque-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queima-de-estoque-covid-19.com"; sid:536674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid.com"; sid:536675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitcorona.com"; sid:536676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qwuhan.com"; sid:536677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for racovid-19dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"racovid-19dashboard.com"; sid:536678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronatesting.com"; sid:536679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidcheck.com"; sid:536680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestscovid19.com"; sid:536681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readyforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readyforpandemic.com"; sid:536682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecovid19.com"; sid:536683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebuildaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebuildaftercovid.com"; sid:536684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebuildfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebuildfromcovid19.com"; sid:536685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rec-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rec-corona.com"; sid:536686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursoscoronavirus.com"; sid:536687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registercoronavirus.com"; sid:536688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relievecoronavirusstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relievecoronavirusstress.com"; sid:536689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for researchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"researchcoronavirus.com"; sid:536690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respuesta-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respuesta-covid19.com"; sid:536691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rheum-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rheum-covid.com"; sid:536692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinsecovid19.com"; sid:536693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riskcorona.com"; sid:536694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for robustcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"robustcorona.com"; sid:536695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ronnycoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ronnycoronado.com"; sid:536696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roomsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roomsagainstcovid.com"; sid:536697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ru-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ru-coronavirus.net"; sid:536698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacramentocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacramentocovid19.com"; sid:536699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronamask.com"; sid:536700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salta-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salta-coronavirus.com"; sid:536701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarasotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarasotacoronavirus.com"; sid:536702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-cov-2covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-cov-2covid-19.com"; sid:536703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sasacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sasacovid19.com"; sid:536704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusemergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusemergencyloan.com"; sid:536705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusemergencyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusemergencyloans.com"; sid:536706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloanhelp.com"; sid:536707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusreliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusreliefhelp.com"; sid:536708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusreliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusreliefloan.com"; sid:536709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusreliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusreliefloans.com"; sid:536710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19emergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19emergencyloan.com"; sid:536711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19emergencyloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19emergencyloanhelp.com"; sid:536712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanhelp.com"; sid:536713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidloan.com"; sid:536714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidloanhelp.com"; sid:536715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovidrelief.com"; sid:536716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schaden-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schaden-corona.com"; sid:536717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolcorona.com"; sid:536718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolsoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolsoutcorona.com"; sid:536719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scotscoopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scotscoopcovid.com"; sid:536720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencorona19.com"; sid:536721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screencorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screencorona19.net"; sid:536722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenforcovid19.com"; sid:536723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningcovid19.com"; sid:536724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19attorney.com"; sid:536725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19lawyer.com"; sid:536726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovidattorney.com"; sid:536727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitycovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitycovid19info.com"; sid:536728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seiu6covid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seiu6covid19info.com"; sid:536729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsttestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsttestcorona.com"; sid:536730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfassesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfassesscovid19.com"; sid:536731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfassessmentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfassessmentcovid19.com"; sid:536732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfreportcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfreportcorona.com"; sid:536733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfswabcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfswabcovid19.com"; sid:536734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcoronavirus.net"; sid:536735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcovid.com"; sid:536736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorscovid19testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorscovid19testingkit.com"; sid:536737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcorona.com"; sid:536738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecoronaexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecoronaexperience.com"; sid:536739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shemacovidpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shemacovidpage.com"; sid:536740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanticoronavirus.com"; sid:536741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoppandemic.com"; sid:536742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutcorona.com"; sid:536743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siagacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siagacovid19.com"; sid:536744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simcovid19.com"; sid:536745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simcovid.com"; sid:536746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sipcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sipcorona.com"; sid:536747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sixnationscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sixnationscovid19.com"; sid:536748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaythecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaythecorona.com"; sid:536749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowthespreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowthespreadcovid19.com"; sid:536750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessassociationcoronavirusemergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessassociationcoronavirusemergencyloan.com"; sid:536751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessassociationcoronavirusemergencyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessassociationcoronavirusemergencyloans.com"; sid:536752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessassociationcoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessassociationcoronavirusloan.com"; sid:536753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessassociationcoronavirusloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessassociationcoronavirusloanhelp.com"; sid:536754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessassociationcoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessassociationcoronavirusloans.com"; sid:536755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirusemergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirusemergencyloan.com"; sid:536756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smash-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smash-corona.com"; sid:536757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobreviviralcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobreviviralcoronavirus.com"; sid:536758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcoronaviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcoronaviruscleanup.com"; sid:536759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for social-distancing-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"social-distancing-covid19.com"; sid:536760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialdistancing-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialdistancing-covid19.com"; sid:536761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialdistancingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialdistancingcovid19.com"; sid:536762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvethecoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvethecoronapandemic.com"; sid:536763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spelcovid19.com"; sid:536764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid19emergencydentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid19emergencydentist.com"; sid:536765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscorona.com"; sid:536766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscorona.net"; sid:536767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafecovid19.com"; sid:536768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellcoronavirus.com"; sid:536769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcelltherapycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcelltherapycoronavirus.com"; sid:536770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaapp.com"; sid:536771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafha.com"; sid:536772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafhapayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafhapayments.com"; sid:536773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronagetgets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronagetgets.com"; sid:536774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronapayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronapayment.com"; sid:536775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronapayment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronapayment.net"; sid:536776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronapayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronapayments.com"; sid:536777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronasettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronasettlement.com"; sid:536778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19cat.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19cat.cat"; sid:536779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19cat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19cat.com"; sid:536780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19test.com"; sid:536781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcorona.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcorona.co.uk"; sid:536782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsvspandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsvspandemics.com"; sid:536783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suechinaforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suechinaforcoronavirus.com"; sid:536784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid192020.com"; sid:536785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecoronapandemic.com"; sid:536786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingapandemic.com"; sid:536787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid-19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid-19-2020.com"; sid:536788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecovid-19outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecovid-19outbreak.com"; sid:536789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sushizencoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sushizencoronado.com"; sid:536790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syage-covid19-assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syage-covid19-assessment.com"; sid:536791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcoronaviruscovid19.com"; sid:536792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tahoecovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tahoecovidcleaning.com"; sid:536793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethatcovid19.com"; sid:536794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethiscovid19.com"; sid:536795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tallahasseecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tallahasseecoronavirus.com"; sid:536796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronaviruscleaning.com"; sid:536797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid-19cleaning.com"; sid:536798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachduringcorona.com"; sid:536799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachingduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachingduringcorona.com"; sid:536800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techagainstcovid.com"; sid:536801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techxcovid.com"; sid:536802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennispandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennispandemic.com"; sid:536803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terrorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terrorcovid19.com"; sid:536804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusnow.com"; sid:536805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19now.com"; sid:536806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidathome.com"; sid:536807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitcovid-19.com"; sid:536808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmijopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmijopcorona.com"; sid:536809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronaviruslawyer.com"; sid:536810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texas-covid-19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texas-covid-19-test.com"; sid:536811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texastakescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texastakescorona.com"; sid:536812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texasvscorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texasvscorona19.com"; sid:536813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texasvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texasvscorona.com"; sid:536814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucoronafrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucoronafrontline.com"; sid:536815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacation.com"; sid:536816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclapback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclapback.com"; sid:536817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacleaningco.com"; sid:536818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona.com"; sid:536819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconcierge.com"; sid:536820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaeconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaeconomy.com"; sid:536821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronagarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronagarden.com"; sid:536822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronagroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronagroup.com"; sid:536823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona-logues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona-logues.com"; sid:536824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamarathon.com"; sid:536825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaoutcome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaoutcome.com"; sid:536826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastories.com"; sid:536827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaupshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaupshot.com"; sid:536828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviralshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviralshow.com"; sid:536829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusblogger.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusblogger.co.uk"; sid:536830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbreakup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbreakup.com"; sid:536831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscompanion.com"; sid:536832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscompanion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscompanion.net"; sid:536833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscovid-19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscovid-19update.com"; sid:536834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusjournal.com"; sid:536835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslie.com"; sid:536836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnovel.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnovel.biz"; sid:536837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusscam.com"; sid:536838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusstimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusstimuluspackage.com"; sid:536839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustales.com"; sid:536840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustaskforce.com"; sid:536841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusvitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusvitamin.com"; sid:536842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid100.com"; sid:536843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19challenge.com"; sid:536844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19help.com"; sid:536845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19helper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19helper.com"; sid:536846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19nightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19nightmare.com"; sid:536847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19story.com"; sid:536848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleanup.com"; sid:536849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcollection.com"; sid:536850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovideffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovideffect.com"; sid:536851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhelp.com"; sid:536852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidquarantine.com"; sid:536853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidquarantineproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidquarantineproject.com"; sid:536854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrelief.com"; sid:536855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstories.com"; sid:536856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtimes.com"; sid:536857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-day-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-day-after-corona.com"; sid:536858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercorona.com"; sid:536859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.com"; sid:536860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofpandemicparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofpandemicparty.net"; sid:536861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegoodnewscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegoodnewscoronavirus.com"; sid:536862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcoronacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcoronacation.com"; sid:536863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehomecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehomecoronavirustest.com"; sid:536864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronaviruses.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronaviruses.biz"; sid:536865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoutbreakofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoutbreakofcovid-19.com"; sid:536866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemichack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemichack.com"; sid:536867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemichacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemichacks.com"; sid:536868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicproject.net"; sid:536869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicroom.com"; sid:536870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepoliticaleconomyofcoronastagnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepoliticaleconomyofcoronastagnation.com"; sid:536871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovid.com"; sid:536872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theremedyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theremedyforcoronavirus.com"; sid:536873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thermalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thermalcovid19.com"; sid:536874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thestoryofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thestoryofcovid-19.com"; sid:536875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcoronavirus.com"; sid:536876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcovid19.com"; sid:536877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthbehindcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthbehindcovid-19.com"; sid:536878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcovid19.com"; sid:536879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tmscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tmscovid19.com"; sid:536880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocoronavirus.com"; sid:536881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontracovid19.com"; sid:536882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcovid19.com"; sid:536883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10bestcoronafacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10bestcoronafacemask.com"; sid:536884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10bestcoronafacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10bestcoronafacemasks.com"; sid:536885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10bestcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10bestcoronamask.com"; sid:536886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10bestcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10bestcoronamasks.com"; sid:536887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronafacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronafacemask.com"; sid:536888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronafacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronafacemasks.com"; sid:536889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top10coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top10coronamask.com"; sid:536890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidcleaners.com"; sid:536891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidcleaning.com"; sid:536892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackpandemics.com"; sid:536893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trapcorona.com"; sid:536894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trapcovid19.com"; sid:536895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercovid.com"; sid:536896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecolorscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecolorscorona.com"; sid:536897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronavirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronavirussurvivors.com"; sid:536898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uascovid-19responce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uascovid-19responce.com"; sid:536899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealthcovid.com"; sid:536900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskcorona.com"; sid:536901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmenskrise-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmenskrise-corona.com"; sid:536902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmenskrise-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmenskrise-corona.net"; sid:536903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgencescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgencescoronavirus.com"; sid:536904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid.com"; sid:536905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusinfo.com"; sid:536906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusnow.com"; sid:536907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruspandemic.com"; sid:536908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19map.com"; sid:536909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationagainstcorona.com"; sid:536910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationagainstcovid19.com"; sid:536911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecorona.net"; sid:536912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-covid.com"; sid:536913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid.net"; sid:536914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacoronacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacoronacine.com"; sid:536915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcovid-19.com"; sid:536916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veiligheid-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veiligheid-corona.com"; sid:536917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimsofcorona.com"; sid:536918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for videocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"videocoronavirus.com"; sid:536919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemicsurvivor.com"; sid:536920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visitcampcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visitcampcorona.com"; sid:536921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vistaflowcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vistaflowcovid19test.com"; sid:536922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivafreecovid.com"; sid:536923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteercoronavirus.com"; sid:536924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacocovid.com"; sid:536925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncorona.com"; sid:536926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watchcovid19.com"; sid:536927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waytoovercomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waytoovercomecorona.com"; sid:536928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waytoovercomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waytoovercomecoronavirus.com"; sid:536929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wchcoronavirus.com"; sid:536930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid-19.com"; sid:536931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcoronavirus.com"; sid:536932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webscreencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webscreencovid19.com"; sid:536933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webtestcovid19.com"; sid:536934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellmark-covidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellmark-covidfacts.com"; sid:536935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weovercovid19.com"; sid:536936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westopcorona.com"; sid:536937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-will-beat-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-will-beat-coronavirus.com"; sid:536938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcomcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcomcovid.com"; sid:536939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscoronaviruses.com"; sid:536940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitehousecoronavirustaskforcedailybriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitehousecoronavirustaskforcedailybriefing.com"; sid:536941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoishiringduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoishiringduringcoronavirus.com"; sid:536942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wikicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wikicovid.com"; sid:536943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipecorona.com"; sid:536944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wordcovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wordcovidmap.com"; sid:536945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldagainstcovid19.com"; sid:536946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronacrisis.com"; sid:536947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusaid.com"; sid:536948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldrecordcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldrecordcorona.com"; sid:536949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcovid19.com"; sid:536950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan2waukegan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan2waukegan.com"; sid:536951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchinavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchinavirus.net"; sid:536952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoodies.com"; sid:536953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancooties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancooties.com"; sid:536954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-guideir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-guideir.com"; sid:536955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-stationery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-stationery.com"; sid:536956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantangclan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantangclan.com"; sid:536957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwendy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwendy.com"; sid:536958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronaespaa-beb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronaespaa-beb.com"; sid:536959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-frdermittel-k3b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-frdermittel-k3b.com"; sid:536960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-frderung-gtb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-frderung-gtb.com"; sid:536961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusmdicaments-m5b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusmdicaments-m5b.com"; sid:536962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirus-mdicaments-n8b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirus-mdicaments-n8b.com"; sid:536963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xocorona.com"; sid:536964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yescorona.com"; sid:536965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcovid19.com"; sid:536966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcoronavirus.com"; sid:536967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youhavethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youhavethecoronavirus.com"; sid:536968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronakits.com"; sid:536969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronasupplies.com"; sid:536970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidcure.com"; sid:536971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeugen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeugen-corona.com"; sid:536972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeugencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeugencorona.com"; sid:536973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeugen-coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeugen-coronas.com"; sid:536974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeugencoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeugencoronas.com"; sid:536975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zinc4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zinc4covid.com"; sid:536976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiecovid19.com"; sid:536977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiecovid.com"; sid:536978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zoomschoolcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zoomschoolcoronado.com"; sid:536979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0pandemic.com"; sid:536980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covid-19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covid-19free.com"; sid:536981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1coronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1coronacare.com"; sid:536982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1pandemic.com"; sid:536983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019pandemic.com"; sid:536984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusstatistics.com"; sid:536985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirususa.com"; sid:536986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.movie"; sid:536987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3d4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3d4covid19.com"; sid:536988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dcovid19.com"; sid:536989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4406coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4406coronado.com"; sid:536990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covid19.com"; sid:536991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 69covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"69covid.com"; sid:536992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800coronavirus.com"; sid:536993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 888corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"888corona.com"; sid:536994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1team-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1team-covid19.com"; sid:536995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaccoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaccoronacare.com"; sid:536996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronacare.com"; sid:536997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronasurvivor.com"; sid:536998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adamscountycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adamscountycoronavirus.com"; sid:536999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adamscountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adamscountycovid19.com"; sid:537000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adamscountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adamscountycovid.com"; sid:537001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoccorona.com"; sid:537002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoccovid19.com"; sid:537003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoccovid.com"; sid:537004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid.com"; sid:537005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosdecoronavirus.com"; sid:537006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporcoronavirus.com"; sid:537007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporcovid19.com"; sid:537008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afrocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afrocovid19.com"; sid:537009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aggiornamentocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aggiornamentocoronavirus.com"; sid:537010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aicovid19.com"; sid:537011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ailaiepidemicpreventionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ailaiepidemicpreventionsupplies.com"; sid:537012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aisa-covid19portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aisa-covid19portal.com"; sid:537013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacorona.com"; sid:537014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacorona.com"; sid:537015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliveaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliveaftercorona.com"; sid:537016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allagainstcovid.com"; sid:537017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid.com"; sid:537018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aloneinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aloneinthetimeofcorona.com"; sid:537019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alstoncoronavirusflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alstoncoronavirusflash.com"; sid:537020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alstoncoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alstoncoronavirusupdates.com"; sid:537021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacorona.com"; sid:537022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amidcovid.com"; sid:537023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelsforcovid.com"; sid:537024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for animalscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"animalscoronavirus.com"; sid:537025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaproducts.com"; sid:537026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.life"; sid:537027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-mask.com"; sid:537028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingcorona.com"; sid:537029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcoronavirusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcoronavirusalert.com"; sid:537030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbeitsrecht-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbeitsrecht-corona.com"; sid:537031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argentina-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argentina-coronavirus.com"; sid:537032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacorona.com"; sid:537033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansasbroadcasterscovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansasbroadcasterscovid19resources.com"; sid:537034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascorona.com"; sid:537035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofcoronavirus.com"; sid:537036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistasymusicoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistasymusicoscovid19.com"; sid:537037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ask4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ask4covid.com"; sid:537038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assicurarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assicurarecoronavirus.com"; sid:537039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovid19.com"; sid:537040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atmospherecoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atmospherecoronaa.com"; sid:537041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atmospherecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atmospherecorona.com"; sid:537042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscorona.com"; sid:537043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autorisation-de-tuer-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autorisation-de-tuer-coronavirus.com"; sid:537044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autorisationdetuercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autorisationdetuercoronavirus.com"; sid:537045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avvocatocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avvocatocoronavirus.com"; sid:537046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovid-19.com"; sid:537047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovidco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovidco.com"; sid:537048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayurvedacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayurvedacorona.com"; sid:537049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcorona.com"; sid:537050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid.com"; sid:537051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babywuhan.com"; sid:537052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baklavagnaw-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baklavagnaw-corona.com"; sid:537053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baptisthealth-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baptisthealth-corona-virus.com"; sid:537054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baptisthealth-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baptisthealth-coronavirus.com"; sid:537055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrierecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrierecovid.com"; sid:537056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bascorona.com"; sid:537057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecovid-19.com"; sid:537058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlingcorona.com"; sid:537059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlingcovid19.com"; sid:537060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19.team"; sid:537061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid2020.com"; sid:537062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.club"; sid:537063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for begonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"begonecovid.com"; sid:537064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellevuecoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellevuecoronaviruscleaning.com"; sid:537065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellevuecoronavirusdecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellevuecoronavirusdecontamination.com"; sid:537066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellevuecovid-19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellevuecovid-19decontamination.com"; sid:537067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellevuecovid-19disenfectcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellevuecovid-19disenfectcleaning.com"; sid:537068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidmemes.com"; sid:537069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestthingaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestthingaboutcoronavirus.com"; sid:537070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betatcorona.com"; sid:537071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betatcorona.net"; sid:537072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betatcovid.com"; sid:537073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betatcovid.net"; sid:537074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betoncorona.com"; sid:537075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betoncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betoncorona.net"; sid:537076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettingcorona.com"; sid:537077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettingcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettingcorona.net"; sid:537078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioblastcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioblastcorona.com"; sid:537079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biopandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biopandemics.com"; sid:537080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blueboxcoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blueboxcoronasupport.com"; sid:537081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bolacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bolacorona.com"; sid:537082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookcoronavirus.com"; sid:537083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootcorona.com"; sid:537084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootcovid.com"; sid:537085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid19.com"; sid:537086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid.com"; sid:537087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botcorona.com"; sid:537088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bouncebackcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bouncebackcovid-19.com"; sid:537089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasilcontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasilcontraocorona.com"; sid:537090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bravenewcoronavirusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bravenewcoronavirusworld.com"; sid:537091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckingcorona.com"; sid:537092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckingcovid19.com"; sid:537093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckscoviddelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckscoviddelivery.com"; sid:537094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckscovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckscovidguide.com"; sid:537095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bucksheraldcovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bucksheraldcovidguide.com"; sid:537096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckshunterdoncovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckshunterdoncovidguide.com"; sid:537097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for busancoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"busancoronamap.com"; sid:537098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessincomelosscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessincomelosscoronavirus.com"; sid:537099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesslosscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesslosscovid19.com"; sid:537100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyacoronavirustest.com"; sid:537101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyacoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyacoronavirustestkit.com"; sid:537102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronafilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronafilter.com"; sid:537103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-byecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-byecorona.com"; sid:537104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19law.com"; sid:537105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcovid19.com"; sid:537106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcovid.com"; sid:537107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcovid.net"; sid:537108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for califcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"califcoronavirus.com"; sid:537109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronacleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronacleaner.com"; sid:537110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronacleaners.com"; sid:537111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidresponse.com"; sid:537112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcoronas.com"; sid:537113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canyousuecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canyousuecorona.com"; sid:537114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for captaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"captaincovid.com"; sid:537115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caramelizeproving-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caramelizeproving-corona.com"; sid:537116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carlsbadcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carlsbadcovid-19.com"; sid:537117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cat5corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cat5corona.com"; sid:537118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalunyacontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalunyacontraelcovid.com"; sid:537119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caza-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caza-covid.com"; sid:537120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccs-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccs-coronavirus.net"; sid:537121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycovid.com"; sid:537122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralcoronavirus.com"; sid:537123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralohiocovid-19shoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralohiocovid-19shoppers.com"; sid:537124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidclear.com"; sid:537125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidclear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidclear.net"; sid:537126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chance-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chance-corona.com"; sid:537127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeinthetimeofcorona.com"; sid:537128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiefcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiefcovid19.com"; sid:537129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chillcovid.com"; sid:537130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinaviruspandemic.com"; sid:537131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chineseviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chineseviruspandemic.com"; sid:537132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecorona.com"; sid:537133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecoronavirus.com"; sid:537134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecovid-19.com"; sid:537135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecovid19.com"; sid:537136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-covid.com"; sid:537137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquineforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquineforcoronavirus.com"; sid:537138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascoronababies.com"; sid:537139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascoronababy.com"; sid:537140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofdentoncoronavirusresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofdentoncoronavirusresources.com"; sid:537141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncorona.com"; sid:537142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncovid19.com"; sid:537143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanautocovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanautocovid19.biz"; sid:537144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancoronanow.com"; sid:537145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidnineteen.com"; sid:537146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanforcovid.com"; sid:537147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanforcovid.net"; sid:537148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcovid-19.com"; sid:537149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcoronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcoronavirususa.com"; sid:537150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for climatepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"climatepandemic.com"; sid:537151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicalibredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicalibredecoronavirus.com"; sid:537152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicasincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicasincoronavirus.com"; sid:537153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicasincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicasincovid19.com"; sid:537154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clobbercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clobbercovid19.com"; sid:537155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clobbercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clobbercovid.com"; sid:537156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for club-atelier-corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"club-atelier-corona-festival.com"; sid:537157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for club-corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"club-corona-festival.com"; sid:537158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoaagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoaagainstcovid19.com"; sid:537159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co-covid.com"; sid:537160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeenotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeenotcovid.com"; sid:537161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colocorona.com"; sid:537162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colombiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colombiacovid19.com"; sid:537163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19.world"; sid:537164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcovid19.com"; sid:537165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcovid.com"; sid:537166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicsovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicsovercorona.com"; sid:537167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companycovid.com"; sid:537168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concoronas.com"; sid:537169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confronting-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confronting-covid.com"; sid:537170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcorona.com"; sid:537171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecoronachallenge.com"; sid:537172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constructionimpactcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constructionimpactcovid19.com"; sid:537173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contagicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contagicoronavirus.com"; sid:537174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraelcorona.com"; sid:537175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookinginthetimeofcorona.com"; sid:537176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingthrucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingthrucorona.com"; sid:537177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolhardener-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolhardener-corona.com"; sid:537178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cures.com"; sid:537179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lawsuit.com"; sid:537180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lawyers.com"; sid:537181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19med.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19med.com"; sid:537182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19neb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19neb.com"; sid:537183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19treatment.com"; sid:537184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19treatment.com"; sid:537185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020tees.com"; sid:537186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona228.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona228.com"; sid:537187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona228.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona228.net"; sid:537188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona25.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona25.com"; sid:537189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2day.com"; sid:537190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona99.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona99.net"; sid:537191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abi-2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abi-2020.cloud"; sid:537192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abi-2020.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abi-2020.team"; sid:537193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaagent.com"; sid:537194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalertsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalertsdaily.com"; sid:537195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-allinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-allinfo.com"; sid:537196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa.net"; sid:537197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantiviraltherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantiviraltherapies.com"; sid:537198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantiviraltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantiviraltherapy.com"; sid:537199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus2020.com"; sid:537200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-api.com"; sid:537201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apocalypse2020.com"; sid:537202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apocolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apocolypse.com"; sid:537203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arabia.com"; sid:537204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arabia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arabia.net"; sid:537205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarms.com"; sid:537206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-art.com"; sid:537207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartcontest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartcontest.com"; sid:537208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ausgangssperre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ausgangssperre.com"; sid:537209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaavoidant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaavoidant.com"; sid:537210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyclothes.com"; sid:537211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababycompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababycompany.com"; sid:537212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababygeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababygeneration.com"; sid:537213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababygeneration.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababygeneration.net"; sid:537214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyus.com"; sid:537215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabaseballkc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabaseballkc.com"; sid:537216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabasketballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabasketballleague.com"; sid:537217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeerchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeerchallenge.com"; sid:537218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestrijdingsplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestrijdingsplan.com"; sid:537219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabillionaire.com"; sid:537220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabitch.com"; sid:537221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiz.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiz.support"; sid:537222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabling.com"; sid:537223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablokes.com"; sid:537224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabody.com"; sid:537225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bond.com"; sid:537226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabowl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabowl.com"; sid:537227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreather.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreather.com"; sid:537228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabunch.com"; sid:537229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabunny.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabunny.net"; sid:537230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessrecovery.com"; sid:537231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersclean.com"; sid:537232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersflorida.com"; sid:537233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabyerus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabyerus.com"; sid:537234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacakes.com"; sid:537235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacal.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacal.biz"; sid:537236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalendar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalendar.com"; sid:537237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm101.com"; sid:537238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamlive.com"; sid:537239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacampers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacampers.com"; sid:537240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamslive.com"; sid:537241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanaria.com"; sid:537242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancellation.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancellation.claims"; sid:537243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacantina.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacantina.club"; sid:537244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cards.com"; sid:537245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarenow.com"; sid:537246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashout.com"; sid:537247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacavalier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacavalier.com"; sid:537248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentral.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentral.life"; sid:537249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertifiedcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertifiedcleaner.com"; sid:537250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertifiedcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertifiedcleaners.com"; sid:537251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertifiedcleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertifiedcleaningco.com"; sid:537252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertified.com"; sid:537253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacession2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacession2020.com"; sid:537254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachannel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachannel.net"; sid:537255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharities.com"; sid:537256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chats.com"; sid:537257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck4u.com"; sid:537258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck4u.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck4u.net"; sid:537259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachimney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachimney.com"; sid:537260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachloroquine.com"; sid:537261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chroniken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chroniken.com"; sid:537262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaims.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaims.claims"; sid:537263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsfirm.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsfirm.biz"; sid:537264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaners.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaners.biz"; sid:537265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleangreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleangreen.com"; sid:537266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningpalmbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningpalmbeach.com"; sid:537267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaning.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaning.pro"; sid:537268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-closing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-closing.com"; sid:537269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosing.com"; sid:537270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocoon.com"; sid:537271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocooner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocooner.com"; sid:537272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocooners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocooners.com"; sid:537273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollins.com"; sid:537274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolombia.com"; sid:537275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoma.com"; sid:537276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommerce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommerce.net"; sid:537277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommercialcleaning.com"; sid:537278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommercial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommercial.com"; sid:537279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommune.com"; sid:537280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunities.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunities.net"; sid:537281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplete.com"; sid:537282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomply.com"; sid:537283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomposure.com"; sid:537284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conference.com"; sid:537285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfinement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfinement.com"; sid:537286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacons.com"; sid:537287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conspiracy.com"; sid:537288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconversations.com"; sid:537289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoop.com"; sid:537290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacooperative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacooperative.com"; sid:537291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopia.net"; sid:537292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacops.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacops.life"; sid:537293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouch.com"; sid:537294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19-forum.com"; sid:537295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid.com"; sid:537296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazee.com"; sid:537297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-creditrequest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-creditrequest.com"; sid:537298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.world"; sid:537299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacriticalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacriticalcare.com"; sid:537300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrooks.com"; sid:537301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrowdfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrowdfunding.com"; sid:537302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crunch.com"; sid:537303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrunch.com"; sid:537304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrunched.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrunched.com"; sid:537305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-culture-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-culture-world.com"; sid:537306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-culture-world.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-culture-world.net"; sid:537307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurious.com"; sid:537308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadairies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadairies.com"; sid:537309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaycamp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaycamp.club"; sid:537310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.deals - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.deals"; sid:537311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecontam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecontam.com"; sid:537312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadef.com"; sid:537313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetector.net"; sid:537314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadez.com"; sid:537315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadimmeda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadimmeda.com"; sid:537316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadimmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadimmed.com"; sid:537317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.discount - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.discount"; sid:537318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscounter.com"; sid:537319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscussion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscussion.net"; sid:537320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasechecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasechecker.com"; sid:537321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasehelp.com"; sid:537322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogift.com"; sid:537323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonation.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonation.world"; sid:537324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosea.com"; sid:537325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivethrutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivethrutesting.com"; sid:537326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadroplet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadroplet.com"; sid:537327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadvisor.com"; sid:537328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemployeeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemployeeattorney.com"; sid:537329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemploymentlaw.com"; sid:537330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaennials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaennials.com"; sid:537331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepoch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepoch.com"; sid:537332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaetf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaetf.com"; sid:537333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpressaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpressaa.com"; sid:537334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpressa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpressa.com"; sid:537335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsco.com"; sid:537336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactstoday.com"; sid:537337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafailures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafailures.com"; sid:537338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakes.com"; sid:537339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-faq-kiddiesfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-faq-kiddiesfamily.com"; sid:537340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.farm - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.farm"; sid:537341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafasttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafasttest.com"; sid:537342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaferienmitkind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaferienmitkind.com"; sid:537343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafestival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafestival.club"; sid:537344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafestivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafestivals.com"; sid:537345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafestival.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafestival.world"; sid:537346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafight.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafight.club"; sid:537347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinanceaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinanceaccess.com"; sid:537348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinances.com"; sid:537349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafitness.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafitness.club"; sid:537350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflexbureau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflexbureau.com"; sid:537351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafonds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafonds.net"; sid:537352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafootballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafootballleague.com"; sid:537353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforbusiness.com"; sid:537354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforcefield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforcefield.com"; sid:537355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforecast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforecast.net"; sid:537356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafragen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafragen.com"; sid:537357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.city"; sid:537358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedating.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedating.net"; sid:537359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezones.com"; sid:537360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriends.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriends.club"; sid:537361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundingaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundingaccess.com"; sid:537362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundingexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundingexpert.com"; sid:537363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundinghelp.com"; sid:537364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageld.com"; sid:537365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenda.com"; sid:537366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagilead.com"; sid:537367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagraduate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagraduate.com"; sid:537368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagraduates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagraduates.com"; sid:537369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagraduation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagraduation.com"; sid:537370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahacks.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahacks.life"; sid:537371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaiku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaiku.com"; sid:537372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalloffame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalloffame.com"; sid:537373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaharita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaharita.com"; sid:537374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthdistro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthdistro.com"; sid:537375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpsdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpsdesk.com"; sid:537376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelptips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelptips.com"; sid:537377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesfestival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesfestival.club"; sid:537378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesfestivalclubatelier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesfestivalclubatelier.com"; sid:537379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesfestival.com"; sid:537380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroes.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroes.world"; sid:537381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-hamburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-hamburg.com"; sid:537382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfspaket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfspaket.com"; sid:537383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilft.com"; sid:537384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilft.com"; sid:537385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahockey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahockey.com"; sid:537386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahockeyleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahockeyleague.com"; sid:537387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomechallenge.com"; sid:537388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeschoolacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeschoolacademy.com"; sid:537389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometestingkits.com"; sid:537390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidaho.com"; sid:537391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaina.com"; sid:537392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainbeeld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainbeeld.com"; sid:537393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincrease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincrease.com"; sid:537394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfopoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfopoint.com"; sid:537395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-initiatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-initiatives.com"; sid:537396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainitiatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainitiatives.com"; sid:537397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insolvenzberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insolvenzberatung.com"; sid:537398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsolvenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsolvenz.com"; sid:537399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceadvisors.com"; sid:537400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancehelp.com"; sid:537401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelaw.com"; sid:537402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-investment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-investment.com"; sid:537403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisbs.com"; sid:537404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaj.com"; sid:537405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajd.com"; sid:537406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajeans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajeans.com"; sid:537407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobloss.com"; sid:537408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajournal.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajournal.world"; sid:537409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarte.com"; sid:537410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak.biz"; sid:537411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakickback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakickback.com"; sid:537412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidscarepacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidscarepacks.com"; sid:537413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerco.com"; sid:537414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitfree.com"; sid:537415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakits.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakits.life"; sid:537416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknights.com"; sid:537417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakryptonite.com"; sid:537418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.business"; sid:537419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.education"; sid:537420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.legal"; sid:537421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawny.com"; sid:537422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawoffice.com"; sid:537423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaws.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaws.legal"; sid:537424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaws.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaws.net"; sid:537425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaws.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaws.tax"; sid:537426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyer.net"; sid:537427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleaders.com"; sid:537428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalclaims.com"; sid:537429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliberation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliberation.com"; sid:537430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliberationfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliberationfestival.com"; sid:537431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalibro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalibro.com"; sid:537432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalife.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalife.solutions"; sid:537433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalightfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalightfest.com"; sid:537434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalimits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalimits.com"; sid:537435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-links.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-links.com"; sid:537436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-list.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-list.com"; sid:537437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalit.com"; sid:537438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live-news.com"; sid:537439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalization.com"; sid:537440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalization.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalization.net"; sid:537441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanexpert.com"; sid:537442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanhelp.com"; sid:537443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogsaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogsaa.com"; sid:537444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogsa.com"; sid:537445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalossclaim.com"; sid:537446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalounge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalounge.com"; sid:537447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalungs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalungs.com"; sid:537448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamade.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamade.club"; sid:537449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalpractice.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalpractice.healthcare"; sid:537450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalpracticeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalpracticeinsurance.com"; sid:537451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalpractice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalpractice.net"; sid:537452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamancave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamancave.com"; sid:537453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapbd.com"; sid:537454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask-store.com"; sid:537455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasti.com"; sid:537456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaze.com"; sid:537457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalmalpractice.com"; sid:537458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalmalpractice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalmalpractice.net"; sid:537459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalproducts.com"; sid:537460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-memorial.com"; sid:537461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-merchandise.com"; sid:537462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamic.com"; sid:537463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamindvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamindvirus.com"; sid:537464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamirror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamirror.com"; sid:537465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagelaw.com"; sid:537466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-music-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-music-world.com"; sid:537467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-music-world.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-music-world.net"; sid:537468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewslive.com"; sid:537469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanight.com"; sid:537470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanights.com"; sid:537471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanmed.com"; sid:537472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanomas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanomas.com"; sid:537473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-no.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-no.net"; sid:537474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notfall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notfall.com"; sid:537475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notfallkoffer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notfallkoffer.net"; sid:537476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronantidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronantidote.com"; sid:537477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronantine.com"; sid:537478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaobserver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaobserver.com"; sid:537479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ohne-angst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ohne-angst.com"; sid:537480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoughta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoughta.com"; sid:537481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaought.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaought.com"; sid:537482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapacolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapacolypse.com"; sid:537483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalmbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalmbeach.com"; sid:537484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparadigm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparadigm.com"; sid:537485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparadigm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparadigm.net"; sid:537486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassport.com"; sid:537487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapenguina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapenguina.com"; sid:537488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapenguin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapenguin.com"; sid:537489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pensioner-purchase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pensioner-purchase.com"; sid:537490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapero.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapero.run"; sid:537491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse.biz"; sid:537492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoetry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoetry.com"; sid:537493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoison.com"; sid:537494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositive.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositive.world"; sid:537495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapottoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapottoma.com"; sid:537496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapottom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapottom.com"; sid:537497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapplication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapplication.com"; sid:537498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-press.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-press.com"; sid:537499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapression.com"; sid:537500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproblem.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproblem.bid"; sid:537501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofit.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofit.club"; sid:537502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofrealtor.com"; sid:537503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofyourbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofyourbiz.com"; sid:537504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofyourbrokerage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofyourbrokerage.com"; sid:537505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-psa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-psa.com"; sid:537506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-psa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-psa.net"; sid:537507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-purge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-purge.com"; sid:537508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapuzzle.com"; sid:537509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqq.net"; sid:537510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqq.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqq.today"; sid:537511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquickcheck4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquickcheck4u.com"; sid:537512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quotes.com"; sid:537513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarado.com"; sid:537514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareader.com"; sid:537515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealestateupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealestateupdate.com"; sid:537516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-records.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-records.com"; sid:537517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareflection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareflection.com"; sid:537518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistry.com"; sid:537519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistry.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistry.international"; sid:537520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistry.net"; sid:537521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistry.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistry.world"; sid:537522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelation.com"; sid:537523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief2020.com"; sid:537524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieflawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieflawyer.com"; sid:537525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-repair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-repair.com"; sid:537526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rights.com"; sid:537527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarisklevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarisklevel.com"; sid:537528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariskscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariskscore.com"; sid:537529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-running.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-running.com"; sid:537530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-running.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-running.net"; sid:537531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeagent.com"; sid:537532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeagents.com"; sid:537533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafebroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafebroker.com"; sid:537534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetytraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetytraining.com"; sid:537535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasandchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasandchill.com"; sid:537536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasapp.com"; sid:537537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavers.com"; sid:537538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschaden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschaden.com"; sid:537539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascherm.com"; sid:537540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schild.com"; sid:537541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnell-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnell-test.com"; sid:537542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schule.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schule.network"; sid:537543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzwand.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzwand.gmbh"; sid:537544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasclean.com"; sid:537545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreative.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreative.community"; sid:537546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasealed.com"; sid:537547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseals.com"; sid:537548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseasonschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseasonschools.com"; sid:537549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselbsttest4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselbsttest4u.com"; sid:537550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftest.net"; sid:537551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashitlist.com"; sid:537552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sim.com"; sid:537553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.digital"; sid:537554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.email"; sid:537555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.guide"; sid:537556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.net"; sid:537557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.tips"; sid:537558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-solidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-solidarity.com"; sid:537559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeedtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeedtest.net"; sid:537560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasphinxa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasphinxa.com"; sid:537561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasphinx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasphinx.com"; sid:537562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasportsleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasportsleague.com"; sid:537563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-staatshilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-staatshilfe.com"; sid:537564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastaatshilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastaatshilfe.com"; sid:537565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatsinfo.com"; sid:537566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stats.world"; sid:537567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stellenmarkt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stellenmarkt.com"; sid:537568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterile.com"; sid:537569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulous.com"; sid:537570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulous.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulous.net"; sid:537571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulus2020.com"; sid:537572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoners.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoners.club"; sid:537573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-store.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-store.net"; sid:537574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.study"; sid:537575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stuff.com"; sid:537576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastyles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastyles.com"; sid:537577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-summit.com"; sid:537578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuperhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuperhero.com"; sid:537579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuperheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuperheroes.com"; sid:537580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-support-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-support-online.com"; sid:537581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurivalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurivalbox.com"; sid:537582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor.today"; sid:537583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor.world"; sid:537584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvirusaid.com"; sid:537585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvirussupport.com"; sid:537586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.sydney"; sid:537587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatagebuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatagebuch.com"; sid:537588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateamsix.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateamsix.team"; sid:537589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tees.com"; sid:537590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateez.com"; sid:537591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-teledoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-teledoc.com"; sid:537592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelehealthservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelehealthservices.com"; sid:537593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestandprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestandprotect.com"; sid:537594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-center.com"; sid:537595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.clinic"; sid:537596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsource.com"; sid:537597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheblog.com"; sid:537598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathegame.com"; sid:537599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheory.com"; sid:537600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathreads.com"; sid:537601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronati.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronati.net"; sid:537602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationgifts.com"; sid:537603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatodate.com"; sid:537604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tool.com"; sid:537605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatorium.com"; sid:537606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.town - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.town"; sid:537607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerindia.com"; sid:537608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraitment.com"; sid:537609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelinformation.com"; sid:537610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreated.com"; sid:537611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trennwand.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trennwand.gmbh"; sid:537612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatribunaal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatribunaal.com"; sid:537613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatribunal.com"; sid:537614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruenews.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruenews.fyi"; sid:537615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruthnews.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruthnews.fyi"; sid:537616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturkiye.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturkiye.net"; sid:537617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatv.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatv.amsterdam"; sid:537618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaundjetzt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaundjetzt.com"; sid:537619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunemployment.com"; sid:537620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunemploymenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunemploymenthelp.com"; sid:537621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-united.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-united.com"; sid:537622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmensberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmensberatung.com"; sid:537623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmerhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmerhilfe.com"; sid:537624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatesonline.com"; sid:537625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauptodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauptodate.com"; sid:537626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurgent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurgent.com"; sid:537627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronautmost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronautmost.com"; sid:537628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavallarta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavallarta.com"; sid:537629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavariusclandestino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavariusclandestino.com"; sid:537630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcancer.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcancer.care"; sid:537631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcast.com"; sid:537632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcure.com"; sid:537633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavegas.photos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavegas.photos"; sid:537634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.club"; sid:537635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.company"; sid:537636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.solutions"; sid:537637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavery.com"; sid:537638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-victim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-victim.com"; sid:537639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida.net"; sid:537640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-violator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-violator.com"; sid:537641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviolator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviolator.com"; sid:537642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviolators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviolators.com"; sid:537643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirrusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirrusnow.com"; sid:537644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirunewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirunewsnow.com"; sid:537645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus12.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus12.co.uk"; sid:537646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19hometest.com"; sid:537647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19oracle.com"; sid:537648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19-test.com"; sid:537649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19world.com"; sid:537650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.expert"; sid:537651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.insure"; sid:537652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.study"; sid:537653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020tees.com"; sid:537654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus204.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus204.com"; sid:537655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus20.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus20.co.uk"; sid:537656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus306.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus306.com"; sid:537657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus403.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus403.com"; sid:537658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus416.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus416.com"; sid:537659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus418.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus418.com"; sid:537660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus514.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus514.com"; sid:537661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus604.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus604.com"; sid:537662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus613.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus613.com"; sid:537663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus709.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus709.com"; sid:537664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus780.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus780.com"; sid:537665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus7.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus7.net"; sid:537666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus867.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus867.com"; sid:537667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus902.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus902.com"; sid:537668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus905.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus905.com"; sid:537669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactivitytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactivitytracker.com"; sid:537670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafterparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafterparties.com"; sid:537671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidmiami.com"; sid:537672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalcoholsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalcoholsanitizer.com"; sid:537673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanimals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanimals.com"; sid:537674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytest.com"; sid:537675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytests.com"; sid:537676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantigentest.com"; sid:537677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantigentests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantigentests.com"; sid:537678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusapps.com"; sid:537679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorney.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorney.expert"; sid:537680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutfraud.com"; sid:537681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutfraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutfraud.net"; sid:537682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestproducts.com"; sid:537683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirds.com"; sid:537684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbomb.com"; sid:537685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrowardcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrowardcounty.com"; sid:537686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildings.com"; sid:537687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildings.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildings.net"; sid:537688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessgrantassistanceadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessgrantassistanceadvice.com"; sid:537689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionattorney.com"; sid:537690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionattorneys.com"; sid:537691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionlawyer.com"; sid:537692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionlawyers.com"; sid:537693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionpolicyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionpolicyattorney.com"; sid:537694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionpolicyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionpolicyattorneys.com"; sid:537695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionpolicylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionpolicylawyer.com"; sid:537696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionpolicylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionpolicylawyers.com"; sid:537697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-business.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-business.support"; sid:537698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbythenumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbythenumbers.com"; sid:537699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-by-zip-code.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-by-zip-code.com"; sid:537700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbyzipcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbyzipcode.com"; sid:537701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-by-zip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-by-zip.com"; sid:537702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbyzip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbyzip.com"; sid:537703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusc-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusc-19.com"; sid:537704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusc19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusc19.com"; sid:537705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapitalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapitalism.com"; sid:537706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatering.com"; sid:537707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedcleaner.com"; sid:537708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharity.net"; sid:537709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschatroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschatroom.com"; sid:537710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-checks.com"; sid:537711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaned.com"; sid:537712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerca.com"; sid:537713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerco.com"; sid:537714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerusa.com"; sid:537715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.biz"; sid:537716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningca.com"; sid:537717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservice.net"; sid:537718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscodes.com"; sid:537719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomconsultantgeneral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomconsultantgeneral.com"; sid:537720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommonsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommonsense.com"; sid:537721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationattorney.com"; sid:537722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationattorneys.com"; sid:537723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationlawyer.com"; sid:537724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationlawyers.com"; sid:537725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconditions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconditions.com"; sid:537726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfidentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfidentials.com"; sid:537727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsulta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsulta.com"; sid:537728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselor.net"; sid:537729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovers.com"; sid:537730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19antidote.com"; sid:537731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19.biz"; sid:537732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.business"; sid:537733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.life"; sid:537734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.today"; sid:537735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19.world"; sid:537736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.club"; sid:537737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.guru"; sid:537738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cure.net"; sid:537739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurse.com"; sid:537740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-damages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-damages.com"; sid:537741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatamap.com"; sid:537742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdealoftheday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdealoftheday.com"; sid:537743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtinfo.com"; sid:537744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdeepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdeepclean.com"; sid:537745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetections.com"; sid:537746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdevices.com"; sid:537747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdevotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdevotions.com"; sid:537748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.direct"; sid:537749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterloans.com"; sid:537750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease20.com"; sid:537751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecovid19.net"; sid:537752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectants.net"; sid:537753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfected.com"; sid:537754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingservice.com"; sid:537755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfection.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfection.services"; sid:537756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdroga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdroga.com"; sid:537757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrogas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrogas.com"; sid:537758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrools.com"; sid:537759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrops.com"; sid:537760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecomsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecomsurvey.com"; sid:537761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicdisaster.com"; sid:537762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseinfo.com"; sid:537763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemics.com"; sid:537764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesba.com"; sid:537765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexamen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexamen.com"; sid:537766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexamenes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexamenes.com"; sid:537767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.express"; sid:537768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusf.com"; sid:537769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfifa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfifa.com"; sid:537770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.finance"; sid:537771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinances.com"; sid:537772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialaid.com"; sid:537773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialassistance.com"; sid:537774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.fish - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.fish"; sid:537775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfmla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfmla.com"; sid:537776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodkitsforseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodkitsforseniors.com"; sid:537777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsurvey.com"; sid:537778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforbusiness.com"; sid:537779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforecaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforecaster.com"; sid:537780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfraud.net"; sid:537781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundingaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundingaccess.com"; sid:537782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeddon.com"; sid:537783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ghana.com"; sid:537784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobal.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobal.chat"; sid:537785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgram.com"; sid:537786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.club"; sid:537787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp4u.com"; sid:537788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp4you.com"; sid:537789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.agency"; sid:537790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpforyou.com"; sid:537791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpwellnesscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpwellnesscheck.com"; sid:537792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestusa.com"; sid:537793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotel.net"; sid:537794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotels.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotels.net"; sid:537795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoy.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoy.life"; sid:537796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushunters.com"; sid:537797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushurtsyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushurtsyou.com"; sid:537798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunesupport.com"; sid:537799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunityproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunityproducts.com"; sid:537800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinegypt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinegypt.com"; sid:537801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfolinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfolinks.com"; sid:537802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationusa.com"; sid:537803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformer.com"; sid:537804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusink.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusink.club"; sid:537805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusink.com"; sid:537806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusink.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusink.life"; sid:537807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusink.net"; sid:537808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusink.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusink.world"; sid:537809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinpakistan.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinpakistan.today"; sid:537810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceadvisors.com"; sid:537811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancehelp.com"; sid:537812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancelaw.com"; sid:537813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancerecovery.com"; sid:537814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinventory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinventory.com"; sid:537815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjelly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjelly.com"; sid:537816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobs.net"; sid:537817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobs.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobs.today"; sid:537818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillers.net"; sid:537819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-killers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-killers.world"; sid:537820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknow.com"; sid:537821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknows.com"; sid:537822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskompensation.com"; sid:537823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskryptonite.com"; sid:537824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatkovski.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatkovski.com"; sid:537825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawhelp.com"; sid:537826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawny.com"; sid:537827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer.expert"; sid:537828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaladviceonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaladviceonline.com"; sid:537829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaladviceonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaladviceonline.net"; sid:537830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaladvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaladvisors.com"; sid:537831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalaid.com"; sid:537832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegaldefense.com"; sid:537833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegal.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegal.expert"; sid:537834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalfirm.com"; sid:537835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalhelpflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalhelpflorida.com"; sid:537836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalminute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalminute.com"; sid:537837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegal.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegal.services"; sid:537838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalupdate.com"; sid:537839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslexicon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslexicon.com"; sid:537840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslexlatkovski.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslexlatkovski.com"; sid:537841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslgbt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslgbt.com"; sid:537842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslgbtq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslgbtq.com"; sid:537843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lima.com"; sid:537844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslima.com"; sid:537845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-liveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-liveupdates.com"; sid:537846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloan.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloan.loans"; sid:537847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloan.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloan.money"; sid:537848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.loans"; sid:537849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslodging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslodging.com"; sid:537850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalpractice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalpractice.net"; sid:537851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks911.com"; sid:537852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedecina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedecina.com"; sid:537853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedecinas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedecinas.com"; sid:537854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicamento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicamento.com"; sid:537855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicamentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicamentos.com"; sid:537856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicina.com"; sid:537857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicinas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicinas.com"; sid:537858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemes.net"; sid:537859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-meter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-meter.com"; sid:537860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiescke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiescke.com"; sid:537861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmike.com"; sid:537862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmobileclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmobileclinics.com"; sid:537863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-money.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-money.support"; sid:537864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitoring.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitoring.life"; sid:537865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.life"; sid:537866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.today"; sid:537867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.world"; sid:537868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnames.com"; sid:537869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsalerts.com"; sid:537870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.center"; sid:537871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewslinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewslinks.com"; sid:537872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-newz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-newz.com"; sid:537873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-niger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-niger.com"; sid:537874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovelties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovelties.com"; sid:537875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnumbers.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnumbers.club"; sid:537876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomedeath.com"; sid:537877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomedeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomedeathlawsuit.com"; sid:537878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnwo.com"; sid:537879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonw.com"; sid:537880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-oracle.com"; sid:537881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusoracle.com"; sid:537882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oracle.com"; sid:537883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorders.com"; sid:537884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreakusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreakusa.com"; sid:537885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutburst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutburst.com"; sid:537886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspalmbeachcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspalmbeachcounty.com"; sid:537887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandamic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandamic.com"; sid:537888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.party"; sid:537889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanb.com"; sid:537890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoop.com"; sid:537891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoopservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoopservice.com"; sid:537892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspot.com"; sid:537893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprank.com"; sid:537894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventions.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventions.world"; sid:537895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protected.com"; sid:537896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectioncleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectioncleaning.com"; sid:537897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection.guru"; sid:537898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprueba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprueba.com"; sid:537899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspruebas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspruebas.com"; sid:537900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspsych.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspsych.com"; sid:537901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinenc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinenc.com"; sid:537902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinenc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinenc.net"; sid:537903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinesolutions.com"; sid:537904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealtimeupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealtimeupdates.com"; sid:537905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryloans.com"; sid:537906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelated.com"; sid:537907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefcalculator.com"; sid:537908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefloans.com"; sid:537909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefplan.com"; sid:537910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremembrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremembrance.com"; sid:537911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremover.com"; sid:537912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrentreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrentreduction.com"; sid:537913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresoursecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresoursecenter.com"; sid:537914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseactlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseactlaw.com"; sid:537915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresultado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresultado.com"; sid:537916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresultados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresultados.com"; sid:537917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrewards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrewards.com"; sid:537918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskscore.com"; sid:537919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetytraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetytraining.com"; sid:537920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanatizingcontractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanatizingcontractor.com"; sid:537921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbabusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbabusinessloan.com"; sid:537922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbadisasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbadisasterloan.com"; sid:537923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscotland.com"; sid:537924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusskibo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusskibo.com"; sid:537925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinesshelp.com"; sid:537926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthflorida.com"; sid:537927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecials.com"; sid:537928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstaff.com"; sid:537929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatenisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatenisland.com"; sid:537930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-suits.com"; sid:537931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-surgical-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-surgical-mask.com"; sid:537932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvival.club"; sid:537933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-survivalkit.com"; sid:537934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivor.net"; sid:537935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswabkit.com"; sid:537936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomstest.com"; sid:537937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptons.com"; sid:537938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustactics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustactics.com"; sid:537939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechhelp.com"; sid:537940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestbeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestbeverlyhills.com"; sid:537941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestbymail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestbymail.com"; sid:537942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingbeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingbeverlyhills.com"; sid:537943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing-centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing-centers.com"; sid:537944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.expert"; sid:537945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglosangeles.com"; sid:537946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.services"; sid:537947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingservices.com"; sid:537948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingtoday.com"; sid:537949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitnv.com"; sid:537950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitnv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitnv.net"; sid:537951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitus.com"; sid:537952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitus.net"; sid:537953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlosangeles.com"; sid:537954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapist.net"; sid:537955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustips.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustips.today"; sid:537956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusto.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusto.date"; sid:537957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustodayupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustodayupdates.com"; sid:537958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustomelloso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustomelloso.com"; sid:537959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracker.world"; sid:537960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrades.com"; sid:537961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustratamientos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustratamientos.com"; sid:537962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemploymenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemploymenthelp.com"; sid:537963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusup.com"; sid:537964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.center"; sid:537965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates.network"; sid:537966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupto.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupto.date"; sid:537967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinefl.com"; sid:537968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinefl.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinefl.net"; sid:537969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.international"; sid:537970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccines.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccines.world"; sid:537971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccine.world"; sid:537972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacunas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacunas.com"; sid:537973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvets.com"; sid:537974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.viajes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.viajes"; sid:537975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictorygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictorygarden.com"; sid:537976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictorygardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictorygardens.com"; sid:537977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvodka.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvodka.net"; sid:537978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvortex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvortex.com"; sid:537979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswater.com"; sid:537980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusw.com"; sid:537981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswedding.com"; sid:537982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweed.com"; sid:537983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswewolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswewolunteer.com"; sid:537984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhattostockupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhattostockupon.com"; sid:537985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wiki.com"; sid:537986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswillnotbeatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswillnotbeatus.com"; sid:537987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusymtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusymtoms.com"; sid:537988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyogastream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyogastream.com"; sid:537989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir.zone"; sid:537990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavision.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavision.network"; sid:537991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitionstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitionstreet.com"; sid:537992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviursnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviursnow.com"; sid:537993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoices.com"; sid:537994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurusnewsnow.com"; sid:537995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavvirus.com"; sid:537996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wall.com"; sid:537997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawar2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawar2020.com"; sid:537998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawear.net"; sid:537999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweatherindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweatherindex.com"; sid:538000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-web.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-web.com"; sid:538001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawholesaling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawholesaling.com"; sid:538002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawiki.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawiki.net"; sid:538003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-win.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-win.com"; sid:538004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-win.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-win.net"; sid:538005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkout.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkout.club"; sid:538006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldometers.com"; sid:538007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldtour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldtour2020.com"; sid:538008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawx.com"; sid:538009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayak.com"; sid:538010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaybaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaybaby.com"; sid:538011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoga.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoga.club"; sid:538012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazap.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazap.guru"; sid:538013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corsocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corsocovid.com"; sid:538014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couplescopingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couplescopingwithcorona.com"; sid:538015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveryourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveryourcovid.com"; sid:538016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid199.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid199.com"; sid:538017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agent.com"; sid:538018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aintshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aintshit.com"; sid:538019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alarm.com"; sid:538020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andchill.com"; sid:538021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytests.com"; sid:538022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antidote.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antidote.world"; sid:538023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentest.com"; sid:538024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentests.com"; sid:538025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirals.com"; sid:538026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antiviraltherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antiviraltherapies.com"; sid:538027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antiviraltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antiviraltherapy.com"; sid:538028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19api.com"; sid:538029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19argentina.com"; sid:538030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19art.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19art.net"; sid:538031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artstories.com"; sid:538032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artstories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artstories.net"; sid:538033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-atol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-atol.com"; sid:538034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorney.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorney.expert"; sid:538035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azlaw.com"; sid:538036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bankruptcy.com"; sid:538037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcylawyer.com"; sid:538038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bellevue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bellevue.com"; sid:538039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bellevuedecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bellevuedecontamination.com"; sid:538040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19benafits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19benafits.com"; sid:538041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bi.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bi.claims"; sid:538042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bloodtests.com"; sid:538043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19brasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19brasil.com"; sid:538044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bridge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bridge.com"; sid:538045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessfunding.com"; sid:538046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessguidance.com"; sid:538047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinsurance.com"; sid:538048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionattorney.com"; sid:538049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionattorneys.com"; sid:538050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionlawyer.com"; sid:538051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionlawyers.com"; sid:538052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionpolicyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionpolicyattorney.com"; sid:538053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionpolicyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionpolicyattorneys.com"; sid:538054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionpolicylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionpolicylawyer.com"; sid:538055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionpolicylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionpolicylawyers.com"; sid:538056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslaw.com"; sid:538057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessloans.com"; sid:538058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business.support"; sid:538059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-by-zip-code.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-by-zip-code.com"; sid:538060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19byzipcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19byzipcode.com"; sid:538061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-by-zip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-by-zip.com"; sid:538062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19byzip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19byzip.com"; sid:538063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cad.com"; sid:538064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cali.com"; sid:538065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calilockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calilockdown.com"; sid:538066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calls.com"; sid:538067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19card.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19card.com"; sid:538068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cardiactest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cardiactest.com"; sid:538069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cash.com"; sid:538070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdcfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdcfacts.com"; sid:538071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdcupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdcupdate.com"; sid:538072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-center.com"; sid:538073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centurytree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centurytree.net"; sid:538074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19charities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19charities.com"; sid:538075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19charts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19charts.net"; sid:538076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chilemakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chilemakers.com"; sid:538077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chopo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chopo.com"; sid:538078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.church"; sid:538079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19church.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19church.com"; sid:538080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.claims"; sid:538081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsolutions.com"; sid:538082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classaction.net"; sid:538083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionsuit.com"; sid:538084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningfortworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningfortworth.com"; sid:538085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningmiami.com"; sid:538086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmiami.com"; sid:538087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.net"; sid:538088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningpalmbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningpalmbeach.com"; sid:538089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clean.net"; sid:538090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleans.com"; sid:538091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleansolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleansolutions.com"; sid:538092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.coffee"; sid:538093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collective.com"; sid:538094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialrentreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialrentreduction.com"; sid:538095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commericalrentreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commericalrentreduction.com"; sid:538096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commonsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commonsense.com"; sid:538097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19con.com"; sid:538098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19confidentialtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19confidentialtest.com"; sid:538099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connection.com"; sid:538100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-conspiracy.com"; sid:538101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19constructionimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19constructionimpact.com"; sid:538102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacts.com"; sid:538103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contractedat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contractedat.com"; sid:538104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coop.com"; sid:538105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cooperative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cooperative.com"; sid:538106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusalert.com"; sid:538107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusdisease.com"; sid:538108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counselor.com"; sid:538109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counselor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counselor.net"; sid:538110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crazies.com"; sid:538111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cred.com"; sid:538112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19credential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19credential.com"; sid:538113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19credits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19credits.com"; sid:538114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cura.com"; sid:538115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure.club"; sid:538116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curekit.com"; sid:538117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damage.com"; sid:538118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damages.com"; sid:538119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19death.com"; sid:538120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontam.com"; sid:538121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationseattle.com"; sid:538122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19delays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19delays.com"; sid:538123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalhub.com"; sid:538124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentists.com"; sid:538125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desdelatrinxera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desdelatrinxera.com"; sid:538126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-detector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-detector.com"; sid:538127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfect.com"; sid:538128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfected.com"; sid:538129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfecters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfecters.com"; sid:538130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfecting.com"; sid:538131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionservice.com"; sid:538132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfector.com"; sid:538133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectors.com"; sid:538134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divorces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divorces.com"; sid:538135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19docs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19docs.com"; sid:538136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-doctor.com"; sid:538137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-doctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-doctors.com"; sid:538138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donator.com"; sid:538139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19droga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19droga.com"; sid:538140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19droga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19droga.com"; sid:538141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drogas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drogas.com"; sid:538142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drogas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drogas.com"; sid:538143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtherapy.com"; sid:538144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dz.com"; sid:538145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecomsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecomsurvey.com"; sid:538146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencykit.com"; sid:538147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyrelieffund.com"; sid:538148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enmexico.com"; sid:538149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-entreprises89.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-entreprises89.com"; sid:538150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-entreprises89.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-entreprises89.net"; sid:538151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19entryscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19entryscreen.com"; sid:538152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epi.com"; sid:538153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19espana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19espana.com"; sid:538154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19examen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19examen.com"; sid:538155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19examen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19examen.com"; sid:538156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facts.biz"; sid:538157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fashion.com"; sid:538158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fasttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fasttest.com"; sid:538159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fight.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fight.club"; sid:538160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fighter.com"; sid:538161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fighter.com"; sid:538162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.financial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.financial"; sid:538163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialaid.com"; sid:538164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialhelp.com"; sid:538165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialpanic.com"; sid:538166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialrelief.com"; sid:538167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialsupport.com"; sid:538168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firewall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firewall.com"; sid:538169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firm.com"; sid:538170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fj.com"; sid:538171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fj.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fj.net"; sid:538172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.flights"; sid:538173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fl.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fl.net"; sid:538174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-flu.com"; sid:538175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.football - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.football"; sid:538176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foremployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foremployers.com"; sid:538177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fortworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fortworth.com"; sid:538178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fraud.com"; sid:538179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fraud.net"; sid:538180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fraud.net"; sid:538181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.life"; sid:538182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freezone.com"; sid:538183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ftworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ftworth.com"; sid:538184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraiser.com"; sid:538185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fx.com"; sid:538186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19games.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19games.com"; sid:538187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gate.com"; sid:538188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gen.com"; sid:538189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.gifts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.gifts"; sid:538190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gilead.com"; sid:538191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalstats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalstats.world"; sid:538192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gone.com"; sid:538193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-gov.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-gov.claims"; sid:538194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grantor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grantor.com"; sid:538195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.gratis - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.gratis"; sid:538196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19greenzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19greenzone.com"; sid:538197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19guatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19guatemala.com"; sid:538198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handsanitizer.com"; sid:538199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hasan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hasan.net"; sid:538200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthtest.com"; sid:538201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help4u.com"; sid:538202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help4you.com"; sid:538203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpforyou.com"; sid:538204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-helpme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-helpme.com"; sid:538205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpme.com"; sid:538206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19holisitc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19holisitc.com"; sid:538207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19holistichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19holistichealth.com"; sid:538208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homekits.com"; sid:538209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometestingkit.com"; sid:538210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotel.com"; sid:538211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotel.net"; sid:538212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingrelief.com"; sid:538213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hpc-consortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hpc-consortium.com"; sid:538214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hpcconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hpcconsortium.com"; sid:538215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hurts.com"; sid:538216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hurtsyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hurtsyou.com"; sid:538217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hydroxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hydroxy.com"; sid:538218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idahocares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idahocares.com"; sid:538219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-i-have-it.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-i-have-it.com"; sid:538220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immune.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immune.net"; sid:538221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ind.com"; sid:538222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infosite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infosite.com"; sid:538223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injamaica.com"; sid:538224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylaw.com"; sid:538225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylawsuit.com"; sid:538226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylawsuits.com"; sid:538227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylawyers.com"; sid:538228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ink.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ink.club"; sid:538229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ink.com"; sid:538230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ink.com"; sid:538231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ink.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ink.life"; sid:538232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ink.net"; sid:538233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ink.net"; sid:538234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ink.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ink.world"; sid:538235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmyarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmyarea.com"; sid:538236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inoculation.com"; sid:538237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insanity.com"; sid:538238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instatest.com"; sid:538239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insuranceclaims.com"; sid:538240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimsolutions.com"; sid:538241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancehelp.com"; sid:538242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelaw.com"; sid:538243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancerecovery.com"; sid:538244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancerecovery.com"; sid:538245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interruption.com"; sid:538246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inventory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inventory.com"; sid:538247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.investments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.investments"; sid:538248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.investments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.investments"; sid:538249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isreal.com"; sid:538250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jd.com"; sid:538251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19juareznl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19juareznl.com"; sid:538252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kc.com"; sid:538253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kerala.com"; sid:538254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kidcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kidcamp.com"; sid:538255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killer.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killer.pro"; sid:538256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killersbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killersbiz.com"; sid:538257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-killers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-killers.world"; sid:538258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kits.com"; sid:538259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kompensation.com"; sid:538260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kompensation.com"; sid:538261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ksa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ksa.com"; sid:538262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labkit.com"; sid:538263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laboratories.com"; sid:538264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laboratorytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laboratorytest.com"; sid:538265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laboratorytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laboratorytests.com"; sid:538266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labtests.com"; sid:538267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawer.com"; sid:538268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawhelp.com"; sid:538269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawinfo.com"; sid:538270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawny.com"; sid:538271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawoffices.com"; sid:538272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.expert"; sid:538273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerhelp.com"; sid:538274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19layoff.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19layoff.today"; sid:538275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19layoff.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19layoff.world"; sid:538276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-learn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-learn.com"; sid:538277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvice.com"; sid:538278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legaladvice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legaladvice.net"; sid:538279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvice.net"; sid:538280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legaladviceonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legaladviceonline.com"; sid:538281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalassistance.com"; sid:538282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalassistance.com"; sid:538283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalfirm.com"; sid:538284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalgroup.com"; sid:538285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalgroup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalgroup.net"; sid:538286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalguide.com"; sid:538287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelpdesk.com"; sid:538288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalnetwork.com"; sid:538289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalrelief.com"; sid:538290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalsolutions.com"; sid:538291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legislation.com"; sid:538292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lgbt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lgbt.com"; sid:538293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.limited - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.limited"; sid:538294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanhelp.com"; sid:538295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19london.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19london.com"; sid:538296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lungs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lungs.com"; sid:538297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19magazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19magazine.com"; sid:538298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malang.com"; sid:538299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malta.com"; sid:538300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.management"; sid:538301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19measures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19measures.com"; sid:538302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19measures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19measures.net"; sid:538303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-med.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-med.com"; sid:538304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medecina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medecina.com"; sid:538305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medecina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medecina.com"; sid:538306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medical.com"; sid:538307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalnews.com"; sid:538308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicamento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicamento.com"; sid:538309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicamento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicamento.com"; sid:538310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicamentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicamentos.com"; sid:538311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicamentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicamentos.com"; sid:538312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicare.com"; sid:538313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-memes.com"; sid:538314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memes.net"; sid:538315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-memorial.com"; sid:538316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-merchandise.com"; sid:538317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mex.com"; sid:538318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mfg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mfg.com"; sid:538319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musicmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musicmarketplace.com"; sid:538320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neb.com"; sid:538321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsreport.com"; sid:538322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsreport.com"; sid:538323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsroundup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsroundup.com"; sid:538324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsroundup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsroundup.com"; sid:538325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsupdate.com"; sid:538326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nh.com"; sid:538327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nonprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nonprofit.com"; sid:538328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19novelties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19novelties.com"; sid:538329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nursinghomedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nursinghomedeath.com"; sid:538330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomedeath.com"; sid:538331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nursinghomedeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nursinghomedeathlawsuit.com"; sid:538332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomedeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomedeathlawsuit.com"; sid:538333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oacle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oacle.com"; sid:538334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19observatory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19observatory.com"; sid:538335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinemd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinemd.com"; sid:538336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinemd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinemd.com"; sid:538337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19online.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19online.net"; sid:538338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orace.com"; sid:538339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracl.com"; sid:538340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.care"; sid:538341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.clinic"; sid:538342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-oracle.com"; sid:538343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracle.com"; sid:538344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-oracle.com"; sid:538345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.healthcare"; sid:538346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.net"; sid:538347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orale.com"; sid:538348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orcle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orcle.com"; sid:538349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outbreak.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outbreak.today"; sid:538350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-outlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-outlet.com"; sid:538351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19outlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19outlet.com"; sid:538352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicera.com"; sid:538353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicprose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicprose.com"; sid:538354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.parts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.parts"; sid:538355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pass.com"; sid:538356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.com"; sid:538357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payments.com"; sid:538358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pep.com"; sid:538359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phlhelplines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phlhelplines.com"; sid:538360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.pizza"; sid:538361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.pizza"; sid:538362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pizza.com"; sid:538363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poker.com"; sid:538364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prayerwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prayerwall.com"; sid:538365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-protection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-protection.net"; sid:538366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protector.com"; sid:538367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prueba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prueba.com"; sid:538368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prueba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prueba.com"; sid:538369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pruebas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pruebas.com"; sid:538370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pruebas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pruebas.com"; sid:538371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pscs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pscs.com"; sid:538372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptsd.com"; sid:538373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptsd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptsd.net"; sid:538374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pulse.com"; sid:538375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pulse.com"; sid:538376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radiotv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radiotv.com"; sid:538377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestingkits.com"; sid:538378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestate.com"; sid:538379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatehelp.com"; sid:538380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19records.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19records.com"; sid:538381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reginarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reginarelief.com"; sid:538382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-registry.com"; sid:538383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registry.net"; sid:538384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registryproject.com"; sid:538385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rehab.com"; sid:538386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rehab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rehab.net"; sid:538387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.life"; sid:538388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefnow.com"; sid:538389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.today"; sid:538390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remboursement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remboursement.net"; sid:538391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reset.com"; sid:538392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19response.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19response.finance"; sid:538393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-response.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-response.finance"; sid:538394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response.finance"; sid:538395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19revealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19revealed.com"; sid:538396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskscore.com"; sid:538397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rna.com"; sid:538398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roatan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roatan.com"; sid:538399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-running.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-running.com"; sid:538400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19running.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19running.com"; sid:538401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-running.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-running.net"; sid:538402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19running.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19running.net"; sid:538403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safefashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safefashion.com"; sid:538404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyguide.com"; sid:538405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scam.com"; sid:538406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scam.net"; sid:538407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scam.net"; sid:538408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scams.com"; sid:538409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scams.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scams.net"; sid:538410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scams.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scams.net"; sid:538411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scanner.com"; sid:538412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-scarecampaign2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-scarecampaign2020.com"; sid:538413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningkits.com"; sid:538414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screeningny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screeningny.com"; sid:538415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sealed.com"; sid:538416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seattledecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seattledecontamination.com"; sid:538417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattledecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattledecontamination.com"; sid:538418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shield.com"; sid:538419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shitshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shitshow.com"; sid:538420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sim.com"; sid:538421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sl.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sl.today"; sid:538422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19social.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19social.com"; sid:538423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19society.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19society.com"; sid:538424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solicitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solicitors.com"; sid:538425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solve.com"; sid:538426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southflorida.com"; sid:538427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19speedtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19speedtest.net"; sid:538428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srl.com"; sid:538429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19staffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19staffing.com"; sid:538430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19statistics.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19statistics.world"; sid:538431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statsnow.com"; sid:538432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluscheck.com"; sid:538433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-store.com"; sid:538434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-store.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-store.net"; sid:538435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stories.net"; sid:538436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19studies.com"; sid:538437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stuff.com"; sid:538438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.style"; sid:538439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-suits.com"; sid:538440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suits.com"; sid:538441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplychain.com"; sid:538442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-support.com"; sid:538443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.surgery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.surgery"; sid:538444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survival.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survival.guide"; sid:538445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorkit.com"; sid:538446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survivor.net"; sid:538447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swap.com"; sid:538448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techtaskforce.com"; sid:538449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teesforacause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teesforacause.com"; sid:538450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tent.com"; sid:538451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19terapia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19terapia.com"; sid:538452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19terapia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19terapia.com"; sid:538453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test4u.com"; sid:538454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testandprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testandprotect.com"; sid:538455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.center"; sid:538456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingdata.com"; sid:538457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingireland.com"; sid:538458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnow.com"; sid:538459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingsource.com"; sid:538460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.plus - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.plus"; sid:538461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnyc.com"; sid:538462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testny.com"; sid:538463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.plus - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.plus"; sid:538464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testpro.com"; sid:538465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtoday.com"; sid:538466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testus.com"; sid:538467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapist.com"; sid:538468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapist.net"; sid:538469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thermaldetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thermaldetection.com"; sid:538470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-thermometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-thermometers.com"; sid:538471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19things.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19things.com"; sid:538472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19time.com"; sid:538473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tomorrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tomorrow.com"; sid:538474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tracker.net"; sid:538475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.world"; sid:538476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.net"; sid:538477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19treament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19treament.com"; sid:538478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treament.com"; sid:538479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treated.com"; sid:538480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-treatments.com"; sid:538481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trial.com"; sid:538482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truth2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truth2020.com"; sid:538483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymenthelp.com"; sid:538484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19untested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19untested.com"; sid:538485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatespa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatespa.com"; sid:538486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa2020.com"; sid:538487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.mobi"; sid:538488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccine.net"; sid:538489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine.net"; sid:538490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccines.net"; sid:538491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ventilators.com"; sid:538492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ventilators.com"; sid:538493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victorygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victorygarden.com"; sid:538494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victorygardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victorygardens.com"; sid:538495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtual5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtual5k.com"; sid:538496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.care"; sid:538497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusepidemic.com"; sid:538498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfoundation.com"; sid:538499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslaw.com"; sid:538500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vodka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vodka.com"; sid:538501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vodka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vodka.com"; sid:538502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vodka.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vodka.net"; sid:538503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vodka.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vodka.net"; sid:538504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vortex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vortex.com"; sid:538505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-webinars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-webinars.com"; sid:538506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wh.com"; sid:538507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19whiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19whiskey.com"; sid:538508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whiskey.com"; sid:538509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19whisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19whisky.com"; sid:538510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19whisky.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19whisky.net"; sid:538511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whisky.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whisky.net"; sid:538512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrexham.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrexham.wales"; sid:538513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19x.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19x.biz"; sid:538514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19yourstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19yourstories.com"; sid:538515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019drug.com"; sid:538516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019emergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019emergencykit.com"; sid:538517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019health.com"; sid:538518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.life"; sid:538519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.systems"; sid:538520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21questions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21questions.biz"; sid:538521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-31.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-31.com"; sid:538522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-34.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-34.com"; sid:538523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-35.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-35.com"; sid:538524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid360.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid360.net"; sid:538525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-36.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-36.com"; sid:538526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-37.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-37.com"; sid:538527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid54daynovena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid54daynovena.com"; sid:538528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.academy"; sid:538529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacademy.com"; sid:538530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidados.com"; sid:538531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagent.com"; sid:538532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ai.com"; sid:538533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid.net"; sid:538534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidance.com"; sid:538535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangels.com"; sid:538536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidata.net"; sid:538537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatanews.com"; sid:538538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathometestkit.com"; sid:538539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattys.com"; sid:538540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida.win"; sid:538541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidazlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidazlaw.com"; sid:538542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbag.com"; sid:538543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailoutfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailoutfraud.com"; sid:538544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bankruptcy.com"; sid:538545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-battle.com"; sid:538546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbi.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbi.claims"; sid:538547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioshield.com"; sid:538548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtest.com"; sid:538549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtests.com"; sid:538550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbody.com"; sid:538551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelet.com"; sid:538552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbr.com"; sid:538553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecovery.com"; sid:538554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecoverygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecoverygroup.com"; sid:538555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecovery.net"; sid:538556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcad.com"; sid:538557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcafe.com"; sid:538558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalvary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalvary.com"; sid:538559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamper.com"; sid:538560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampers.com"; sid:538561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcape.com"; sid:538562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare-carec2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare-carec2.com"; sid:538563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareonline.com"; sid:538564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertified.com"; sid:538565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchainbreaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchainbreaker.com"; sid:538566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchatbot.com"; sid:538567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checks.com"; sid:538568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checkup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checkup.com"; sid:538569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcaresurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcaresurvey.com"; sid:538570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclz.com"; sid:538571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidci.com"; sid:538572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcities.com"; sid:538573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean19.com"; sid:538574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanser.com"; sid:538575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanx.com"; sid:538576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktails.com"; sid:538577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocoon.com"; sid:538578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoder.com"; sid:538579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedyfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedyfestival.com"; sid:538580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommerce.com"; sid:538581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommonsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommonsense.com"; sid:538582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitycookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitycookbook.com"; sid:538583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunity.net"; sid:538584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconference.com"; sid:538585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrol.net"; sid:538586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrols.com"; sid:538587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona2020.com"; sid:538588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughcollector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughcollector.com"; sid:538589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-couture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-couture.com"; sid:538590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouture.com"; sid:538591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-covid19.com"; sid:538592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoyotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoyotes.com"; sid:538593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoyotes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoyotes.net"; sid:538594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraft.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraft.club"; sid:538595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreatives.com"; sid:538596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreativity.com"; sid:538597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredits.com"; sid:538598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupid.com"; sid:538599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcura.com"; sid:538600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcured.com"; sid:538601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddamage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddamage.com"; sid:538602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddds.com"; sid:538603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-decon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-decon.com"; sid:538604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecontam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecontam.com"; sid:538605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefend.com"; sid:538606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentist.com"; sid:538607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentists.com"; sid:538608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetector.com"; sid:538609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiecinueve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiecinueve.com"; sid:538610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-digital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-digital.com"; sid:538611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidding.com"; sid:538612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddingme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddingme.com"; sid:538613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddna.com"; sid:538614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocs.com"; sid:538615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-doctor.com"; sid:538616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctorny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctorny.com"; sid:538617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-doctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-doctors.com"; sid:538618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctorsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctorsny.com"; sid:538619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddot.com"; sid:538620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.download"; sid:538621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddroga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddroga.com"; sid:538622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrogas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrogas.com"; sid:538623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideal.com"; sid:538624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideate.com"; sid:538625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideation.com"; sid:538626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideducation.com"; sid:538627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelicious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelicious.com"; sid:538628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemescouilles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemescouilles.com"; sid:538629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidems.com"; sid:538630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentist.com"; sid:538631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentistry.com"; sid:538632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentists.com"; sid:538633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideodating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideodating.com"; sid:538634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideopub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideopub.com"; sid:538635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos.life"; sid:538636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepcr.com"; sid:538637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepi.com"; sid:538638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covider.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covider.net"; sid:538639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapes.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapes.co.uk"; sid:538640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesq.com"; sid:538641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestateplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestateplanning.com"; sid:538642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideuskadi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideuskadi.net"; sid:538643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexamen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexamen.com"; sid:538644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.exposed"; sid:538645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideye.com"; sid:538646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeed.com"; sid:538647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fight.com"; sid:538648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.club"; sid:538649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.digital"; sid:538650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.network"; sid:538651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.today"; sid:538652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinder.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinder.world"; sid:538653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirewall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirewall.com"; sid:538654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirm.com"; sid:538655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfitig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfitig.com"; sid:538656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.fitness"; sid:538657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfleck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfleck.com"; sid:538658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix.com"; sid:538659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfools.com"; sid:538660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfordummies.com"; sid:538661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfume.com"; sid:538662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfumedecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfumedecon.com"; sid:538663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfumer.com"; sid:538664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfun.com"; sid:538665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenerations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenerations.com"; sid:538666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgesundheit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgesundheit.com"; sid:538667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgetover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgetover.com"; sid:538668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgilead.com"; sid:538669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgin.com"; sid:538670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.graphics"; sid:538671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguidance.com"; sid:538672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealer.com"; sid:538673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthinsurance.com"; sid:538674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthplan.com"; sid:538675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthy.com"; sid:538676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheilung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheilung.com"; sid:538677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpathome.com"; sid:538678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.directory"; sid:538679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpma.com"; sid:538680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hep.net"; sid:538681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhigh.com"; sid:538682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhighschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhighschool.com"; sid:538683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidh.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidh.net"; sid:538684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesaleoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesaleoffer.com"; sid:538685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalsupply.com"; sid:538686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanpsychologicaldisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanpsychologicaldisorder.com"; sid:538687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiag.com"; sid:538688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididn.com"; sid:538689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiecinueve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiecinueve.com"; sid:538690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidier.com"; sid:538691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpacts.com"; sid:538692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpfung.com"; sid:538693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimunnity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimunnity.com"; sid:538694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimunnity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimunnity.net"; sid:538695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.fyi"; sid:538696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-informer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-informer.com"; sid:538697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsanity.com"; sid:538698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelaw.com"; sid:538699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinventory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinventory.com"; sid:538700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot-20.com"; sid:538701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot20.com"; sid:538702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditems.com"; sid:538703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditi.com"; sid:538704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjd.com"; sid:538705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeys.com"; sid:538706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids.net"; sid:538707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller.pro"; sid:538708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkosova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkosova.com"; sid:538709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkz.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkz.today"; sid:538710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw.biz"; sid:538711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawinfo.com"; sid:538712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawny.com"; sid:538713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerma.com"; sid:538714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlayoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlayoff.com"; sid:538715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlies.com"; sid:538716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidline.com"; sid:538717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivenews.com"; sid:538718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivesmatter.com"; sid:538719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogic.com"; sid:538720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.management"; sid:538721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapusa.com"; sid:538722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-maroc.com"; sid:538723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascarilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascarilla.com"; sid:538724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mask-makers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mask-makers.com"; sid:538725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedecina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedecina.com"; sid:538726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedical.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedical.life"; sid:538727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicaltest.com"; sid:538728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicamento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicamento.com"; sid:538729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicamentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicamentos.com"; sid:538730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicina.com"; sid:538731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicine.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicine.clinic"; sid:538732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-memes.com"; sid:538733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetrics.com"; sid:538734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobalize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobalize.com"; sid:538735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilize.com"; sid:538736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidna.com"; sid:538737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneighbors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneighbors.com"; sid:538738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidness.net"; sid:538739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.club"; sid:538740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.life"; sid:538741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.today"; sid:538742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.world"; sid:538743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnight.com"; sid:538744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnights.com"; sid:538745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenclean.com"; sid:538746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-n.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-n.net"; sid:538747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffice.com"; sid:538748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoh.com"; sid:538749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomist.com"; sid:538750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomists.com"; sid:538751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomy.com"; sid:538752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidon.com"; sid:538753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinemd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinemd.com"; sid:538754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidornot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidornot.com"; sid:538755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic.net"; sid:538756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcr.com"; sid:538757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpenpals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpenpals.com"; sid:538758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphone.com"; sid:538759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanofaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanofaction.com"; sid:538760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoa.com"; sid:538761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-porn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-porn.com"; sid:538762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidporno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidporno.com"; sid:538763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ppe.com"; sid:538764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppetransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppetransfer.com"; sid:538765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprestamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprestamo.com"; sid:538766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprestamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprestamos.com"; sid:538767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproblems.com"; sid:538768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproduction.com"; sid:538769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectmask.com"; sid:538770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotocols.com"; sid:538771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprueba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprueba.com"; sid:538772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpruebas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpruebas.com"; sid:538773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpun.com"; sid:538774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuns.com"; sid:538775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqq.com"; sid:538776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqq.net"; sid:538777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquine.com"; sid:538778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rapid-test.com"; sid:538779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestkits.com"; sid:538780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebels.com"; sid:538781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecover.com"; sid:538782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recovery.com"; sid:538783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistry.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistry.healthcare"; sid:538784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffund.com"; sid:538785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefma.com"; sid:538786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepdom.com"; sid:538787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.net"; sid:538788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.review - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.review"; sid:538789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrheum4patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrheum4patients.com"; sid:538790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrip.com"; sid:538791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rx.com"; sid:538792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeagent.com"; sid:538793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafekids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafekids.com"; sid:538794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferealtor.com"; sid:538795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafezone.com"; sid:538796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafezones.com"; sid:538797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitized.com"; sid:538798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsba.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsba.loans"; sid:538799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscanner.com"; sid:538800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningny.com"; sid:538801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreenings.com"; sid:538802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningtest.com"; sid:538803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsealed.com"; sid:538804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsepare.com"; sid:538805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidship.com"; sid:538806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilverlining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilverlining.com"; sid:538807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskip.com"; sid:538808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.net"; sid:538809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspirits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspirits.com"; sid:538810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsquad.com"; sid:538811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stem.com"; sid:538812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstem.com"; sid:538813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidster.com"; sid:538814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilizer.com"; sid:538815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstickers.com"; sid:538816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-store.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-store.net"; sid:538817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstream.com"; sid:538818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucks.net"; sid:538819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupermarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupermarket.com"; sid:538820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesonline.com"; sid:538821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalkit.net"; sid:538822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorkit.com"; sid:538823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.tax"; sid:538824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tax.com"; sid:538825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteesforacause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteesforacause.com"; sid:538826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelemedicine.com"; sid:538827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterapia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterapia.com"; sid:538828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcenter.com"; sid:538829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingny.com"; sid:538830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsource.com"; sid:538831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmap.com"; sid:538832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnyc.com"; sid:538833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestny.com"; sid:538834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsupply.com"; sid:538835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.training"; sid:538836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-us.com"; sid:538837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-texts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-texts.com"; sid:538838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapies.com"; sid:538839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapyhelp.com"; sid:538840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermometer.com"; sid:538841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthoughts.com"; sid:538842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtodate.com"; sid:538843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtotal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtotal.com"; sid:538844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trac.com"; sid:538845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrac.com"; sid:538846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trace.com"; sid:538847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-track.com"; sid:538848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackers.com"; sid:538849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrail.com"; sid:538850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransport.com"; sid:538851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraps.com"; sid:538852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrax.com"; sid:538853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreament.com"; sid:538854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreat.com"; sid:538855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialio.com"; sid:538856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtusc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtusc.com"; sid:538857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemploymenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemploymenthelp.com"; sid:538858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdater.com"; sid:538859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupto.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupto.date"; sid:538860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduptodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduptodate.com"; sid:538861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscleanse.com"; sid:538862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdna.com"; sid:538863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslawsuit.com"; sid:538864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslawsuit.net"; sid:538865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslawyer.com"; sid:538866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvodka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvodka.com"; sid:538867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.wales"; sid:538868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalk.com"; sid:538869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwash.com"; sid:538870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-watch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-watch.net"; sid:538871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-win.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-win.com"; sid:538872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-win.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-win.net"; sid:538873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworker.com"; sid:538874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworker.net"; sid:538875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkers.com"; sid:538876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkers.net"; sid:538877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkrelief.com"; sid:538878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creationinthefaceofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creationinthefaceofcovid.com"; sid:538879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crutscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crutscorona.com"; sid:538880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatorcorona.com"; sid:538881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure2covid19.com"; sid:538882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4covid19.com"; sid:538883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureandtreatmentforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureandtreatmentforcorona.com"; sid:538884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureandtreatmentsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureandtreatmentsforcoronavirus.com"; sid:538885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronatoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronatoday.com"; sid:538886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedcovid19.com"; sid:538887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcorona-19.com"; sid:538888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curescorona.com"; sid:538889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curescovid-19.com"; sid:538890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curescovid19.com"; sid:538891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronavirusinfo.com"; sid:538892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dankcoronavirusmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dankcoronavirusmemes.com"; sid:538893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginapandemic.com"; sid:538894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for day-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"day-after-corona.com"; sid:538895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadofcorona.com"; sid:538896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovid19.com"; sid:538897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decreasecovid19atwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decreasecovid19atwork.com"; sid:538898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcovid19.com"; sid:538899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dekalbcountycovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dekalbcountycovid19responsefund.com"; sid:538900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecorona.com"; sid:538901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovid.com"; sid:538902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistalibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistalibredecovid19.com"; sid:538903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistasincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistasincoronavirus.com"; sid:538904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistasincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistasincovid19.com"; sid:538905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistcovid.com"; sid:538906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarcoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarcoronavirusmadrid.com"; sid:538907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deteccion-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deteccion-covid-19.com"; sid:538908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dinkespandeglang-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dinkespandeglang-covid19.com"; sid:538909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidninteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidninteen.com"; sid:538910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distancebycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distancebycorona.com"; sid:538911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorcebycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorcebycorona.com"; sid:538912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doccovid19.com"; sid:538913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doccovid.com"; sid:538914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doccovid.net"; sid:538915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorcovid19.com"; sid:538916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doessouthlaketahoehaveanycoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doessouthlaketahoehaveanycoronaviruscases.com"; sid:538917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogoodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogoodcorona.com"; sid:538918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacoronavirustest.com"; sid:538919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacorona.com"; sid:538920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donate4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donate4corona.com"; sid:538921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doncorona.com"; sid:538922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgetcovid19.com"; sid:538923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doughnutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doughnutcorona.com"; sid:538924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronatesting.com"; sid:538925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drxcovid.com"; sid:538926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dz-corona.com"; sid:538927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eacorona.com"; sid:538928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edelmancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edelmancovid-19.com"; sid:538929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educovid19.com"; sid:538930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatecovid.com"; sid:538931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidlaw.com"; sid:538932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidlawyer.com"; sid:538933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronavirusfmla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronavirusfmla.com"; sid:538934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronaviruspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronaviruspackage.com"; sid:538935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencypandemic.com"; sid:538936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empleocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empleocovid.com"; sid:538937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encovid.com"; sid:538938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entregas-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entregas-covid19.com"; sid:538939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicovid19.com"; sid:538940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicovid.com"; sid:538941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdashboard.com"; sid:538942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdays.com"; sid:538943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdaysmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdaysmovie.com"; sid:538944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpolicy.com"; sid:538945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsupport.com"; sid:538946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercovidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercovidcenter.com"; sid:538947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercovid.com"; sid:538948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ertecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ertecovid.com"; sid:538949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esn-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esn-covid19.com"; sid:538950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcovid19.com"; sid:538951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estadisticascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estadisticascoronavirus.com"; sid:538952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiocovid19.com"; sid:538953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopia-covid19.com"; sid:538954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everybodyvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everybodyvscovid19.com"; sid:538955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronavirustest.com"; sid:538956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-ckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-ckcoronavirus.com"; sid:538957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacoronavirus.com"; sid:538958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovid19.com"; sid:538959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight4covid19.com"; sid:538960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcoronanow.com"; sid:538961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.international"; sid:538962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid-19.net"; sid:538963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.today"; sid:538964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightscorona.com"; sid:538965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthecovid19virus.com"; sid:538966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstaidagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstaidagainstcorona.com"; sid:538967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkucovid19.com"; sid:538968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flacorona.com"; sid:538969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronaviruslawyers.com"; sid:538970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusclaim.com"; sid:538971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusclaims.com"; sid:538972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19claims.com"; sid:538973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19claims.com"; sid:538974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19insuranceclaims.com"; sid:538975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogcovid-19.com"; sid:538976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogcovid19.com"; sid:538977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogcovid.com"; sid:538978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followcovid.com"; sid:538979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondocorona.com"; sid:538980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forecastcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forecastcoronavirus.com"; sid:538981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forecastpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forecastpandemic.com"; sid:538982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formazionecoronavirus.com"; sid:538983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusjob.com"; sid:538984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusjobs.com"; sid:538985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fubarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fubarcorona.com"; sid:538986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckacorona.com"; sid:538987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirus4real.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirus4real.com"; sid:538988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-covid19.com"; sid:538989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19shirt.com"; sid:538990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fu-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fu-covid.com"; sid:538991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncoronavirus.com"; sid:538992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid19.com"; sid:538993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundmecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundmecorona.com"; sid:538994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundmethroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundmethroughcorona.com"; sid:538995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycoronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycoronavirusshirts.com"; sid:538996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fusioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fusioncovid19.com"; sid:538997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurebeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurebeyondcovid.com"; sid:538998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fyoucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fyoucoronavirus.com"; sid:538999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacorona.com"; sid:539000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gestionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gestionescoronavirus.com"; sid:539001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacoronavirusmask.com"; sid:539002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacoronavirustest.com"; sid:539003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirushelp.com"; sid:539004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustested.com"; sid:539005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19tested.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19tested.net"; sid:539006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getovercovid.com"; sid:539007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettingthroughcovid.com"; sid:539008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcoronatest.com"; sid:539009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcovidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcovidtesttoday.com"; sid:539010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourfreecoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourfreecoronakit.com"; sid:539011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourfreecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourfreecoronaviruskit.com"; sid:539012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gh-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gh-corona.com"; sid:539013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gileadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gileadcorona.com"; sid:539014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gileadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gileadcoronavirus.com"; sid:539015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gileadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gileadcovid19.com"; sid:539016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gileadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gileadcovid.com"; sid:539017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19poll.com"; sid:539018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicbunker.com"; sid:539019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemickit.com"; sid:539020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicqaurantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicqaurantine.com"; sid:539021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicsupply.com"; sid:539022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronavirusgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronavirusgo.com"; sid:539023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovid-19.com"; sid:539024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gofightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gofightcovid.com"; sid:539025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewscovid19.com"; sid:539026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotcovid-19survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotcovid-19survivalkit.com"; sid:539027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for got-youcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"got-youcovid.com"; sid:539028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grafschaft-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grafschaft-gegen-corona.com"; sid:539029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiascovid19.com"; sid:539030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hack4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hack4covid.com"; sid:539031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackerthepandemic413.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackerthepandemic413.com"; sid:539032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackthepandemic413.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackthepandemic413.com"; sid:539033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcovid.com"; sid:539034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harshcoronary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harshcoronary.com"; sid:539035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harshcoronary-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harshcoronary-corona.com"; sid:539036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hascovid19killedusallyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hascovid19killedusallyet.com"; sid:539037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicorona.com"; sid:539038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthycovid.com"; sid:539039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellocorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellocorona.club"; sid:539040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronacare.com"; sid:539041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecorona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecorona.care"; sid:539042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecorona.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecorona.support"; sid:539043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecorona.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecorona.tips"; sid:539044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpduringcovid19.com"; sid:539045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpincorona.com"; sid:539046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid19.com"; sid:539047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid19.net"; sid:539048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.net"; sid:539049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroes-fight-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroes-fight-against-corona.com"; sid:539050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroes-fight-against-corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroes-fight-against-corona-festival.com"; sid:539051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofcorona.com"; sid:539052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hesobrevividoalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hesobrevividoalcoronavirus.com"; sid:539053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hhcovid19.com"; sid:539054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hokicovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hokicovid.net"; sid:539055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holdcorona.com"; sid:539056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homealoneinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homealoneinthetimeofcorona.com"; sid:539057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeforgoodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeforgoodcovid19.com"; sid:539058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeinthetimeofcorona.com"; sid:539059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcovid-19.com"; sid:539060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingkitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingkitcoronavirus.com"; sid:539061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingkitforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingkitforcoronavirus.com"; sid:539062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeforcorona.com"; sid:539063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeinthefaceofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeinthefaceofcovid19.com"; sid:539064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotcoronabuns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotcoronabuns.com"; sid:539065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howicovid.com"; sid:539066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcoronavirus.com"; sid:539067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoaccesscoronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoaccesscoronafunds.com"; sid:539068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtogetacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtogetacoronavirustest.com"; sid:539069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtogetcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtogetcovid19test.com"; sid:539070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtohealcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtohealcorona.com"; sid:539071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivecoronavirus.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivecoronavirus.tips"; sid:539072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hugecoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hugecoronaviruspandemic.com"; sid:539073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hulpnacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hulpnacorona.com"; sid:539074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hulpnacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hulpnacoronavirus.com"; sid:539075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hulptijdenscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hulptijdenscorona.com"; sid:539076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronatest.com"; sid:539077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirus.net"; sid:539078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hurricanecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hurricanecorona.com"; sid:539079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinecoronavirus.com"; sid:539080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinecovid-19.com"; sid:539081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinecovid19.com"; sid:539082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidfree.com"; sid:539083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidimmune.com"; sid:539084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcoronaclub.com"; sid:539085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcoronavirus.club"; sid:539086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-beat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-beat-covid19.com"; sid:539087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid.club"; sid:539088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icuredcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icuredcoronavirus.com"; sid:539089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icuredmycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icuredmycoronavirus.com"; sid:539090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocorona.com"; sid:539091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iecoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iecoronalawyer.com"; sid:539092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iecovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iecovidresponse.com"; sid:539093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-got-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-got-covid19.com"; sid:539094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-have-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-have-covid19.com"; sid:539095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihelpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihelpcorona.com"; sid:539096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcovid.com"; sid:539097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillthecoronavirus.com"; sid:539098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid-19helpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid-19helpfund.com"; sid:539099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19helpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19helpfund.com"; sid:539100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid-19helpfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid-19helpfund.net"; sid:539101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19helpfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19helpfund.net"; sid:539102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid-19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid-19responsefund.com"; sid:539103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19responsefund.com"; sid:539104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid-19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid-19responsefund.net"; sid:539105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid19responsefund.net"; sid:539106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovidhelpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovidhelpfund.com"; sid:539107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovidhelpfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovidhelpfund.net"; sid:539108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovidresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovidresponsefund.com"; sid:539109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovidresponsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovidresponsefund.net"; sid:539110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscorona.com"; sid:539111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovid-19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovid-19responsefund.com"; sid:539112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovid19responsefund.com"; sid:539113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovid-19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovid-19responsefund.net"; sid:539114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovid19responsefund.net"; sid:539115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovidresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovidresponsefund.com"; sid:539116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilstatecovidresponsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilstatecovidresponsefund.net"; sid:539117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilvirussenzacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilvirussenzacorona.com"; sid:539118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imayhavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imayhavecovid19.com"; sid:539119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidient.com"; sid:539120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidienttruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidienttruth.com"; sid:539121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacorona.com"; sid:539122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacionsobrecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacionsobrecoronavirus.com"; sid:539123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-lescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-lescoronavirus.com"; sid:539124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmatecovid19.com"; sid:539125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatecovid19.com"; sid:539126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtest.com"; sid:539127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intimesofcorona.com"; sid:539128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacorona.com"; sid:539129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronaviruscured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronaviruscured.com"; sid:539130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronaviruscuredyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronaviruscuredyet.com"; sid:539131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israel-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israel-coronavirus.com"; sid:539132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-stopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-stopcoronavirus.com"; sid:539133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronaextravirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronaextravirus2020.com"; sid:539134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronaextravirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronaextravirus.com"; sid:539135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusextra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusextra.com"; sid:539136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusextra.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusextra.net"; sid:539137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.life"; sid:539138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19tshirt.com"; sid:539139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19tshirt.com"; sid:539140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.world"; sid:539141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusspring2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusspring2020.com"; sid:539142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19quarantine.com"; sid:539143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19quarantine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19quarantine.net"; sid:539144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itcovid19.com"; sid:539145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itcovid.com"; sid:539146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jailcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jailcorona.com"; sid:539147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jailcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jailcorona.net"; sid:539148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jailcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jailcovid19.com"; sid:539149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jepeuxpasjaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jepeuxpasjaicorona.com"; sid:539150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jerseypandemicrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jerseypandemicrelieffund.com"; sid:539151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jerseypandemicrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jerseypandemicrelieffund.net"; sid:539152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jinglecheddars-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jinglecheddars-corona.com"; sid:539153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsforcoronavirus.com"; sid:539154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnbortolihascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnbortolihascovid-19.com"; sid:539155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincorona.com"; sid:539156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincovid19cleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincovid19cleanup.com"; sid:539157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcoronaclaim.com"; sid:539158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovidclaim.com"; sid:539159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jwscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jwscovid19.com"; sid:539160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascorona.com"; sid:539161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccoronabaseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccoronabaseball.com"; sid:539162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepingcalmduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepingcalmduringcovid19.com"; sid:539163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepingupwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepingupwithcovid.com"; sid:539164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckycorona.com"; sid:539165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsofcorona.com"; sid:539166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsversuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsversuscovid19.com"; sid:539167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsversuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsversuscovid.com"; sid:539168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsvscovid.com"; sid:539169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusnow.com"; sid:539170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirus.today"; sid:539171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-covid19.com"; sid:539172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19.services"; sid:539173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19.tips"; sid:539174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitchencoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitchencoronaa.com"; sid:539175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitchencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitchencorona.com"; sid:539176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kredit-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kredit-corona.com"; sid:539177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kreditcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kreditcorona.com"; sid:539178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacolombecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacolombecovid19.com"; sid:539179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacolombecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacolombecovid19.net"; sid:539180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronalawyer.com"; sid:539181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid.com"; sid:539182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagoscorona.com"; sid:539183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawfirmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawfirmcovid19.com"; sid:539184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcorona.com"; sid:539185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcorona.net"; sid:539186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcovid19.com"; sid:539187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lbgadvisorscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lbgadvisorscovid19.com"; sid:539188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learntofight-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learntofight-covid19.com"; sid:539189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lecovid-19.com"; sid:539190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcorona.com"; sid:539191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcorona.net"; sid:539192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelp4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelp4corona.com"; sid:539193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelp4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelp4covid19.com"; sid:539194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelpcovid19.com"; sid:539195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsduringcorona.com"; sid:539196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid.net"; sid:539197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbootcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbootcorona.com"; sid:539198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbootcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbootcovid.com"; sid:539199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liebeinzeitenvoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liebeinzeitenvoncorona.com"; sid:539200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirustour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirustour.com"; sid:539201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeandcoronavirus.com"; sid:539202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeb4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeb4covid19.com"; sid:539203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcoronavirus.life"; sid:539204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcoronavirus.com"; sid:539205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lightupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lightupcorona.com"; sid:539206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lightupcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lightupcorona.net"; sid:539207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limitcovid.com"; sid:539208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livewithcovid.com"; sid:539209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locatecorona.com"; sid:539210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lojacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lojacoronavirus.com"; sid:539211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lol-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lol-covid19.com"; sid:539212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lomitacoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lomitacoronavirusinfo.com"; sid:539213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveandcoronavirus.com"; sid:539214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveandcovid.com"; sid:539215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveduringcorona.com"; sid:539216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.singles"; sid:539217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.today"; sid:539218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.singles"; sid:539219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.biz"; sid:539220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-covid.com"; sid:539221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofglobalpandemic.com"; sid:539222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintimeofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintimeofthecorona.com"; sid:539223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidrelief.com"; sid:539224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcovid.com"; sid:539225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainecorona.com"; sid:539226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malpracticecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malpracticecorona.com"; sid:539227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malpracticecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malpracticecorona.net"; sid:539228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malpracticeincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malpracticeincorona.com"; sid:539229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marcovid19.com"; sid:539230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for margincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"margincorona.com"; sid:539231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for markedsafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"markedsafecovid19.com"; sid:539232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcorona.com"; sid:539233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskanticovid.com"; sid:539234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksfightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksfightcorona.com"; sid:539235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachusettscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachusettscorona.com"; sid:539236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachusettscovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachusettscovidlaw.com"; sid:539237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscovid.com"; sid:539238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscovidrelief.com"; sid:539239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcicovid.com"; sid:539240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcicovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcicovidresults.com"; sid:539241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcicovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcicovidtesting.com"; sid:539242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmalpracticecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmalpracticecorona.com"; sid:539243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicoscoronavirus.com"; sid:539244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medstarmyhrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medstarmyhrcovid19.com"; sid:539245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medstarmyhrcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medstarmyhrcovid19.net"; sid:539246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19.com"; sid:539247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michcorona.com"; sid:539248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for midascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"midascovid.com"; sid:539249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minnesotacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minnesotacorona.com"; sid:539250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicorona.com"; sid:539251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mkecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mkecovid.com"; sid:539252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocorona.com"; sid:539253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyduringcorona.com"; sid:539254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanacorona.com"; sid:539255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muertecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muertecoronavirus.com"; sid:539256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvccovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvccovid19help.com"; sid:539257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvccovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvccovidhelp.com"; sid:539258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona69.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona69.com"; sid:539259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaapp.com"; sid:539260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacare.com"; sid:539261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachapters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachapters.com"; sid:539262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalive.com"; sid:539263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusjournal.com"; sid:539264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19doctor.com"; sid:539265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19doctor.com"; sid:539266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19stories.com"; sid:539267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid.care"; sid:539268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddoctor.com"; sid:539269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidvaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidvaca.com"; sid:539270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylivecoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylivecoronanews.com"; sid:539271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicinsurance.com"; sid:539272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytrackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytrackcovid19.com"; sid:539273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for namastecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"namastecoronavirus.com"; sid:539274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naughtycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naughtycorona.com"; sid:539275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskabroadcasterscovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskabroadcasterscovid19resources.com"; sid:539276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacorona.com"; sid:539277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needcovid19test.com"; sid:539278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflix-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflix-coronavirus.com"; sid:539279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacorona.com"; sid:539280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforgetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforgetcovid19.com"; sid:539281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaviruseconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaviruseconomy.com"; sid:539282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-coronavirus-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-coronavirus-testing.com"; sid:539283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhampshirecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhampshirecorona.com"; sid:539284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycorona.com"; sid:539285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseypandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseypandemicrelief.com"; sid:539286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseypandemicrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseypandemicrelieffund.com"; sid:539287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseypandemicrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseypandemicrelieffund.net"; sid:539288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseypandemicrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseypandemicrelief.net"; sid:539289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocorona.com"; sid:539290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocovid.com"; sid:539291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocovidlaw.com"; sid:539292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronalawyers.com"; sid:539293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkstatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkstatecorona.com"; sid:539294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkstatecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkstatecovidtest.com"; sid:539295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njpandemicrelief.com"; sid:539296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njpandemicrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njpandemicrelieffund.com"; sid:539297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njpandemicrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njpandemicrelieffund.net"; sid:539298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njpandemicrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njpandemicrelief.net"; sid:539299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcorona.com"; sid:539300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcoronalaw.com"; sid:539301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcovid.com"; sid:539302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcovidlaw.com"; sid:539303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2coronavirus.com"; sid:539304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronago.com"; sid:539305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19usa.com"; sid:539306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.net"; sid:539307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidtees.com"; sid:539308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.world"; sid:539309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nonprofittoiletrollforcoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nonprofittoiletrollforcoronatime.com"; sid:539310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noquierocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noquierocorona.com"; sid:539311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcarolinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcarolinacorona.com"; sid:539312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacorona.com"; sid:539313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notesfromapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notesfromapandemic.com"; sid:539314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiacoronavirus.com"; sid:539315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus19oracle.com"; sid:539316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusattention.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusattention.recipes"; sid:539317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusescure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusescure.com"; sid:539318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusoracle.com"; sid:539319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nsbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nsbcovid19.com"; sid:539320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecocovid-19death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecocovid-19death.com"; sid:539321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecocovid19death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecocovid19death.com"; sid:539322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecocovid-19deathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecocovid-19deathlawsuit.com"; sid:539323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecocovid19deathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecocovid19deathlawsuit.com"; sid:539324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecoronavirusdeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecoronavirusdeath.com"; sid:539325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecoronavirusdeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecoronavirusdeathlawsuit.com"; sid:539326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronasupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronasupply.com"; sid:539327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19test.com"; sid:539328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid.com"; sid:539329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidtest.com"; sid:539330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyghtacklescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyghtacklescovid19.com"; sid:539331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oaclecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oaclecovid19.com"; sid:539332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occoronalawyer.com"; sid:539333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofiarycoronawirusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofiarycoronawirusa.com"; sid:539334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocorona.com"; sid:539335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oilcorona.com"; sid:539336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okbroadcasterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okbroadcasterscovid19.com"; sid:539337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacorona.com"; sid:539338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oldscovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oldscovid19help.com"; sid:539339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oldscovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oldscovidhelp.com"; sid:539340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcovid.com"; sid:539341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlycovid19.com"; sid:539342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlycovid.com"; sid:539343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ontariocovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ontariocovidresponse.com"; sid:539344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for open-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"open-covid19.com"; sid:539345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracecovid19.com"; sid:539346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclcovid19.com"; sid:539347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-coronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-coronavirus-19.com"; sid:539348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecoronavirus19.com"; sid:539349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-corona-virus.com"; sid:539350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-coronavirus.com"; sid:539351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecoronavirus.com"; sid:539352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-covid-19.com"; sid:539353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-covid19.com"; sid:539354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecovid-19.com"; sid:539355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecovid19.com"; sid:539356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecovid19.net"; sid:539357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclenovelcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclenovelcoronavirus19.com"; sid:539358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclenovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclenovelcoronavirus.com"; sid:539359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oralecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oralecovid19.com"; sid:539360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecountycovid19.com"; sid:539361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orclecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orclecovid19.com"; sid:539362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orderacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orderacoronavirustest.com"; sid:539363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orderacoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orderacoronavirustestkit.com"; sid:539364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncorona.com"; sid:539365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronadiary.com"; sid:539366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcorona-virus.com"; sid:539367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19story.com"; sid:539368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidstory.com"; sid:539369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourfuturebeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourfuturebeyondcovid.com"; sid:539370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outremontcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outremontcovid19.com"; sid:539371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for p2p-covid19forum-canadiandentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"p2p-covid19forum-canadiandentists.com"; sid:539372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacovid.com"; sid:539373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicams.com"; sid:539374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaproductions.com"; sid:539375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicattire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicattire.com"; sid:539376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboutique.com"; sid:539377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccad.com"; sid:539378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccanada.com"; sid:539379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchildcarecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchildcarecenter.com"; sid:539380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchristian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchristian.com"; sid:539381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiaries.net"; sid:539382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdivorce.com"; sid:539383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdoctors.com"; sid:539384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicepicurean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicepicurean.com"; sid:539385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfordummies.com"; sid:539386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforecaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforecaster.com"; sid:539387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfreedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfreedom.com"; sid:539388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.gallery"; sid:539389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgardening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgardening.com"; sid:539390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguru.com"; sid:539391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichan.com"; sid:539392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichang.com"; sid:539393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichomeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichomeschool.com"; sid:539394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancelawyer.com"; sid:539395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestingplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestingplan.com"; sid:539396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickindness.com"; sid:539397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickit.net"; sid:539398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.legal"; sid:539399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmoods.com"; sid:539400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnotes.com"; sid:539401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparty.net"; sid:539402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpastor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpastor.com"; sid:539403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpentameter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpentameter.com"; sid:539404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpentameter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpentameter.net"; sid:539405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivot.com"; sid:539406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplayground.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplayground.com"; sid:539407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplayoffs.com"; sid:539408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpornhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpornhub.com"; sid:539409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-posters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-posters.com"; sid:539410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicposters.com"; sid:539411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicposts.com"; sid:539412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppe.com"; sid:539413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprayerteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprayerteam.com"; sid:539414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepcentral.com"; sid:539415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventing.com"; sid:539416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprint.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprint.team"; sid:539417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofyourbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofyourbiz.com"; sid:539418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotocols.com"; sid:539419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicptsd.com"; sid:539420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicptsd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicptsd.net"; sid:539421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicqaurantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicqaurantine.com"; sid:539422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefresources.com"; sid:539423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsejobs.com"; sid:539424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsejobs.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsejobs.today"; sid:539425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsejob.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsejob.today"; sid:539426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseplans.com"; sid:539427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.today"; sid:539428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-are-not-funny-but.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-are-not-funny-but.com"; sid:539429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsfordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsfordummies.com"; sid:539430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-simulator.com"; sid:539431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsluts.com"; sid:539432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.mobi"; sid:539433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsnews.com"; sid:539434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stocks.com"; sid:539435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupport.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupport.team"; sid:539436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthinker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthinker.com"; sid:539437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrack.com"; sid:539438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrump.com"; sid:539439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrust.com"; sid:539440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrust.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrust.net"; sid:539441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvolunteers.com"; sid:539442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panepidemics.com"; sid:539443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacorona.com"; sid:539444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pervertpaternal-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pervertpaternal-corona.com"; sid:539445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petscoronavirus.com"; sid:539446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pfafftowncoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pfafftowncoronachronicles.com"; sid:539447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacycovid19.com"; sid:539448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacycovid.com"; sid:539449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcoronaviruskillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcoronaviruskillers.com"; sid:539450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pkcovid19.com"; sid:539451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planrestaurantescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planrestaurantescoronavirus.com"; sid:539452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadoscovid19.com"; sid:539453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadoscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadoscovid19.net"; sid:539454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformacovid19.com"; sid:539455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformacovid19.net"; sid:539456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plentyofcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plentyofcoronacare.com"; sid:539457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pncovid.com"; sid:539458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portalcorona.com"; sid:539459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaart.com"; sid:539460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacrisis.com"; sid:539461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafuture.com"; sid:539462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapotential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapotential.com"; sid:539463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaturnup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaturnup.com"; sid:539464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidacademy.com"; sid:539465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycoronaaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycoronaaway.com"; sid:539466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnancycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnancycovid19.com"; sid:539467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premiercovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premiercovidlawyer.com"; sid:539468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preseasonarab-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preseasonarab-corona.com"; sid:539469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencaocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencaocovid19.com"; sid:539470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princecharlescoronationgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princecharlescoronationgifts.com"; sid:539471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisoncorona.com"; sid:539472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisoncovid19.com"; sid:539473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisonercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisonercorona.com"; sid:539474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisonercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisonercovid19.com"; sid:539475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profitfrompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profitfrompandemic.com"; sid:539476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proformula-coronavirus-be-nl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proformula-coronavirus-be-nl.com"; sid:539477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promedical-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promedical-covid19.com"; sid:539478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcovid19.net"; sid:539479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionecovid19.com"; sid:539480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionicoronavirus.com"; sid:539481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionicovid19.com"; sid:539482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacoronavirus.com"; sid:539483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacovid19.com"; sid:539484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasdecoronavirus.com"; sid:539485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologosfrentealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologosfrentealcoronavirus.com"; sid:539486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptowncovid19.com"; sid:539487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcovid19.com"; sid:539488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcovid19.net"; sid:539489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdpandemic.com"; sid:539490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdpandemic.net"; sid:539491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puertoricocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puertoricocorona.com"; sid:539492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulltogetheragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulltogetheragainstcoronavirus.com"; sid:539493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punchcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punchcovid-19.com"; sid:539494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for putocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"putocoronavirus.com"; sid:539495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qqcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qqcovid.com"; sid:539496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qqcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qqcovid.net"; sid:539497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quincycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quincycovid.com"; sid:539498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rajasthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rajasthancovid19.com"; sid:539499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19hometest.com"; sid:539500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcorona.com"; sid:539501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcovid-19.com"; sid:539502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readingbeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readingbeyondcovid19.com"; sid:539503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ready4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ready4covid-19.com"; sid:539504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronatesting.com"; sid:539505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19test.com"; sid:539506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursossobrecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursossobrecoronavirus.com"; sid:539507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reduccionautonomoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reduccionautonomoscovid.com"; sid:539508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relawancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relawancovid.com"; sid:539509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcovid19.com"; sid:539510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remboursementcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remboursementcovid19.com"; sid:539511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remboursementcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remboursementcovid19.net"; sid:539512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercoronavirus.com"; sid:539513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcoronavirus.com"; sid:539514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovid.com"; sid:539515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondtocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondtocoronavirus.com"; sid:539516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondtocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondtocovid19.com"; sid:539517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retirementcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retirementcovid19.com"; sid:539518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rheumcovid4patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rheumcovid4patients.com"; sid:539519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhodeislandbroadcasterscovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhodeislandbroadcasterscovid19resources.com"; sid:539520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhodeislandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhodeislandcorona.com"; sid:539521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ribroadcasterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ribroadcasterscovid19.com"; sid:539522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riemannvolta-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riemannvolta-corona.com"; sid:539523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rockagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rockagainstcorona.com"; sid:539524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romanceandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romanceandcoronavirus.com"; sid:539525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romanceandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romanceandcovid.com"; sid:539526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid19.com"; sid:539527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovidnineteen.com"; sid:539528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizerforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizerforcorona.com"; sid:539529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizerforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizerforcovid-19.com"; sid:539530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santacruzgestionacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santacruzgestionacovid.com"; sid:539531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynocorona.com"; sid:539532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayonaracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayonaracovid.com"; sid:539533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronasupport.com"; sid:539534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusbusinessloan.com"; sid:539535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-coronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-coronavirusloan.com"; sid:539536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloan-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloan-corona.com"; sid:539537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloan-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloan-coronavirus.com"; sid:539538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloanscoronavirus.com"; sid:539539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbloancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbloancoronavirus.com"; sid:539540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scacciamoilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scacciamoilcovid19.com"; sid:539541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scheduleacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scheduleacoronavirustest.com"; sid:539542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schedulecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schedulecoronavirustest.com"; sid:539543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltest-corona.com"; sid:539544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scrmccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scrmccovid19.com"; sid:539545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronaviruscleaning.com"; sid:539546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronavirusdecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronavirusdecontamination.com"; sid:539547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19decontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19decontaminationcleaning.com"; sid:539548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19decontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19decontaminationcleaning.com"; sid:539549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19decontamination.com"; sid:539550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19decontamination.com"; sid:539551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsttest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsttest-corona.com"; sid:539552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for self-test-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"self-test-corona.com"; sid:539553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftest-corona.com"; sid:539554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semaforocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semaforocovid19.com"; sid:539555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servpro-of-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servpro-of-corona.com"; sid:539556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sewyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sewyoucorona.com"; sid:539557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcovid19.com"; sid:539558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for share4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"share4covid.com"; sid:539559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shelterinplacecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shelterinplacecovid-19.com"; sid:539560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcovid.com"; sid:539561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldforcovid.com"; sid:539562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shootdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shootdowncovid19.com"; sid:539563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurcovid19.com"; sid:539564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siestadayroom-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siestadayroom-corona.com"; sid:539565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simcovid.net"; sid:539566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singlesincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singlesincorona.com"; sid:539567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skrewcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skrewcovid19.com"; sid:539568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smashcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smashcovid19.com"; sid:539569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smbcovid19.com"; sid:539570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smipandemicdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smipandemicdiaries.com"; sid:539571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smipandemicdiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smipandemicdiaries.net"; sid:539572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecovid19.net"; sid:539573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecovid.net"; sid:539574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somecorona.com"; sid:539575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid19.com"; sid:539576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscovid.world"; sid:539577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcarolinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcarolinacorona.com"; sid:539578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southdakotacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southdakotacorona.com"; sid:539579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadloveinthetimeofcorona.com"; sid:539580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staatshilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staatshilfe-corona.com"; sid:539581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for starterpackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"starterpackcovid19.com"; sid:539582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statisticscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statisticscovid19.com"; sid:539583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomecoronavirus.com"; sid:539584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomecovid-19.com"; sid:539585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomecovid19.com"; sid:539586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecoronavirus.com"; sid:539587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecovid-19.com"; sid:539588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecovid19.com"; sid:539589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterlizecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterlizecovid19.com"; sid:539590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirustesting.com"; sid:539591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19app.com"; sid:539592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19-flu.com"; sid:539593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19now.com"; sid:539594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovids19.com"; sid:539595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingthecoronavirus.com"; sid:539596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopspreadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopspreadcovid.com"; sid:539597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovid.com"; sid:539598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stpcoronavirus.com"; sid:539599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stroungoutofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stroungoutofcorona.com"; sid:539600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studycovid.com"; sid:539601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sunshinetokillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sunshinetokillcovid.com"; sid:539602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalguidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalguidecoronavirus.com"; sid:539603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-corona.net"; sid:539604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovid19kit.com"; sid:539605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-covid.com"; sid:539606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovidkit.com"; sid:539607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronapocalypse.com"; sid:539608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving-covid19.com"; sid:539609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19.life"; sid:539610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sweetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sweetcorona.com"; sid:539611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftercorona.com"; sid:539612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tackling-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tackling-covid.com"; sid:539613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkcovid19.com"; sid:539614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tanggapcovid19kalsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tanggapcovid19kalsel.com"; sid:539615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taowuhang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taowuhang.com"; sid:539616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamfuckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamfuckcoronavirus.com"; sid:539617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for technoagainstcorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"technoagainstcorona.wtf"; sid:539618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teigncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teigncovid19.com"; sid:539619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecoachcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecoachcoronavirus.com"; sid:539620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid-19.com"; sid:539621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid19.com"; sid:539622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthcovid-19.com"; sid:539623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthcovid19.com"; sid:539624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedcovid19.com"; sid:539625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicinecovid19.com"; sid:539626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellyourcovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellyourcovid19story.com"; sid:539627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennesseecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennesseecorona.com"; sid:539628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminixcovid19.com"; sid:539629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tescorona.com"; sid:539630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tesrforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tesrforcovid19.com"; sid:539631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covidnow.com"; sid:539632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcorona-virus.com"; sid:539633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirus-maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirus-maroc.com"; sid:539634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19kit.com"; sid:539635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidonline.com"; sid:539636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdecovid.com"; sid:539637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedforcovid.com"; sid:539638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid-19.com"; sid:539639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitsforcorona.com"; sid:539640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmeforcorona.com"; sid:539641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testonlinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testonlinecovid.com"; sid:539642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronaviruslawyers.com"; sid:539643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19lawyers.com"; sid:539644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidlawyers.com"; sid:539645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcovidlife.com"; sid:539646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theantiepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theantiepidemic.com"; sid:539647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechinesepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechinesepandemic.com"; sid:539648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaarchives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaarchives.com"; sid:539649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabaseballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabaseballleague.com"; sid:539650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabasketballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabasketballleague.com"; sid:539651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabunch.com"; sid:539652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacraft.com"; sid:539653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries.fyi"; sid:539654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-diary.com"; sid:539655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafestival.com"; sid:539656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafestivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafestivals.com"; sid:539657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafootballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafootballleague.com"; sid:539658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahockeyleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahockeyleague.com"; sid:539659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalie.com"; sid:539660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamom.com"; sid:539661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamonologues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamonologues.com"; sid:539662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaparadigm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaparadigm.com"; sid:539663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronareset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronareset.com"; sid:539664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasidehustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasidehustle.com"; sid:539665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasportsleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasportsleague.com"; sid:539666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasurvivor.com"; sid:539667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiet.com"; sid:539668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruskillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruskillers.com"; sid:539669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusloan.com"; sid:539670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusolution.com"; sid:539671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusshutdown.com"; sid:539672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswars.com"; sid:539673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawars.com"; sid:539674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19app.com"; sid:539675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19buster.com"; sid:539676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19buster.com"; sid:539677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19clean.com"; sid:539678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19dentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19dentist.com"; sid:539679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19depression.com"; sid:539680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19diary.com"; sid:539681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19documentary.com"; sid:539682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19mask.com"; sid:539683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19news.com"; sid:539684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19sanitizer.com"; sid:539685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19wars.com"; sid:539686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcafe.com"; sid:539687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddoctor.com"; sid:539688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidesq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidesq.com"; sid:539689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfight.com"; sid:539690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfree.com"; sid:539691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlawoffice.com"; sid:539692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpandemic.com"; sid:539693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresponse.com"; sid:539694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviduspatriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviduspatriots.com"; sid:539695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwars.com"; sid:539696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefight4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefight4covid19.com"; sid:539697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theincovidienttruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theincovidienttruth.com"; sid:539698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themecovid19.net"; sid:539699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themecovid.net"; sid:539700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theofficialcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theofficialcoronamask.com"; sid:539701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theonlinecoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theonlinecoronavirusclinic.com"; sid:539702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccookbook.com"; sid:539703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicdiaries.com"; sid:539704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicjournal.com"; sid:539705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicjournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicjournals.com"; sid:539706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiclife.com"; sid:539707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpaycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpaycheck.com"; sid:539708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepointcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepointcoronado.com"; sid:539709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovidfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovidfit.com"; sid:539710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thestoryofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thestoryofcovid19.com"; sid:539711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesunclobberscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesunclobberscovid.com"; sid:539712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theuscovidpatriot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theuscovidpatriot.com"; sid:539713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewaroncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewaroncoronavirus.com"; sid:539714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewaroncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewaroncovid19.com"; sid:539715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanconspiracy.com"; sid:539716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhandocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhandocumentary.com"; sid:539717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanwhiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanwhiskey.com"; sid:539718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkbeyondcorona.com"; sid:539719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkbeyondcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkbeyondcoronavirus.com"; sid:539720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thriveincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thriveincorona.com"; sid:539721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayscoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayscoronavirusnews.com"; sid:539722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayscovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayscovid-19news.com"; sid:539723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayscovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayscovid19news.com"; sid:539724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togethercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togethercorona.com"; sid:539725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togethercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togethercoronavirus.com"; sid:539726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togethercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togethercovid.com"; sid:539727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwebeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwebeatcorona.com"; sid:539728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecorona.com"; sid:539729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamientodecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamientodecoronavirus.com"; sid:539730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatforcovid.com"; sid:539731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribunecoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribunecoronaa.com"; sid:539732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribunecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribunecorona.com"; sid:539733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trotz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trotz-corona.com"; sid:539734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trotzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trotzcorona.com"; sid:539735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tudosobrecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tudosobrecorona.com"; sid:539736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkeycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkeycorona.com"; sid:539737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuscaloosacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuscaloosacovid.com"; sid:539738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uber-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uber-coronavirus.com"; sid:539739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universidadpanamericanacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universidadpanamericanacovid19.com"; sid:539740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universityofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universityofcorona.com"; sid:539741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urbanpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urbanpandemics.com"; sid:539742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgentcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgentcoronacare.com"; sid:539743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatcoronavirus.com"; sid:539744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronahealth.com"; sid:539745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidlaws.com"; sid:539746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcorona.com"; sid:539747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccorona.com"; sid:539748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronakiller.com"; sid:539749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinateagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinateagainstcovid19.com"; sid:539750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-covid-19.com"; sid:539751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccines-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccines-coronavirus.com"; sid:539752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacontracoronavirus.com"; sid:539753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunascoronavirus.com"; sid:539754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaginacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaginacoronavirus.com"; sid:539755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vancouverduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vancouverduringcorona.com"; sid:539756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vermontcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vermontcorona.com"; sid:539757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victorycovid19.com"; sid:539758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercorona.com"; sid:539759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercoronavirus.com"; sid:539760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidadespuescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidadespuescoronavirus.com"; sid:539761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidahealth-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidahealth-covid-19.com"; sid:539762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viewcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viewcorona.com"; sid:539763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralkindnessinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralkindnessinthetimeofcorona.com"; sid:539764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacorona.com"; sid:539765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronaparty.com"; sid:539766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona.guru"; sid:539767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid-19.club"; sid:539768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19.club"; sid:539769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemickit.com"; sid:539770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virussenzacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virussenzacorona.com"; sid:539771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vomercolumns-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vomercolumns-corona.com"; sid:539772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3coronavirus.net"; sid:539773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3covid-19.com"; sid:539774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3covid19.com"; sid:539775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3covid-19.net"; sid:539776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3covid19.net"; sid:539777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wakemeupwhencoronaends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wakemeupwhencoronaends.com"; sid:539778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtonstatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtonstatecorona.com"; sid:539779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid.com"; sid:539780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcoronaclub.com"; sid:539781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid-19.com"; sid:539782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcorona.com"; sid:539783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcoronavirus.com"; sid:539784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovid-19.com"; sid:539785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovid19.com"; sid:539786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovid.com"; sid:539787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovidvirus.com"; sid:539788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillthecoronavirus.com"; sid:539789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for welcometothecoronaverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"welcometothecoronaverse.com"; sid:539790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for welcometothecoronaverse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"welcometothecoronaverse.net"; sid:539791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacorona.com"; sid:539792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvidedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvidedcovid19.com"; sid:539793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wevscorona.com"; sid:539794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillbeatcovid19.com"; sid:539795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheelofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheelofcorona.com"; sid:539796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheredoigotogettestedforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheredoigotogettestedforcoronavirus.com"; sid:539797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheretogettestedforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheretogettestedforcoronavirus.com"; sid:539798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whilecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whilecovid.com"; sid:539799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whiskeywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whiskeywuhan.com"; sid:539800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wholesalingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wholesalingcorona.com"; sid:539801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wikipecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wikipecovid19.com"; sid:539802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcovid19killme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcovid19killme.com"; sid:539803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcovidkillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcovidkillme.com"; sid:539804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipingoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipingoutcovid19.com"; sid:539805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisconsincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisconsincorona.com"; sid:539806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wiscovid.com"; sid:539807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wishcorona.com"; sid:539808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcoronavirus.com"; sid:539809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronamemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronamemorial.com"; sid:539810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwide-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwide-pandemic.com"; sid:539811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcoronavirus.com"; sid:539812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcoronavirus.net"; sid:539813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcovid-19.com"; sid:539814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcovid19.com"; sid:539815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcovid-19.net"; sid:539816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidewebcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidewebcovid19.net"; sid:539817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcoronavirus.com"; sid:539818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchinesecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchinesecoronavirus.com"; sid:539819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchinesecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchinesecoronavirus.net"; sid:539820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclassactionlawsuit.com"; sid:539821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclassactionlawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclassactionlawsuit.net"; sid:539822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanconspiracy.com"; sid:539823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandocumentary.com"; sid:539824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanicplague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanicplague.com"; sid:539825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-lawsuit.com"; sid:539826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-lawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-lawsuit.net"; sid:539827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus411.com"; sid:539828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusfund.com"; sid:539829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruslawyer.com"; sid:539830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruslawyers.com"; sid:539831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusonline.com"; sid:539832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxrjd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxrjd.com"; sid:539833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19oracle.com"; sid:539834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wyomingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wyomingcorona.com"; sid:539835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcorona19.com"; sid:539836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovid.net"; sid:539837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-solidaritt-5qb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-solidaritt-5qb.com"; sid:539838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirs-codiv19-u6b.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirs-codiv19-u6b.club"; sid:539839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavrus19-74b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavrus19-74b.com"; sid:539840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youmeandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youmeandcovid.com"; sid:539841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidtest.com"; sid:539842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youthagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youthagainstcorona.com"; sid:539843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zendesk-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zendesk-covid19.com"; sid:539844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zendesk-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zendesk-covid19.net"; sid:539845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronafree.com"; sid:539846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronafrei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronafrei.com"; sid:539847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidfrei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidfrei.com"; sid:539848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covid-gouv12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covid-gouv12.com"; sid:539849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019novelcoronavirusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019novelcoronavirusoracle.com"; sid:539850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusmortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusmortgagerelief.com"; sid:539851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-covid19.com"; sid:539852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19survivor.com"; sid:539853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidchallenge.com"; sid:539854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020worldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020worldpandemic.com"; sid:539855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20covid.com"; sid:539856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covid.com"; sid:539857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411covid-19.com"; sid:539858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadacorona.com"; sid:539859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-corona.net"; sid:539860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcorona.net"; sid:539861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid19.net"; sid:539862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accidentlawduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accidentlawduringpandemic.com"; sid:539863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovid19tests.com"; sid:539864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acureforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acureforcovid.com"; sid:539865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscoronaviruscelebration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscoronaviruscelebration.com"; sid:539866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscoronavirusparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscoronavirusparty.com"; sid:539867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adultcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adultcoronavirus.com"; sid:539868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adultcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adultcovid19.com"; sid:539869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aes-test4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aes-test4covid-19.com"; sid:539870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscoronavirus.net"; sid:539871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona2020.com"; sid:539872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-coronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-coronaparty.com"; sid:539873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona-party.com"; sid:539874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona-party.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona-party.net"; sid:539875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthecoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthecoronation.com"; sid:539876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agir-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agir-covid-19.com"; sid:539877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agir-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agir-covid19.com"; sid:539878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agircovid19.com"; sid:539879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovidtesting.com"; sid:539880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovidtesting.com"; sid:539881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all4covid-19.com"; sid:539882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all-about-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all-about-corona.com"; sid:539883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronavirusdisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronavirusdisinfect.com"; sid:539884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allfactscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allfactscovid-19.com"; sid:539885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliance-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliance-covid-19.com"; sid:539886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliance-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliance-covid19.com"; sid:539887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliancecovid19.com"; sid:539888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allycoronavirus.com"; sid:539889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alphapandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alphapandemic.net"; sid:539890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiemposdecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiemposdecorona.net"; sid:539891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiemposdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiemposdelcorona.com"; sid:539892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ampcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ampcovid19.com"; sid:539893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ampdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ampdowncovid19.com"; sid:539894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amprecovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amprecovercovid19.com"; sid:539895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andrewscovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andrewscovidupdates.com"; sid:539896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona19coin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona19coin.com"; sid:539897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronacenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronacenter.com"; sid:539898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaclinic.com"; sid:539899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.ltd"; sid:539900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavaccine.com"; sid:539901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19coin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19coin.com"; sid:539902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19coin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19coin.com"; sid:539903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19coin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19coin.com"; sid:539904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19coin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19coin.net"; sid:539905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19coin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19coin.net"; sid:539906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19coin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19coin.net"; sid:539907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19.net"; sid:539908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19.net"; sid:539909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.life"; sid:539910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovids19.com"; sid:539911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemictheater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemictheater.com"; sid:539912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apparelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apparelcovid-19.com"; sid:539913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcovid19.com"; sid:539914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcoronavirusbankruptcy.com"; sid:539915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidtesting.com"; sid:539916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascoronavirusbankruptcy.com"; sid:539917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidtesting.com"; sid:539918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arlogistics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arlogistics-covid19.com"; sid:539919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciacorona.com"; sid:539920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciacoronavirus.com"; sid:539921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustestkit.com"; sid:539922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustestkits.com"; sid:539923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athometestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athometestcoronavirus.com"; sid:539924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athometestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athometestforcoronavirus.com"; sid:539925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aucoeurducovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aucoeurducovid19.com"; sid:539926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviancoronavirus.com"; sid:539927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudamiamicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudamiamicorona.com"; sid:539928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasbacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasbacoronavirus.com"; sid:539929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasbacovid19.com"; sid:539930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azoncologycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azoncologycovid-19.com"; sid:539931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babiesbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babiesbycorona.com"; sid:539932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bakercountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bakercountycovid19.com"; sid:539933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batcovid19.com"; sid:539934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid.com"; sid:539935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid.net"; sid:539936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidvirus.com"; sid:539937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruslawyers.com"; sid:539938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19insurance.com"; sid:539939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidlawyers.com"; sid:539940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestmask-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestmask-coronavirus.com"; sid:539941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoronacomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoronacomeback.com"; sid:539942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhhccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhhccovid19.com"; sid:539943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizaftercorona.com"; sid:539944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizaftercovid.com"; sid:539945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizhelpcovid19.com"; sid:539946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogildoposcuolaoltreilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogildoposcuolaoltreilcoronavirus.com"; sid:539947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bombcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bombcorona.com"; sid:539948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootocorona.com"; sid:539949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boscovid.com"; sid:539950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovidchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovidchain.com"; sid:539951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bridgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bridgecovid19.com"; sid:539952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckcorona19.com"; sid:539953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckcorona.com"; sid:539954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckcovid19.com"; sid:539955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckcovid.com"; sid:539956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bullbear-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bullbear-corona.com"; sid:539957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesshelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesshelpcovid19.com"; sid:539958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncoronavirus.com"; sid:539959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioninsurancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioninsurancecoronavirus.com"; sid:539960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19kit.com"; sid:539961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirustest.com"; sid:539962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid-19cases.com"; sid:539963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid-19.com"; sid:539964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19test.com"; sid:539965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecorona.world"; sid:539966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirusemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirusemployment.com"; sid:539967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruslawyers.com"; sid:539968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidtesting.com"; sid:539969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camp-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camp-corona.com"; sid:539970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninecoronavirus.com"; sid:539971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantaffordcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantaffordcorona.com"; sid:539972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capricorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capricorona.com"; sid:539973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capricoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capricoronas.com"; sid:539974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careduringcorona.com"; sid:539975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringforcovid.com"; sid:539976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpinteriacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpinteriacorona.com"; sid:539977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causajustacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causajustacoronavirus.com"; sid:539978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcurescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcurescorona.com"; sid:539979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccc4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccc4covid.com"; sid:539980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccceh-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccceh-covid.com"; sid:539981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cc-covid-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cc-covid-recovery.com"; sid:539982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcoronavirus.com"; sid:539983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cekcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cekcorona.com"; sid:539984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebswithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebswithcovid19.com"; sid:539985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralcovid19.com"; sid:539986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeaftercorona.com"; sid:539987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid19s.com"; sid:539988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid19t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid19t.com"; sid:539989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid19v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid19v.com"; sid:539990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcoronavirus.com"; sid:539991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checking4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checking4corona.com"; sid:539992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkingcorona.com"; sid:539993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkingforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkingforcorona.com"; sid:539994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chequecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chequecorona.com"; sid:539995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcleaning.com"; sid:539996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidlawyer.com"; sid:539997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcoronavirus.com"; sid:539998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcovid19.com"; sid:539999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronaviruslawsuit.com"; sid:540000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronaviruslawyer.com"; sid:540001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19lawsuit.com"; sid:540002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinaflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinaflupandemic.com"; sid:540003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecoronacure.com"; sid:540004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-covid19.com"; sid:540005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chokecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chokecorona.com"; sid:540006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cirmacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cirmacovid.com"; sid:540007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim-help-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim-help-covid-19.com"; sid:540008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim-help-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim-help-covid-19.net"; sid:540009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classcorona.com"; sid:540010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classescorona.com"; sid:540011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaning-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaning-covid19.com"; sid:540012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearofcorona.com"; sid:540013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clejewishcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clejewishcovid19.com"; sid:540014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid-19.com"; sid:540015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co-corona-coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co-corona-coaching.com"; sid:540016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocorona-coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocorona-coaching.com"; sid:540017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co-corona.com"; sid:540018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeeandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeeandcorona.com"; sid:540019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coincovid.com"; sid:540020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidsolutions.com"; sid:540021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidtesting.com"; sid:540022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for computingagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"computingagainstcovid19.com"; sid:540023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for computingagainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"computingagainstcovid19.net"; sid:540024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcovidtesting.com"; sid:540025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovid19.com"; sid:540026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovidchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovidchaos.com"; sid:540027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contemplationinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contemplationinthetimeofcovid.com"; sid:540028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingundercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingundercorona.com"; sid:540029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingincovid.com"; sid:540030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcoronavirus.net"; sid:540031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.club"; sid:540032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornishcorona.com"; sid:540033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona15.com"; sid:540034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona168.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona168.com"; sid:540035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona168.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona168.net"; sid:540036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19bandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19bandaid.com"; sid:540037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19bandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19bandaid.com"; sid:540038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19bandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19bandaid.net"; sid:540039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19bandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19bandaid.net"; sid:540040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19diary.com"; sid:540041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19karaoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19karaoke.com"; sid:540042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19stickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19stickingplaster.com"; sid:540043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19stickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19stickingplaster.net"; sid:540044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-2.com"; sid:540045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabogada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabogada.com"; sid:540046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabogado.com"; sid:540047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaact.com"; sid:540048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadventures.com"; sid:540049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaid20.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaid20.biz"; sid:540050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandcoffee.com"; sid:540051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasistencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasistencia.com"; sid:540052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaathome.com"; sid:540053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aufkleber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aufkleber.com"; sid:540054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ausstattung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ausstattung.com"; sid:540055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababymaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababymaker.com"; sid:540056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyregistry.com"; sid:540057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabacklash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabacklash.com"; sid:540058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandaid.com"; sid:540059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandaid.net"; sid:540060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandanas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandanas.com"; sid:540061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcylawyers.com"; sid:540062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyservices.com"; sid:540063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabed.com"; sid:540064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabicho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabicho.com"; sid:540065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabird.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabird.com"; sid:540066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirusnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirusnewnow.com"; sid:540067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirusnow.com"; sid:540068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirus-sd.com"; sid:540069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-blockbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-blockbuster.com"; sid:540070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablows.com"; sid:540071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabond.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabond.cloud"; sid:540072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonus.com"; sid:540073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboo.com"; sid:540074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomers2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomers2020.com"; sid:540075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomers2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomers2021.com"; sid:540076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabureau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabureau.com"; sid:540077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburnout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburnout.com"; sid:540078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessexperts.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessexperts.solutions"; sid:540079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesssupport.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesssupport.co.uk"; sid:540080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusiness.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusiness.wtf"; sid:540081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster.net"; sid:540082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterz.com"; sid:540083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabycounty.com"; sid:540084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabana.com"; sid:540085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabinfevers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabinfevers.com"; sid:540086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-calamity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-calamity.com"; sid:540087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacantbeatme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacantbeatme.com"; sid:540088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacantkeepusapart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacantkeepusapart.com"; sid:540089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarehi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarehi.com"; sid:540090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaremd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaremd.com"; sid:540091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareparcel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareparcel.com"; sid:540092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.world"; sid:540093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesamerica.com"; sid:540094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesusa.com"; sid:540095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashsecrets.com"; sid:540096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacause.com"; sid:540097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaccomplishments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaccomplishments.com"; sid:540098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachallanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachallanges.com"; sid:540099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachallenge2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachallenge2020.com"; sid:540100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-changed-the-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-changed-the-world.com"; sid:540101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-changed-theworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-changed-theworld.com"; sid:540102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-changed-theworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-changed-theworld.net"; sid:540103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecks.net"; sid:540104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck-sudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck-sudan.com"; sid:540105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachristmas2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachristmas2020.com"; sid:540106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidades.com"; sid:540107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cine.com"; sid:540108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirusnow.com"; sid:540109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirus-sd.com"; sid:540110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassified.com"; sid:540111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanses.com"; sid:540112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleared.com"; sid:540113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoachcafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoachcafe.com"; sid:540114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoaster.com"; sid:540115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolumbus.com"; sid:540116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomeback2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomeback2020.com"; sid:540117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-communication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-communication.com"; sid:540118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunitysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunitysupport.com"; sid:540119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnect.net"; sid:540120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnects.com"; sid:540121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontext.com"; sid:540122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontext.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontext.net"; sid:540123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoord.com"; sid:540124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacord.com"; sid:540125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounseling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounseling.net"; sid:540126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounters.com"; sid:540127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouriers.com"; sid:540128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cover.com"; sid:540129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidcare.com"; sid:540130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidcleaner.com"; sid:540131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraft.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraft.club"; sid:540132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crafts.com"; sid:540133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisburn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisburn.com"; sid:540134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisischallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisischallenge.com"; sid:540135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crowd.com"; sid:540136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruisesvi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruisesvi.com"; sid:540137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacryptonite.com"; sid:540138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaction.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaction.world"; sid:540139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuresong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuresong.com"; sid:540140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuriosity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuriosity.com"; sid:540141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadataanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadataanalysis.com"; sid:540142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-datahub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-datahub.com"; sid:540143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadax.com"; sid:540144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaddio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaddio.com"; sid:540145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtservices.com"; sid:540146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefence2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefence2020.com"; sid:540147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefenselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefenselawyers.com"; sid:540148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensepack.com"; sid:540149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadentist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadentist.net"; sid:540150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnosticos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnosticos.com"; sid:540151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries-pod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries-pod.com"; sid:540152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiariespod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiariespod.com"; sid:540153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiarys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiarys.com"; sid:540154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiet.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiet.club"; sid:540155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiploma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiploma.net"; sid:540156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterhelp.com"; sid:540157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterrecovery.com"; sid:540158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscovery.com"; sid:540159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecheck.com"; sid:540160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaselawyers.com"; sid:540161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaserecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaserecovery.com"; sid:540162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseventilator.com"; sid:540163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-doctor.com"; sid:540164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocuments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocuments.com"; sid:540165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadollars.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadollars.net"; sid:540166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadontbuckwithtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadontbuckwithtexas.com"; sid:540167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivethroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivethroughs.com"; sid:540168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadronline.com"; sid:540169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadruglawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadruglawyer.com"; sid:540170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrugusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrugusa.com"; sid:540171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaecuador.com"; sid:540172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeinkaufshilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeinkaufshilfe.com"; sid:540173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelixir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelixir.com"; sid:540174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-essentials.com"; sid:540175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaet.com"; sid:540176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeuropa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeuropa.com"; sid:540177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextinction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextinction.com"; sid:540178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.finance"; sid:540179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinance.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinance.guru"; sid:540180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinance.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinance.today"; sid:540181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finanzhilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finanzhilfe.net"; sid:540182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fitnessinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fitnessinfo.com"; sid:540183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflcounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflcounsel.com"; sid:540184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fonds.com"; sid:540185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafooddelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafooddelivery.com"; sid:540186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodkit.com"; sid:540187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodreserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodreserve.com"; sid:540188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforchange.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforchange.net"; sid:540189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforeclosureservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforeclosureservices.com"; sid:540190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.club"; sid:540191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.life"; sid:540192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrei.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrei.net"; sid:540193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafro.com"; sid:540194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fund.com"; sid:540195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-future.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-future.com"; sid:540196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagale.com"; sid:540197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaga.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaga.net"; sid:540198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirusnow.com"; sid:540199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-good-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-good-news.com"; sid:540200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardians.com"; sid:540201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguard.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguard.life"; sid:540202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardtest.com"; sid:540203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunlerindeiyilik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunlerindeiyilik.com"; sid:540204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahackers.com"; sid:540205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsanitizerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsanitizerpro.com"; sid:540206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappened.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappened.com"; sid:540207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappened.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappened.net"; sid:540208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappyhour.com"; sid:540209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthlawyers.com"; sid:540210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.agency"; sid:540211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpbox.com"; sid:540212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpcenterct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpcenterct.com"; sid:540213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpcenters.com"; sid:540214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.coach"; sid:540215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.guru"; sid:540216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahero.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahero.today"; sid:540217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherpes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherpes.com"; sid:540218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hessen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hessen.com"; sid:540219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.coach"; sid:540220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfedeutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfedeutschland.com"; sid:540221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.digital"; sid:540222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomam.com"; sid:540223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecation.com"; sid:540224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-home-cup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-home-cup.com"; sid:540225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotline.net"; sid:540226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immunity.com"; sid:540227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpact.net"; sid:540228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjurylaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjurylaws.com"; sid:540229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsua.com"; sid:540230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelawsuits.com"; sid:540231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurances.com"; sid:540232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsusa.com"; sid:540233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuas.com"; sid:540234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuse.com"; sid:540235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisusa.com"; sid:540236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisus.com"; sid:540237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jo.com"; sid:540238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajugend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajugend.com"; sid:540239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-karaoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-karaoke.com"; sid:540240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakicks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakicks.com"; sid:540241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakids2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakids2020.com"; sid:540242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.life"; sid:540243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillermask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillermask.life"; sid:540244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillsus.com"; sid:540245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindnessproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindnessproject.com"; sid:540246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakink.com"; sid:540247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaklenze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaklenze.com"; sid:540248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakonkurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakonkurse.com"; sid:540249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kredit.net"; sid:540250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaldo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaldo.com"; sid:540251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legal-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legal-helpline.com"; sid:540252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalhelpline.com"; sid:540253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legal-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legal-hotline.com"; sid:540254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalhotline.com"; sid:540255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-liquiditaetshilfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-liquiditaetshilfen.com"; sid:540256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive.events"; sid:540257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivesmatter.com"; sid:540258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanmods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanmods.com"; sid:540259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalookout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalookout.com"; sid:540260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-made.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-made.com"; sid:540261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamademe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamademe.com"; sid:540262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadness.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadness.co.uk"; sid:540263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamain.com"; sid:540264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaison.com"; sid:540265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanceseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanceseries.com"; sid:540266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskbr.com"; sid:540267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskee.com"; sid:540268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedcentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedcentrum.com"; sid:540269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalbroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalbroker.com"; sid:540270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalconsults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalconsults.com"; sid:540271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicaldoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicaldoctors.com"; sid:540272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medicalsupplies.com"; sid:540273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedtech.com"; sid:540274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerchshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerchshop.com"; sid:540275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametro.com"; sid:540276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminator.com"; sid:540277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminecraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminecraft.com"; sid:540278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoneyhelp.com"; sid:540279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoney.net"; sid:540280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonitoring.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonitoring.net"; sid:540281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mortgagerelief.com"; sid:540282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagerelif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagerelif.com"; sid:540283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoviereviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoviereviews.com"; sid:540284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamu.net"; sid:540285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamurcia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamurcia.com"; sid:540286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanavigator.com"; sid:540287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewborns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewborns.com"; sid:540288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsbit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsbit.com"; sid:540289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsbits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsbits.com"; sid:540290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsflash.com"; sid:540291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews-lb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews-lb.com"; sid:540292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsletter.com"; sid:540293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsspot.com"; sid:540294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsupdates.com"; sid:540295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanigeria.com"; sid:540296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanineteen.com"; sid:540297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoroc.com"; sid:540298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopportunity.com"; sid:540299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopportunityfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopportunityfund.com"; sid:540300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-osusi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-osusi.net"; sid:540301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakupdates.com"; sid:540302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pacolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pacolypse.com"; sid:540303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapale.com"; sid:540304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapanacea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapanacea.com"; sid:540305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemic.club"; sid:540306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatient.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatient.care"; sid:540307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatients.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatients.care"; sid:540308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatrol.com"; sid:540309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapay.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapay.net"; sid:540310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapi.com"; sid:540311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapleiten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapleiten.com"; sid:540312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplumbersltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplumbersltd.com"; sid:540313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaporn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaporn.net"; sid:540314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappe.com"; sid:540315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreps.com"; sid:540316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventiemiddelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventiemiddelen.com"; sid:540317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventiescherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventiescherm.com"; sid:540318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprice.com"; sid:540319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-problems-worth-solving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-problems-worth-solving.com"; sid:540320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiongear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiongear.com"; sid:540321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotective.com"; sid:540322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectkit.com"; sid:540323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-qa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-qa.com"; sid:540324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinesolutions.com"; sid:540325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqueens.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqueens.club"; sid:540326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-race.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-race.com"; sid:540327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarank.com"; sid:540328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapid-test.com"; sid:540329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealitycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealitycheck.com"; sid:540330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebate.com"; sid:540331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recession.com"; sid:540332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareckoning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareckoning.com"; sid:540333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recovery.com"; sid:540334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefresca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefresca.com"; sid:540335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareg.com"; sid:540336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-register.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-register.com"; sid:540337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefhelp.com"; sid:540338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremover.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremover.biz"; sid:540339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponse.net"; sid:540340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestart.com"; sid:540341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestaurantdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestaurantdelivery.com"; sid:540342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarirusnow.com"; sid:540343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariskmap.com"; sid:540344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarius-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarius-19.com"; sid:540345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronart.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronart.life"; sid:540346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarumors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarumors.com"; sid:540347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizeclean.com"; sid:540348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizecleaning.com"; sid:540349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzschild.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzschild.net"; sid:540350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzwand.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzwand.net"; sid:540351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascoop.com"; sid:540352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningservices.com"; sid:540353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasept.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasept.net"; sid:540354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasequence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasequence.com"; sid:540355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasequencing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasequencing.com"; sid:540356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasexxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasexxx.com"; sid:540357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shop24.com"; sid:540358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shopping.com"; sid:540359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesscounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesscounsel.com"; sid:540360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesslaw.com"; sid:540361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesslaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesslaw.net"; sid:540362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesslaws.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesslaws.net"; sid:540363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesslawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesslawyer.net"; sid:540364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesslegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesslegal.com"; sid:540365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasidehustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasidehustle.com"; sid:540366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasinusa.com"; sid:540367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasip.com"; sid:540368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasitting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasitting.com"; sid:540369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasme.com"; sid:540370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasporty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasporty.com"; sid:540371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspotter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspotter.com"; sid:540372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassur.com"; sid:540373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sticker.com"; sid:540374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastiftung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastiftung.com"; sid:540375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong2020.com"; sid:540376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastudent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastudent.com"; sid:540377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastudents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastudents.com"; sid:540378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastudie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastudie.com"; sid:540379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucksofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucksofficial.com"; sid:540380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuckthis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuckthis.com"; sid:540381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucs.com"; sid:540382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucs.net"; sid:540383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunrise2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunrise2020.com"; sid:540384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesbroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesbroker.com"; sid:540385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survival-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survival-party.com"; sid:540386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survival-party.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survival-party.net"; sid:540387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorstore.com"; sid:540388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasutra.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasutra.life"; sid:540389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvirusnow.com"; sid:540390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatainment.com"; sid:540391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatco.com"; sid:540392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-t.com"; sid:540393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatconsulting.com"; sid:540394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatedtct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatedtct.com"; sid:540395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestca.com"; sid:540396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.center"; sid:540397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglocation.com"; sid:540398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testkits.com"; sid:540399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlocation.com"; sid:540400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsd.com"; sid:540401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestyourself.com"; sid:540402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathehelp.com"; sid:540403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-the-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-the-movie.com"; sid:540404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathemusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathemusical.com"; sid:540405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaties.com"; sid:540406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.net"; sid:540407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrealty.com"; sid:540408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ts.com"; sid:540409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatsjoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatsjoy.com"; sid:540410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatsusa.com"; sid:540411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatuning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatuning.com"; sid:540412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatur.com"; sid:540413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatxlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatxlawyers.com"; sid:540414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunus.com"; sid:540415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatesbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatesbd.com"; sid:540416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauslaw.com"; sid:540417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavblues.com"; sid:540418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverified.com"; sid:540419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicidal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicidal.com"; sid:540420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictorygardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictorygardens.com"; sid:540421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigator.com"; sid:540422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinusa.com"; sid:540423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirasnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirasnewnow.com"; sid:540424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirasnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirasnow.com"; sid:540425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirismewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirismewsnow.com"; sid:540426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirosnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirosnow.com"; sid:540427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsunewnos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsunewnos.com"; sid:540428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsus-sd.com"; sid:540429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruanow.com"; sid:540430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirua-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirua-sd.com"; sid:540431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirue.com"; sid:540432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus019.com"; sid:540433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus310.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus310.com"; sid:540434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-411.com"; sid:540435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus773.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus773.com"; sid:540436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus818.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus818.com"; sid:540437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabogado.com"; sid:540438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusacqua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusacqua.com"; sid:540439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ad.com"; sid:540440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafrica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafrica.net"; sid:540441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagediscrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagediscrimination.com"; sid:540442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaircleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaircleaner.com"; sid:540443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalternativecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalternativecare.com"; sid:540444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalternativecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalternativecure.com"; sid:540445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanddentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanddentistry.com"; sid:540446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxieties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxieties.com"; sid:540447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxious.com"; sid:540448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaqua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaqua.com"; sid:540449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-arbeitsrecht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-arbeitsrecht.com"; sid:540450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattackgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattackgame.com"; sid:540451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysatlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysatlaw.com"; sid:540452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaumaroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaumaroc.com"; sid:540453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbandaid.com"; sid:540454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbandaid.net"; sid:540455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bankruptcyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bankruptcyattorney.com"; sid:540456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bankruptcylawyer.com"; sid:540457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarcelona.com"; sid:540458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbed.com"; sid:540459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeer.net"; sid:540460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbharat.com"; sid:540461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbizloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbizloan.com"; sid:540462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbridgeloan.com"; sid:540463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbridgeloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbridgeloans.com"; sid:540464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbudget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbudget.com"; sid:540465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessbridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessbridgeloan.com"; sid:540466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessgrants.com"; sid:540467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruption.com"; sid:540468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruption.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruption.net"; sid:540469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslawyer.com"; sid:540470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloancpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloancpa.com"; sid:540471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslostlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslostlawyer.com"; sid:540472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbycounty.com"; sid:540473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscampusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscampusnews.com"; sid:540474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-careers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-careers.com"; sid:540475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashflow.com"; sid:540476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-chart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-chart.com"; sid:540477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaims.biz"; sid:540478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawsuit.com"; sid:540479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassrooms.com"; sid:540480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanandclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanandclear.com"; sid:540481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerkc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerkc.com"; sid:540482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningelpaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningelpaso.com"; sid:540483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninginfo.com"; sid:540484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningusa.com"; sid:540485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosedown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosedown.com"; sid:540486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollegefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollegefund.com"; sid:540487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomments.com"; sid:540488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-compensation.com"; sid:540489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconstructionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconstructionlawyer.com"; sid:540490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconversations.com"; sid:540491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovidnineteen.com"; sid:540492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-crash.com"; sid:540493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisishelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisishelp.com"; sid:540494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisismanagement.com"; sid:540495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrossstitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrossstitch.com"; sid:540496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseclaim.com"; sid:540497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureitaly.com"; sid:540498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusd19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusd19.com"; sid:540499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtcollect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtcollect.com"; sid:540500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtmanagement.com"; sid:540501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtreliefservices.com"; sid:540502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeepkleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeepkleen.com"; sid:540503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dentistry.com"; sid:540504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-diabetes-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-diabetes-registry.com"; sid:540505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnostico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnostico.com"; sid:540506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterinsurance.com"; sid:540507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterreliefcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterreliefcalifornia.com"; sid:540508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterreliefnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterreliefnewyork.com"; sid:540509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscriminations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscriminations.com"; sid:540510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-donate.com"; sid:540511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonatenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonatenow.com"; sid:540512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-donation.com"; sid:540513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-doyourpart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-doyourpart.com"; sid:540514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdtx.com"; sid:540515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployeeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployeeclaims.com"; sid:540516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployeerights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployeerights.com"; sid:540517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployergrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployergrants.com"; sid:540518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentsupport.com"; sid:540519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenlinea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenlinea.com"; sid:540520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesmasks.com"; sid:540521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesnow.com"; sid:540522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestateplanning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestateplanning.net"; sid:540523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesventilator.com"; sid:540524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-express-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-express-test.com"; sid:540525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfc.com"; sid:540526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialclaims.com"; sid:540527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialcrash.com"; sid:540528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialexperts.com"; sid:540529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfondos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfondos.com"; sid:540530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsupplies.com"; sid:540531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsupply.com"; sid:540532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortunecookie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortunecookie.com"; sid:540533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortunecookies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortunecookies.com"; sid:540534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreesurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreesurgery.com"; sid:540535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunk.com"; sid:540536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuture.net"; sid:540537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-genetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-genetics.com"; sid:540538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenetics.com"; sid:540539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgermmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgermmask.com"; sid:540540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgirona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgirona.com"; sid:540541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobaloutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobaloutbreak.com"; sid:540542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmenthelp.com"; sid:540543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.group"; sid:540544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroupactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroupactions.com"; sid:540545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroupclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroupclaims.com"; sid:540546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-health.com"; sid:540547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthny.com"; sid:540548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthplan.com"; sid:540549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthretreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthretreats.com"; sid:540550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpcentre.com"; sid:540551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.guide"; sid:540552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoarding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoarding.com"; sid:540553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomesforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomesforsale.com"; sid:540554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotzone.com"; sid:540555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushouseparty.com"; sid:540556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hq.net"; sid:540557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-humor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-humor.com"; sid:540558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusillinoislawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusillinoislawyers.com"; sid:540559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunesupports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunesupports.com"; sid:540560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-immunity.com"; sid:540561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationonline.com"; sid:540562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinisa.com"; sid:540563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjections.com"; sid:540564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusint.com"; sid:540565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjob.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjob.net"; sid:540566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobretentionscheme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobretentionscheme.com"; sid:540567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawfirm.com"; sid:540568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawforeveryone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawforeveryone.com"; sid:540569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaw.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaw.legal"; sid:540570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerblog.com"; sid:540571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyercolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyercolorado.com"; sid:540572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyers.biz"; sid:540573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalblog.com"; sid:540574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalclaims.com"; sid:540575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-legalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-legalhelp.com"; sid:540576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalservices.com"; sid:540577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsolutions.com"; sid:540578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslessonplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslessonplan.com"; sid:540579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslessonplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslessonplans.com"; sid:540580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslitigationblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslitigationblog.com"; sid:540581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslitigatorblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslitigatorblog.com"; sid:540582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslive.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslive.support"; sid:540583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanmodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanmodification.com"; sid:540584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanprogram.com"; sid:540585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapnow.com"; sid:540586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaptips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaptips.com"; sid:540587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapviewer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapviewer.com"; sid:540588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.kim - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.kim"; sid:540589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalexperts.com"; sid:540590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medications.com"; sid:540591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmentalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmentalhelp.com"; sid:540592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-merch.com"; sid:540593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmewnow.com"; sid:540594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmexico.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmexico.net"; sid:540595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichiganlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichiganlawyers.com"; sid:540596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmindfulness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmindfulness.com"; sid:540597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgagereliefplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgagereliefplan.com"; sid:540598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95.club"; sid:540599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95.life"; sid:540600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews365.com"; sid:540601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsheadlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsheadlines.com"; sid:540602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnlimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnlimes.com"; sid:540603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnom.com"; sid:540604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotforprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotforprofit.com"; sid:540605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetherapy.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetherapy.solutions"; sid:540606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopen.com"; sid:540607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopportunities.com"; sid:540608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopposition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopposition.com"; sid:540609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicessentials.com"; sid:540610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparent.com"; sid:540611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparenting.com"; sid:540612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusperu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusperu.net"; sid:540613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspillow.com"; sid:540614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspodcasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspodcasts.com"; sid:540615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspot.net"; sid:540616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppequip.com"; sid:540617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspregnant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspregnant.com"; sid:540618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prescription.com"; sid:540619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusproducts.com"; sid:540620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprojects.com"; sid:540621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprophet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprophet.com"; sid:540622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection.agency"; sid:540623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection.biz"; sid:540624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprueba.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprueba.net"; sid:540625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusptsd.com"; sid:540626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantineporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantineporn.com"; sid:540627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatelaw.com"; sid:540628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatelawyer.com"; sid:540629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatelawyers.com"; sid:540630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusrealtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusrealtime.com"; sid:540631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrebatecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrebatecheck.com"; sid:540632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrebate.com"; sid:540633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-recht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-recht.com"; sid:540634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rechtsberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rechtsberatung.com"; sid:540635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-recovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-recovered.com"; sid:540636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecovery.net"; sid:540637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregistry.net"; sid:540638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelationships.com"; sid:540639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefcheck.com"; sid:540640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrentalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrentalrights.com"; sid:540641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrentersrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrentersrights.com"; sid:540642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchlive.com"; sid:540643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcesforprinters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcesforprinters.com"; sid:540644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrespiratoryppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrespiratoryppe.com"; sid:540645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafehome.com"; sid:540646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafehouse.com"; sid:540647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyequipment.com"; sid:540648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreeningterminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreeningterminal.com"; sid:540649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussearchresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussearchresults.com"; sid:540650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfemployed.com"; sid:540651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussequence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussequence.com"; sid:540652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussequencing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussequencing.com"; sid:540653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussip.com"; sid:540654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessbridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessbridgeloan.com"; sid:540655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessloans.com"; sid:540656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussongs.com"; sid:540657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sozialrecht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sozialrecht.com"; sid:540658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-spiele.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-spiele.com"; sid:540659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstayathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstayathome.com"; sid:540660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluscheck.com"; sid:540661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstore.net"; sid:540662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppychains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppychains.com"; sid:540663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalism.com"; sid:540664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurviver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurviver.com"; sid:540665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyllabus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyllabus.com"; sid:540666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomsdaybyday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomsdaybyday.com"; sid:540667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteaching.com"; sid:540668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tec.com"; sid:540669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechsupport.com"; sid:540670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustenantrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustenantrights.com"; sid:540671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustenantsrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustenantsrights.com"; sid:540672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminal.com"; sid:540673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-teste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-teste.com"; sid:540674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingservice.com"; sid:540675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingtx.com"; sid:540676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsd.com"; sid:540677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteststrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteststrips.com"; sid:540678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tests-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tests-uk.com"; sid:540679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestuk.com"; sid:540680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestus.com"; sid:540681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthinktoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthinktoday.com"; sid:540682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimeout.com"; sid:540683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoptreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoptreatments.com"; sid:540684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustories.com"; sid:540685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialblog.com"; sid:540686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustriallawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustriallawyer.com"; sid:540687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusturk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusturk.com"; sid:540688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemploymentapplication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemploymentapplication.com"; sid:540689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemploymentbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemploymentbenefits.com"; sid:540690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemploymentcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemploymentcalifornia.com"; sid:540691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemploymentflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemploymentflorida.com"; sid:540692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunions.com"; sid:540693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususe.com"; sid:540694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacinations.com"; sid:540695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirusnow.com"; sid:540696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvodka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvodka.com"; sid:540697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoices.com"; sid:540698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswageclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswageclaims.com"; sid:540699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswages.com"; sid:540700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarriors.com"; sid:540701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhiskey.com"; sid:540702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhiskey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhiskey.net"; sid:540703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhisky.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhisky.net"; sid:540704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusy.net"; sid:540705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyourhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyourhealth.com"; sid:540706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruznews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruznews.com"; sid:540707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirysnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirysnewnow.com"; sid:540708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitality.com"; sid:540709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitus-sd.com"; sid:540710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavius-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavius-sd.com"; sid:540711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivirus.com"; sid:540712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorus-sd.com"; sid:540713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrfinancialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrfinancialhelp.com"; sid:540714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavris.com"; sid:540715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavriusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavriusnews.com"; sid:540716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurusnow.com"; sid:540717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavvirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavvirusnewsnow.com"; sid:540718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalaw.com"; sid:540719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wall.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wall.net"; sid:540720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashlaw.com"; sid:540721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashlaws.com"; sid:540722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashlawyer.com"; sid:540723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashlawyers.com"; sid:540724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wear.com"; sid:540725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebinar.com"; sid:540726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wissen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wissen.com"; sid:540727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldinfo.com"; sid:540728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-worldmap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-worldmap.net"; sid:540729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldwide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldwide.net"; sid:540730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawp.com"; sid:540731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxombie.com"; sid:540732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-yoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-yoga.com"; sid:540733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayouth.com"; sid:540734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikatest.com"; sid:540735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coursecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coursecorona.com"; sid:540736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-02.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-02.com"; sid:540737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid02.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid02.com"; sid:540738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-10k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-10k.com"; sid:540739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10k.com"; sid:540740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-13.com"; sid:540741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-411.com"; sid:540742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984.wtf"; sid:540743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-africa.com"; sid:540744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid.group"; sid:540745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aid.net"; sid:540746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alternativetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alternativetreatment.com"; sid:540747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alternativetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alternativetreatment.com"; sid:540748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alternativetreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alternativetreatments.com"; sid:540749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alternativetreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alternativetreatments.com"; sid:540750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anccancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anccancer.com"; sid:540751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcancer.com"; sid:540752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andcancerinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andcancerinformation.com"; sid:540753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcancerinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcancerinformation.com"; sid:540754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andcancerresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andcancerresources.com"; sid:540755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcancerresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcancerresources.com"; sid:540756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andyourcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andyourcancer.com"; sid:540757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andyourcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andyourcancer.com"; sid:540758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19animals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19animals.com"; sid:540759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodies.com"; sid:540760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibody.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibody.net"; sid:540761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antidote.com"; sid:540762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anxiety.com"; sid:540763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19approved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19approved.com"; sid:540764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19archive.com"; sid:540765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19archive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19archive.net"; sid:540766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-askhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-askhr.com"; sid:540767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19association.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19association.com"; sid:540768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneycolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneycolorado.com"; sid:540769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysatlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysatlaw.com"; sid:540770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19auto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19auto.com"; sid:540771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19avatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19avatar.com"; sid:540772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avatar.com"; sid:540773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awearness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awearness.com"; sid:540774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babyboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babyboomer.com"; sid:540775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19badge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19badge.com"; sid:540776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bandaid.com"; sid:540777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bandaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bandaid.com"; sid:540778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bandaid.net"; sid:540779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bandaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bandaid.net"; sid:540780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bank.com"; sid:540781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bed.com"; sid:540782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19beer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19beer.net"; sid:540783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beer.net"; sid:540784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bg.com"; sid:540785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biclaims.com"; sid:540786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bingo.com"; sid:540787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizinterruption.com"; sid:540788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizpivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizpivots.com"; sid:540789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biztips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biztips.com"; sid:540790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-blog.com"; sid:540791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-blood-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-blood-test.com"; sid:540792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bloodtest.com"; sid:540793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19brazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19brazil.com"; sid:540794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brooklynhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brooklynhelpers.com"; sid:540795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19browser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19browser.com"; sid:540796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionclaims.com"; sid:540797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesstips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesstips.com"; sid:540798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cabinfever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cabinfever.com"; sid:540799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19calc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19calc.com"; sid:540800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19calistrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19calistrong.com"; sid:540801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cameras.com"; sid:540802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19careers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19careers.com"; sid:540803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careers.com"; sid:540804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carekits.com"; sid:540805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carepackage.com"; sid:540806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chain.com"; sid:540807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chain.com"; sid:540808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19charity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19charity.com"; sid:540809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.cheap - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.cheap"; sid:540810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chi.com"; sid:540811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-chloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-chloroquine.com"; sid:540812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chronicles.com"; sid:540813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19church.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19church.club"; sid:540814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ci.com"; sid:540815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cide.com"; sid:540816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cide.com"; sid:540817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcompany.com"; sid:540818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsanitizingservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsanitizingservicesnashville.com"; sid:540819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsanitizingsevicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsanitizingsevicesnashville.com"; sid:540820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupar.com"; sid:540821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanuparkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanuparkansas.com"; sid:540822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closed.com"; sid:540823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closure.com"; sid:540824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19club.com"; sid:540825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cme.com"; sid:540826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cme.com"; sid:540827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19comedy.com"; sid:540828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleaning.com"; sid:540829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commission.com"; sid:540830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19convention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19convention.com"; sid:540831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona.care"; sid:540832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus-vaccine.com"; sid:540833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counsel.com"; sid:540834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cover.com"; sid:540835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.credit"; sid:540836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crisiscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crisiscounseling.com"; sid:540837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisiscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisiscounseling.com"; sid:540838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crisismanagement.com"; sid:540839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisispr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisispr.com"; sid:540840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crossstitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crossstitch.com"; sid:540841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure.today"; sid:540842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-daily-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-daily-report.com"; sid:540843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-dashboard.com"; sid:540844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deal.com"; sid:540845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalppedonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalppedonations.com"; sid:540846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dfw.com"; sid:540847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterinsurance.com"; sid:540848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterreliefcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterreliefcalifornia.com"; sid:540849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disruption.com"; sid:540850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diy.com"; sid:540851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doctor.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doctor.today"; sid:540852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19documentprepservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19documentprepservice.com"; sid:540853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-donate.com"; sid:540854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donations.net"; sid:540855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethroughs.com"; sid:540856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dvm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dvm.com"; sid:540857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edinburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edinburgh.com"; sid:540858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elvirus.com"; sid:540859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emirates.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emirates.pro"; sid:540860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeeclaims.com"; sid:540861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19experimentaltheraputics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19experimentaltheraputics.com"; sid:540862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facetime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facetime.com"; sid:540863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facilities.com"; sid:540864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facility.com"; sid:540865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19families.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19families.com"; sid:540866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fashion.com"; sid:540867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fasthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fasthelp.com"; sid:540868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fasthometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fasthometest.com"; sid:540869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19finance.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19finance.today"; sid:540870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialexperts.com"; sid:540871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstone.com"; sid:540872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstresponders.com"; sid:540873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fondos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fondos.com"; sid:540874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fonds.com"; sid:540875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fonds.com"; sid:540876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fonds.com"; sid:540877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodsurvey.com"; sid:540878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontline.com"; sid:540879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funding.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funding.biz"; sid:540880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fundraiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fundraiser.com"; sid:540881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19future.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19future.com"; sid:540882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19future.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19future.net"; sid:540883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ga.com"; sid:540884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ga.com"; sid:540885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genericvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genericvaccine.com"; sid:540886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genericvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genericvaccines.com"; sid:540887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-genetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-genetics.com"; sid:540888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-genetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-genetics.com"; sid:540889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genetics.com"; sid:540890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalresponseteam.com"; sid:540891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19go.com"; sid:540892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gohelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gohelp.com"; sid:540893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19google.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19google.com"; sid:540894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentgrant.com"; sid:540895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentgrant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentgrant.net"; sid:540896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-grant.com"; sid:540897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19groupclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19groupclaim.com"; sid:540898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19groupclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19groupclaims.com"; sid:540899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guarda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guarda.com"; sid:540900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-guidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-guidelines.com"; sid:540901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haiti.com"; sid:540902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healingavatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healingavatar.com"; sid:540903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healingavatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healingavatar.com"; sid:540904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healingoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healingoracle.com"; sid:540905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthinsurance.com"; sid:540906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthinsurance.com"; sid:540907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19help4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19help4u.com"; sid:540908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpcenter.com"; sid:540909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpcentre.com"; sid:540910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpforyou.com"; sid:540911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hoarding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hoarding.com"; sid:540912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homelabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homelabtest.com"; sid:540913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-home-test.com"; sid:540914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeworkoutprogramme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeworkoutprogramme.com"; sid:540915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitals.com"; sid:540916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19house.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19house.com"; sid:540917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19house.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19house.net"; sid:540918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houses.com"; sid:540919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hurts.com"; sid:540920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hurtsyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hurtsyou.com"; sid:540921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icide.com"; sid:540922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ig.com"; sid:540923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ig.com"; sid:540924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunesupport.com"; sid:540925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunity.com"; sid:540926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infos.com"; sid:540927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injuryattorney.com"; sid:540928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injuryattorneys.com"; sid:540929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylawyer.com"; sid:540930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurance.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurance.guru"; sid:540931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawsuits.com"; sid:540932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceonline.com"; sid:540933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurances.com"; sid:540934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19interviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19interviews.com"; sid:540935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interviews.com"; sid:540936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19issues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19issues.com"; sid:540937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19janitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19janitorial.com"; sid:540938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jersey.com"; sid:540939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19karaoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19karaoke.com"; sid:540940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keyworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keyworkers.com"; sid:540941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19krun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19krun.com"; sid:540942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19launchpad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19launchpad.com"; sid:540943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.club"; sid:540944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawfirm.com"; sid:540945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.legal"; sid:540946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.pro"; sid:540947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laws.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laws.net"; sid:540948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.solutions"; sid:540949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.today"; sid:540950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyercolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyercolorado.com"; sid:540951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawyers.net"; sid:540952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyers.net"; sid:540953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalcenter.com"; sid:540954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalclaims.com"; sid:540955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaldocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaldocs.com"; sid:540956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-legal-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-legal-helpline.com"; sid:540957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelpline.com"; sid:540958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-legal-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-legal-hotline.com"; sid:540959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-legalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-legalhotline.com"; sid:540960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalinfo.com"; sid:540961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalissues.com"; sid:540962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lenders.com"; sid:540963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lending.com"; sid:540964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveconcert.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveconcert.club"; sid:540965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveconcert.com"; sid:540966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveconcerts.com"; sid:540967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveconcert.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveconcert.ventures"; sid:540968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.net"; sid:540969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live-news.com"; sid:540970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestatus.com"; sid:540971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livesymphony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livesymphony.com"; sid:540972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lk.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lk.today"; sid:540973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmodification.com"; sid:540974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.loans"; sid:540975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans.net"; sid:540976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lockdowns.com"; sid:540977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-loracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-loracle.com"; sid:540978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lracle.com"; sid:540979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.management"; sid:540980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19map.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19map.life"; sid:540981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19market.com"; sid:540982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksource.com"; sid:540983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masque.com"; sid:540984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalexperts.com"; sid:540985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicalsupplies.com"; sid:540986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalsupply.com"; sid:540987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalteam.com"; sid:540988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medication.com"; sid:540989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medications.com"; sid:540990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.run"; sid:540991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealth.net"; sid:540992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meteo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meteo.com"; sid:540993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miamiattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miamiattorney.com"; sid:540994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miamilaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miamilaw.com"; sid:540995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miamilawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miamilawfirm.com"; sid:540996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miamilawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miamilawyer.com"; sid:540997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miamisba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miamisba.com"; sid:540998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19michiganlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19michiganlawyers.com"; sid:540999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19midmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19midmo.com"; sid:541000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19military.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19military.com"; sid:541001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19missouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19missouri.com"; sid:541002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moments.com"; sid:541003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mortgage.com"; sid:541004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mortgagerelief.com"; sid:541005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movers.com"; sid:541006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mystery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mystery.com"; sid:541007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalrecovery.com"; sid:541008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19navigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19navigator.com"; sid:541009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19network.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19network.com"; sid:541010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsday.com"; sid:541011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nonprofitcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nonprofitcourse.com"; sid:541012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19normality.com"; sid:541013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normality.com"; sid:541014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notify.com"; sid:541015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nurses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nurses.com"; sid:541016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ofacle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ofacle.com"; sid:541017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ofacle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ofacle.com"; sid:541018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officecleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officecleaningservices.com"; sid:541019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinehelp.com"; sid:541020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineshopguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineshopguide.com"; sid:541021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracke.com"; sid:541022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oraclle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oraclle.com"; sid:541023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oraclr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oraclr.com"; sid:541024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracole.com"; sid:541025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19orale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19orale.com"; sid:541026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-orcle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-orcle.com"; sid:541027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19origin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19origin.com"; sid:541028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemic-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemic-data.com"; sid:541029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicrelief.com"; sid:541030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patterns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patterns.com"; sid:541031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pay.com"; sid:541032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pb.com"; sid:541033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phone.com"; sid:541034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photos.com"; sid:541035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photostory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photostory.com"; sid:541036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pivots.com"; sid:541037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pot.com"; sid:541038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pot.net"; sid:541039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pot.net"; sid:541040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppenow.com"; sid:541041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prescription.com"; sid:541042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionofficecleaningservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionofficecleaningservicesnashville.com"; sid:541043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectmenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectmenow.com"; sid:541044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychology.com"; sid:541045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pub.com"; sid:541046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantineporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantineporn.com"; sid:541047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantineporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantineporn.com"; sid:541048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-quiz.com"; sid:541049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresponse.com"; sid:541050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresulttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresulttestkit.com"; sid:541051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtest.net"; sid:541052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtalk.com"; sid:541053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19refinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19refinance.com"; sid:541054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rehab.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rehab.club"; sid:541055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehab.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehab.club"; sid:541056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relationships.com"; sid:541057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefhelp.com"; sid:541058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remover.com"; sid:541059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsehub.com"; sid:541060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.restaurant"; sid:541061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19review.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19review.com"; sid:541062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19routtcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19routtcounty.com"; sid:541063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rr.com"; sid:541064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rx.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rx.world"; sid:541065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyinfo.com"; sid:541066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetypros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetypros.com"; sid:541067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitization.com"; sid:541068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitkit.com"; sid:541069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saudihackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saudihackathon.com"; sid:541070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19savelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19savelife.com"; sid:541071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sba.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sba.loans"; sid:541072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbamiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbamiami.com"; sid:541073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scientific.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scientific.com"; sid:541074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scotland.com"; sid:541075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningterminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningterminal.com"; sid:541076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sequence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sequence.com"; sid:541077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sequencing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sequencing.com"; sid:541078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serviver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serviver.com"; sid:541079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19servivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19servivor.com"; sid:541080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sickness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sickness.com"; sid:541081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sims.com"; sid:541082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19situation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19situation.com"; sid:541083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessemergencybridgeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessemergencybridgeloan.com"; sid:541084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solicitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solicitor.com"; sid:541085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solicitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solicitor.com"; sid:541086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidaritytravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidaritytravel.com"; sid:541087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidaritywall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidaritywall.com"; sid:541088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsnow.com"; sid:541089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ss.com"; sid:541090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19staff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19staff.com"; sid:541091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stars.com"; sid:541092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stickingplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stickingplaster.com"; sid:541093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stickingplaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stickingplaster.net"; sid:541094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockpiling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockpiling.com"; sid:541095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stoper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stoper.com"; sid:541096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19studentreformact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19studentreformact.com"; sid:541097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stuff.com"; sid:541098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19submissions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19submissions.com"; sid:541099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyco.com"; sid:541100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportnetwork.com"; sid:541101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.world"; sid:541102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpport.com"; sid:541103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpportgroup.com"; sid:541104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpportgroup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpportgroup.net"; sid:541105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpport.net"; sid:541106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surveyaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surveyaz.com"; sid:541107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorlist.com"; sid:541108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tax.com"; sid:541109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxhelp.com"; sid:541110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxtips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxtips.com"; sid:541111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxtips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxtips.com"; sid:541112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techlab.com"; sid:541113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19technicalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19technicalsupport.com"; sid:541114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teletest.com"; sid:541115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teletest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teletest.net"; sid:541116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19terminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19terminal.com"; sid:541117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testbooth.com"; sid:541118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testca.com"; sid:541119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test.guru"; sid:541120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.guru"; sid:541121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testhome.com"; sid:541122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingbooth.com"; sid:541123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testingkits.com"; sid:541124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtexas.com"; sid:541125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingtx.com"; sid:541126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtx.com"; sid:541127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testkit.net"; sid:541128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testkits.com"; sid:541129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststore.com"; sid:541130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtool.com"; sid:541131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testus.com"; sid:541132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testyourself.com"; sid:541133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapists.com"; sid:541134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19theraputics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19theraputics.com"; sid:541135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thinktank.com"; sid:541136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thoughts.com"; sid:541137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toiletroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toiletroll.com"; sid:541138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toll.com"; sid:541139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trac.com"; sid:541140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.study"; sid:541141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.life"; sid:541142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19treatments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19treatments.net"; sid:541143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatments.net"; sid:541144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-truth.com"; sid:541145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truth.net"; sid:541146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-uk-relieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-uk-relieve.com"; sid:541147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-update1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-update1.com"; sid:541148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.net"; sid:541149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacinations.com"; sid:541150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19venitlator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19venitlator.com"; sid:541151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ventilator.com"; sid:541152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veri.com"; sid:541153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19verified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19verified.com"; sid:541154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victim.com"; sid:541155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victim.net"; sid:541156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victims.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victims.world"; sid:541157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusca.com"; sid:541158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruspandemic.com"; sid:541159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wageclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wageclaims.com"; sid:541160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wagessupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wagessupport.com"; sid:541161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washoe.com"; sid:541162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wear.com"; sid:541163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19weed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19weed.net"; sid:541164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weed.net"; sid:541165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19whiskey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19whiskey.net"; sid:541166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whiskey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whiskey.net"; sid:541167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whisky.com"; sid:541168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workhome.com"; sid:541169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ww3.com"; sid:541170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019update.com"; sid:541171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020diary.com"; sid:541172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3d.com"; sid:541173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid54.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid54.com"; sid:541174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-5k.com"; sid:541175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5k.com"; sid:541176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid77.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid77.com"; sid:541177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9tees.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9tees.biz"; sid:541178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida-19.com"; sid:541179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvise.com"; sid:541180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalert.net"; sid:541181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-analytics.com"; sid:541182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathometests.com"; sid:541183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauto.com"; sid:541184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyboom2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyboom2020.com"; sid:541185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidban.com"; sid:541186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandit.com"; sid:541187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandits.com"; sid:541188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbats.com"; sid:541189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidb.com"; sid:541190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeater.com"; sid:541191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbingo.com"; sid:541192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizcheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizcheckup.com"; sid:541193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbound.com"; sid:541194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrooklynhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrooklynhelpers.com"; sid:541195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrooklynnyhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrooklynnyhelpers.com"; sid:541196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbug.com"; sid:541197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscheckup.com"; sid:541198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesshelp.com"; sid:541199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrescue.com"; sid:541200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampout.com"; sid:541201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalpartners.com"; sid:541202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaps.com"; sid:541203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapsule.com"; sid:541204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregiver.com"; sid:541205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregivers.com"; sid:541206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarekits.com"; sid:541207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepackage.com"; sid:541208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaring.com"; sid:541209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasetracker.com"; sid:541210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcc-dev-carec2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcc-dev-carec2.com"; sid:541211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidccine.com"; sid:541212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchallenge.net"; sid:541213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecktest.com"; sid:541214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckupforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckupforbusiness.com"; sid:541215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchild.com"; sid:541216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchorus.com"; sid:541217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclez.com"; sid:541218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanteam.com"; sid:541219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleared.com"; sid:541220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktail.com"; sid:541221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoin.net"; sid:541222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommshotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommshotline.com"; sid:541223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitycare.com"; sid:541224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitysupport.com"; sid:541225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultation.com"; sid:541226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontract.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontract.com"; sid:541227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontract.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontract.net"; sid:541228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidco-op.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidco-op.com"; sid:541229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoop.com"; sid:541230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostrelief.com"; sid:541231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughclassifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughclassifier.com"; sid:541232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughinc.com"; sid:541233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouriers.com"; sid:541234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.credit"; sid:541235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscoach.com"; sid:541236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrossstitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrossstitch.com"; sid:541237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cures.com"; sid:541238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cymru"; sid:541239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsolutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsolutions.biz"; sid:541240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeepclean.com"; sid:541241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentalhealth.com"; sid:541242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentalhelp.com"; sid:541243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisruption.com"; sid:541244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriver.com"; sid:541245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrivethroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrivethroughs.com"; sid:541246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dx.com"; sid:541247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideas.com"; sid:541248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideofilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideofilmfestival.com"; sid:541249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideofilmfestival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideofilmfestival.net"; sid:541250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideogaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideogaming.com"; sid:541251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidera.com"; sid:541252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexit.com"; sid:541253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidferien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidferien.com"; sid:541254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidferien.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidferien.net"; sid:541255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinances.com"; sid:541256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancing.com"; sid:541257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflare.com"; sid:541258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforward.com"; sid:541259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoster.com"; sid:541260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfr.com"; sid:541261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedentistry.com"; sid:541262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.life"; sid:541263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesurgery.com"; sid:541264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.today"; sid:541265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fund.com"; sid:541266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidga.com"; sid:541267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraph.com"; sid:541268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphics.com"; sid:541269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguard.net"; sid:541270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcwmortality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcwmortality.com"; sid:541271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpcenter.com"; sid:541272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpcentre.com"; sid:541273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelphu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelphu.com"; sid:541274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpme.com"; sid:541275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecommunity.com"; sid:541276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomelife.com"; sid:541277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitality.com"; sid:541278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalitydata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalitydata.com"; sid:541279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalitysituation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalitysituation.com"; sid:541280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumour.com"; sid:541281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhunt.com"; sid:541282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicate.com"; sid:541283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicide.com"; sid:541284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ig.com"; sid:541285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunesupport.com"; sid:541286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpfstoff.com"; sid:541287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insights.com"; sid:541288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterview.com"; sid:541289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterviews.com"; sid:541290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-iot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-iot.com"; sid:541291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidism.com"; sid:541292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-itchallange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-itchallange.com"; sid:541293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidixhealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidixhealthcare.com"; sid:541294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidklenze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidklenze.com"; sid:541295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaunchpad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaunchpad.com"; sid:541296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawil.com"; sid:541297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawillinois.com"; sid:541298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawnj.com"; sid:541299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyeril.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyeril.com"; sid:541300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyers.net"; sid:541301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-legal-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-legal-hotline.com"; sid:541302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalhotline.com"; sid:541303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlife.net"; sid:541304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliving.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliving.net"; sid:541305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.loans"; sid:541306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlosses.com"; sid:541307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidma.com"; sid:541308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanufacturingfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanufacturingfund.com"; sid:541309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskmakers.com"; sid:541310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaster.com"; sid:541311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-medicina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-medicina.com"; sid:541312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedizin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedizin.com"; sid:541313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedya.com"; sid:541314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmegantic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmegantic.com"; sid:541315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmex.com"; sid:541316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmlife.com"; sid:541317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneyhelp.com"; sid:541318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonitoring.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonitoring.net"; sid:541319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnation.net"; sid:541320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegative.com"; sid:541321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nepal.com"; sid:541322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnet.com"; sid:541323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenca.com"; sid:541324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteeninfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteeninfection.com"; sid:541325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.life"; sid:541326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.ltd"; sid:541327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.world"; sid:541328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnumber.com"; sid:541329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-o2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-o2.com"; sid:541330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomaha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomaha.com"; sid:541331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopen.com"; sid:541332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoperations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoperations.net"; sid:541333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutcomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutcomes.com"; sid:541334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutcomes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutcomes.net"; sid:541335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpad.com"; sid:541336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpak.com"; sid:541337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicrelief.com"; sid:541338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicresources.com"; sid:541339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparent.com"; sid:541340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparenting.com"; sid:541341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartners.com"; sid:541342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.com"; sid:541343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcrselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcrselftest.com"; sid:541344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphl.com"; sid:541345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpif.com"; sid:541346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pocus.com"; sid:541347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpod.com"; sid:541348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpower.com"; sid:541349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnancy.com"; sid:541350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpression.com"; sid:541351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprintouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprintouts.com"; sid:541352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotocols.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotocols.net"; sid:541353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsychology.com"; sid:541354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqr.net"; sid:541355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquick.com"; sid:541356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquilt.com"; sid:541357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrangers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrangers.com"; sid:541358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrank.com"; sid:541359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresults.com"; sid:541360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyassessment.com"; sid:541361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelationships.com"; sid:541362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcollective.com"; sid:541363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.net"; sid:541364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotesupport.com"; sid:541365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-research.com"; sid:541366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreset.com"; sid:541367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcecenter.com"; sid:541368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponders.com"; sid:541369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsegroup.com"; sid:541370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepbc.com"; sid:541371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepbc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepbc.net"; sid:541372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroads.com"; sid:541373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroulette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroulette.com"; sid:541374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.club"; sid:541375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreener.com"; sid:541376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseatcovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseatcovers.com"; sid:541377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecured.com"; sid:541378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfisolation.com"; sid:541379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsequence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsequence.com"; sid:541380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsequencing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsequencing.com"; sid:541381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilverlinings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilverlinings.com"; sid:541382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-society.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-society.net"; sid:541383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-solutions.com"; sid:541384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrikeforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrikeforce.com"; sid:541385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplychain.com"; sid:541386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurprise.com"; sid:541387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurviveandthrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurviveandthrive.com"; sid:541388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtax.com"; sid:541389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechsupport.com"; sid:541390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtents.com"; sid:541391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglocation.com"; sid:541392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmiami.com"; sid:541393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-kit.com"; sid:541394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitsusa.com"; sid:541395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlab.com"; sid:541396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsite.com"; sid:541397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsusa.com"; sid:541398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtextassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtextassist.com"; sid:541399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthai.net"; sid:541400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtidbits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtidbits.com"; sid:541401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtipjars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtipjars.com"; sid:541402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerapp.com"; sid:541403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransportation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransportation.com"; sid:541404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtricking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtricking.com"; sid:541405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidubidapdap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidubidapdap.com"; sid:541406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemploymentpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemploymentpayments.com"; sid:541407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdateslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdateslive.com"; sid:541408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdate.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdate.today"; sid:541409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupside.com"; sid:541410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidus-19.com"; sid:541411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvidapdap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvidapdap.com"; sid:541412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccines.com"; sid:541413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vacuna.com"; sid:541414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.ventures"; sid:541415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverified.com"; sid:541416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvibes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvibes.com"; sid:541417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusloss.com"; sid:541418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisual.com"; sid:541419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesvcovid.com"; sid:541420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativevscorona.com"; sid:541421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityvscorona.com"; sid:541422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocovid19.com"; sid:541423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct-covid19-business-exemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct-covid19-business-exemption.com"; sid:541424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19businessexemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19businessexemption.com"; sid:541425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curemycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curemycorona.com"; sid:541426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curescoronavirus.com"; sid:541427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyber-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyber-pandemic.com"; sid:541428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cypruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cypruscovid-19.com"; sid:541429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dammitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dammitcorona.com"; sid:541430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damncovid.com"; sid:541431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danceagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danceagainstcorona.com"; sid:541432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datcoronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datcoronabutt.com"; sid:541433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daviesscountycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daviesscountycovid-19.com"; sid:541434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathscoronavirus.com"; sid:541435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtreliefcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtreliefcorona.com"; sid:541436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminatecovid19.com"; sid:541437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleancorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleancorona19.com"; sid:541438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleancovid19.com"; sid:541439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delewarecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delewarecovidtesting.com"; sid:541440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delhifightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delhifightscorona.com"; sid:541441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltaairlinescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltaairlinescoronavirus.com"; sid:541442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltacorona.com"; sid:541443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltacoronaviris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltacoronaviris.com"; sid:541444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovidloan.com"; sid:541445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovidloans.com"; sid:541446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistcovid19.com"; sid:541447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistvscorona.com"; sid:541448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19attorney.com"; sid:541449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19lawyer.com"; sid:541450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfektion-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfektion-corona.com"; sid:541451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectarcovid.com"; sid:541452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dezinfekciq-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dezinfekciq-coronavirus.com"; sid:541453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovid19.com"; sid:541454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetescovid.com"; sid:541455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetescovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetescovid.net"; sid:541456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didicrosscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didicrosscovid19.com"; sid:541457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didicrosscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didicrosscovid.com"; sid:541458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for die-corona-wg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"die-corona-wg.com"; sid:541459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcoronavirustesting.com"; sid:541460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronaaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronaaz.com"; sid:541461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectionservicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectionservicescovid19.com"; sid:541462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disscoronavirus.com"; sid:541463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distilleriesfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distilleriesfightingcovid.com"; sid:541464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dlcovid.com"; sid:541465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for docovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"docovid.com"; sid:541466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for don-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"don-covid-19.com"; sid:541467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for don-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"don-covid19.com"; sid:541468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doncovid19.com"; sid:541469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontspreadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontspreadcoronavirus.com"; sid:541470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontspreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontspreadcovid19.com"; sid:541471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for douglascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"douglascovid19.com"; sid:541472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drop-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drop-covid19.com"; sid:541473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dropcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dropcovid19.com"; sid:541474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drozcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drozcoronavirus.com"; sid:541475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugcoronavirus.com"; sid:541476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugforcorona.com"; sid:541477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19hack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19hack.com"; sid:541478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19hacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19hacks.com"; sid:541479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebcovid.com"; sid:541480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educatingthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educatingthroughcovid19.com"; sid:541481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effyoucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effyoucoronavirus.com"; sid:541482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpasocoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpasocoronaviruscleaning.com"; sid:541483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endthepandemic.com"; sid:541484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemble-contre-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemble-contre-covid19.com"; sid:541485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.cloud"; sid:541486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdocs.com"; sid:541487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdocuments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdocuments.com"; sid:541488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicethic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicethic.com"; sid:541489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicethics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicethics.com"; sid:541490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicethics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicethics.net"; sid:541491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpass.com"; sid:541492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsurviveplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsurviveplus.com"; sid:541493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.today"; sid:541494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictrack.com"; sid:541495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecorona.net"; sid:541496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erdentistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erdentistcovid19.com"; sid:541497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essaycovid.com"; sid:541498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etxcovid.com"; sid:541499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eucoronavirus.com"; sid:541500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everlywellcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everlywellcoronavirustestkit.com"; sid:541501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examencovid19.com"; sid:541502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exponentialcoronavirusgrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exponentialcoronavirusgrowth.com"; sid:541503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezonyxecovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezonyxecovideo.com"; sid:541504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factcheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factcheckcorona.com"; sid:541505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronatesting.com"; sid:541506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid-19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid-19hometest.com"; sid:541507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid-19test.com"; sid:541508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19test.com"; sid:541509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttestcovid19.com"; sid:541510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fatcoronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fatcoronabutt.com"; sid:541511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fatesttestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fatesttestcovid19.com"; sid:541512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for favelasemcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"favelasemcorona.com"; sid:541513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid-19.com"; sid:541514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid19.net"; sid:541515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcovid.com"; sid:541516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcorona2020india.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcorona2020india.club"; sid:541517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronabrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronabrand.com"; sid:541518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona-party.com"; sid:541519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.club"; sid:541520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19mask.com"; sid:541521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finanzhilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finanzhilfe-corona.com"; sid:541522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronalab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronalab.com"; sid:541523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedbycorona.com"; sid:541524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedforcorona.com"; sid:541525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedforcoronavirus.com"; sid:541526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitforcorona.com"; sid:541527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flacoronavirustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flacoronavirustracker.com"; sid:541528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirustest.com"; sid:541529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid-19cases.com"; sid:541530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid-19.com"; sid:541531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19test.com"; sid:541532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusunemployment.com"; sid:541533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidtesting.com"; sid:541534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followingcovid.com"; sid:541535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondoscoronavirus.com"; sid:541536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondoscovid19.com"; sid:541537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fooglecovid19.com"; sid:541538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19testkits.com"; sid:541539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuccorona.com"; sid:541540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuccovid19.com"; sid:541541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.today"; sid:541542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckucoronavirus.com"; sid:541543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckucovid.com"; sid:541544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyou-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyou-covid19.com"; sid:541545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundscoronavirus.com"; sid:541546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycoronavirus.com"; sid:541547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funwithcorona.com"; sid:541548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureofcoronavirus.com"; sid:541549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureofcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureofcoronavirus.net"; sid:541550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid.com"; sid:541551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgetowncovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgetowncovidinfo.com"; sid:541552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidtesting.com"; sid:541553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatestnow.com"; sid:541554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustestkit.com"; sid:541555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testathome.com"; sid:541556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19tests.com"; sid:541557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getthecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getthecovid19test.com"; sid:541558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ggooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ggooglecovid19.com"; sid:541559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givelovenotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givelovenotcoronavirus.com"; sid:541560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronachallenge.com"; sid:541561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaviruses.com"; sid:541562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusnews.com"; sid:541563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19cases.com"; sid:541564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19news.com"; sid:541565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19news.net"; sid:541566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidchallenge.com"; sid:541567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicproductions.com"; sid:541568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovid20.com"; sid:541569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goglecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goglecovid-19.com"; sid:541570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goglecovid19.com"; sid:541571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gogolecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gogolecovid19.com"; sid:541572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gooflecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gooflecovid19.com"; sid:541573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googecovid19.com"; sid:541574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googelcovid19.com"; sid:541575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googkecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googkecovid19.com"; sid:541576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlcovid19.com"; sid:541577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecomcovid19.com"; sid:541578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid10.com"; sid:541579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid119.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid119.com"; sid:541580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid18.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid18.com"; sid:541581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid1.com"; sid:541582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid29.com"; sid:541583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid91.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid91.com"; sid:541584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovid9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovid9.com"; sid:541585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecovidd19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecovidd19.com"; sid:541586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googleecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googleecovid19.com"; sid:541587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlocovid19.com"; sid:541588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlrcovid19.com"; sid:541589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlwcovid19.com"; sid:541590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goohlecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goohlecovid19.com"; sid:541591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goolecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goolecovid19.com"; sid:541592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goolgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goolgecovid19.com"; sid:541593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goooglecovid19.com"; sid:541594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gopglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gopglecovid19.com"; sid:541595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotwuhan.com"; sid:541596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grantscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grantscoronavirus.com"; sid:541597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcoronapression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcoronapression.com"; sid:541598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencovid19.com"; sid:541599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiacombatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiacombatecoronavirus.com"; sid:541600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guyanacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guyanacoronavirus.com"; sid:541601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guyanacovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guyanacovid19cases.com"; sid:541602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guyanacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guyanacovid-19.com"; sid:541603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcoronavirus.net"; sid:541604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.center"; sid:541605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.com"; sid:541606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.group"; sid:541607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.net"; sid:541608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid20x.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid20x.pro"; sid:541609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid.net"; sid:541610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethcleaningcovid19sanitizingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethcleaningcovid19sanitizingservices.com"; sid:541611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethcleaningservicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethcleaningservicescovid19.com"; sid:541612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethcleaningservicescovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethcleaningservicescovid19prevention.com"; sid:541613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethcommercialcleaningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethcommercialcleaningcovid19.com"; sid:541614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethjanitorialservicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethjanitorialservicescovid19.com"; sid:541615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethofficecleaningservicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethofficecleaningservicescovid19.com"; sid:541616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harvardcovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harvardcovidstudy.com"; sid:541617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hatecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hatecorona.world"; sid:541618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovidhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovidhotline.com"; sid:541619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovidtesting.com"; sid:541620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthlinkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthlinkcovid19.com"; sid:541621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid9.com"; sid:541622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcorona.com"; sid:541623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpinghandscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpinghandscovid-19.com"; sid:541624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid19.com"; sid:541625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for high-speedtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"high-speedtestcovid19.com"; sid:541626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hijosdelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hijosdelcovid.com"; sid:541627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homebycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homebycovid.com"; sid:541628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronaviruskit.com"; sid:541629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeschooling-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeschooling-corona.com"; sid:541630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometest-covid19.com"; sid:541631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestforcorona.com"; sid:541632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestforcoronavirus.com"; sid:541633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingkitcovid19.com"; sid:541634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingkitscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingkitscoronavirus.com"; sid:541635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hooglecovid19.com"; sid:541636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeagainstcovid.com"; sid:541637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoisurviveaglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoisurviveaglobalpandemic.com"; sid:541638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how-i-beat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how-i-beat-covid19.com"; sid:541639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcovid-19.com"; sid:541640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomakeacovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomakeacovid19mask.com"; sid:541641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomastercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomastercovid19.com"; sid:541642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomastercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomastercovid.com"; sid:541643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamlivingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamlivingcoronavirus.com"; sid:541644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidrelief.com"; sid:541645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovidtesting.com"; sid:541646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideascovid19.com"; sid:541647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihdcovid19.com"; sid:541648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscoronaviruslawyers.com"; sid:541649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovidtesting.com"; sid:541650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilostmyjobtocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilostmyjobtocorona.com"; sid:541651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imagecovid.com"; sid:541652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imalivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imalivecovid19.com"; sid:541653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imasurvivercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imasurvivercoronavirus.com"; sid:541654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronasafe.com"; sid:541655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronavirusfree.com"; sid:541656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactoeconomicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactoeconomicocovid19.com"; sid:541657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impfstoff-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impfstoff-corona.com"; sid:541658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacovidtesting.com"; sid:541659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indonesia-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indonesia-coronavirus.com"; sid:541660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcoronatesting.com"; sid:541661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcoronatestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcoronatestingnow.com"; sid:541662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectedcoronavirus.com"; sid:541663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"information-covid-19.com"; sid:541664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informe-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informe-covid.com"; sid:541665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informecovid.com"; sid:541666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initialstagesofcovid19disease.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initialstagesofcovid19disease.golf"; sid:541667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insideoutpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insideoutpandemic.com"; sid:541668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceforcoronavirus.com"; sid:541669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuredpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuredpandemic.com"; sid:541670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalepidemicsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalepidemicsupport.com"; sid:541671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investinginthetimeofcorona.com"; sid:541672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for invisibleenemycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"invisibleenemycovid19.com"; sid:541673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacovidtesting.com"; sid:541674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for is-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"is-corona.com"; sid:541675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid.com"; sid:541676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidnearme.com"; sid:541677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iservivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iservivedcorona.com"; sid:541678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iservivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iservivedcovid-19.com"; sid:541679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iservivedcovid-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iservivedcovid-20.com"; sid:541680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istanbulcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istanbulcorona.com"; sid:541681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthepandemicover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthepandemicover.com"; sid:541682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19in20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19in20.com"; sid:541683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19out2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19out2020.com"; sid:541684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19out2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19out2020.net"; sid:541685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthepandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthepandemic2020.com"; sid:541686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italtycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italtycoronavirus.com"; sid:541687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italycovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italycovid-19cases.com"; sid:541688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italycovid-19.com"; sid:541689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italycovid19.com"; sid:541690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itonlytookapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itonlytookapandemic.com"; sid:541691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatime19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatime19.com"; sid:541692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatime.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatime.net"; sid:541693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsnotmyfirstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsnotmyfirstpandemic.com"; sid:541694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecorona.com"; sid:541695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecovid.com"; sid:541696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksoncountytxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksoncountytxcovid19.com"; sid:541697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jmcovid19.com"; sid:541698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juegaencasacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juegaencasacovid.com"; sid:541699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontracoronavirus.com"; sid:541700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascovidtesting.com"; sid:541701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepoutcorona.com"; sid:541702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckycovidtesting.com"; sid:541703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keolis-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keolis-covid.com"; sid:541704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kiemtienthoicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kiemtienthoicovid.com"; sid:541705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19now.com"; sid:541706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovids.com"; sid:541707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-the-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-the-coronavirus.com"; sid:541708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnesscorona.com"; sid:541709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kirklandcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kirklandcovid19lawyers.com"; sid:541710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kirklandcovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kirklandcovidcases.com"; sid:541711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsforcovid.com"; sid:541712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kolhapurcovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kolhapurcovid19care.com"; sid:541713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ksbroadcasterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ksbroadcasterscovid19.com"; sid:541714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kungfupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kungfupandemic.com"; sid:541715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwaitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwaitcovid19.com"; sid:541716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronalaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronalaws.com"; sid:541717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovidvirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovidvirusnews.com"; sid:541718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laughatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laughatcovid.com"; sid:541719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcoronanj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcoronanj.com"; sid:541720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcovid19.com"; sid:541721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for law-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"law-covid.com"; sid:541722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for law-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"law-covid.net"; sid:541723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadingthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadingthroughcovid19.com"; sid:541724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lettersinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lettersinthetimeofcorona.com"; sid:541725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lettersofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lettersofcorona.com"; sid:541726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinginthetimeofcorona.com"; sid:541727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronahelp.com"; sid:541728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for local-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"local-covid.com"; sid:541729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lojacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lojacorona.com"; sid:541730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovidlawyer.com"; sid:541731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacovidtesting.com"; sid:541732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthedaysofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthedaysofcoronavirus.com"; sid:541733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintimesofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintimesofcorona.net"; sid:541734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lutte-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lutte-coronavirus.com"; sid:541735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcovid2020.com"; sid:541736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maddcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maddcovid.com"; sid:541737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for magalu-combate-ao-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"magalu-combate-ao-corona.com"; sid:541738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maidservicecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maidservicecoronavirus.com"; sid:541739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeacovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeacovid19mask.com"; sid:541740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makemoneyduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makemoneyduringcoronavirus.com"; sid:541741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maladie-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maladie-coronavirus.com"; sid:541742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maladiecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maladiecoronavirus.net"; sid:541743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mappingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mappingcovid.com"; sid:541744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maroc-contre-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maroc-contre-coronavirus.com"; sid:541745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovidtesting.com"; sid:541746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacovid19.net"; sid:541747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid19.net"; sid:541748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskfactorycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskfactorycoronavirus.com"; sid:541749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachachussettscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachachussettscovidtesting.com"; sid:541750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mastercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mastercovid19.com"; sid:541751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mastercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mastercovid.com"; sid:541752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid2020.com"; sid:541753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalsuppliescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalsuppliescoronavirus.com"; sid:541754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metrocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metrocovid.com"; sid:541755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicovid19.com"; sid:541756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronaviruslaw.com"; sid:541757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronaviruslawfirm.com"; sid:541758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronaviruslawyer.com"; sid:541759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19attorney.com"; sid:541760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19law.com"; sid:541761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19lawfirm.com"; sid:541762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19sba.com"; sid:541763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidtestnow.com"; sid:541764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamisbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamisbacovid19.com"; sid:541765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mikebloombergstartedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mikebloombergstartedcovid-19.com"; sid:541766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindfulcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindfulcoronavirus.com"; sid:541767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minecoronacraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minecoronacraft.com"; sid:541768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minnesotacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minnesotacovidtesting.com"; sid:541769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicovidtesting.com"; sid:541770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricovidtesting.com"; sid:541771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19antidote.com"; sid:541772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovidaction.com"; sid:541773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovidadvocacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovidadvocacy.com"; sid:541774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovidresponse.com"; sid:541775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyforcorona.com"; sid:541776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyforcoronavirus.com"; sid:541777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monmouthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monmouthcorona.com"; sid:541778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanacovidtesting.com"; sid:541779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for morecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"morecorona.com"; sid:541780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movilizacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movilizacioncovid.com"; sid:541781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtpandemicdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtpandemicdiaries.com"; sid:541782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvhcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvhcoronavirus.com"; sid:541783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona2019.com"; sid:541784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabutt.com"; sid:541785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadefense.com"; sid:541786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadoctors.com"; sid:541787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaguard.com"; sid:541788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronameter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronameter.com"; sid:541789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-shot.com"; sid:541790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-therapy.com"; sid:541791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatracker.com"; sid:541792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-treatment.com"; sid:541793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavacation.com"; sid:541794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-vaccine.com"; sid:541795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirus19.com"; sid:541796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirus2019.com"; sid:541797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruscarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruscarepackage.com"; sid:541798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusinsurance.com"; sid:541799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestkit.com"; sid:541800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19diaries.com"; sid:541801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19insurance.com"; sid:541802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19recovery.com"; sid:541803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid2019.com"; sid:541804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicdiaries.com"; sid:541805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicdiary.com"; sid:541806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecommercialcleaningcovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecommercialcleaningcovid19prevention.com"; sid:541807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19cleaningservices.com"; sid:541808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19commercialcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19commercialcleaningservices.com"; sid:541809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19janitorialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19janitorialservices.com"; sid:541810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19officecleaningpreventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19officecleaningpreventionservices.com"; sid:541811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillejanitorialcovid19services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillejanitorialcovid19services.com"; sid:541812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillejanitorialservicescovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillejanitorialservicescovid19prevention.com"; sid:541813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvilleofficecleaningservicescovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvilleofficecleaningservicescovid19prevention.com"; sid:541814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidtesting.com"; sid:541815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationcovidtesting.com"; sid:541816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19live.com"; sid:541817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacovids.com"; sid:541818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacovidtesting.com"; sid:541819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needacovid19test.com"; sid:541820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needcoronatesting.com"; sid:541821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neocorona.com"; sid:541822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netizencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netizencorona.com"; sid:541823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyagecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyagecovid-19.com"; sid:541824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyagecovid19.com"; sid:541825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacovidtesting.com"; sid:541826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincovid2019.com"; sid:541827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforgetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforgetcorona.com"; sid:541828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhampshirecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhampshirecovidtesting.com"; sid:541829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycovidtesting.com"; sid:541830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocovidtesting.com"; sid:541831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscovidtesting.com"; sid:541832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-covid19.com"; sid:541833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruslawyer.com"; sid:541834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruslawyers.com"; sid:541835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19claims.com"; sid:541836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidlawyer.com"; sid:541837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidsolutions.com"; sid:541838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidtesting.com"; sid:541839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscorona.com"; sid:541840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronalaw.com"; sid:541841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolongercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolongercorona.com"; sid:541842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomocorona.com"; sid:541843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norcalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norcalcorona.com"; sid:541844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normalisecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normalisecorona.com"; sid:541845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcarolinacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcarolinacovidtesting.com"; sid:541846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacovidtesting.com"; sid:541847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notesfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notesfromthepandemic.com"; sid:541848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmyfirstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmyfirstpandemic.com"; sid:541849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus2019oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus2019oracle.com"; sid:541850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwflcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwflcoronavirus.com"; sid:541851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirusunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirusunemployment.com"; sid:541852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruslaw.com"; sid:541853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirustest.com"; sid:541854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusunemployment.com"; sid:541855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid-19cases.com"; sid:541856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19claims.com"; sid:541857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid-19.com"; sid:541858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nypandemictherapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nypandemictherapists.com"; sid:541859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyvscovid.com"; sid:541860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nz-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nz-coronavirus.com"; sid:541861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohio-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohio-covid19.com"; sid:541862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidtesting.com"; sid:541863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacovidtesting.com"; sid:541864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronadoctor.com"; sid:541865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronadoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronadoctors.com"; sid:541866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ooglecovid19.com"; sid:541867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid-19.com"; sid:541868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovidmask.com"; sid:541869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringcorona.com"; sid:541870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringcovid.com"; sid:541871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openduringcovidsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openduringcovidsandiego.com"; sid:541872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecorona.com"; sid:541873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecorona.net"; sid:541874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracl-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracl-covid19.com"; sid:541875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclcovid-19.com"; sid:541876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle2019novelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle2019novelcoronavirus.com"; sid:541877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclenovelcoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclenovelcoronavirus2019.com"; sid:541878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclewuhanvirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclewuhanvirus19.com"; sid:541879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclewuhanvirus.com"; sid:541880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclrcovid19.com"; sid:541881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracoecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracoecovid-19.com"; sid:541882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracoecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracoecovid19.com"; sid:541883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcle-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcle-covid19.com"; sid:541884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercovid19test.com"; sid:541885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercovid19tests.com"; sid:541886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncoronavirusemploymentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncoronavirusemploymentlawyer.com"; sid:541887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncovidtesting.com"; sid:541888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ottawa-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ottawa-pandemic.com"; sid:541889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ottawapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ottawapandemic.com"; sid:541890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ottawapandemicservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ottawapandemicservices.com"; sid:541891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.biz"; sid:541892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicanomaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicanomaly.com"; sid:541893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicard.com"; sid:541894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicassault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicassault.com"; sid:541895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicawarenessmonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicawarenessmonth.com"; sid:541896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbeverageco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbeverageco.com"; sid:541897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbirthexplosion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbirthexplosion.com"; sid:541898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccharity.com"; sid:541899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccouture.com"; sid:541900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeliveries.com"; sid:541901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdon.com"; sid:541902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfootprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfootprint.com"; sid:541903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgames.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgames.net"; sid:541904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelpcenter.com"; sid:541905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelpcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelpcentre.com"; sid:541906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichistories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichistories.com"; sid:541907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichome.com"; sid:541908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinamerica.com"; sid:541909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinformationsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinformationsystems.com"; sid:541910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinphotos.com"; sid:541911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsideout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsideout.com"; sid:541912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicis.com"; sid:541913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickindness2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickindness2020.com"; sid:541914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickvetching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickvetching.com"; sid:541915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-law.com"; sid:541916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-legal-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-legal-helpline.com"; sid:541917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclegalhelpline.com"; sid:541918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-legal-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-legal-hotline.com"; sid:541919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclegalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclegalhotline.com"; sid:541920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifestyle.com"; sid:541921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmortgage.com"; sid:541922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmusings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmusings.com"; sid:541923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatience.com"; sid:541924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatient.com"; sid:541925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpause.com"; sid:541926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpeacepause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpeacepause.com"; sid:541927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonalprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonalprotection.com"; sid:541928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphenomena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphenomena.com"; sid:541929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphenomenon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphenomenon.com"; sid:541930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpics.com"; sid:541931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.pizza"; sid:541932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplayhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplayhouse.com"; sid:541933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplayhouse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplayhouse.net"; sid:541934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpregnancy.com"; sid:541935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-preppers.com"; sid:541936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionfund.com"; sid:541937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionmonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionmonth.com"; sid:541938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionprogram.com"; sid:541939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionpurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionpurse.com"; sid:541940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofessionals.com"; sid:541941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpt.com"; sid:541942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpunch.com"; sid:541943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelationships.com"; sid:541944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefpayments.com"; sid:541945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriders.com"; sid:541946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrts.com"; sid:541947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrtsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrtsupplies.com"; sid:541948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrush.com"; sid:541949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-safe.com"; sid:541950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-safe.net"; sid:541951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshandemic.com"; sid:541952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsoap.com"; sid:541953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstatus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstatus.today"; sid:541954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstick.com"; sid:541955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstorm.com"; sid:541956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportteam.com"; sid:541957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurthrival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurthrival.com"; sid:541958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwineco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwineco.com"; sid:541959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelmembercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelmembercorona.com"; sid:541960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pannelloprotettivocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pannelloprotettivocoronavirus.com"; sid:541961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentspandemicprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentspandemicprevention.com"; sid:541962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcccovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcccovidupdates.com"; sid:541963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovid.com"; sid:541964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovideupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovideupdates.com"; sid:541965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pemfandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pemfandcovid19.com"; sid:541966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovidtesting.com"; sid:541967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplespandemic.com"; sid:541968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplespandemicprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplespandemicprevention.com"; sid:541969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplevscorona.com"; sid:541970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalcovid19test.com"; sid:541971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perventcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perventcovid-19.com"; sid:541972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perventcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perventcovid19.com"; sid:541973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phatcoronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phatcoronabutt.com"; sid:541974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciancovidnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciancovidnetwork.com"; sid:541975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pocketsketchingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pocketsketchingcorona.com"; sid:541976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pocketsketchingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pocketsketchingcoronavirus.com"; sid:541977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandcoronavirusemploymentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandcoronavirusemploymentlawyer.com"; sid:541978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona2020.com"; sid:541979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.life"; sid:541980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidboycott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidboycott.com"; sid:541981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbabyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbabyboom.com"; sid:541982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicblockparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicblockparty.com"; sid:541983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicboom.com"; sid:541984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpantyparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpantyparty.com"; sid:541985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.world"; sid:541986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayer-beten-prier-pregare-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayer-beten-prier-pregare-corona.com"; sid:541987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayer-beten-prier-pregare-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayer-beten-prier-pregare-corona.net"; sid:541988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnancycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnancycoronavirus.com"; sid:541989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnantcoronavirus.com"; sid:541990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prescription-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prescription-covid19.com"; sid:541991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidentcorona.com"; sid:541992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusdisease.com"; sid:541993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for printcovidaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"printcovidaway.com"; sid:541994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovid19testing.com"; sid:541995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegete-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegete-covid19.com"; sid:541996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protemcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protemcovidupdates.com"; sid:541997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseactivecoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseactivecoronavirusinsurance.com"; sid:541998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseactivecovid19insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseactivecovid19insurance.com"; sid:541999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsecoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsecoronavirusinsurance.com"; sid:542000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsecovid19insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsecovid19insurance.com"; sid:542001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punchcorona.com"; sid:542002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questionsaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questionsaftercorona.com"; sid:542003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickesttestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickesttestcovid19.com"; sid:542004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktestcovid19.com"; sid:542005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19tests.com"; sid:542006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reallifewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reallifewithcorona.com"; sid:542007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatung-corona.com"; sid:542008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatung-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatung-coronavirus.com"; sid:542009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidcube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidcube.com"; sid:542010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid.today"; sid:542011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinigungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinigungcorona.com"; sid:542012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for removecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"removecovid.com"; sid:542013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repelcovid19.com"; sid:542014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcovid.com"; sid:542015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistirealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistirealcovid19.com"; sid:542016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for responsetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"responsetocovid19.com"; sid:542017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhodeislandcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhodeislandcovidtesting.com"; sid:542018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rncovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rncovidinfo.com"; sid:542019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roccovid.com"; sid:542020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rogers-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rogers-covid19.com"; sid:542021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runfromcoronavirus.com"; sid:542022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saga-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saga-covid19.com"; sid:542023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samentegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samentegencorona.com"; sid:542024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloanassistance.com"; sid:542025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19help.com"; sid:542026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loans.com"; sid:542027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidbusinessloans.com"; sid:542028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for search-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"search-against-corona.com"; sid:542029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid19test.com"; sid:542030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfhelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfhelpcoronavirus.com"; sid:542031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfhelpcovid19.com"; sid:542032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendlovenotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendlovenotcoronavirus.com"; sid:542033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorcoronavirus.com"; sid:542034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorcovid19.com"; sid:542035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovidcheck.com"; sid:542036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shootcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shootcorona.com"; sid:542037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sipcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sipcoronavirus.com"; sid:542038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sistershelpingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sistershelpingcorona.com"; sid:542039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowitcovid.com"; sid:542040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcovid.com"; sid:542041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smcovid20.com"; sid:542042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smgcovid.com"; sid:542043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcarolinacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcarolinacovidtesting.com"; sid:542044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southdakotacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southdakotacovidtesting.com"; sid:542045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedytestcovid19.com"; sid:542046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecoronavirus.com"; sid:542047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecoronavirus.net"; sid:542048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid-19.com"; sid:542049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid19.com"; sid:542050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid-19.net"; sid:542051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid19.net"; sid:542052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid.com"; sid:542053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid.net"; sid:542054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportcoronavirus.com"; sid:542055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotcoronavirus.com"; sid:542056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for srocorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"srocorona19.com"; sid:542057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stalkingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stalkingcorona.com"; sid:542058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuptocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuptocorona.com"; sid:542059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsvscoronavirus.com"; sid:542060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizecovid19.com"; sid:542061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stompcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stompcovid19.com"; sid:542062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronabulos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronabulos.com"; sid:542063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronabulos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronabulos.com"; sid:542064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona.care"; sid:542065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona-pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona-pandemie.com"; sid:542066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.pro"; sid:542067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovids.com"; sid:542068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthiscoronavirus.com"; sid:542069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesofcovid.com"; sid:542070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightouttacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightouttacovid19.com"; sid:542071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strongerthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strongerthancovid19.com"; sid:542072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studycorona.com"; sid:542073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliesforcovid.com"; sid:542074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportyourartistsduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportyourartistsduringcovid19.com"; sid:542075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviveandthrivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviveandthrivecoronavirus.com"; sid:542076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviveandthrivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviveandthrivecovid-19.com"; sid:542077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviveandthrivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviveandthrivecovid19.com"; sid:542078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovid192020.com"; sid:542079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovid2020.com"; sid:542080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecovid19.com"; sid:542081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivercovid19.com"; sid:542082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivercovid19.net"; sid:542083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19.net"; sid:542084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swifttestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swifttestcovid19.com"; sid:542085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syntheticpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syntheticpandemic.com"; sid:542086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeahikecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeahikecoronavirus.com"; sid:542087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecoronaserious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecoronaserious.com"; sid:542088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachingsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachingsofcorona.com"; sid:542089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencoronavirus.com"; sid:542090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencovid19.com"; sid:542091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tennesseecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tennesseecoronavirustesting.com"; sid:542092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teracovid-19.com"; sid:542093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teracovid19.com"; sid:542094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teracovid.com"; sid:542095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid-19.net"; sid:542096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidcare.com"; sid:542097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidtoday.com"; sid:542098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidvirus.com"; sid:542099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcoronafree.com"; sid:542100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testen-corona.com"; sid:542101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19.net"; sid:542102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testgearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testgearcorona.com"; sid:542103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testgearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testgearcovid19.com"; sid:542104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit-corona.com"; sid:542105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit-covid19.com"; sid:542106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitscorona.com"; sid:542107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmecorona.com"; sid:542108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testscorona.com"; sid:542109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidtesting.com"; sid:542110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcovid-19heroes.com"; sid:542111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcovid19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcovid19heroes.com"; sid:542112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcovid19heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcovid19heros.com"; sid:542113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcovid19responders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcovid19responders.com"; sid:542114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankscovid.com"; sid:542115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucovid19.com"; sid:542116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcoronabutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcoronabutt.com"; sid:542117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020globalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020globalpandemic.com"; sid:542118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the5gcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the5gcoronavirus.com"; sid:542119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theaterofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theaterofthepandemic.com"; sid:542120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona19.com"; sid:542121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaarms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaarms.com"; sid:542122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacomeback2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacomeback2020.com"; sid:542123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacomeback.com"; sid:542124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconnection.com"; sid:542125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacontext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacontext.com"; sid:542126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacontext.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacontext.net"; sid:542127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries-pod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries-pod.com"; sid:542128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiariespod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiariespod.com"; sid:542129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaessays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaessays.com"; sid:542130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakids.net"; sid:542131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalist.com"; sid:542132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaltimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaltimes.com"; sid:542133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapledge.com"; sid:542134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapub.com"; sid:542135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasystem.com"; sid:542136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus2020.net"; sid:542137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiaries.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiaries.co.uk"; sid:542138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiaries.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiaries.uk"; sid:542139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiary.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiary.co.uk"; sid:542140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiary.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiary.uk"; sid:542141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusexplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusexplained.com"; sid:542142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushelpline.com"; sid:542143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushelp.net"; sid:542144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushelps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushelps.com"; sid:542145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslawproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslawproject.com"; sid:542146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspoems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspoems.com"; sid:542147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusupdate.net"; sid:542148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusvaccines.com"; sid:542149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19babies.com"; sid:542150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19chronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19chronicle.com"; sid:542151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19.com"; sid:542152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19dataproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19dataproject.com"; sid:542153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19insurance.com"; sid:542154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19-test.com"; sid:542155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchorus.com"; sid:542156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcomeback.com"; sid:542157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiots.com"; sid:542158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiots.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiots.net"; sid:542159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidjournal.com"; sid:542160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkids.net"; sid:542161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidloan.com"; sid:542162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidquiz.com"; sid:542163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshield.com"; sid:542164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstudy.com"; sid:542165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcovid19.com"; sid:542166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccompany.com"; sid:542167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccrossroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccrossroad.com"; sid:542168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicdiary.com"; sid:542169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpost.com"; sid:542170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecoviddays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecoviddays.com"; sid:542171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theteachingsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theteachingsofcoronavirus.com"; sid:542172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercorona.com"; sid:542173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercoronavirus.com"; sid:542174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanbat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanbat.com"; sid:542175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thriveduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thriveduringcorona.com"; sid:542176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivingaftercovid.com"; sid:542177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thxcovid.com"; sid:542178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcovid.com"; sid:542179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronasongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronasongs.com"; sid:542180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovid.com"; sid:542181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovid-19.com"; sid:542182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracking-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracking-covid19.com"; sid:542183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatyourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatyourcovid.com"; sid:542184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpandemic.net"; sid:542185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumppandemicreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumppandemicreport.com"; sid:542186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronalaw.com"; sid:542187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronalawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronalawyer.net"; sid:542188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronaviruscancermonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronaviruscancermonitoring.com"; sid:542189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uk-covid-19-relieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uk-covid-19-relieve.com"; sid:542190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncorona.net"; sid:542191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovid19.com"; sid:542192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedagainstcovid19.com"; sid:542193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedagainstcovid.com"; sid:542194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unofficialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unofficialcorona.com"; sid:542195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgence-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgence-coronavirus.com"; sid:542196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgences-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgences-coronavirus.com"; sid:542197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacorona2019.com"; sid:542198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-corona.com"; sid:542199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruspandemic.com"; sid:542200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaupdatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaupdatenews.com"; sid:542201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaupdatenews.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaupdatenews.today"; sid:542202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaupdatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaupdatetoday.com"; sid:542203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirustest.com"; sid:542204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirustest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirustest.net"; sid:542205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19cases.com"; sid:542206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19test.com"; sid:542207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidlaw.com"; sid:542208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemic2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemic2020.biz"; sid:542209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspestcoronavirus.com"; sid:542210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovidtesting.com"; sid:542211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacoronavirus.net"; sid:542212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorcovid-19.com"; sid:542213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vercoronaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vercoronaat.com"; sid:542214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vermontcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vermontcovidtesting.com"; sid:542215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimascoronavirus.com"; sid:542216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralcovid19.com"; sid:542217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacovidtesting.com"; sid:542218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovidscreen.com"; sid:542219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusescorona.com"; sid:542220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamincoronavirus.com"; sid:542221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volontaire-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volontaire-covid.com"; sid:542222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volontaire-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volontaire-covid.net"; sid:542223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtpandemicdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtpandemicdiary.com"; sid:542224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovidclaims.com"; sid:542225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waragainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waragainstcorona.com"; sid:542226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waragainstcoronavirus.com"; sid:542227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waragainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waragainstcovid19.com"; sid:542228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncovid19claims.com"; sid:542229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncovidclaims.com"; sid:542230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncovidtesting.com"; sid:542231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtondccovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtondccovidtesting.com"; sid:542232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecoronababies.com"; sid:542233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for web-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"web-coronavirus.com"; sid:542234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid19deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid19deals.com"; sid:542235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecarecovid19.com"; sid:542236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecovid19.com"; sid:542237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehadcorona.com"; sid:542238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehatecorona.com"; sid:542239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehavehadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehavehadcorona.com"; sid:542240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westfieldcouncilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westfieldcouncilcovid19.com"; sid:542241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovidtesting.com"; sid:542242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wevscoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wevscoronacrisis.com"; sid:542243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wevscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wevscoronavirus.com"; sid:542244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecovid.com"; sid:542245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatacoronaon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatacoronaon.com"; sid:542246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcoronavirustaughtus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcoronavirustaughtus.com"; sid:542247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcovid19taughtus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcovid19taughtus.com"; sid:542248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsmycovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsmycovidrisk.com"; sid:542249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitmancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitmancovid19.com"; sid:542250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-covid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-covid19.world"; sid:542251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winovercoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winovercoronavirus.life"; sid:542252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisconsincovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisconsincovidtesting.com"; sid:542253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for woodrosevscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"woodrosevscovid.com"; sid:542254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercovid-19.com"; sid:542255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-corona.com"; sid:542256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecorona.com"; sid:542257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19news.com"; sid:542258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19news.net"; sid:542259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbat.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbat.club"; sid:542260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancruises.com"; sid:542261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-flu-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-flu-relief.com"; sid:542262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-flu-relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-flu-relief.net"; sid:542263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-flu-victim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-flu-victim.com"; sid:542264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-flu-victim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-flu-victim.net"; sid:542265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus19oracle.com"; sid:542266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusoracle.com"; sid:542267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovidmap.com"; sid:542268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronavirusnow.com"; sid:542269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwgooglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwgooglecovid19.com"; sid:542270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wyomingcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wyomingcovidtesting.com"; sid:542271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yescoronavirus.com"; sid:542272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youbeatcorona.com"; sid:542273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youngcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youngcoronavirus.com"; sid:542274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youngcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youngcovid19.com"; sid:542275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronatest.com"; sid:542276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidhelp.com"; sid:542277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yovencialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yovencialcoronavirus.com"; sid:542278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovid.com"; sid:542279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zozocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zozocorona.com"; sid:542280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1438corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1438corona.com"; sid:542281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovidtest.com"; sid:542282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronatest.com"; sid:542283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21wuhan.com"; sid:542284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dforcovid.com"; sid:542285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dprint-vs-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dprint-vs-pandemic.com"; sid:542286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3plycovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3plycovid19masks.com"; sid:542287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 86-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"86-covid-19.com"; sid:542288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1coronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1coronatesting.com"; sid:542289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abocoyotepcr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abocoyotepcr-covid19.com"; sid:542290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abopcr-covid19buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abopcr-covid19buy.com"; sid:542291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abopcr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abopcr-covid19.com"; sid:542292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abopcr-covid19sales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abopcr-covid19sales.com"; sid:542293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actioncorona.com"; sid:542294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acu-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acu-corona.com"; sid:542295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acureforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acureforthecoronavirus.com"; sid:542296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporcovid-19.com"; sid:542297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosporcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosporcovid-19.net"; sid:542298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid-19.com"; sid:542299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.club"; sid:542300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthecoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthecoronaviruspandemic.com"; sid:542301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovid-19.com"; sid:542302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidforcoronavirus.com"; sid:542303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudacorona.com"; sid:542304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronaviruslaw.com"; sid:542305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovid19law.com"; sid:542306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albopcrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albopcrcovid19.com"; sid:542307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19supply.com"; sid:542308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all-united-vs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all-united-vs-covid19.com"; sid:542309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all-vs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all-vs-covid19.com"; sid:542310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americavscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americavscovid-19.com"; sid:542311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americavscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americavscovid19.com"; sid:542312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americavscovid.com"; sid:542313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anendtocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anendtocoronavirus.com"; sid:542314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.group"; sid:542315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.land - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.land"; sid:542316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaschild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaschild.com"; sid:542317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.team"; sid:542318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusglove.com"; sid:542319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusgloves.com"; sid:542320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusscherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusscherm.com"; sid:542321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.zone"; sid:542322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.supplies"; sid:542323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivirus-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivirus-corona.com"; sid:542324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anxietycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anxietycoronavirus.com"; sid:542325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anxietycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anxietycovid19.com"; sid:542326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anxietycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anxietycovid.com"; sid:542327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoronacare.com"; sid:542328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid19care.com"; sid:542329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-corona.com"; sid:542330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescorona.com"; sid:542331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiacoronavirus.com"; sid:542332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantabeatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantabeatscovid.com"; sid:542333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincoronavirusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincoronavirusdisinfection.com"; sid:542334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid-19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid-19disinfection.com"; sid:542335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid19disinfection.com"; sid:542336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autoankaufcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autoankaufcorona.com"; sid:542337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotransportcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotransportcorona.com"; sid:542338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auxiliocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auxiliocorona.com"; sid:542339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awayfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awayfromcoronavirus.com"; sid:542340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayeitscoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayeitscoronatime.com"; sid:542341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babyinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babyinthetimeofcoronavirus.com"; sid:542342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babypandemic.com"; sid:542343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcaseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcaseofcorona.com"; sid:542344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcoronavirus.com"; sid:542345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantaycovid.com"; sid:542346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlethecovid19.com"; sid:542347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareacoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareacoronavirusrelief.com"; sid:542348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bb-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bb-coronavirus.com"; sid:542349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcoronamap.com"; sid:542350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronagame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronagame.com"; sid:542351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid-19.com"; sid:542352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beating-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beating-coronavirus.com"; sid:542353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beating-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beating-covid19.com"; sid:542354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecorona.world"; sid:542355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bell-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bell-covid19.com"; sid:542356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepandemicready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepandemicready.com"; sid:542357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafetestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafetestcovid19.com"; sid:542358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruslawyer.com"; sid:542359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcorona.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcorona.church"; sid:542360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthecoronavirus.com"; sid:542361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthecoronavirus.net"; sid:542362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigcoronaguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigcoronaguy.com"; sid:542363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigdatacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigdatacoronavirus.com"; sid:542364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchaincovid.com"; sid:542365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockpandemic.com"; sid:542366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncoviddisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncoviddisinfection.com"; sid:542367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidsanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidsanitation.com"; sid:542368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bravecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bravecovid.com"; sid:542369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buloscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buloscoronavirus.com"; sid:542370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesses-vs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesses-vs-covid19.com"; sid:542371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronatestkits.com"; sid:542372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19testkits.com"; sid:542373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-covid19.com"; sid:542374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidrelief.com"; sid:542375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cagecovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cagecovid.club"; sid:542376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcoronalaw.com"; sid:542377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaclaims.com"; sid:542378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19law.com"; sid:542379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmlyfacingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmlyfacingcovid.com"; sid:542380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancer-coronavirus-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancer-coronavirus-registry.com"; sid:542381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canselcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canselcorona.com"; sid:542382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitalcorona.com"; sid:542383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsfightingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsfightingcoronavirus.com"; sid:542384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecovidartresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecovidartresource.com"; sid:542385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carolinacoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carolinacoronaclaims.com"; sid:542386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cepheidcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cepheidcovid19test.com"; sid:542387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cflaldiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cflaldiacovid.com"; sid:542388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changecorona.com"; sid:542389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncoronaclaims.com"; sid:542390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlottecoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlottecoronarelief.com"; sid:542391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartcorona.com"; sid:542392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chase-covid19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chase-covid19s.com"; sid:542393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkpandemic.com"; sid:542394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19.world"; sid:542395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-covid-19.com"; sid:542396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cienciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cienciacovid19.com"; sid:542397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncoronavirusattorneys.com"; sid:542398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncoronaviruslawyer.com"; sid:542399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncovid19attorney.com"; sid:542400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncovid19attorneys.com"; sid:542401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncovid19lawyer.com"; sid:542402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claytoncovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claytoncovid19lawyers.com"; sid:542403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid19ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid19ny.com"; sid:542404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean-covid.com"; sid:542405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleansecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleansecovid.com"; sid:542406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickagainstcorona.com"; sid:542407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for climatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"climatecorona.com"; sid:542408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for climbcovidcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"climbcovidcanada.com"; sid:542409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clobbercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clobbercorona.com"; sid:542410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothingcovid19.com"; sid:542411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid-19.com"; sid:542412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovidcare.com"; sid:542413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codecovid.com"; sid:542414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coin4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coin4corona.com"; sid:542415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinage4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinage4corona.com"; sid:542416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinagecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinagecorona.com"; sid:542417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinageforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinageforcorona.com"; sid:542418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinforcorona.com"; sid:542419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coins4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coins4corona.com"; sid:542420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinsforcorona.com"; sid:542421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorado-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorado-covid.com"; sid:542422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorsvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorsvscorona.com"; sid:542423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comedy4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comedy4covid.com"; sid:542424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercecorona.com"; sid:542425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conceptcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conceptcorona.com"; sid:542426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confesscorona.com"; sid:542427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcoronavirus.com"; sid:542428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcovid19.com"; sid:542429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for continuingthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"continuingthroughcoronavirus.com"; sid:542430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraelcovid.com"; sid:542431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coomercialcleaningcovid19preventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coomercialcleaningcovid19preventionservices.com"; sid:542432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornercovid.com"; sid:542433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona14daychallenges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona14daychallenges.com"; sid:542434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona14day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona14day.com"; sid:542435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19shield.com"; sid:542436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19supplies.com"; sid:542437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19testkit.com"; sid:542438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19tests.com"; sid:542439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020test.com"; sid:542440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4business.com"; sid:542441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4business.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4business.net"; sid:542442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona95masks.com"; sid:542443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadapt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadapt.com"; sid:542444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaddictionrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaddictionrecovery.com"; sid:542445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaddictionrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaddictionrecovery.net"; sid:542446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadjust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadjust.com"; sid:542447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaagency.com"; sid:542448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaagenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaagenda.com"; sid:542449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaidfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaidfirst.com"; sid:542450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaidlawyer.com"; sid:542451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalcoholismrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalcoholismrecovery.com"; sid:542452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalcoholismrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalcoholismrecovery.net"; sid:542453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-angebote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-angebote.com"; sid:542454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antrag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antrag.com"; sid:542455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarena.com"; sid:542456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabacteriophage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabacteriophage.com"; sid:542457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabae.com"; sid:542458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabakes.com"; sid:542459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankrupt.com"; sid:542460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyhelp.com"; sid:542461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabasis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabasis.com"; sid:542462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeacon.com"; sid:542463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bedarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bedarf.com"; sid:542464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegone420313.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegone420313.com"; sid:542465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabenefitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabenefitsusa.com"; sid:542466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabenfitsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabenfitsny.com"; sid:542467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-berater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-berater.com"; sid:542468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaberatung.com"; sid:542469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabillpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabillpay.com"; sid:542470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabills.com"; sid:542471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabills.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabills.net"; sid:542472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabingus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabingus.com"; sid:542473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabluz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabluz.com"; sid:542474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabluz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabluz.net"; sid:542475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboft5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboft5.com"; sid:542476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboft.com"; sid:542477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bonds.com"; sid:542478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-borealis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-borealis.com"; sid:542479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboxx.com"; sid:542480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabr.com"; sid:542481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrowardcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrowardcounty.com"; sid:542482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabudget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabudget.com"; sid:542483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessexpert.com"; sid:542484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-businessexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-businessexperts.com"; sid:542485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessexperts.com"; sid:542486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesstraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesstraining.com"; sid:542487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalypsecookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalypsecookbook.com"; sid:542488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalfinance.com"; sid:542489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardeals.com"; sid:542490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarelegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarelegal.com"; sid:542491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaricature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaricature.com"; sid:542492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaring.com"; sid:542493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashclaims.com"; sid:542494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationwear.com"; sid:542495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacconomy.com"; sid:542496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacel.com"; sid:542497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacel.net"; sid:542498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacensuscollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacensuscollective.com"; sid:542499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentralengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentralengland.com"; sid:542500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentralscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentralscotland.com"; sid:542501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentralwales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentralwales.com"; sid:542502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chancen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chancen.com"; sid:542503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chance.net"; sid:542504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-change.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-change.com"; sid:542505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachanged.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachanged.com"; sid:542506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-change.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-change.net"; sid:542507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharge.com"; sid:542508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checklist.com"; sid:542509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachef.com"; sid:542510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachella2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachella2020.com"; sid:542511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachinesevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachinesevirus.com"; sid:542512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachorus.com"; sid:542513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chronicle.com"; sid:542514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide.solutions"; sid:542515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimusa.com"; sid:542516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcourse.com"; sid:542517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcourses.com"; sid:542518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanse.net"; sid:542519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclimate.com"; sid:542520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosets.com"; sid:542521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloudmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloudmarketplace.com"; sid:542522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coaching.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coaching.net"; sid:542523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coinage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coinage.com"; sid:542524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoinage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoinage.com"; sid:542525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollateral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollateral.com"; sid:542526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomet.com"; sid:542527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommercials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommercials.com"; sid:542528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunism.com"; sid:542529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcept.com"; sid:542530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfessionals.com"; sid:542531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfession.com"; sid:542532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfessions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfessions.net"; sid:542533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconflict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconflict.com"; sid:542534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconflict.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconflict.net"; sid:542535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfusion.com"; sid:542536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongalinechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongalinechallenge.com"; sid:542537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongaline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongaline.com"; sid:542538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsecuences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsecuences.com"; sid:542539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontemplations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontemplations.com"; sid:542540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontinent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontinent.com"; sid:542541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontreras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontreras.com"; sid:542542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-controlled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-controlled.com"; sid:542543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrolusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrolusa.com"; sid:542544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookoff.com"; sid:542545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacosmos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacosmos.com"; sid:542546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-counter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-counter.net"; sid:542547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouplesdanceoffparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouplesdanceoffparty.com"; sid:542548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidcure.com"; sid:542549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacozies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacozies.com"; sid:542550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreativecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreativecommunity.com"; sid:542551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacredit.net"; sid:542552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatenite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatenite.com"; sid:542553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dates.com"; sid:542554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-depression.com"; sid:542555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadidntgetme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadidntgetme.com"; sid:542556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiet101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiet101.com"; sid:542557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiet.net"; sid:542558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadietplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadietplan.com"; sid:542559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadietprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadietprogram.com"; sid:542560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistrict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistrict.com"; sid:542561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diy.com"; sid:542562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohotelservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohotelservice.com"; sid:542563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-donation.com"; sid:542564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaduel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaduel.com"; sid:542565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaegypt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaegypt.net"; sid:542566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelbisesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelbisesi.com"; sid:542567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaera.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaera.email"; sid:542568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessentialscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessentialscalculator.com"; sid:542569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeve.com"; sid:542570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevolution.com"; sid:542571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexposure.com"; sid:542572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpresstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpresstest.com"; sid:542573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafallout.com"; sid:542574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyinterventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyinterventions.com"; sid:542575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyinterventions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyinterventions.net"; sid:542576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafatigue.com"; sid:542577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafightback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafightback.com"; sid:542578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafight.net"; sid:542579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finance.com"; sid:542580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinanceusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinanceusa.com"; sid:542581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialservices.com"; sid:542582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialsolution.com"; sid:542583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialsolutions.com"; sid:542584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinisher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinisher.com"; sid:542585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.fish - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.fish"; sid:542586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflag.com"; sid:542587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflags.com"; sid:542588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafootshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafootshake.com"; sid:542589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforbusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforbusiness.net"; sid:542590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecertification.com"; sid:542591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeclean.com"; sid:542592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreed.com"; sid:542593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeflight.com"; sid:542594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreelife.com"; sid:542595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrees.com"; sid:542596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreightnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreightnews.com"; sid:542597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundny.com"; sid:542598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundrecovery.com"; sid:542599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundrecovery.net"; sid:542600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagalaxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagalaxy.com"; sid:542601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gamechanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gamechanger.com"; sid:542602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gamechanger.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gamechanger.net"; sid:542603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaghostbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaghostbuster.com"; sid:542604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaghostbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaghostbusters.com"; sid:542605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagir.com"; sid:542606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagist.com"; sid:542607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagiving.com"; sid:542608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobally.com"; sid:542609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoal.com"; sid:542610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagp.com"; sid:542611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagranthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagranthelp.com"; sid:542612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrantsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrantsuk.com"; sid:542613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreenz.com"; sid:542614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hackathon.com"; sid:542615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaircuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaircuts.com"; sid:542616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahairdontcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahairdontcare.com"; sid:542617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandout.com"; sid:542618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-healthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-healthcheck.com"; sid:542619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthinsurance2day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthinsurance2day.com"; sid:542620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthinsurancetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthinsurancetoday.com"; sid:542621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthprogram.com"; sid:542622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helden.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helden.net"; sid:542623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-help.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-help.center"; sid:542624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpcentre.com"; sid:542625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.credit"; sid:542626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelplinecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelplinecenter.com"; sid:542627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelplines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelplines.com"; sid:542628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahi.com"; sid:542629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe24.com"; sid:542630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.center"; sid:542631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.tips"; sid:542632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomo.com"; sid:542633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahope.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahope.life"; sid:542634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahouston.com"; sid:542635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoy.com"; sid:542636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahr.com"; sid:542637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuunbutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuunbutton.com"; sid:542638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuun.com"; sid:542639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfstoff.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfstoff.net"; sid:542640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindustry.com"; sid:542641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainstacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainstacheck.com"; sid:542642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainstanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainstanttest.com"; sid:542643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceclaims.net"; sid:542644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruption.com"; sid:542645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterventions.com"; sid:542646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterventions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterventions.net"; sid:542647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobs.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobs.guide"; sid:542648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarte.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarte.net"; sid:542649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsco.com"; sid:542650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakktc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakktc.com"; sid:542651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krisenportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krisenportal.com"; sid:542652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtests.com"; sid:542653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatestupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatestupdate.com"; sid:542654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawcenter.com"; sid:542655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.guru"; sid:542656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.today"; sid:542657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalcare.com"; sid:542658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalennial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalennial.net"; sid:542659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-less.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-less.com"; sid:542660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessons.com"; sid:542661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivefeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivefeed.com"; sid:542662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronallennial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronallennial.com"; sid:542663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogues.com"; sid:542664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalprecision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalprecision.com"; sid:542665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyser.com"; sid:542666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamap.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamap.life"; sid:542667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarriages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarriages.com"; sid:542668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarriages.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarriages.net"; sid:542669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask24.com"; sid:542670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskpk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskpk.com"; sid:542671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedacine.com"; sid:542672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamentalhealthhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamentalhealthhelp.com"; sid:542673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameters.net"; sid:542674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametin2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametin2.com"; sid:542675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronami.com"; sid:542676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mietrecht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mietrecht.com"; sid:542677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaml.com"; sid:542678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoney.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoney.club"; sid:542679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoneyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoneyloan.com"; sid:542680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonth.com"; sid:542681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamove.com"; sid:542682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovement.com"; sid:542683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusicclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusicclub.com"; sid:542684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamyself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamyself.com"; sid:542685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanbitcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanbitcoin.com"; sid:542686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanest.com"; sid:542687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanettoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanettoyage.com"; sid:542688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-neustart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-neustart.com"; sid:542689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsstream.com"; sid:542690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsus.com"; sid:542691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewyearseve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewyearseve.com"; sid:542692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoa.com"; sid:542693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanode.com"; sid:542694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notfallkarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notfallkarte.com"; sid:542695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoasis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoasis.com"; sid:542696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-offers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-offers.com"; sid:542697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaok.com"; sid:542698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-oke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-oke.com"; sid:542699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganize.com"; sid:542700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverflow.com"; sid:542701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapakistan.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapakistan.services"; sid:542702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapantser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapantser.com"; sid:542703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-patient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-patient.com"; sid:542704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-patients.com"; sid:542705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphilanthropy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphilanthropy.com"; sid:542706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphonescams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphonescams.com"; sid:542707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapicture.com"; sid:542708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pictures.com"; sid:542709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplot.com"; sid:542710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocolypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocolypse2020.com"; sid:542711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaposters.com"; sid:542712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecision.com"; sid:542713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprogram.com"; sid:542714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproleisuretour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproleisuretour.com"; sid:542715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofairbnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofairbnb.com"; sid:542716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproprete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproprete.com"; sid:542717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotokoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotokoll.com"; sid:542718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotokoll.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotokoll.net"; sid:542719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsychologicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsychologicalhelp.com"; sid:542720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapt.com"; sid:542721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapuram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapuram.com"; sid:542722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinejournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinejournal.com"; sid:542723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinekids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinekids.com"; sid:542724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquestion.com"; sid:542725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-radar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-radar.net"; sid:542726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rapid-test.com"; sid:542727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarchist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarchist.com"; sid:542728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebel.com"; sid:542729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsfolgen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsfolgen.com"; sid:542730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recover.com"; sid:542731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveries.com"; sid:542732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecovery.net"; sid:542733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryny.com"; sid:542734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareferendum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareferendum.com"; sid:542735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregions.com"; sid:542736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelationships.com"; sid:542737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefcorps.com"; sid:542738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefer.com"; sid:542739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reset.com"; sid:542740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresident.com"; sid:542741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresolution.com"; sid:542742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresolution.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresolution.net"; sid:542743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponseni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponseni.com"; sid:542744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareturns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareturns.com"; sid:542745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronargv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronargv.com"; sid:542746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarix.com"; sid:542747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarix.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarix.net"; sid:542748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaruptcy.com"; sid:542749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safe-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safe-mask.com"; sid:542750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysupply.com"; sid:542751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafework.com"; sid:542752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalary.com"; sid:542753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasauce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasauce.com"; sid:542754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaurusrex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaurusrex.com"; sid:542755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schaedlingsbekaempfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schaedlingsbekaempfung.com"; sid:542756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-online.com"; sid:542757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasclosets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasclosets.com"; sid:542758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascloset.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascloset.world"; sid:542759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfchecker.com"; sid:542760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasex24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasex24.com"; sid:542761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasi.com"; sid:542762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasignal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasignal.com"; sid:542763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslim.com"; sid:542764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmittad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmittad.com"; sid:542765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasobersupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasobersupport.com"; sid:542766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasobersupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasobersupport.net"; sid:542767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolutionpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolutionpro.com"; sid:542768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-specialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-specialist.com"; sid:542769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspiracy.com"; sid:542770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspiration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspiration.com"; sid:542771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastartpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastartpage.com"; sid:542772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-statistic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-statistic.net"; sid:542773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilisation.com"; sid:542774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-style.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-style.com"; sid:542775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubsidy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubsidy.com"; sid:542776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorstories.com"; sid:542777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalk.net"; sid:542778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateca.com"; sid:542779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatempus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatempus.com"; sid:542780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.biz"; sid:542781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tester.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tester.net"; sid:542782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestexpress.com"; sid:542783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfromhome.com"; sid:542784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestionline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestionline.com"; sid:542785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesttx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesttx.com"; sid:542786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.zone"; sid:542787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapist1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapist1.com"; sid:542788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapist4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapist4u.com"; sid:542789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapy.net"; sid:542790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathoughtsandfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathoughtsandfears.com"; sid:542791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatider.com"; sid:542792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatinytales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatinytales.com"; sid:542793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatip.com"; sid:542794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipjar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipjar.com"; sid:542795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipoftheday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipoftheday.com"; sid:542796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipoftheweek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipoftheweek.com"; sid:542797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatodayusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatodayusa.com"; sid:542798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraces.com"; sid:542799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerapp.com"; sid:542800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackermap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackermap.com"; sid:542801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingapp.com"; sid:542802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrans.com"; sid:542803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrashchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrashchallenge.com"; sid:542804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrauma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrauma.net"; sid:542805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatypewriters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatypewriters.com"; sid:542806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauniversity2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauniversity2020.com"; sid:542807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-university.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-university.com"; sid:542808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaval.com"; sid:542809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavariousantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavariousantibody.com"; sid:542810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavast.com"; sid:542811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimfund.com"; sid:542812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictims2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictims2020.com"; sid:542813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictorygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictorygarden.com"; sid:542814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigilante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigilante.com"; sid:542815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralanxiety.com"; sid:542816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviri.com"; sid:542817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirouss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirouss.com"; sid:542818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus15minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus15minutetest.com"; sid:542819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19d.com"; sid:542820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.pro"; sid:542821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19survivor.com"; sid:542822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19us.com"; sid:542823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus24horas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus24horas.com"; sid:542824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus253.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus253.com"; sid:542825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactiongroup.com"; sid:542826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafectados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafectados.com"; sid:542827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalliance.net"; sid:542828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalternativetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalternativetreatment.com"; sid:542829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalternativetreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalternativetreatments.com"; sid:542830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietyhelp.com"; sid:542831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusartproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusartproject.com"; sid:542832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassociation.com"; sid:542833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusathomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusathomecare.com"; sid:542834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysflorida.com"; sid:542835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysfortlauderdale.com"; sid:542836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysnewyorkcity.com"; sid:542837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysnewyork.com"; sid:542838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyswashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyswashingtondc.com"; sid:542839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-aus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-aus.com"; sid:542840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bankruptcy-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bankruptcy-lawyer.com"; sid:542841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyprevention.com"; sid:542842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbesttips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbesttips.com"; sid:542843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbluz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbluz.com"; sid:542844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbluz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbluz.net"; sid:542845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-book.com"; sid:542846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesshotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesshotline.com"; sid:542847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslosslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslosslawsuit.com"; sid:542848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslosslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslosslawsuits.com"; sid:542849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscamposdojordao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscamposdojordao.com"; sid:542850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanceledmyevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanceledmyevent.com"; sid:542851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaptivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaptivity.com"; sid:542852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareer.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareer.coach"; sid:542853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareercoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareercoach.com"; sid:542854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscensuscollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscensuscollective.com"; sid:542855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-checker.com"; sid:542856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschemical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschemical.com"; sid:542857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschemicalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschemicalsolutions.com"; sid:542858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschina.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschina.world"; sid:542859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschronicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschronicals.com"; sid:542860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimant.com"; sid:542861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawsuits.com"; sid:542862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleancrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleancrew.com"; sid:542863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscleaners.com"; sid:542864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanersnaples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanersnaples.com"; sid:542865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcharlotte.com"; sid:542866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcourse.com"; sid:542867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcrew.com"; sid:542868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningny.com"; sid:542869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cleaning.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cleaning.sydney"; sid:542870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.today"; sid:542871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupservices.com"; sid:542872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcern.com"; sid:542873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconflict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconflict.com"; sid:542874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconflict.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconflict.net"; sid:542875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongaline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongaline.com"; sid:542876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsulting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsulting.net"; sid:542877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscorrelations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscorrelations.com"; sid:542878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselingonline.com"; sid:542879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounting.com"; sid:542880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovered.com"; sid:542881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19cases.com"; sid:542882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19disinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19disinfectionservices.com"; sid:542883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-credit.com"; sid:542884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscryptocurrency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscryptocurrency.com"; sid:542885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cure.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cure.club"; sid:542886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureforcommercialbuildings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureforcommercialbuildings.com"; sid:542887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureforhome.com"; sid:542888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureformedicalfacilitys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureformedicalfacilitys.com"; sid:542889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureforofficebuildings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureforofficebuildings.com"; sid:542890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureforschools.com"; sid:542891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuremedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuremedicine.com"; sid:542892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurriculum.com"; sid:542893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdata.com"; sid:542894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathbedchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathbedchallenge.com"; sid:542895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeepcleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeepcleansing.com"; sid:542896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefeated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefeated.com"; sid:542897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfektion.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfektion.cleaning"; sid:542898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnostickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnostickit.com"; sid:542899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-diaries.com"; sid:542900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasters.com"; sid:542901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectants.kim - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectants.kim"; sid:542902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingservices.com"; sid:542903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfection.net"; sid:542904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdonates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdonates.com"; sid:542905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-easy-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-easy-test.com"; sid:542906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffort.com"; sid:542907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployee.com"; sid:542908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendsinamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendsinamerica.com"; sid:542909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenews.com"; sid:542910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemicptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemicptsd.com"; sid:542911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseskit.com"; sid:542912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestimator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestimator.com"; sid:542913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexperiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexperiences.com"; sid:542914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexpertwitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexpertwitness.com"; sid:542915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfabricmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfabricmask.com"; sid:542916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfabricmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfabricmasks.com"; sid:542917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusface.com"; sid:542918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemaskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemaskn95.com"; sid:542919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaces.com"; sid:542920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusfacts.com"; sid:542921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastcheckkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastcheckkit.com"; sid:542922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflowers.com"; sid:542923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflutestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflutestkit.com"; sid:542924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfomo.com"; sid:542925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfood.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfood.net"; sid:542926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforpresidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforpresidents.com"; sid:542927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrontpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrontpage.com"; sid:542928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusfunding.com"; sid:542929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundinguk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundinguk.com"; sid:542930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeo.com"; sid:542931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobal.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobal.club"; sid:542932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalimpact.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalimpact.club"; sid:542933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglove.com"; sid:542934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanitizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanitizer.net"; sid:542935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-healthcare.com"; sid:542936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthlink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthlink.com"; sid:542937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-help-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-help-center.com"; sid:542938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.company"; sid:542939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelp.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelp.life"; sid:542940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomedelivery.com"; sid:542941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeservice.com"; sid:542942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-home-test.com"; sid:542943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-home-test.com"; sid:542944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometesting.net"; sid:542945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hometreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hometreatment.com"; sid:542946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimtellingyoushitisreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimtellingyoushitisreal.com"; sid:542947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectie.com"; sid:542948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.business"; sid:542949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfonetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfonetwork.com"; sid:542950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinindia.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinindia.today"; sid:542951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinnigeria.com"; sid:542952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinspections.com"; sid:542953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborlaw.com"; sid:542954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborlawyer.com"; sid:542955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawer.com"; sid:542956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmflorida.com"; sid:542957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitusa.com"; sid:542958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerfortlauderdale.com"; sid:542959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersflorida.com"; sid:542960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerslasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerslasvegas.com"; sid:542961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersnevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersnevada.com"; sid:542962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerswashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerswashingtondc.com"; sid:542963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalreport.com"; sid:542964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalresources.com"; sid:542965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslistofrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslistofrights.com"; sid:542966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanhotline.com"; sid:542967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusloans.com"; sid:542968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosslawsuit.com"; sid:542969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosslawsuits.com"; sid:542970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslungs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslungs.com"; sid:542971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaps.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaps.info"; sid:542972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarseille.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarseille.com"; sid:542973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskcompany.com"; sid:542974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmatch.com"; sid:542975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalequipment.com"; sid:542976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-medicalsupplies.com"; sid:542977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmentalhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmentalhealth.net"; sid:542978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmingle.com"; sid:542979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmodeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmodeling.com"; sid:542980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyhotline.com"; sid:542981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-naturalremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-naturalremedies.com"; sid:542982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusncnoco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusncnoco.com"; sid:542983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.org.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.org.uk"; sid:542984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newstoday.com"; sid:542985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoco.com"; sid:542986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnomundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnomundo.com"; sid:542987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusobituaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusobituaries.com"; sid:542988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusocd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusocd.com"; sid:542989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorganicremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorganicremedies.com"; sid:542990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorganictreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorganictreatment.com"; sid:542991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicbook.com"; sid:542992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicptsd.com"; sid:542993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandemic.today"; sid:542994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-pandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-pandemic.world"; sid:542995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-pandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-pandemie.com"; sid:542996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pcr.com"; sid:542997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspenpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspenpal.com"; sid:542998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetstest.com"; sid:542999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphishing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphishing.com"; sid:543000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-photos.com"; sid:543001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolicies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolicies.com"; sid:543002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppesource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppesource.com"; sid:543003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspredictionchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspredictionchallenge.com"; sid:543004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventiongear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventiongear.com"; sid:543005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspubquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspubquiz.com"; sid:543006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidkits.com"; sid:543007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtests.com"; sid:543008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefbayarea.com"; sid:543009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefco.com"; sid:543010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremedy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremedy.net"; sid:543011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-removal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-removal.com"; sid:543012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovals.com"; sid:543013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovalservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovalservice.com"; sid:543014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovalservices.com"; sid:543015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovalusa.com"; sid:543016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremove.com"; sid:543017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-resources.com"; sid:543018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestrictions.com"; sid:543019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusribbon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusribbon.com"; sid:543020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusroadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusroadmap.com"; sid:543021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrus.club"; sid:543022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyboots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyboots.com"; sid:543023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetycleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetycleaning.com"; sid:543024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetygloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetygloves.com"; sid:543025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussafetymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussafetymasks.com"; sid:543026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysource.com"; sid:543027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscamalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscamalert.com"; sid:543028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseguro.com"; sid:543029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseguro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseguro.net"; sid:543030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftestingkits.com"; sid:543031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussexting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussexting.com"; sid:543032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolardiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolardiscount.com"; sid:543033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussrbija.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussrbija.com"; sid:543034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockvideo.com"; sid:543035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussucks5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussucks5k.com"; sid:543036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussucks.net"; sid:543037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupershop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupershop.com"; sid:543038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurivivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurivivor.com"; sid:543039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tchad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tchad.com"; sid:543040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-telehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-telehealth.com"; sid:543041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelevision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelevision.com"; sid:543042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest411.com"; sid:543043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest911.com"; sid:543044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfromhome.com"; sid:543045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinguk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinguk.com"; sid:543046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkits.kim - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkits.kim"; sid:543047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthetodayshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthetodayshow.com"; sid:543048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthisshitisreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthisshitisreal.com"; sid:543049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustodayshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustodayshow.com"; sid:543050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackerr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackerr.com"; sid:543051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraumarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraumarecovery.com"; sid:543052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-treatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-treatement.com"; sid:543053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusverification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusverification.com"; sid:543054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvetdrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvetdrugs.com"; sid:543055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveteran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveteran.com"; sid:543056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvetvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvetvaccine.com"; sid:543057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-videos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-videos.com"; sid:543058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebtherapy.com"; sid:543059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusword.com"; sid:543060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-words.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-words.com"; sid:543061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworker.com"; sid:543062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyou.com"; sid:543063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyxe.com"; sid:543064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavz.com"; sid:543065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-war.com"; sid:543066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaware.net"; sid:543067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawellnessprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawellnessprogram.com"; sid:543068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldstatistics.com"; sid:543069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-world-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-world-virus.com"; sid:543070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldvirus.com"; sid:543071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawristbands.com"; sid:543072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawriters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawriters.com"; sid:543073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayourself.com"; sid:543074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazi.com"; sid:543075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosmoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosmoscorona.com"; sid:543076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cotedivoirecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cotedivoirecovid-19.com"; sid:543077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cotedivoirecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cotedivoirecovid19.com"; sid:543078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192019.com"; sid:543079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19411.com"; sid:543080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid194dummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid194dummies.com"; sid:543081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid195k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid195k.com"; sid:543082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1970s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1970s.com"; sid:543083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1977.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1977.com"; sid:543084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19abatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19abatement.com"; sid:543085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19act.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19act.com"; sid:543086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19activation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19activation.com"; sid:543087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19africa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19africa.net"; sid:543088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agecare.com"; sid:543089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ai.com"; sid:543090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ai.com"; sid:543091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alert.net"; sid:543092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19altmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19altmed.com"; sid:543093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.amsterdam"; sid:543094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.amsterdam"; sid:543095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigen.com"; sid:543096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antiseptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antiseptic.com"; sid:543097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anxietyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anxietyhelp.com"; sid:543098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anxiety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anxiety.net"; sid:543099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aprou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aprou.com"; sid:543100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ar.com"; sid:543101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19arizona.com"; sid:543102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomecare.com"; sid:543103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athome.com"; sid:543104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneylasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneylasvegas.com"; sid:543105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyslasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyslasvegas.com"; sid:543106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneys.net"; sid:543107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysnewyork.com"; sid:543108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-aware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-aware.com"; sid:543109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-baby.com"; sid:543110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bae.com"; sid:543111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bangladesh.com"; sid:543112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylawyer.com"; sid:543113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19billing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19billing.com"; sid:543114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blockchain.com"; sid:543115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blogs.com"; sid:543116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boards.com"; sid:543117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boots.com"; sid:543118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19br.com"; sid:543119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bucha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bucha.com"; sid:543120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruption.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruption.center"; sid:543121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionflorida.com"; sid:543122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlasvegas.com"; sid:543123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionnevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionnevada.com"; sid:543124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionnewyork.com"; sid:543125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslawyer.com"; sid:543126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslawyers.com"; sid:543127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslosslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslosslawsuit.com"; sid:543128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslosslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslosslawsuit.com"; sid:543129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslosslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslosslawsuits.com"; sid:543130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslosslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslosslawsuits.com"; sid:543131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesssupport.com"; sid:543132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bussiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bussiness.com"; sid:543133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bystate.com"; sid:543134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19calculator.com"; sid:543135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cannabis.com"; sid:543136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashclaims.com"; sid:543137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cats.com"; sid:543138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbt.com"; sid:543139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbts.com"; sid:543140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19census.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19census.com"; sid:543141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19centers.com"; sid:543142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centralscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centralscotland.com"; sid:543143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centralwales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centralwales.com"; sid:543144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cert.com"; sid:543145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certified.com"; sid:543146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cert.net"; sid:543147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-challenge.com"; sid:543148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chemist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chemist.com"; sid:543149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chicago.com"; sid:543150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-claim.com"; sid:543151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawsuits.com"; sid:543152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaned.com"; sid:543153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaners.net"; sid:543154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaners.net"; sid:543155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanteam.com"; sid:543156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clear.com"; sid:543157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clincs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clincs.com"; sid:543158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicalsupplies.com"; sid:543159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cocktailhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cocktailhour.com"; sid:543160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coding.com"; sid:543161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19collection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19collection.com"; sid:543162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collection.com"; sid:543163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coloradocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coloradocleaning.com"; sid:543164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19comcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19comcast.com"; sid:543165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleaningservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleaningservicesnashville.com"; sid:543166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19community.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19community.com"; sid:543167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliance.com"; sid:543168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantcert.com"; sid:543169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantcert.com"; sid:543170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantcertified.com"; sid:543171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliant.com"; sid:543172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliant.net"; sid:543173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contacts.com"; sid:543174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contagion.com"; sid:543175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.biz"; sid:543176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus.mobi"; sid:543177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19covered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19covered.com"; sid:543178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covered.com"; sid:543179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crash.com"; sid:543180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-crisis.com"; sid:543181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.cruises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.cruises"; sid:543182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cure.net"; sid:543183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19daily.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19daily.net"; sid:543184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datenight.com"; sid:543185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathrate.com"; sid:543186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrelief.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrelief.credit"; sid:543187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decals.com"; sid:543188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminate.com"; sid:543189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deepcleaning.com"; sid:543190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deepcleaning.com"; sid:543191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deepcleaning.com"; sid:543192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19depression.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19depression.net"; sid:543193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dictionary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dictionary.com"; sid:543194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectcolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectcolorado.com"; sid:543195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectingservices.com"; sid:543196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectnow.com"; sid:543197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dissinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dissinfection.com"; sid:543198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-docs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-docs.com"; sid:543199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dogs.com"; sid:543200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-donation.com"; sid:543201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19down.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19down.com"; sid:543202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19economicstimulusproposal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19economicstimulusproposal.com"; sid:543203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeelaw.com"; sid:543204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneyflorida.com"; sid:543205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneynevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneynevada.com"; sid:543206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneynewyork.com"; sid:543207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneysflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneysflorida.com"; sid:543208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneysnevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneysnevada.com"; sid:543209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentattorneysnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentattorneysnewyork.com"; sid:543210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ems.com"; sid:543211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-entschaedigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-entschaedigung.com"; sid:543212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemicptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemicptsd.com"; sid:543213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemiology.com"; sid:543214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.equipment"; sid:543215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eradication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eradication.com"; sid:543216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-essentials.com"; sid:543217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19essentialsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19essentialsupplies.com"; sid:543218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ety.com"; sid:543219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19event.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19event.com"; sid:543220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19experience.com"; sid:543221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-experience.com"; sid:543222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-experiences.com"; sid:543223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experiences.com"; sid:543224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expertwitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expertwitness.com"; sid:543225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19extermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19extermination.com"; sid:543226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fabricmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fabricmask.com"; sid:543227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fabricmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fabricmasks.com"; sid:543228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-facemasks.com"; sid:543229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-facemasks.com"; sid:543230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fallout.com"; sid:543231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fema.com"; sid:543232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fest.com"; sid:543233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19festival.com"; sid:543234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fileaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fileaclaim.com"; sid:543235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19filmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19filmfestival.com"; sid:543236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19finances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19finances.com"; sid:543237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.financial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.financial"; sid:543238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19finisher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19finisher.com"; sid:543239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flix.com"; sid:543240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flutesting.com"; sid:543241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flutestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flutestkit.com"; sid:543242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forbussiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forbussiness.com"; sid:543243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forcemajeure.com"; sid:543244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forcemajeure.com"; sid:543245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeworkplace.com"; sid:543246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fumigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fumigation.com"; sid:543247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-game.com"; sid:543248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gear.com"; sid:543249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-genertation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-genertation.com"; sid:543250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goaway.com"; sid:543251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gov.com"; sid:543252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grants.net"; sid:543253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grantsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grantsuk.com"; sid:543254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19groceries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19groceries.com"; sid:543255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19growthtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19growthtracker.com"; sid:543256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guidance.com"; sid:543257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guitars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guitars.com"; sid:543258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gym.com"; sid:543259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gyms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gyms.com"; sid:543260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hacks.com"; sid:543261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halfmarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halfmarathon.com"; sid:543262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healt.com"; sid:543263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcarejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcarejobs.com"; sid:543264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthmasks.com"; sid:543265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healt.net"; sid:543266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpdesk.com"; sid:543267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-helpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-helpline.com"; sid:543268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpny.com"; sid:543269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpsupplies.com"; sid:543270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herb.com"; sid:543271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoaks.com"; sid:543272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecareupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecareupdates.com"; sid:543273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeremedies.com"; sid:543274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homestestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homestestkit.com"; sid:543275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-home-test.com"; sid:543276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-home-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-home-test-kits.com"; sid:543277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hosting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hosting.com"; sid:543278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hotline.com"; sid:543279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humanity.com"; sid:543280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hvac.com"; sid:543281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hv.com"; sid:543282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygienekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygienekit.com"; sid:543283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hype.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hype.net"; sid:543284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hysteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hysteria.com"; sid:543285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hysteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hysteria.com"; sid:543286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hysteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hysteria.com"; sid:543287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ilaclama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ilaclama.com"; sid:543288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuunbutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuunbutton.com"; sid:543289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuun.com"; sid:543290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impacto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impacto.com"; sid:543291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inc.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inc.life"; sid:543292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incomeloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incomeloss.com"; sid:543293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-india.com"; sid:543294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infants.com"; sid:543295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.club"; sid:543296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infographic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infographic.com"; sid:543297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innovation.com"; sid:543298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ins.com"; sid:543299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instacheck.com"; sid:543300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttestkit.com"; sid:543301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investing.com"; sid:543302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isfalse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isfalse.com"; sid:543303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isgone.com"; sid:543304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19janitorialservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19janitorialservicesnashville.com"; sid:543305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-justsavelives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-justsavelives.com"; sid:543306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killers.biz"; sid:543307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kilz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kilz.com"; sid:543308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kn95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kn95masks.com"; sid:543309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborlaw.com"; sid:543310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawer.com"; sid:543311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmlasvegas.com"; sid:543312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmnewyorkcity.com"; sid:543313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19laws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19laws.com"; sid:543314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerslasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerslasvegas.com"; sid:543315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelp.net"; sid:543316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifestyle.com"; sid:543317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-livetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-livetracker.com"; sid:543318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans-sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans-sba.com"; sid:543319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans-sba.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans-sba.mobi"; sid:543320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans-sba.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans-sba.net"; sid:543321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loneliness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loneliness.com"; sid:543322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19losangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19losangeles.com"; sid:543323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19losslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19losslawsuit.com"; sid:543324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losslawsuit.com"; sid:543325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19losslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19losslawsuits.com"; sid:543326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losslawsuits.com"; sid:543327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lostincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lostincome.com"; sid:543328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manufacturing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manufacturing.com"; sid:543329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mapusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mapusa.com"; sid:543330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskusa.com"; sid:543331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masque.com"; sid:543332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19match.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19match.com"; sid:543333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19match.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19match.net"; sid:543334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mealdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mealdelivery.com"; sid:543335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medapp.com"; sid:543336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medcare.com"; sid:543337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalbills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalbills.com"; sid:543338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalequipment.com"; sid:543339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalequiptment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalequiptment.com"; sid:543340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medsupply.com"; sid:543341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meme.com"; sid:543342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mesa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mesa.com"; sid:543343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19miami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19miami.com"; sid:543344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mindset.com"; sid:543345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19money.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19money.net"; sid:543346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortalityrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortalityrate.com"; sid:543347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19motionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19motionpicture.com"; sid:543348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mylocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mylocal.com"; sid:543349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19myths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19myths.com"; sid:543350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19n95.com"; sid:543351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-n95mask.com"; sid:543352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nation.com"; sid:543353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalmedicine.com"; sid:543354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ncnoco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ncnoco.com"; sid:543355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nepal.com"; sid:543356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nepalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nepalnews.com"; sid:543357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neutralizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neutralizer.com"; sid:543358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newborns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newborns.com"; sid:543359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsroom.com"; sid:543360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nitrilegloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nitrilegloves.com"; sid:543361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noco.com"; sid:543362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-normailty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-normailty.com"; sid:543363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normailty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normailty.com"; sid:543364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-normalcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-normalcy.com"; sid:543365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-normality.com"; sid:543366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oaktown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oaktown.com"; sid:543367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officecleaningservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officecleaningservicesnashville.com"; sid:543368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19om.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19om.com"; sid:543369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19opportunism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19opportunism.com"; sid:543370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opportunities.com"; sid:543371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19order.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19order.com"; sid:543372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organicremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organicremedies.com"; sid:543373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19org.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19org.com"; sid:543374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19outerwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19outerwear.com"; sid:543375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19over.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19over.com"; sid:543376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19overstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19overstock.com"; sid:543377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overstocknews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overstocknews.com"; sid:543378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overstocktoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overstocktoday.com"; sid:543379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overstockweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overstockweb.com"; sid:543380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicptsd.com"; sid:543381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemics.com"; sid:543382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.solutions"; sid:543383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemictv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemictv.com"; sid:543384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicusa.com"; sid:543385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patrol.com"; sid:543386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pcr.com"; sid:543387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pcr.com"; sid:543388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr.com"; sid:543389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petcare.com"; sid:543390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petcareguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petcareguide.com"; sid:543391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petcareresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petcareresource.com"; sid:543392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petguide.com"; sid:543393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petpro.com"; sid:543394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petstest.com"; sid:543395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petsvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petsvaccine.com"; sid:543396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pictures.com"; sid:543397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plumber.com"; sid:543398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plus.com"; sid:543399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pmoinabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pmoinabox.com"; sid:543400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pmoinabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pmoinabox.com"; sid:543401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-poker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-poker.com"; sid:543402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19politics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19politics.com"; sid:543403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-positivenormality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-positivenormality.com"; sid:543404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppegear.com"; sid:543405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppewear.com"; sid:543406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventioncleaningservicesnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventioncleaningservicesnashville.com"; sid:543407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventiondisinfectioncompaniesnashvilletn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventiondisinfectioncompaniesnashvilletn.com"; sid:543408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19problemsolvers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19problemsolvers.com"; sid:543409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19promise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19promise.com"; sid:543410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19promse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19promse.com"; sid:543411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pros.com"; sid:543412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protectivegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protectivegear.com"; sid:543413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivegear.com"; sid:543414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19providerlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19providerlaw.com"; sid:543415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19providorlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19providorlaw.com"; sid:543416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19publicservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19publicservice.com"; sid:543417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19py.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19py.com"; sid:543418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qc.com"; sid:543419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantine2020.com"; sid:543420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-questions.com"; sid:543421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quicktest.com"; sid:543422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19race.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19race.com"; sid:543423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapid.com"; sid:543424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidvirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidvirustest.com"; sid:543425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.recipes"; sid:543426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recovery2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recovery2020.com"; sid:543427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverydiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverydiy.com"; sid:543428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverysupplies.com"; sid:543429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-referendum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-referendum.com"; sid:543430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19referendum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19referendum.com"; sid:543431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refi.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refi.today"; sid:543432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remede.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remede.com"; sid:543433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-remedies.com"; sid:543434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19removal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19removal.com"; sid:543435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19repellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19repellent.com"; sid:543436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reportcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reportcard.com"; sid:543437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reportcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reportcard.com"; sid:543438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reportcard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reportcard.net"; sid:543439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reportcard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reportcard.net"; sid:543440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19report.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19report.net"; sid:543441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resource.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resource.center"; sid:543442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcecenter.com"; sid:543443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-resource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-resource.com"; sid:543444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resources.net"; sid:543445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response.fund"; sid:543446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response.net"; sid:543447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurants.com"; sid:543448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ribbon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ribbon.com"; sid:543449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rnjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rnjobs.com"; sid:543450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rvt.com"; sid:543451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetesting.com"; sid:543452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safetygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safetygear.com"; sid:543453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanfrancisco.com"; sid:543454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizing.com"; sid:543455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanity.com"; sid:543456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19self-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19self-test.com"; sid:543457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seniorcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seniorcare.com"; sid:543458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19service.com"; sid:543459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19settlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19settlements.com"; sid:543460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shelterinplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shelterinplace.com"; sid:543461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shields.com"; sid:543462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shirt.com"; sid:543463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signage.com"; sid:543464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signage.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signage.mobi"; sid:543465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signage.net"; sid:543466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-signs.com"; sid:543467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessloan.com"; sid:543468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19snapback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19snapback.com"; sid:543469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialcaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialcaring.com"; sid:543470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialisolation.com"; sid:543471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soins.com"; sid:543472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southkorea.com"; sid:543473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southkorea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southkorea.net"; sid:543474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19star.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19star.com"; sid:543475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stars.com"; sid:543476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19states.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19states.com"; sid:543477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statz.com"; sid:543478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stayfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stayfit.com"; sid:543479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stockfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stockfootage.com"; sid:543480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strikeforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strikeforce.com"; sid:543481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-students.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-students.com"; sid:543482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19subsidy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19subsidy.com"; sid:543483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suits.com"; sid:543484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sup.com"; sid:543485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superyacht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superyacht.com"; sid:543486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superyachts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superyachts.com"; sid:543487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplieshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplieshub.com"; sid:543488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplydonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplydonation.com"; sid:543489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportpage.com"; sid:543490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survival.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survival.group"; sid:543491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors.net"; sid:543492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorstories.com"; sid:543493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swag.com"; sid:543494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19target.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19target.com"; sid:543495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19target.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19target.com"; sid:543496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tcs.com"; sid:543497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tec.com"; sid:543498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tech.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tech.pro"; sid:543499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teleschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teleschool.com"; sid:543500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teletherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teletherapy.com"; sid:543501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teletherapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teletherapy.net"; sid:543502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19termination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19termination.com"; sid:543503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19terminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19terminator.com"; sid:543504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.expert"; sid:543505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.support"; sid:543506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.technology"; sid:543507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtogo.com"; sid:543508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testuk.com"; sid:543509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thetodayshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thetodayshow.com"; sid:543510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19to.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19to.com"; sid:543511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19todayshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19todayshow.com"; sid:543512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tools.com"; sid:543513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.town - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.town"; sid:543514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trac.com"; sid:543515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19training.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19training.net"; sid:543516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trainings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trainings.com"; sid:543517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transition.com"; sid:543518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traumarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traumarecovery.com"; sid:543519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialattorney.com"; sid:543520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialattorneys.com"; sid:543521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19triallawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19triallawyer.com"; sid:543522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvlive.com"; sid:543523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19twentytwenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19twentytwenty.com"; sid:543524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uae.com"; sid:543525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemployment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemployment.net"; sid:543526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unity.com"; sid:543527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uplift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uplift.com"; sid:543528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usacleaners.com"; sid:543529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ushistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ushistory.com"; sid:543530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19us.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19us.net"; sid:543531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvlight.com"; sid:543532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvlights.com"; sid:543533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccin.net"; sid:543534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacina.com"; sid:543535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ventilator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ventilator.net"; sid:543536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vet.com"; sid:543537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vetdrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vetdrugs.com"; sid:543538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vetvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vetvaccine.com"; sid:543539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victims.com"; sid:543540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19video.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19video.com"; sid:543541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19videos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19videos.com"; sid:543542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19videovisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19videovisit.com"; sid:543543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.life"; sid:543544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusmedicine.com"; sid:543545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussupply.com"; sid:543546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vn.net"; sid:543547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19voip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19voip.com"; sid:543548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellnesshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellnesshub.com"; sid:543549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19work.com"; sid:543550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerlaw.com"; sid:543551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-world.com"; sid:543552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldstatistics.com"; sid:543553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019-2020.com"; sid:543554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2022.com"; sid:543555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20mask.com"; sid:543556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20twenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20twenty.com"; sid:543557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4business.com"; sid:543558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4comedy.com"; sid:543559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-666.com"; sid:543560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid99.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid99.net"; sid:543561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-a.com"; sid:543562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidact.com"; sid:543563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvising.com"; sid:543564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaffects.com"; sid:543565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidahq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidahq.com"; sid:543566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidai.net"; sid:543567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalberta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalberta.com"; sid:543568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamx.com"; sid:543569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcorona.com"; sid:543570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-anxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-anxiety.com"; sid:543571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxiety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxiety.net"; sid:543572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapproved.com"; sid:543573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.download"; sid:543574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.loan"; sid:543575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.men - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.men"; sid:543576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19online.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19online.download"; sid:543577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.party"; sid:543578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.technology"; sid:543579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarizona.com"; sid:543580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidash.com"; sid:543581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistancecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistancecenter.com"; sid:543582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassure.com"; sid:543583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidays.com"; sid:543584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbae.com"; sid:543585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbalkan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbalkan.com"; sid:543586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefits.com"; sid:543587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbg.com"; sid:543588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbill.com"; sid:543589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbilling.com"; sid:543590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioscience.com"; sid:543591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiosciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiosciences.com"; sid:543592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiotech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiotech.com"; sid:543593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbirth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbirth.com"; sid:543594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiz.com"; sid:543595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizrelief.com"; sid:543596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackbox.com"; sid:543597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblood.com"; sid:543598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbot.net"; sid:543599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathing.com"; sid:543600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbucha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbucha.com"; sid:543601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbugout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbugout.com"; sid:543602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessadvisors.com"; sid:543603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessassistance.com"; sid:543604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscenter.com"; sid:543605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesses.com"; sid:543606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessresources.com"; sid:543607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbyair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbyair.com"; sid:543608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbystate.com"; sid:543609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabin.com"; sid:543610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabrini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabrini.com"; sid:543611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidca.com"; sid:543612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcage.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcage.club"; sid:543613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalls.com"; sid:543614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalm.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalm.club"; sid:543615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantabria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantabria.com"; sid:543616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantabria.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantabria.net"; sid:543617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapital.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapital.net"; sid:543618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapixaba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapixaba.com"; sid:543619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecenter.com"; sid:543620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare-dev-carec2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare-dev-carec2.com"; sid:543621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregiverjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregiverjobs.com"; sid:543622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarenyc.com"; sid:543623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashclaims.com"; sid:543624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcast.net"; sid:543625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidccc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidccc.com"; sid:543626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcircle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcircle.com"; sid:543627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimcenter.com"; sid:543628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaims.net"; sid:543629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawyer.com"; sid:543630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclause.com"; sid:543631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanusa.com"; sid:543632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearme.com"; sid:543633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clicker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clicker.com"; sid:543634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicaltrial.com"; sid:543635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoeds.com"; sid:543636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollect.com"; sid:543637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollections.com"; sid:543638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomet.com"; sid:543639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomm.com"; sid:543640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcert.com"; sid:543641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcertificate.com"; sid:543642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcertified.com"; sid:543643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compliant.com"; sid:543644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcert.com"; sid:543645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-connections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-connections.com"; sid:543646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnect.net"; sid:543647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.business"; sid:543648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractlaw.com"; sid:543649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontracts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontracts.com"; sid:543650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounselor.com"; sid:543651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounselors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounselors.com"; sid:543652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowboy.com"; sid:543653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowboys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowboys.com"; sid:543654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcr.com"; sid:543655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrelief.com"; sid:543656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrepair.com"; sid:543657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditservices.com"; sid:543658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscentral.com"; sid:543659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisexperts.com"; sid:543660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuisine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuisine.com"; sid:543661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-czar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-czar.com"; sid:543662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddamages.com"; sid:543663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dashboard.com"; sid:543664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.cloud"; sid:543665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatenight.com"; sid:543666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtagency.com"; sid:543667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtcounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtcounseling.com"; sid:543668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtcounselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtcounselor.com"; sid:543669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtmitigation.com"; sid:543670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtplan.com"; sid:543671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtrecovery.com"; sid:543672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtservices.com"; sid:543673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecals.com"; sid:543674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-decameron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-decameron.com"; sid:543675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesign.com"; sid:543676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesign.net"; sid:543677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesinfeccao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesinfeccao.com"; sid:543678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetox.com"; sid:543679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterloans.com"; sid:543680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterrelief.com"; sid:543681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonations.com"; sid:543682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomy2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomy2020.com"; sid:543683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedmonton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedmonton.com"; sid:543684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenet.com"; sid:543685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideotraumatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideotraumatherapy.com"; sid:543686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepot.com"; sid:543687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesamail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesamail.com"; sid:543688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessential.com"; sid:543689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facemask.com"; sid:543690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfears.com"; sid:543691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfema.com"; sid:543692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfighters.com"; sid:543693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancecenter.com"; sid:543694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialadvisor.com"; sid:543695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialadvisors.com"; sid:543696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialcenter.com"; sid:543697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstresponders.com"; sid:543698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfish.com"; sid:543699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloridainsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloridainsurance.com"; sid:543700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloridainsurance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloridainsurance.net"; sid:543701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fn.com"; sid:543702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforbusiness.com"; sid:543703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforcemajeure.com"; sid:543704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosure.com"; sid:543705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosures.com"; sid:543706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidformula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidformula.com"; sid:543707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeinsurance.com"; sid:543708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeinsurance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeinsurance.net"; sid:543709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenyc.com"; sid:543710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkplace.com"; sid:543711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkworkplace.com"; sid:543712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreezove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreezove.com"; sid:543713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontline.com"; sid:543714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfx.com"; sid:543715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgen.com"; sid:543716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgen.net"; sid:543717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgolf.com"; sid:543718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovbill.com"; sid:543719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovrelief.com"; sid:543720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgps.com"; sid:543721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrid.com"; sid:543722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrid.net"; sid:543723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgroupsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgroupsupport.com"; sid:543724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguards.com"; sid:543725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguidelines.com"; sid:543726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguitars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguitars.com"; sid:543727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgvtloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgvtloan.com"; sid:543728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgvtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgvtrelief.com"; sid:543729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcenter.com"; sid:543730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheart.com"; sid:543731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesafety.com"; sid:543732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomestar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomestar.com"; sid:543733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesteaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesteaders.com"; sid:543734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometester.com"; sid:543735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhosting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhosting.com"; sid:543736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhosting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhosting.net"; sid:543737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhouse.com"; sid:543738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumans.com"; sid:543739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidilator.com"; sid:543740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimaging.com"; sid:543741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immune.com"; sid:543742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia.today"; sid:543743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovation.com"; sid:543744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovations.com"; sid:543745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstanttest.com"; sid:543746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaims.net"; sid:543747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthai.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthai.today"; sid:543748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.club"; sid:543749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.club"; sid:543750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.today"; sid:543751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditate.com"; sid:543752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditation.com"; sid:543753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobbenefits.com"; sid:543754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillah.com"; sid:543755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits.life"; sid:543756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawcenter.com"; sid:543757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalaction.com"; sid:543758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalaid.com"; sid:543759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalservices.com"; sid:543760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlend.com"; sid:543761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlender.com"; sid:543762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlenders.com"; sid:543763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlending.com"; sid:543764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeinsurance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeinsurance.net"; sid:543765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifesaver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifesaver.com"; sid:543766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifesavermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifesavermask.com"; sid:543767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlims.com"; sid:543768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigator.com"; sid:543769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigators.com"; sid:543770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliveconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliveconcert.com"; sid:543771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivetracker.com"; sid:543772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloaninfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloaninfo.com"; sid:543773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanrelief.com"; sid:543774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask24.com"; sid:543775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskbrigade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskbrigade.com"; sid:543776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaske.com"; sid:543777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskup.com"; sid:543778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaszk19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaszk19.com"; sid:543779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalcare.com"; sid:543780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalcenter.com"; sid:543781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsupply.com"; sid:543782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalhealthmgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalhealthmgh.com"; sid:543783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalhealthmgh.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalhealthmgh.net"; sid:543784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalhealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalhealth.net"; sid:543785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmiami.com"; sid:543786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmilitia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmilitia.com"; sid:543787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmingle.com"; sid:543788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigation.com"; sid:543789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodeling.com"; sid:543790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodels.com"; sid:543791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-moi-un-lit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-moi-un-lit.com"; sid:543792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewslive.com"; sid:543793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninetee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninetee.com"; sid:543794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnode.com"; sid:543795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnormality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnormality.com"; sid:543796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoo.com"; sid:543797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorcovfefe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorcovfefe.com"; sid:543798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemie.com"; sid:543799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-party.com"; sid:543800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidp.com"; sid:543801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpics.com"; sid:543802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanner.com"; sid:543803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpl.com"; sid:543804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicyholderlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicyholderlaw.com"; sid:543805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoll.com"; sid:543806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecision.com"; sid:543807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprediction.com"; sid:543808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpredictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpredictions.com"; sid:543809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprintedmaterials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprintedmaterials.com"; sid:543810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprinting.com"; sid:543811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprograms.com"; sid:543812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproleisuretour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproleisuretour.com"; sid:543813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromise.com"; sid:543814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpropietario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpropietario.com"; sid:543815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotection.net"; sid:543816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionnow.com"; sid:543817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectmenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectmenow.com"; sid:543818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protector.com"; sid:543819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pulse.com"; sid:543820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradio.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradio.club"; sid:543821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rapid.com"; sid:543822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidr.com"; sid:543823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryhouse.com"; sid:543824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecruiter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecruiter.com"; sid:543825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefflorida.com"; sid:543826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffunds.com"; sid:543827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefpackage.com"; sid:543828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrep.com"; sid:543829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreports.net"; sid:543830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchfund.com"; sid:543831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresolutions.com"; sid:543832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsebill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsebill.com"; sid:543833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreview.com"; sid:543834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrgv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrgv.com"; sid:543835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidribbon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidribbon.com"; sid:543836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ro.com"; sid:543837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrotrading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrotrading.com"; sid:543838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpg.com"; sid:543839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidruptcy.com"; sid:543840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrxmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrxmedical.com"; sid:543841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.club"; sid:543842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysupply.com"; sid:543843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscams.com"; sid:543844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-scan.com"; sid:543845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscholar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscholar.com"; sid:543846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscientific.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscientific.com"; sid:543847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.world"; sid:543848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-security.com"; sid:543849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseer.com"; sid:543850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseguro.com"; sid:543851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseguro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseguro.net"; sid:543852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfie.com"; sid:543853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservicecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservicecenter.com"; sid:543854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservice.com"; sid:543855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseverancepay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseverancepay.com"; sid:543856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsew.com"; sid:543857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshame.com"; sid:543858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshame.net"; sid:543859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignage.com"; sid:543860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartphonetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartphonetest.com"; sid:543861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnapback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnapback.com"; sid:543862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecialist.com"; sid:543863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecialists.com"; sid:543864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspiracy.com"; sid:543865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspiracy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspiracy.net"; sid:543866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaterelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaterelief.com"; sid:543867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stats.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stats.today"; sid:543868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuit.com"; sid:543869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportcenter.com"; sid:543870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswag.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswag.net"; sid:543871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomsurvey.com"; sid:543872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtakip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtakip.com"; sid:543873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtarget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtarget.com"; sid:543874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxrelief.com"; sid:543875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechhub.com"; sid:543876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechmomentum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechmomentum.com"; sid:543877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechnologies.com"; sid:543878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechnology.com"; sid:543879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtele.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtele.com"; sid:543880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteletherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteletherapies.com"; sid:543881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtele-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtele-therapy.com"; sid:543882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest2020.com"; sid:543883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.biz"; sid:543884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcenters.com"; sid:543885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdetroit.com"; sid:543886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.expert"; sid:543887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlabs.com"; sid:543888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtf.com"; sid:543889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapeutics.com"; sid:543890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapeutix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapeutix.com"; sid:543891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tipjars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tipjars.com"; sid:543892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracing.com"; sid:543893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrain.com"; sid:543894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraining.com"; sid:543895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrauma.com"; sid:543896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraumatherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraumatherapies.com"; sid:543897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrauma-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrauma-therapy.com"; sid:543898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrax.net"; sid:543899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreat.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreat.club"; sid:543900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatment.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatment.club"; sid:543901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrust.com"; sid:543902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtutors.com"; sid:543903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ua.com"; sid:543904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidumb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidumb.com"; sid:543905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidumb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidumb.net"; sid:543906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidup.com"; sid:543907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusamasks.com"; sid:543908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusaproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusaproject.com"; sid:543909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusa-realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusa-realtime.com"; sid:543910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccination.com"; sid:543911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvallecas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvallecas.com"; sid:543912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vax.com"; sid:543913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvillains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvillains.com"; sid:543914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviralsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviralsolutions.com"; sid:543915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdefensepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdefensepack.com"; sid:543916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslearnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslearnings.com"; sid:543917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslessons.com"; sid:543918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprecautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprecautions.com"; sid:543919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustestkits.com"; sid:543920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvitamin.com"; sid:543921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoiceportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoiceportal.com"; sid:543922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvshumans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvshumans.com"; sid:543923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-water.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-water.com"; sid:543924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwc.com"; sid:543925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xixnewsandreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xixnewsandreviews.com"; sid:543926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xixnewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xixnewsupdates.com"; sid:543927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xixupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xixupdates.com"; sid:543928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixupdates.com"; sid:543929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyok.com"; sid:543930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackingcorona.com"; sid:543931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovid.com"; sid:543932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creationamidstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creationamidstcorona.com"; sid:543933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativeinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativeinthetimeofcoronavirus.com"; sid:543934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativeinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativeinthetimeofcovid.com"; sid:543935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativitypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativitypandemic.com"; sid:543936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crookedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crookedcovid.com"; sid:543937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid.net"; sid:543938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushedcovid.com"; sid:543939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturecovid.com"; sid:543940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cura-coronavirus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cura-coronavirus-covid-19.com"; sid:543941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbsidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbsidecovid.com"; sid:543942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid-1921.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid-1921.com"; sid:543943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforthecoronavirus.com"; sid:543944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datavscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datavscorona.com"; sid:543945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingaftercorona.com"; sid:543946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingwithcovid.com"; sid:543947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deafukcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deafukcoronavirus.com"; sid:543948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovid19.net"; sid:543949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovid.com"; sid:543950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid19.com"; sid:543951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decompresscovid19stress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decompresscovid19stress.com"; sid:543952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminatecoronavirus.com"; sid:543953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminationcoronavirus.com"; sid:543954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminationcovid-19.com"; sid:543955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovid-19.com"; sid:543956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcoronaviruscleaning.com"; sid:543957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcovid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcovid-19cleaning.com"; sid:543958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dein-corona-anwalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dein-corona-anwalt.com"; sid:543959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dekalbcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dekalbcovid-19.com"; sid:543960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dekalbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dekalbcovid19.com"; sid:543961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deletecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deletecovid.com"; sid:543962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliverooridinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliverooridinginapandemic.com"; sid:543963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandacovid19.com"; sid:543964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandascovid19.com"; sid:543965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denunciascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denunciascoronavirus.com"; sid:543966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denunciascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denunciascovid19.com"; sid:543967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for design2fightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"design2fightcovid19.com"; sid:543968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccaocovid.com"; sid:543969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detoxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detoxcorona.com"; sid:543970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetes-coronavirus-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetes-coronavirus-registry.com"; sid:543971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronatests.com"; sid:543972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorcovid-19.com"; sid:543973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpandemic.com"; sid:543974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dopo-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dopo-corona-virus.com"; sid:543975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcoronavirustesting.com"; sid:543976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugofcoronavirus.com"; sid:543977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ealingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ealingcovid19.com"; sid:543978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easyprotocolwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easyprotocolwuhan.com"; sid:543979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economicsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economicsofcovid.com"; sid:543980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effcorona.com"; sid:543981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effcovid-19.com"; sid:543982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for egcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"egcorona.com"; sid:543983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for el-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"el-corona.com"; sid:543984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronaearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronaearth.com"; sid:543985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronausa.com"; sid:543986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronaus.com"; sid:543987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcorona.world"; sid:543988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronaworld.com"; sid:543989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entrecovid.com"; sid:543990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic20.com"; sid:543991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.mobi"; sid:543992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.network"; sid:543993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicomics.com"; sid:543994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-prevention.com"; sid:543995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eshop-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eshop-covid19.com"; sid:543996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialbusinesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialbusinesscovid19.com"; sid:543997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopiacovidtracker-testingdashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopiacovidtracker-testingdashboard.com"; sid:543998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evapharma-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evapharma-covid19.com"; sid:543999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everyonevscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everyonevscovid.com"; sid:544000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingaboutcorona.com"; sid:544001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresstestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresstestcorona.com"; sid:544002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskforcovid19.com"; sid:544003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faqscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faqscoronavirus.com"; sid:544004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faq-you-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faq-you-corona.com"; sid:544005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttrackcovid.com"; sid:544006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-ckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-ckcovid19.com"; sid:544007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-covid-19.com"; sid:544008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-covid19.com"; sid:544009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcorona.net"; sid:544010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaclub.com"; sid:544011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid-19.net"; sid:544012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.club"; sid:544013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightnovelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightnovelcorona.com"; sid:544014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidtestin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidtestin.com"; sid:544015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findthecovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findthecovidcure.com"; sid:544016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flappy-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flappy-corona.com"; sid:544017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronacare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronacare.net"; sid:544018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19lawyers.com"; sid:544019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-sbaloans-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-sbaloans-corona.com"; sid:544020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortlauderdalecovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortlauderdalecovid19attorney.com"; sid:544021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortlauderdalecovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortlauderdalecovid19attorneys.com"; sid:544022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxnewspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxnewspandemic.com"; sid:544023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxpandemic.com"; sid:544024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronatestkit.com"; sid:544025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtestkit.com"; sid:544026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontlinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontlinecovid.com"; sid:544027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generacioncovid19.com"; sid:544028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationaftercoronavirus.com"; sid:544029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationaftercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationaftercoronavirus.net"; sid:544030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geocoronavirus.com"; sid:544031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19certified.com"; sid:544032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19compliant.com"; sid:544033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19compliant.com"; sid:544034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19compliantonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19compliantonline.com"; sid:544035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19compliantonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19compliantonline.com"; sid:544036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19compliantonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19compliantonline.net"; sid:544037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19compliantonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19compliantonline.net"; sid:544038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidcompliant.com"; sid:544039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidhelp.com"; sid:544040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronanews.com"; sid:544041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronasurvey.com"; sid:544042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirussurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirussurvey.com"; sid:544043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19pandemic.com"; sid:544044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicviral.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicviral.solutions"; sid:544045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicviralsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicviralsolutions.com"; sid:544046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalviralpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalviralpandemicsolutions.com"; sid:544047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewscoronavirus.net"; sid:544048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graphscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graphscoronavirus.com"; sid:544049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencovid-19.com"; sid:544050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencovid.com"; sid:544051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guidetosurvivingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guidetosurvivingcoronavirus.com"; sid:544052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guyanacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guyanacorona.com"; sid:544053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid19.com"; sid:544054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid19.net"; sid:544055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid.com"; sid:544056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid.net"; sid:544057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haiticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haiticovid19.com"; sid:544058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcovid-19.com"; sid:544059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happy-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happy-against-corona.com"; sid:544060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyagainstcorona.com"; sid:544061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hapuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hapuscovid.com"; sid:544062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harpethcleaningdisinfectionpreventioncoronavirursnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harpethcleaningdisinfectionpreventioncoronavirursnashville.com"; sid:544063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hatecovid19.com"; sid:544064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hatecovid.com"; sid:544065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovid19.net"; sid:544066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heartofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heartofcorona.com"; sid:544067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heartsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heartsofcorona.com"; sid:544068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help4corona.com"; sid:544069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpbeatcorona.com"; sid:544070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovida.com"; sid:544071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid.com"; sid:544072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecovid.com"; sid:544073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpendcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpendcorona.com"; sid:544074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcovidnineteen.com"; sid:544075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingduringcorona.com"; sid:544076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hilfecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hilfecorona.com"; sid:544077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovid-19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovid-19compliant.com"; sid:544078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovid19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovid19compliant.com"; sid:544079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovid-19compliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovid-19compliant.net"; sid:544080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovid19compliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovid19compliant.net"; sid:544081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovidcompliant.com"; sid:544082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hippacovidcompliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hippacovidcompliant.net"; sid:544083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holycovidcation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holycovidcation.com"; sid:544084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecarecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecarecorona.com"; sid:544085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecorona.com"; sid:544086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitcorona.com"; sid:544087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homepandemic.com"; sid:544088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeschoolingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeschoolingpandemic.com"; sid:544089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcorona.com"; sid:544090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopcovid.com"; sid:544091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopewithcorona.com"; sid:544092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidtesting.com"; sid:544093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how-corona.com"; sid:544094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobecoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobecoronavirusfree.com"; sid:544095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtofileforcoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtofileforcoronavirusbankruptcy.com"; sid:544096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtohealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtohealcoronavirus.com"; sid:544097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtohealcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtohealcoronavirus.net"; sid:544098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurviveapandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurviveapandemicbook.com"; sid:544099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanity-against-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanity-against-coronavirus.com"; sid:544100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntcorona.com"; sid:544101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iccovid19.com"; sid:544102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid19.care"; sid:544103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idefeatedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idefeatedcoronavirus.com"; sid:544104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idefeatedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idefeatedcovid19.com"; sid:544105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-juanacovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-juanacovid19update.com"; sid:544106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid-19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid-19law.com"; sid:544107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycovid19.com"; sid:544108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactcorona.com"; sid:544109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactocovid19.com"; sid:544110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscorona.net"; sid:544111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronaviruskit.com"; sid:544112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instanttestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instanttestcorona.com"; sid:544113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instanttestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instanttestcovid.com"; sid:544114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceforpandemics.com"; sid:544115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofpandemic.com"; sid:544116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irvinecompanycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irvinecompanycovid19.com"; sid:544117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19over.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19over.com"; sid:544118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isolatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isolatecorona.com"; sid:544119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for issolatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"issolatecorona.com"; sid:544120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived2020pandemic.com"; sid:544121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirusoutbreak.com"; sid:544122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19nyc.com"; sid:544123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19nyc.com"; sid:544124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid-19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid-19quarantine.com"; sid:544125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isuvivedcoronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isuvivedcoronaoutbreak.com"; sid:544126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaapgoudsmitaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaapgoudsmitaboutcorona.com"; sid:544127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaapgoudsmitaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaapgoudsmitaboutcoronavirus.com"; sid:544128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksonvillecovidmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksonvillecovidmatch.com"; sid:544129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsgegencorona.com"; sid:544130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsgegencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsgegencorona.net"; sid:544131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jointhefightagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jointhefightagainstcovid-19.com"; sid:544132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for js-wuhangshipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"js-wuhangshipping.com"; sid:544133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juiciocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juiciocoronavirus.com"; sid:544134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karunafightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karunafightscorona.com"; sid:544135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karunafightscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karunafightscorona.net"; sid:544136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmandcorona.com"; sid:544137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronablues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronablues.com"; sid:544138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid19blues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid19blues.com"; sid:544139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovidblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovidblues.com"; sid:544140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsfightcovid19.com"; sid:544141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killallababyboomerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killallababyboomerscovid19.com"; sid:544142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercoronavirus.world"; sid:544143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercorona.world"; sid:544144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecovid-19.com"; sid:544145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecovid19.com"; sid:544146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitscovid.com"; sid:544147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kocorona.com"; sid:544148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laiwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laiwuhan.com"; sid:544149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovid19attorneys.com"; sid:544150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovid19lawyers.com"; sid:544151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancorona.com"; sid:544152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancovid19.com"; sid:544153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcovid-19.com"; sid:544154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcoronacare.com"; sid:544155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesscorona.com"; sid:544156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsendcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsendcovid.com"; sid:544157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcorona.net"; sid:544158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsstopcovid19.com"; sid:544159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lh-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lh-covid19.com"; sid:544160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liceoecologicovida2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liceoecologicovida2020.com"; sid:544161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterthepandemic.com"; sid:544162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringcorona.com"; sid:544163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringcovid.com"; sid:544164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcovid19.life"; sid:544165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimesofcovid19.com"; sid:544166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lightintheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lightintheageofcovid.com"; sid:544167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronastats.com"; sid:544168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthroughcorona.com"; sid:544169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthroughcoronavirus.com"; sid:544170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lluhpicucovid19hub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lluhpicucovid19hub.net"; sid:544171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronaviruslawyer.com"; sid:544172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logmycorona.com"; sid:544173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescoronaclaims.com"; sid:544174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveandcorona.com"; sid:544175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthecorona.com"; sid:544176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.film"; sid:544177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid-19.net"; sid:544178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid-19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid-19podcast.com"; sid:544179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimesofcoronavirus.com"; sid:544180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovesexcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovesexcorona.com"; sid:544181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lustinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lustinthetimeofcovid19.com"; sid:544182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luvinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luvinthetimeofcorona.com"; sid:544183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascoronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascoronavirus.pro"; sid:544184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mangetoocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mangetoocovid.com"; sid:544185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mankindvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mankindvscovid19.com"; sid:544186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovid19.com"; sid:544187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandccprojectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandccprojectcovid19.com"; sid:544188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovid-19.com"; sid:544189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasparacovid.com"; sid:544190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-covid.com"; sid:544191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-ffp2-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-ffp2-covid19.com"; sid:544192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcovid.com"; sid:544193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-covid-19.com"; sid:544194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medsforcorona.com"; sid:544195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meincoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meincoronatest.com"; sid:544196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcoronavirus.com"; sid:544197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcoronavirus.net"; sid:544198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcovid19.com"; sid:544199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcovid19.net"; sid:544200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicovid-19.com"; sid:544201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mgcovid19.com"; sid:544202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microcovid19.com"; sid:544203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for millionvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"millionvscorona.com"; sid:544204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miltoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miltoncovid19.com"; sid:544205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mividadurantelapandemicadelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mividadurantelapandemicadelcovid-19.com"; sid:544206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitorcovid19.com"; sid:544207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muda-corona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muda-corona.care"; sid:544208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mumbaicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mumbaicovid19.com"; sid:544209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musingsonlifeinacoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musingsonlifeinacoronaworld.com"; sid:544210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-app.com"; sid:544211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacartoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacartoon.com"; sid:544212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaexperiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaexperiences.com"; sid:544213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaguide.com"; sid:544214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahaircut.com"; sid:544215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronameds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronameds.com"; sid:544216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronanews.com"; sid:544217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaquarantinediary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaquarantinediary.com"; sid:544218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaquarantinejournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaquarantinejournal.com"; sid:544219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatestkit.com"; sid:544220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatests.com"; sid:544221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusdiaries.com"; sid:544222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusguide.com"; sid:544223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruskits.com"; sid:544224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusswab.com"; sid:544225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronawork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronawork.com"; sid:544226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covid19experience.com"; sid:544227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19experience.com"; sid:544228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covid19experiences.com"; sid:544229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19experiences.com"; sid:544230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19journal.com"; sid:544231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcare.com"; sid:544232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcure.com"; sid:544233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-experience.com"; sid:544234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidexperience.com"; sid:544235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidexperiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidexperiences.com"; sid:544236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidjourney.com"; sid:544237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmeds.com"; sid:544238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicpantry.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicpantry.biz"; sid:544239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicsurvivalplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicsurvivalplan.com"; sid:544240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysmartcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysmartcovid19test.com"; sid:544241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestcovid19.com"; sid:544242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronamaskusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronamaskusa.com"; sid:544243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95forcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95forcovid19.com"; sid:544244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecoronaviruscommercialcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecoronaviruscommercialcleaningservices.com"; sid:544245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19disinfectionpreventionharpethcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19disinfectionpreventionharpethcleaningservices.com"; sid:544246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19disinfectpreventcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19disinfectpreventcleaningservices.com"; sid:544247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillejanitorialservicescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillejanitorialservicescoronavirus.com"; sid:544248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronacare.com"; sid:544249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19cure.com"; sid:544250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19treatment.com"; sid:544251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflixcovid19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflixcovid19s.com"; sid:544252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacovid19lawyers.com"; sid:544253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-covid-19.com"; sid:544254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newworldaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newworldaftercorona.com"; sid:544255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19attorneys.com"; sid:544256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid-19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid-19law.com"; sid:544257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19lawfirm.com"; sid:544258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19lawyers.com"; sid:544259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2covid.com"; sid:544260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noblecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noblecoronavirus.com"; sid:544261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nococovidanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nococovidanxiety.com"; sid:544262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronashop.com"; sid:544263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona-virus.com"; sid:544264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronazone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronazone.com"; sid:544265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid-19.net"; sid:544266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19.net"; sid:544267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19shop.com"; sid:544268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecorona.net"; sid:544269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusfight.com"; sid:544270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirussupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirussupply.com"; sid:544271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowtestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowtestcorona.com"; sid:544272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntscoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntscoronatest.com"; sid:544273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nurseforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nurseforcoronavirus.com"; sid:544274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nurseforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nurseforcovid19.com"; sid:544275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesforcoronavirus.com"; sid:544276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesforcovid-19.com"; sid:544277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesforcovid19.com"; sid:544278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid-19.com"; sid:544279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidrelief.com"; sid:544280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirustestkit.com"; sid:544281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19testkit.com"; sid:544282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19tracker.com"; sid:544283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronatests.com"; sid:544284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovidcounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovidcounseling.com"; sid:544285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlygoodcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlygoodcoronavirusnews.com"; sid:544286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openpandemic.com"; sid:544287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcevscorona.com"; sid:544288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oslercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oslercovid19.com"; sid:544289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19experience.com"; sid:544290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for our-covid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"our-covid19experiences.com"; sid:544291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19experiences.com"; sid:544292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid.com"; sid:544293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlifeaftercovid.com"; sid:544294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourpostcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourpostcoronaworld.com"; sid:544295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourworldaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourworldaftercovid.com"; sid:544296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ousortir-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ousortir-covid19.com"; sid:544297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outbreakofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outbreakofcovid-19.com"; sid:544298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overstockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overstockcovid19.com"; sid:544299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakfightscorona.com"; sid:544300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020stories.com"; sid:544301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic20.net"; sid:544302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactiongroup.com"; sid:544303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicafe.com"; sid:544304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemication.com"; sid:544305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbounceback.com"; sid:544306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbrunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbrunch.com"; sid:544307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuster.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuster.club"; sid:544308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuster.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuster.life"; sid:544309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuster.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuster.world"; sid:544310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccafe.com"; sid:544311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccamping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccamping.com"; sid:544312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccampout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccampout.com"; sid:544313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccampout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccampout.net"; sid:544314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclaim.com"; sid:544315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclaims.com"; sid:544316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclassaction.com"; sid:544317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccleaners.com"; sid:544318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclinic.com"; sid:544319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccontinuity.com"; sid:544320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiy.com"; sid:544321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-economics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-economics.com"; sid:544322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicempire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicempire.com"; sid:544323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfallout.com"; sid:544324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-fashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-fashion.com"; sid:544325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforecasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforecasts.com"; sid:544326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.graphics"; sid:544327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichandsanitizer.com"; sid:544328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichef.com"; sid:544329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichotline.com"; sid:544330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinfo.net"; sid:544331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinfo.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinfo.today"; sid:544332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestmentbenefitsharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestmentbenefitsharing.com"; sid:544333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjam.com"; sid:544334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawsuit.com"; sid:544335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmitigation.com"; sid:544336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmonitoring.com"; sid:544337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofcovid19.com"; sid:544338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicomedy.com"; sid:544339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicomics.com"; sid:544340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicooking.com"; sid:544341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpantry2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpantry2020.com"; sid:544342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparadigm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparadigm.com"; sid:544343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-parenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-parenting.com"; sid:544344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivot.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivot.biz"; sid:544345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaydate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaydate.com"; sid:544346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpong.com"; sid:544347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpowerpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpowerpack.com"; sid:544348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreacher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreacher.com"; sid:544349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprediction.com"; sid:544350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpredictionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpredictionnetwork.com"; sid:544351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproblem.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproblem.bid"; sid:544352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrats.com"; sid:544353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-ready-industries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-ready-industries.com"; sid:544354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadyindustries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadyindustries.com"; sid:544355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrebound.com"; sid:544356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsenow.com"; sid:544357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrevealed.com"; sid:544358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicseer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicseer.com"; sid:544359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsettlement.com"; sid:544360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshitlist.com"; sid:544361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.life"; sid:544362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstimulus.com"; sid:544363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategy.com"; sid:544364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteam.com"; sid:544365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictunes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictunes.com"; sid:544366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicunity.com"; sid:544367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvinyl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvinyl.com"; sid:544368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwork.com"; sid:544369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworship.com"; sid:544370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paperpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paperpandemic.com"; sid:544371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pastcovid.com"; sid:544372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcr-covid19.com"; sid:544373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcrcovid19.com"; sid:544374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofcovid19.com"; sid:544375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplevspandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplevspandemics.com"; sid:544376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcarecovid19.com"; sid:544377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcarecovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcarecovid19support.com"; sid:544378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcovid19test.com"; sid:544379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pledgeagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pledgeagainstcorona.com"; sid:544380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pointofcarecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pointofcarecoronatest.com"; sid:544381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pointofcarecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pointofcarecoronavirustest.com"; sid:544382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pointofcarecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pointofcarecovid19test.com"; sid:544383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pointofcaretestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pointofcaretestcoronavirus.com"; sid:544384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pointofcaretestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pointofcaretestcovid19.com"; sid:544385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona.net"; sid:544386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona-virus.com"; sid:544387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-coronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-coronaworld.com"; sid:544388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19world.com"; sid:544389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.life"; sid:544390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnewworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnewworld.com"; sid:544391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicworld.com"; sid:544392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pray4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pray4covid19.com"; sid:544393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predcovid19.com"; sid:544394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predictcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predictcovid19.com"; sid:544395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19bostonstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19bostonstudy.com"; sid:544396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for primacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"primacovid19.com"; sid:544397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecoronavirustest.com"; sid:544398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectscorona.com"; sid:544399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncoronavirus.net"; sid:544400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecovid.com"; sid:544401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectagainstcovid.com"; sid:544402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologacoronavirus.com"; sid:544403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologicoronavirus.com"; sid:544404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantainecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantainecovid19.com"; sid:544405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantine2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantine2020covid19.com"; sid:544406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinechroniclescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinechroniclescovid19.com"; sid:544407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecorona2020.com"; sid:544408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecoronavirus2020.com"; sid:544409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quebeccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quebeccoronavirus.com"; sid:544410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustesting.com"; sid:544411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustestkit.com"; sid:544412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustestkits.com"; sid:544413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustests.com"; sid:544414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidkit.com"; sid:544415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidkits.com"; sid:544416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestforcorona.com"; sid:544417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestforcovid19.com"; sid:544418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronaviruscure.com"; sid:544419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestateandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestateandcovid19.com"; sid:544420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realhousewivescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realhousewivescoronavirus.com"; sid:544421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatung-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatung-corona.net"; sid:544422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatung-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatung-covid19.net"; sid:544423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recover4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recover4corona.com"; sid:544424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recover4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recover4covid.com"; sid:544425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverycorona.com"; sid:544426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redcovid19mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redcovid19mx.com"; sid:544427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redcovid19mx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redcovid19mx.net"; sid:544428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renoproscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renoproscovid19.com"; sid:544429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourceguideforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourceguideforcoronavirus.com"; sid:544430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourcesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourcesforcovid19.com"; sid:544431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourcesforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourcesforthecoronavirus.com"; sid:544432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rgvcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rgvcorona.com"; sid:544433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rgvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rgvcovid.com"; sid:544434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rid-covid.com"; sid:544435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtcovid19.com"; sid:544436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtcovidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtcovidstatus.com"; sid:544437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronagloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronagloves.com"; sid:544438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safepandemic.com"; sid:544439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetestingcovid19.com"; sid:544440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycovid-19.com"; sid:544441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocoronaclaims.com"; sid:544442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionelocalicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionelocalicoronavirus.com"; sid:544443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-cov-2-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-cov-2-covid-19.com"; sid:544444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19.net"; sid:544445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloanconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloanconsulting.com"; sid:544446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid.com"; sid:544447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidrelief.com"; sid:544448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scancorona.com"; sid:544449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schaedlingsbekaempfung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schaedlingsbekaempfung-corona.com"; sid:544450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sciencecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sciencecovid19.com"; sid:544451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestingcovid19.com"; sid:544452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestkitcovid19.com"; sid:544453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serodxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serodxcovid.com"; sid:544454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicecorona.com"; sid:544455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcoronavirusrelief.com"; sid:544456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shcovid19.com"; sid:544457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoalscovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoalscovid19law.com"; sid:544458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicoronaviruschronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicoronaviruschronicles.com"; sid:544459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for situationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"situationcorona.com"; sid:544460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcovid19test.com"; sid:544461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smellcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smellcorona.com"; sid:544462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobreviviente-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobreviviente-coronavirus.com"; sid:544463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivientecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivientecoronavirus.com"; sid:544464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivircorona.com"; sid:544465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialcoronacharity.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialcoronacharity.cloud"; sid:544466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialcoronacharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialcoronacharity.com"; sid:544467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for societyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"societyaftercovid19.com"; sid:544468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sofortzuschuss-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sofortzuschuss-corona.com"; sid:544469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sofortzuschuss-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sofortzuschuss-corona.net"; sid:544470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soldiersofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soldiersofcovid-19.com"; sid:544471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidaridadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidaridadcoronavirus.com"; sid:544472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for srqcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"srqcovid.com"; sid:544473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingcorona.com"; sid:544474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingforcovid19.com"; sid:544475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingresponceforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingresponceforcovid19.com"; sid:544476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standagainstcovid-19.com"; sid:544477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standagainstcovid19.com"; sid:544478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standagainstcovid.com"; sid:544479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statsofcorona.com"; sid:544480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staustellcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staustellcovidsupport.com"; sid:544481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovid19free.com"; sid:544482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staythrough-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staythrough-covid19.com"; sid:544483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizingcovid19.com"; sid:544484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaearth.com"; sid:544485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafestival.com"; sid:544486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus-19.com"; sid:544487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusfestival.com"; sid:544488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus-today.com"; sid:544489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19now.com"; sid:544490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid2019.com"; sid:544491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidtoday.com"; sid:544492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopviruscorona.com"; sid:544493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesfromapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesfromapandemic.com"; sid:544494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strongerthancoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strongerthancoronavirus.net"; sid:544495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentdebtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentdebtcovid.com"; sid:544496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for succeedingagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"succeedingagainstcorona.com"; sid:544497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliescorona.com"; sid:544498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliescovid.com"; sid:544499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving-corona-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving-corona-crisis.com"; sid:544500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesfromthepandemic.com"; sid:544501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesofthepandemic.com"; sid:544502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkaboutcoronavirus.com"; sid:544503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkcovid.com"; sid:544504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamingcorona.com"; sid:544505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetccoronavirus.com"; sid:544506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcorona.com"; sid:544507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for target-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"target-covid19.com"; sid:544508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid-19.com"; sid:544509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid19.com"; sid:544510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for target-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"target-covid.com"; sid:544511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid.com"; sid:544512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachingcorona.com"; sid:544513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachingcoronavirus.com"; sid:544514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid-19.com"; sid:544515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tengocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tengocoronavirus.net"; sid:544516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirus.center"; sid:544517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaviruses.com"; sid:544518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid19-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid19-uk.com"; sid:544519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcoronavirus.today"; sid:544520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitscovid.com"; sid:544521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnowcovid19.com"; sid:544522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirusdisinfection.com"; sid:544523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19disinfection.com"; sid:544524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020coronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020coronaviruspandemic.com"; sid:544525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theclassofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theclassofcovid19.com"; sid:544526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecleancorona.com"; sid:544527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachorus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachorus.com"; sid:544528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacloset.com"; sid:544529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacover.com"; sid:544530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadays.com"; sid:544531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiariesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiariesonline.com"; sid:544532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafight.com"; sid:544533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalogues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalogues.com"; sid:544534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaman.com"; sid:544535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-news.com"; sid:544536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaoutbreak.com"; sid:544537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaplan.com"; sid:544538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronascanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronascanner.com"; sid:544539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronascloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronascloset.com"; sid:544540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasyndrome.com"; sid:544541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusanxiety.com"; sid:544542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussummit.com"; sid:544543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawall.com"; sid:544544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19apparel.com"; sid:544545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19busters.com"; sid:544546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19cleaner.com"; sid:544547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19kit.com"; sid:544548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pandemicof2020.com"; sid:544549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19store.com"; sid:544550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19summit.com"; sid:544551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19support.com"; sid:544552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcoop.com"; sid:544553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcrash.com"; sid:544554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddiaries.net"; sid:544555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresponseteam.com"; sid:544556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecreativitypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecreativitypandemic.com"; sid:544557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theendofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theendofcoronavirus.com"; sid:544558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicblog.com"; sid:544559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicof2020.com"; sid:544560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicparent.com"; sid:544561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpress.com"; sid:544562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldsurvivedcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldsurvivedcoronavirus2020.com"; sid:544563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thoushaltnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thoushaltnotcovid.com"; sid:544564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivingcoronavirus.com"; sid:544565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivingcovid19.com"; sid:544566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeout-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeout-covid19.com"; sid:544567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tmcovid.com"; sid:544568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpaperepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpaperepidemic.com"; sid:544569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalcovid.com"; sid:544570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcorona19.com"; sid:544571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for track-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"track-corona.com"; sid:544572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidtn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidtn.com"; sid:544573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trcorona.com"; sid:544574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatingcovid-19.com"; sid:544575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trendcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trendcorona.com"; sid:544576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpandemic2020.com"; sid:544577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovidrelief.com"; sid:544578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkiyecoronahaberleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkiyecoronahaberleri.com"; sid:544579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucpandemicsupports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucpandemicsupports.com"; sid:544580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukraine-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukraine-corona.com"; sid:544581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united-vs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united-vs-covid19.com"; sid:544582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedvscovid19.com"; sid:544583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universalcorona.com"; sid:544584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmerhilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmerhilfe-corona.com"; sid:544585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upliftingstoriescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upliftingstoriescoronavirus.com"; sid:544586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upliftingstoriescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upliftingstoriescovid19.com"; sid:544587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urbancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urbancorona.com"; sid:544588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaaftercovid19.com"; sid:544589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronatesting.com"; sid:544590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaforcoronavirus.com"; sid:544591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usavscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usavscovid-19.com"; sid:544592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usavscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usavscovid19.com"; sid:544593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usavscovid.com"; sid:544594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronatest.com"; sid:544595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcoronalaw.com"; sid:544596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovidcleaners.com"; sid:544597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovid-19.com"; sid:544598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillcovid19.com"; sid:544599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcoronahappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcoronahappyhour.com"; sid:544600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vergognacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vergognacovid.com"; sid:544601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vetterpharmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vetterpharmacovid19.com"; sid:544602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vicorona.com"; sid:544603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vicorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vicorona.net"; sid:544604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimascovid19.com"; sid:544605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralglobalpandemic.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralglobalpandemic.solutions"; sid:544606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralglobalpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralglobalpandemicsolutions.com"; sid:544607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralpandemicsolutions.com"; sid:544608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronahappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronahappyhour.com"; sid:544609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronaworkfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronaworkfromhome.com"; sid:544610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivadiagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivadiagcovid19.com"; sid:544611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivadiagcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivadiagcovid.com"; sid:544612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volontairescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volontairescovid.com"; sid:544613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtondccovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtondccovid19attorneys.com"; sid:544614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtondccovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtondccovid19lawyers.com"; sid:544615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovid.com"; sid:544616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid-19.life"; sid:544617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovidapps-19.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovidapps-19.download"; sid:544618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wedefeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wedefeatcorona.com"; sid:544619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wedisinfectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wedisinfectcovid19.com"; sid:544620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehatecovid19.com"; sid:544621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid-19.com"; sid:544622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wetindeycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wetindeycovid.com"; sid:544623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wevscoronahackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wevscoronahackathon.com"; sid:544624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecorona.com"; sid:544625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wfecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wfecovid19.com"; sid:544626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcoronavirusdoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcoronavirusdoes.com"; sid:544627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcovid-19does.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcovid-19does.com"; sid:544628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcovid19does.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcovid19does.com"; sid:544629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencoronaviruswillend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencoronaviruswillend.com"; sid:544630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whenwillcoronavirusend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whenwillcoronavirusend.com"; sid:544631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whipcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whipcoronavirus.com"; sid:544632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecoronakit.com"; sid:544633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusinfo.com"; sid:544634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusupdates.com"; sid:544635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidparty.com"; sid:544636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldfightscovid19.com"; sid:544637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worthingtoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worthingtoncovid.com"; sid:544638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrongaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrongaboutcovid19.com"; sid:544639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcorona2020.com"; sid:544640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanapocalypse.com"; sid:544641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbateaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbateaters.com"; sid:544642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbegone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbegone.com"; sid:544643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchoochoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchoochoo.com"; sid:544644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangirls.com"; sid:544645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpoker.com"; sid:544646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrestaurant.com"; sid:544647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruslaw.com"; sid:544648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwtargetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwtargetcovid19.com"; sid:544649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtargetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtargetcovid19.com"; sid:544650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wxcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wxcorona.club"; sid:544651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-frdermittel-k3b.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-frdermittel-k3b.net"; sid:544652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yamanaka-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yamanaka-covid19.com"; sid:544653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronacentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronacentral.com"; sid:544654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaviruscentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaviruscentral.com"; sid:544655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusexperience.com"; sid:544656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19central.com"; sid:544657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19experience.com"; sid:544658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19experiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19experiences.com"; sid:544659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-experience.com"; sid:544660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidexperience.com"; sid:544661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidexperiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidexperiences.com"; sid:544662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yovenciacovid-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yovenciacovid-19.cat"; sid:544663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincoronatestkit.com"; sid:544664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincoronatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincoronatestkits.com"; sid:544665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovid19test.com"; sid:544666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidtestkit.com"; sid:544667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mintestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mintestcoronavirus.com"; sid:544668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covid19.com"; sid:544669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronababy.com"; sid:544670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusoutbreak.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusoutbreak.cloud"; sid:544671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid2019.com"; sid:544672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020greencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020greencorona.com"; sid:544673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicrecovery.com"; sid:544674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20pandemic.com"; sid:544675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4coronatest.com"; sid:544676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 86covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"86covid.com"; sid:544677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcovidsupport.com"; sid:544678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadocoronavirus.com"; sid:544679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovid19.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovid19.legal"; sid:544680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcorona.biz"; sid:544681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcoronavirus.biz"; sid:544682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid19.biz"; sid:544683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for act4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"act4corona.com"; sid:544684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actupagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actupagainstcovid19.com"; sid:544685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actupagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actupagainstcovid.com"; sid:544686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadocoronavirus.com"; sid:544687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affop-covid19-soignants.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affop-covid19-soignants.care"; sid:544688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona19.com"; sid:544689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona19.net"; sid:544690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.net"; sid:544691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.biz"; sid:544692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.biz"; sid:544693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.net"; sid:544694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcorona19.com"; sid:544695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agendacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agendacorona.com"; sid:544696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-entreprises-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-entreprises-coronavirus.com"; sid:544697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-entreprises-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-entreprises-covid19.com"; sid:544698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronalawyer.com"; sid:544699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovid19lawyer.com"; sid:544700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcoronalawyer.com"; sid:544701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcovid19lawyer.com"; sid:544702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertcorona.net"; sid:544703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliceincoronaland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliceincoronaland.com"; sid:544704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronamasks.com"; sid:544705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronasupplies.com"; sid:544706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronaviruses.com"; sid:544707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amandaricovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amandaricovid19.com"; sid:544708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid-19.com"; sid:544709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid19.com"; sid:544710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus-19.com"; sid:544711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirushealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirushealthinfo.com"; sid:544712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.pro"; sid:544713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirussupplies.com"; sid:544714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19-store.com"; sid:544715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.today"; sid:544716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19-virus.com"; sid:544717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid2019.com"; sid:544718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid2020.com"; sid:544719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidgel.com"; sid:544720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidium.com"; sid:544721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycorona.com"; sid:544722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apoyocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apoyocovid19.com"; sid:544723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcoronavirus.com"; sid:544724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistforcovid19.com"; sid:544725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciacovid19.com"; sid:544726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciamexicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciamexicocovid19.com"; sid:544727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associazioneitalianacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associazioneitalianacovid.com"; sid:544728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associazioneitalianavittimecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associazioneitalianavittimecovid.com"; sid:544729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacorona.com"; sid:544730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidcleanup.com"; sid:544731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcovidexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcovidexchange.com"; sid:544732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocovid19.com"; sid:544733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avcorona.com"; sid:544734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avecoronachan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avecoronachan.com"; sid:544735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid.com"; sid:544736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babyboomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babyboomcovid19.com"; sid:544737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ban-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ban-corona.com"; sid:544738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bancorona.com"; sid:544739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banemaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banemaskcorona.com"; sid:544740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baohiemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baohiemcovid.com"; sid:544741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareacovidbusinessinteruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareacovidbusinessinteruption.com"; sid:544742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baycorona.com"; sid:544743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardofcovid.com"; sid:544744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardsforcorona.com"; sid:544745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardsofcovid.com"; sid:544746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidclothing.com"; sid:544747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidhoodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidhoodies.com"; sid:544748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovids19.com"; sid:544749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berufsorientierungtrotzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berufsorientierungtrotzcorona.com"; sid:544750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusquotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusquotes.com"; sid:544751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19lawyers.com"; sid:544752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid.com"; sid:544753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidsolutions.com"; sid:544754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-ideas-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-ideas-corona.com"; sid:544755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestideas-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestideas-corona.com"; sid:544756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betcorona2020.com"; sid:544757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beverleycovid19mutualaidgmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beverleycovid19mutualaidgmail.com"; sid:544758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beydicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beydicovid.com"; sid:544759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid-19.com"; sid:544760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid19.com"; sid:544761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcovid19.com"; sid:544762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenhascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenhascovid19.com"; sid:544763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenhascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenhascovid19.net"; sid:544764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitemecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitemecovid19.com"; sid:544765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitemecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitemecovid.com"; sid:544766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blessingsinthemidstofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blessingsinthemidstofcovid19.com"; sid:544767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boocorona.com"; sid:544768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for booyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"booyoucorona.com"; sid:544769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidcleanup.com"; sid:544770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boycoronavirus.com"; sid:544771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for branchcovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"branchcovidian.com"; sid:544772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasilxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasilxcovid19.com"; sid:544773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingnewscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingnewscorona.com"; sid:544774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for browardcovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"browardcovidcleanup.com"; sid:544775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buongkhukhuancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buongkhukhuancovid.com"; sid:544776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessbeyondcorona.com"; sid:544777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid19claims.com"; sid:544778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessvscorona.com"; sid:544779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-corona.com"; sid:544780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusprotection.com"; sid:544781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calgarycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calgarycorona.com"; sid:544782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicorona.com"; sid:544783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californaicovid19realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californaicovid19realestate.com"; sid:544784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirusattorney.com"; sid:544785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruslawsuit.com"; sid:544786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruslawyer.com"; sid:544787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19attorneys.com"; sid:544788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidbusinessinteruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidbusinessinteruption.com"; sid:544789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calivallecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calivallecorona.com"; sid:544790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardio19vscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardio19vscovid19.com"; sid:544791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribcovid19tests.com"; sid:544792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carlsoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carlsoncovid.com"; sid:544793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casescovid19.com"; sid:544794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashforcovid.com"; sid:544795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchacorona.com"; sid:544796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchingcoronavirus.com"; sid:544797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catsagainstcovid19.com"; sid:544798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catsofcoronavirus.com"; sid:544799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cekcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cekcovid19.com"; sid:544800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralcorona.com"; sid:544801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cfdvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cfdvscovid.com"; sid:544802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chancecorona.com"; sid:544803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chandlercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chandlercovid19.com"; sid:544804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronasymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronasymptoms.com"; sid:544805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmycovid-19.com"; sid:544806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmycovid19.com"; sid:544807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for children4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"children4covid19.com"; sid:544808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenforcovid19.com"; sid:544809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronaviruswar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronaviruswar.com"; sid:544810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquine-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquine-coronavirus.com"; sid:544811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquineforcovid19.com"; sid:544812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christycoronachronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christycoronachronicle.com"; sid:544813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christycorona.com"; sid:544814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchbeyondcorona.com"; sid:544815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciccoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciccoronatracker.com"; sid:544816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cimiterovirtualecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cimiterovirtualecovid19.com"; sid:544817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimscovid19.com"; sid:544818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clarity-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clarity-covid19.com"; sid:544819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid2020.com"; sid:544820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closcorona.com"; sid:544821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubpandemic.com"; sid:544822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oracel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oracel.com"; sid:544823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oracel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oracel.com"; sid:544824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oracel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oracel.net"; sid:544825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oracel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oracel.net"; sid:544826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oracle.com"; sid:544827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oracle.com"; sid:544828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oracle.net"; sid:544829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oracle.net"; sid:544830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oralce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oralce.com"; sid:544831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oralce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oralce.com"; sid:544832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-oralce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-oralce.net"; sid:544833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-oralce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-oralce.net"; sid:544834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-orcale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-orcale.com"; sid:544835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-orcale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-orcale.com"; sid:544836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid-19-orcale.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid-19-orcale.net"; sid:544837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19-orcale.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19-orcale.net"; sid:544838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmi-covid19.com"; sid:544839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmicovid19.com"; sid:544840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid19.net"; sid:544841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovide.com"; sid:544842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid.net"; sid:544843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colimacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colimacovid19.com"; sid:544844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatecovid.com"; sid:544845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comedycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comedycorona.com"; sid:544846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comedypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comedypandemic.com"; sid:544847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comics4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comics4corona.com"; sid:544848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comics4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comics4coronavirus.com"; sid:544849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicsforcorona.com"; sid:544850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicsforcoronavirus.com"; sid:544851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compute4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compute4covid.com"; sid:544852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for computecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"computecovid.com"; sid:544853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congocovid.com"; sid:544854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultaparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultaparacoronavirus.com"; sid:544855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona14daychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona14daychallenge.com"; sid:544856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19challenge.com"; sid:544857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cured.com"; sid:544858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lbs.com"; sid:544859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19pounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19pounds.com"; sid:544860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19vaccine.com"; sid:544861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.finance"; sid:544862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020store.com"; sid:544863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4kids.com"; sid:544864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvise.com"; sid:544865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadviser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadviser.com"; sid:544866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvisers.com"; sid:544867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvising.com"; sid:544868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aid-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aid-kit.com"; sid:544869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartists.com"; sid:544870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassembly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassembly.com"; sid:544871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassure.com"; sid:544872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-attorneys.com"; sid:544873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies2021.com"; sid:544874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiesboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiesboom.com"; sid:544875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiesusa.com"; sid:544876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-babyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-babyboom.com"; sid:544877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy-boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy-boom.com"; sid:544878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-babyboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-babyboomer.com"; sid:544879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboutique.com"; sid:544880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyco.com"; sid:544881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyoops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyoops.com"; sid:544882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyfirm.com"; sid:544883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcynow.com"; sid:544884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabarter.com"; sid:544885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabdnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabdnow.com"; sid:544886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeardchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeardchallenge.com"; sid:544887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeaters.com"; sid:544888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beer.com"; sid:544889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabelgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabelgium.com"; sid:544890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bescheinigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bescheinigung.com"; sid:544891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beware.com"; sid:544892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabezwaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabezwaar.com"; sid:544893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioscience.com"; sid:544894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiosciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiosciences.com"; sid:544895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiotech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiotech.com"; sid:544896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizrecovery.com"; sid:544897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizsupport.com"; sid:544898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiztalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiztalk.com"; sid:544899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabono.com"; sid:544900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonos.com"; sid:544901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabooking.com"; sid:544902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrazil.com"; sid:544903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabride.com"; sid:544904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabridge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabridge.com"; sid:544905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusiness.net"; sid:544906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuynowstaylater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuynowstaylater.com"; sid:544907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabystate.com"; sid:544908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabine.com"; sid:544909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalling.com"; sid:544910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalls.com"; sid:544911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardtest.com"; sid:544912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecenters.com"; sid:544913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareclinic.com"; sid:544914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareglobal.com"; sid:544915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarelabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarelabs.com"; sid:544916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaretime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaretime.com"; sid:544917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatholic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatholic.com"; sid:544918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachart.net"; sid:544919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachatroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachatroom.com"; sid:544920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecknow.com"; sid:544921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecktest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecktest.net"; sid:544922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chic.com"; sid:544923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachoir.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachoir.club"; sid:544924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachop.com"; sid:544925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidesolution.com"; sid:544926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidesolutions.com"; sid:544927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacitizen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacitizen.com"; sid:544928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimcenter.com"; sid:544929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsgroup.com"; sid:544930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclan.com"; sid:544931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaners.net"; sid:544932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningexperts.com"; sid:544933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.today"; sid:544934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanwater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanwater.com"; sid:544935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclinger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclinger.com"; sid:544936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomms.com"; sid:544937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfession.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfession.net"; sid:544938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongorna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongorna.com"; sid:544939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconquest.com"; sid:544940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstructionrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstructionrecovery.com"; sid:544941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontra.com"; sid:544942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontract.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontract.com"; sid:544943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouchpotato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouchpotato.com"; sid:544944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouchpotatoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouchpotatoe.com"; sid:544945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coupon.com"; sid:544946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19.net"; sid:544947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19pandemic.com"; sid:544948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19usa.com"; sid:544949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covidnineteen.com"; sid:544950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrash.net"; sid:544951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crew.com"; sid:544952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrewcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrewcom.com"; sid:544953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisesinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisesinvesting.com"; sid:544954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisconditions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisconditions.com"; sid:544955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscoverage.com"; sid:544956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscraziness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscraziness.com"; sid:544957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiseffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiseffects.com"; sid:544958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis-food.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis-food.com"; sid:544959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisnews.com"; sid:544960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crowddeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crowddeals.com"; sid:544961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cup.com"; sid:544962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuties.com"; sid:544963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadagbog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadagbog.net"; sid:544964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadead.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadead.today"; sid:544965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathlawyers.com"; sid:544966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtattorney.com"; sid:544967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtlawyer.com"; sid:544968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensemask.com"; sid:544969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-delivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-delivery.com"; sid:544970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevi.com"; sid:544971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiariesla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiariesla.com"; sid:544972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries.world"; sid:544973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisability.com"; sid:544974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasedeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasedeat.com"; sid:544975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocap.com"; sid:544976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoor.com"; sid:544977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaedge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaedge.com"; sid:544978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-effekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-effekt.com"; sid:544979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeffekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeffekt.com"; sid:544980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelection.com"; sid:544981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaempire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaempire.com"; sid:544982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeverything.com"; sid:544983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeviction.com"; sid:544984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpansion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpansion.com"; sid:544985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactor.com"; sid:544986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilybaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilybaby.com"; sid:544987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeliz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeliz.com"; sid:544988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaficationnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaficationnation.com"; sid:544989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinement.com"; sid:544990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinland.com"; sid:544991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-firmen-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-firmen-hilfe.com"; sid:544992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafobia.com"; sid:544993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-food.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-food.com"; sid:544994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeafrica.com"; sid:544995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeamerica.com"; sid:544996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeamericas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeamericas.com"; sid:544997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecanada.com"; sid:544998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreechina.com"; sid:544999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecontent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecontent.com"; sid:545000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedesi.com"; sid:545001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeeurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeeurope.com"; sid:545002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehuman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehuman.com"; sid:545003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehumans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehumans.com"; sid:545004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeiran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeiran.com"; sid:545005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeitaly.com"; sid:545006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreejapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreejapan.com"; sid:545007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreekorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreekorea.com"; sid:545008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeplanet.com"; sid:545009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesingapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesingapore.com"; sid:545010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeuniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeuniverse.com"; sid:545011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeusa.com"; sid:545012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeus.com"; sid:545013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrontliners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrontliners.com"; sid:545014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundusa.com"; sid:545015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunnyshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunnyshirts.com"; sid:545016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunnytshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunnytshirts.com"; sid:545017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaga.com"; sid:545018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagap.com"; sid:545019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagate.net"; sid:545020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageddon2020usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageddon2020usa.com"; sid:545021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageddon.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageddon.wtf"; sid:545022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenalpha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenalpha.com"; sid:545023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagene.com"; sid:545024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagives.com"; sid:545025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrancanaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrancanaria.com"; sid:545026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gutscheine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gutscheine.com"; sid:545027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahall.com"; sid:545028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthassistance.com"; sid:545029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp2020.com"; sid:545030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpfromchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpfromchina.com"; sid:545031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahijyeni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahijyeni.com"; sid:545032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahobbies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahobbies.com"; sid:545033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholicc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholicc.com"; sid:545034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometester.com"; sid:545035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomevacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomevacation.com"; sid:545036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahope247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahope247.com"; sid:545037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hospitals.com"; sid:545038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahouseparty.com"; sid:545039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahugs.com"; sid:545040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahygienekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahygienekit.com"; sid:545041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaicu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaicu.com"; sid:545042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronails.com"; sid:545043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincentives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincentives.com"; sid:545044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincentives.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincentives.guru"; sid:545045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infektionsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infektionsschutz.com"; sid:545046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuryclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuryclaims.com"; sid:545047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnovation.com"; sid:545048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnovations.com"; sid:545049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuk.com"; sid:545050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaism.com"; sid:545051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-is-over.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-is-over.com"; sid:545052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakala.com"; sid:545053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kfw.com"; sid:545054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersoap.com"; sid:545055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillspray.com"; sid:545056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitsonline.com"; sid:545057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoll.com"; sid:545058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalation.com"; sid:545059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.biz"; sid:545060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawclaim.com"; sid:545061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawhelp.com"; sid:545062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaws.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaws.biz"; sid:545063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalead.com"; sid:545064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalease.com"; sid:545065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalaction.com"; sid:545066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalservices.com"; sid:545067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lisa.com"; sid:545068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive24.com"; sid:545069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivecounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivecounter.com"; sid:545070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdates.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdates.today"; sid:545071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanassistance.com"; sid:545072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloancenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloancenter.com"; sid:545073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloop.com"; sid:545074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluchamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluchamos.com"; sid:545075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadesimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadesimple.com"; sid:545076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalpractice.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalpractice.biz"; sid:545077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascaras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascaras.com"; sid:545078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskcompany.com"; sid:545079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskproject.com"; sid:545080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamc.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamc.club"; sid:545081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamds.com"; sid:545082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameasures.com"; sid:545083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedica.com"; sid:545084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalcare.com"; sid:545085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicine.biz"; sid:545086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedz.com"; sid:545087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamers.com"; sid:545088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamine.com"; sid:545089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamistake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamistake.com"; sid:545090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamitigation.com"; sid:545091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamorons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamorons.com"; sid:545092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuscle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuscle.com"; sid:545093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusica.com"; sid:545094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsnetwork.com"; sid:545095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-news.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-news.today"; sid:545096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanexus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanexus.com"; sid:545097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanomo.com"; sid:545098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanovel.com"; sid:545099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronans.com"; sid:545100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nyc.com"; sid:545101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaobvious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaobvious.com"; sid:545102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaobvious.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaobvious.net"; sid:545103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-office.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-office.net"; sid:545104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-onlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-onlineshop.com"; sid:545105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoops.com"; sid:545106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ot.com"; sid:545107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaover.com"; sid:545108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaintings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaintings.com"; sid:545109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartner.com"; sid:545110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparty.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparty.amsterdam"; sid:545111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayout.com"; sid:545112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonality.com"; sid:545113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapins.com"; sid:545114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanner.com"; sid:545115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaybook.com"; sid:545116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolis.com"; sid:545117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prayers.com"; sid:545118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreneurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreneurs.com"; sid:545119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prevention-program.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prevention-program.com"; sid:545120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapricegouging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapricegouging.com"; sid:545121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproblem.com"; sid:545122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofcredit.com"; sid:545123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquorum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquorum.com"; sid:545124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraby.com"; sid:545125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebound.com"; sid:545126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecovery2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecovery2020.com"; sid:545127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregulation.com"; sid:545128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelated.com"; sid:545129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelationship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelationship.com"; sid:545130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefcenter.com"; sid:545131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremoval.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremoval.net"; sid:545132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareportbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareportbd.com"; sid:545133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarescue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarescue.net"; sid:545134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchgate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchgate.com"; sid:545135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-responses-4-climate.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-responses-4-climate.solutions"; sid:545136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevealed.com"; sid:545137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareview.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareview.net"; sid:545138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarightsizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarightsizing.com"; sid:545139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarivus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarivus-test.com"; sid:545140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-romania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-romania.com"; sid:545141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroutine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroutine.com"; sid:545142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarpphometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarpphometest.com"; sid:545143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarule.com"; sid:545144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarunners.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarunners.club"; sid:545145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarussia.com"; sid:545146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafari.com"; sid:545147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafekits.com"; sid:545148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafemask.net"; sid:545149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sanitize.com"; sid:545150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasan.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasan.solutions"; sid:545151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasan.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasan.today"; sid:545152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbankruptcy.com"; sid:545153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltester.com"; sid:545154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzmasken.com"; sid:545155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-versand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-versand.com"; sid:545156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-scout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-scout.com"; sid:545157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascout.com"; sid:545158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascum.com"; sid:545159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseniorhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseniorhelp.com"; sid:545160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaserbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaserbia.com"; sid:545161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaserramenti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaserramenti.com"; sid:545162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasex.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasex.amsterdam"; sid:545163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashift.com"; sid:545164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shopping-fieber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shopping-fieber.com"; sid:545165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasidechats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasidechats.com"; sid:545166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingleparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingleparty.com"; sid:545167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmash.com"; sid:545168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitta.com"; sid:545169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasofort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasofort.com"; sid:545170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoforthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoforthilfe.com"; sid:545171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe.net"; sid:545172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasonrasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasonrasi.com"; sid:545173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecialdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecialdeals.com"; sid:545174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreaders.com"; sid:545175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spuckschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spuckschutz.com"; sid:545176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasremedy.com"; sid:545177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatica.com"; sid:545178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulus.net"; sid:545179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoryproject.com"; sid:545180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuperstars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuperstars.com"; sid:545181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurance.com"; sid:545182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasweden.com"; sid:545183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomchecker.com"; sid:545184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-syndrome.com"; sid:545185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-syndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-syndrome.net"; sid:545186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tales.com"; sid:545187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatea.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatea.club"; sid:545188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tek.com"; sid:545189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatenant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatenant.com"; sid:545190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testen-lassen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testen-lassen.com"; sid:545191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testenlassen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testenlassen.com"; sid:545192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathemusicalorig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathemusicalorig.com"; sid:545193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathenewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathenewnormal.com"; sid:545194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathenewnormal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathenewnormal.net"; sid:545195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapeutics.com"; sid:545196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapeutix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapeutix.com"; sid:545197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermometer.com"; sid:545198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermometer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermometer.net"; sid:545199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathink.com"; sid:545200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathisisvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathisisvirus.com"; sid:545201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathriveus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathriveus.com"; sid:545202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiomb.com"; sid:545203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationbargozo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationbargozo.com"; sid:545204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tip.com"; sid:545205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoy.com"; sid:545206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracker.world"; sid:545207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracking.com"; sid:545208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatransparency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatransparency.com"; sid:545209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrap.com"; sid:545210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatree.com"; sid:545211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatribe.com"; sid:545212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trust-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trust-fund.com"; sid:545213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrustfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrustfund.com"; sid:545214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-turkiye.com"; sid:545215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatutors.com"; sid:545216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunion.com"; sid:545217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunity.com"; sid:545218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmens-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmens-hilfe.com"; sid:545219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateonline.com"; sid:545220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausdata.com"; sid:545221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaustest.com"; sid:545222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19killed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19killed.com"; sid:545223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19movie.com"; sid:545224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinelawyer.com"; sid:545225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaclaims.com"; sid:545226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavations.com"; sid:545227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavators.com"; sid:545228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventure.com"; sid:545229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveri.com"; sid:545230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveteransclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveteransclaims.com"; sid:545231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidasya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidasya.com"; sid:545232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideoconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideoconsult.com"; sid:545233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviet.com"; sid:545234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviewer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviewer.com"; sid:545235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vinos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vinos.com"; sid:545236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavins.com"; sid:545237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vinus.com"; sid:545238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral19.com"; sid:545239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirruss.com"; sid:545240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1200check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1200check.com"; sid:545241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus123.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus123.net"; sid:545242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19mask.com"; sid:545243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19masks.com"; sid:545244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19oracle.com"; sid:545245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19testkit.com"; sid:545246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19testkits.com"; sid:545247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19tests.com"; sid:545248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19-vaccine.com"; sid:545249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019help.com"; sid:545250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020news.com"; sid:545251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus757.com"; sid:545252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus9.com"; sid:545253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadjuster.com"; sid:545254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadjusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadjusters.com"; sid:545255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafrica.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafrica.biz"; sid:545256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhomevalues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhomevalues.com"; sid:545257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrealestate.com"; sid:545258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytherapy.com"; sid:545259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytreatment.com"; sid:545260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusappforslack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusappforslack.com"; sid:545261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusargentina.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusargentina.net"; sid:545262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistanceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistanceprogram.com"; sid:545263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistanceprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistanceprograms.com"; sid:545264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneycenter.com"; sid:545265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusayurvedictreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusayurvedictreatment.com"; sid:545266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbahrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbahrain.com"; sid:545267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboards.com"; sid:545268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessaid.com"; sid:545269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesshelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesshelp.net"; sid:545270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabis.com"; sid:545271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanner.com"; sid:545272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscases.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscases.world"; sid:545273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscautions.com"; sid:545274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschecknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschecknow.com"; sid:545275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheck.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheck.today"; sid:545276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimlawyer.com"; sid:545277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimlawyers.com"; sid:545278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaim.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaim.pro"; sid:545279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaims.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaims.pro"; sid:545280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmiami.com"; sid:545281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanup.net"; sid:545282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommunityresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommunityresources.com"; sid:545283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationfund.com"; sid:545284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscon.com"; sid:545285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-congress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-congress.com"; sid:545286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.biz"; sid:545287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19prevention.com"; sid:545288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuritiba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuritiba.com"; sid:545289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscyrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscyrus.com"; sid:545290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentalmarketing.com"; sid:545291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeta.com"; sid:545292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-diary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-diary.net"; sid:545293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdictionary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdictionary.com"; sid:545294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdies.com"; sid:545295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdigitalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdigitalmarketing.com"; sid:545296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisability.com"; sid:545297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctorslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctorslive.com"; sid:545298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicreliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicreliefbill.com"; sid:545299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicrelief.com"; sid:545300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicresources.com"; sid:545301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicresources.net"; sid:545302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployeetestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployeetestkits.com"; sid:545303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployerliability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployerliability.com"; sid:545304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesclean.com"; sid:545305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaceshield.com"; sid:545306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsonline.com"; sid:545307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialhelpforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialhelpforbusiness.com"; sid:545308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfullface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfullface.com"; sid:545309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundraising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundraising.com"; sid:545310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuture.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuture.biz"; sid:545311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gift.com"; sid:545312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrantsservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrantsservices.com"; sid:545313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgroupusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgroupusa.com"; sid:545314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealingherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealingherbs.com"; sid:545315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.world"; sid:545316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpnetwork.com"; sid:545317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpstream.com"; sid:545318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushiring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushiring.com"; sid:545319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hoax.com"; sid:545320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomefogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomefogger.com"; sid:545321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-home-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-home-kits.com"; sid:545322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeschoolingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeschoolingnow.com"; sid:545323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushouse.com"; sid:545324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiceland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiceland.com"; sid:545325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincentives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincentives.com"; sid:545326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-india-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-india-travel.com"; sid:545327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionawyer.com"; sid:545328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionlawsuits.com"; sid:545329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-infektionsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-infektionsschutz.com"; sid:545330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfektionsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfektionsschutz.com"; sid:545331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfirmiere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfirmiere.com"; sid:545332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinquiry.com"; sid:545333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiscoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiscoming.com"; sid:545334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobsuk.com"; sid:545335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjourney.com"; sid:545336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillergoatsmilksoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillergoatsmilksoap.com"; sid:545337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawandleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawandleadership.com"; sid:545338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerdirectory.com"; sid:545339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslbnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslbnews.com"; sid:545340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalclaim.com"; sid:545341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsolutions.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsolutions.co.uk"; sid:545342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveupdateg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveupdateg.com"; sid:545343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloans.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloans.biz"; sid:545344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanservices.com"; sid:545345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-made-simple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-made-simple.com"; sid:545346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaponline.com"; sid:545347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmartincounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmartincounty.com"; sid:545348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-maski.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-maski.com"; sid:545349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksupplies.com"; sid:545350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalmarketing.com"; sid:545351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorials.com"; sid:545352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmistake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmistake.com"; sid:545353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgagerelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgagerelief.net"; sid:545354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneighborhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneighborhood.com"; sid:545355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneighbors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneighbors.com"; sid:545356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsonline.com"; sid:545357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsradio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsradio.com"; sid:545358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newsupdate.com"; sid:545359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-normality.com"; sid:545360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinecounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinecounselling.com"; sid:545361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoracle.net"; sid:545362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic20.com"; sid:545363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparasites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparasites.com"; sid:545364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspotus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspotus.com"; sid:545365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprison.com"; sid:545366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprisons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprisons.com"; sid:545367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspro.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspro.guru"; sid:545368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection.today"; sid:545369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspsychology.com"; sid:545370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublicadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublicadjuster.com"; sid:545371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquery.com"; sid:545372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquicktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquicktests.com"; sid:545373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrajasthan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrajasthan.com"; sid:545374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrajasthan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrajasthan.net"; sid:545375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rd.com"; sid:545376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregister.com"; sid:545377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelaxationhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelaxationhub.com"; sid:545378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-releif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-releif.com"; sid:545379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefcenter.com"; sid:545380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-relief.com"; sid:545381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffunding.com"; sid:545382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-relief.net"; sid:545383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreminder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreminder.com"; sid:545384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotejobs.com"; sid:545385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreportonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreportonline.com"; sid:545386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-resource-hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-resource-hub.com"; sid:545387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrevealed.com"; sid:545388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrutherfordcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrutherfordcounty.com"; sid:545389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrxpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrxpak.com"; sid:545390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sars-cov-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sars-cov-2.com"; sid:545391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussarscov2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussarscov2.com"; sid:545392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenate.com"; sid:545393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserviceusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserviceusa.com"; sid:545394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-shield-mission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-shield-mission.com"; sid:545395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshipt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshipt.com"; sid:545396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshitisreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshitisreal.com"; sid:545397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussingapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussingapore.com"; sid:545398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbizloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbizloan.com"; sid:545399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessattorney.com"; sid:545400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessattorney.net"; sid:545401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussonrasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussonrasi.com"; sid:545402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-staffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-staffing.com"; sid:545403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstaffing.com"; sid:545404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatsonline.com"; sid:545405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstpete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstpete.com"; sid:545406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstpetersburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstpetersburg.com"; sid:545407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussucksballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussucksballs.com"; sid:545408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussucksdonkeydicks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussucksdonkeydicks.com"; sid:545409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvior.com"; sid:545410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptoms.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptoms.biz"; sid:545411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustalk.com"; sid:545412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustariffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustariffs.com"; sid:545413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxresources.com"; sid:545414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxresources.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxresources.mobi"; sid:545415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxresources.net"; sid:545416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustek.com"; sid:545417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustelehealthrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustelehealthrelief.com"; sid:545418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustequila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustequila.com"; sid:545419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.guru"; sid:545420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.biz"; sid:545421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing-kit.com"; sid:545422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingservice.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingservice.co.uk"; sid:545423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit.biz"; sid:545424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test-kits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test-kits.net"; sid:545425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsonline.com"; sid:545426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthepandemic.com"; sid:545427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackers.world"; sid:545428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracker.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracker.today"; sid:545429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrack.net"; sid:545430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentinfo.com"; sid:545431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustribe.com"; sid:545432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunexplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunexplained.com"; sid:545433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunion.com"; sid:545434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuruguay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuruguay.com"; sid:545435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususapro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususapro.com"; sid:545436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususas.com"; sid:545437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususastudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususastudio.com"; sid:545438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaweb.com"; sid:545439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususonrasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususonrasi.com"; sid:545440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinator.com"; sid:545441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvassine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvassine.com"; sid:545442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimcompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimcompensation.com"; sid:545443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtualdoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtualdoctor.com"; sid:545444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtualmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtualmd.com"; sid:545445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisualized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisualized.com"; sid:545446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvpn.com"; sid:545447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusway.com"; sid:545448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswills.com"; sid:545449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.win"; sid:545450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyellowpages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyellowpages.com"; sid:545451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusympthoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusympthoms.com"; sid:545452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusypropietarios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusypropietarios.com"; sid:545453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoidance.com"; sid:545454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteerbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteerbd.com"; sid:545455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav.today"; sid:545456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatchuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatchuk.com"; sid:545457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweed.net"; sid:545458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawife.com"; sid:545459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-will.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-will.com"; sid:545460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawill.com"; sid:545461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawills.com"; sid:545462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wins.com"; sid:545463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-yuushi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-yuushi.com"; sid:545464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikausa.com"; sid:545465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazim.com"; sid:545466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cottonbeatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cottonbeatscovid.com"; sid:545467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countingcovid19.com"; sid:545468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid12pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid12pack.com"; sid:545469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid12pak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid12pak.com"; sid:545470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-101.com"; sid:545471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020.life"; sid:545472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aaz.com"; sid:545473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ab.com"; sid:545474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accelerator.com"; sid:545475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountinghelp.com"; sid:545476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19affectedbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19affectedbusiness.com"; sid:545477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-algeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-algeria.com"; sid:545478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19americabankpayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19americabankpayment.com"; sid:545479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhomevalues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhomevalues.com"; sid:545480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrealestate.com"; sid:545481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andus.com"; sid:545482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibody.com"; sid:545483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodykits.com"; sid:545484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytherapy.com"; sid:545485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19app.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19app.care"; sid:545486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arabia.com"; sid:545487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-arabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-arabic.com"; sid:545488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19artificialintelligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19artificialintelligence.com"; sid:545489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometesting.com"; sid:545490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19athometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19athometestkit.com"; sid:545491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-attorneys.com"; sid:545492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atwork.com"; sid:545493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awakening.com"; sid:545494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-baby.com"; sid:545495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bastaya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bastaya.com"; sid:545496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19battleship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19battleship.com"; sid:545497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19begone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19begone.net"; sid:545498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19belize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19belize.com"; sid:545499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bharat.com"; sid:545500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biclaim.com"; sid:545501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthdefect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthdefect.com"; sid:545502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthdefects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthdefects.com"; sid:545503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizrecovery.com"; sid:545504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizsupport.com"; sid:545505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blows.com"; sid:545506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bomb.com"; sid:545507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19books.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19books.com"; sid:545508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brain.com"; sid:545509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-busters.com"; sid:545510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buynowstaylater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buynowstaylater.com"; sid:545511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canadaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canadaupdate.com"; sid:545512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capsule.com"; sid:545513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carealestate.com"; sid:545514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cat.com"; sid:545515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cauca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cauca.com"; sid:545516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chaina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chaina.com"; sid:545517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chain.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chain.digital"; sid:545518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-checklist.com"; sid:545519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checknow.com"; sid:545520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chhattisgarh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chhattisgarh.com"; sid:545521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19citizen.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19citizen.science"; sid:545522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimlawyer.com"; sid:545523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimlawyers.com"; sid:545524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimlawyers.com"; sid:545525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningar.com"; sid:545526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningarkansas.com"; sid:545527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnashville.com"; sid:545528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanupar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanupar.com"; sid:545529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanuparkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanuparkansas.com"; sid:545530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cocktails.com"; sid:545531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-codes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-codes.com"; sid:545532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cohesion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cohesion.com"; sid:545533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19combat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19combat.com"; sid:545534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleaningnashville.com"; sid:545535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commonsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commonsense.com"; sid:545536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communityresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communityresources.com"; sid:545537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensationfund.com"; sid:545538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conception.com"; sid:545539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concerts.com"; sid:545540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultantion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultantion.com"; sid:545541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-consultation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-consultation.com"; sid:545542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cope.com"; sid:545543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19countdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19countdown.com"; sid:545544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19counter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19counter.com"; sid:545545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cpas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cpas.com"; sid:545546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19credentialing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19credentialing.com"; sid:545547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19credentialing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19credentialing.com"; sid:545548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure.biz"; sid:545549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cvs.com"; sid:545550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cvs.com"; sid:545551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataky.com"; sid:545552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.dating"; sid:545553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deadpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deadpool.com"; sid:545554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19debt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19debt.com"; sid:545555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decal.com"; sid:545556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalmarketing.com"; sid:545557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19depot.com"; sid:545558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designermask.com"; sid:545559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designermasks.com"; sid:545560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostic.net"; sid:545561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digitalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digitalmarketing.com"; sid:545562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diseaselawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diseaselawsuit.com"; sid:545563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaselawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaselawsuit.com"; sid:545564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diseaselawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diseaselawsuits.com"; sid:545565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaselawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaselawsuits.com"; sid:545566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diseaselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diseaselawyer.com"; sid:545567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaselawyer.com"; sid:545568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diseaselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diseaselawyers.com"; sid:545569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaselawyers.com"; sid:545570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionpro.com"; sid:545571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.domains - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.domains"; sid:545572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-drug.com"; sid:545573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earlydetectionrpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earlydetectionrpm.com"; sid:545574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19easytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19easytestkit.com"; sid:545575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19effect.com"; sid:545576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerliability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerliability.com"; sid:545577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19es.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19es.net"; sid:545578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19essential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19essential.com"; sid:545579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essential.com"; sid:545580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essential.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essential.net"; sid:545581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ethiopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ethiopia.com"; sid:545582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-eu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-eu.com"; sid:545583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expeditedcredentialing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expeditedcredentialing.com"; sid:545584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposure.com"; sid:545585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fail.com"; sid:545586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familytestkit.com"; sid:545587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fandemic.com"; sid:545588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faqs.com"; sid:545589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faqs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faqs.net"; sid:545590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19files.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19files.com"; sid:545591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmfest.com"; sid:545592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridaclaims.com"; sid:545593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foggerbomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foggerbomb.com"; sid:545594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fuckyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fuckyou.com"; sid:545595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fukui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fukui.com"; sid:545596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19future.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19future.biz"; sid:545597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19futures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19futures.com"; sid:545598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-generation.com"; sid:545599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-genertation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-genertation.com"; sid:545600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gifts.com"; sid:545601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19give.com"; sid:545602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.golf"; sid:545603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.golf"; sid:545604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19govt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19govt.com"; sid:545605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-grocery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-grocery.com"; sid:545606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hawaii.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hawaii.world"; sid:545607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healingoracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healingoracle.net"; sid:545608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19health.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19health.net"; sid:545609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpalbany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpalbany.com"; sid:545610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19help.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19help.biz"; sid:545611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpnyc.com"; sid:545612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.today"; sid:545613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroproject.com"; sid:545614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hilfe.com"; sid:545615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hoax.com"; sid:545616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hoax.com"; sid:545617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebomb.com"; sid:545618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-home-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-home-kits.com"; sid:545619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeloan.com"; sid:545620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeloans.com"; sid:545621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homerelief.com"; sid:545622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeschool.com"; sid:545623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hope.com"; sid:545624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howtoadapt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howtoadapt.com"; sid:545625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ideaaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ideaaccelerator.com"; sid:545626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ideas.com"; sid:545627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ifornia.com"; sid:545628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunitytest.com"; sid:545629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunitytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunitytestkit.com"; sid:545630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-impfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-impfstoff.com"; sid:545631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inc.com"; sid:545632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.industries - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.industries"; sid:545633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infodesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infodesk.com"; sid:545634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infokit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infokit.com"; sid:545635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19info.net"; sid:545636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmemoriam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmemoriam.com"; sid:545637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inuk.com"; sid:545638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-invest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-invest.com"; sid:545639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19invest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19invest.com"; sid:545640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ireland.com"; sid:545641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isfake.com"; sid:545642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19knowmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19knowmore.com"; sid:545643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19krise.com"; sid:545644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laboratory.com"; sid:545645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lasseube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lasseube.com"; sid:545646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawaus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawaus.net"; sid:545647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerdirectory.com"; sid:545648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lb.com"; sid:545649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leb.com"; sid:545650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19library.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19library.com"; sid:545651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livetrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livetrack.com"; sid:545652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lk.com"; sid:545653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lossadjusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lossadjusters.com"; sid:545654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksbio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksbio.com"; sid:545655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksupplier.com"; sid:545656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksuppliers.com"; sid:545657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksupplies.com"; sid:545658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19md.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19md.net"; sid:545659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19md.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19md.net"; sid:545660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmarketing.com"; sid:545661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medical-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medical-mask.com"; sid:545662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicus.com"; sid:545663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialday.com"; sid:545664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialwall.com"; sid:545665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miler.com"; sid:545666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mobiletesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mobiletesting.com"; sid:545667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modeling.com"; sid:545668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modeling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modeling.net"; sid:545669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modelling.com"; sid:545670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modelling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modelling.net"; sid:545671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19models.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19models.com"; sid:545672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mom.com"; sid:545673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgageadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgageadvice.com"; sid:545674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagerelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagerelieffund.com"; sid:545675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagerelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagerelief.net"; sid:545676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortgages.com"; sid:545677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mytest.com"; sid:545678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsandsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsandsupplies.com"; sid:545679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.biz"; sid:545680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ngo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ngo.com"; sid:545681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obamacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obamacare.com"; sid:545682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obamacaresep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obamacaresep.com"; sid:545683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ohioclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ohioclaims.com"; sid:545684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracel.com"; sid:545685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracel.com"; sid:545686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracle.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracle.care"; sid:545687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracle.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracle.clinic"; sid:545688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oraclecloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oraclecloud.com"; sid:545689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oraclecloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oraclecloud.com"; sid:545690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid--19-oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid--19-oracle.com"; sid:545691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid--19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid--19oracle.com"; sid:545692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracle.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracle.healthcare"; sid:545693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oracle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oracle.net"; sid:545694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oralce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oralce.com"; sid:545695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19orcale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19orcale.com"; sid:545696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orcale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orcale.com"; sid:545697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oshawa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oshawa.com"; sid:545698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outlet.com"; sid:545699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pak.com"; sid:545700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pak.com"; sid:545701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patriots.com"; sid:545702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payment.com"; sid:545703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19peacemakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19peacemakers.com"; sid:545704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjury.com"; sid:545705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philippines.com"; sid:545706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.photography"; sid:545707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicaltherapy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicaltherapy.club"; sid:545708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicaltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicaltherapy.com"; sid:545709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physio.com"; sid:545710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plague.com"; sid:545711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19planb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19planb.com"; sid:545712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policoro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policoro.com"; sid:545713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portal.net"; sid:545714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19positive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19positive.com"; sid:545715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ppe.com"; sid:545716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppes.com"; sid:545717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ppe-training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ppe-training.com"; sid:545718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prehospitalguidance.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prehospitalguidance.wales"; sid:545719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prevent.com"; sid:545720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventioncleaningservives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventioncleaningservives.com"; sid:545721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventioncommercialcleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventioncommercialcleaningnashville.com"; sid:545722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventiongear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventiongear.com"; sid:545723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionjanitorialnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionjanitorialnashville.com"; sid:545724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionjanitorialservicesnashvilletn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionjanitorialservicesnashvilletn.com"; sid:545725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionofficecleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionofficecleaningnashville.com"; sid:545726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-products2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-products2020.com"; sid:545727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectio.com"; sid:545728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivemask.com"; sid:545729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19publicadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19publicadjuster.com"; sid:545730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19py.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19py.net"; sid:545731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pyschology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pyschology.com"; sid:545732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qroo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qroo.com"; sid:545733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quest.com"; sid:545734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quest.com"; sid:545735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raceforthecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raceforthecure.com"; sid:545736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raceforthecure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raceforthecure.net"; sid:545737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidhometest.com"; sid:545738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidhometest.com"; sid:545739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestateadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestateadvice.com"; sid:545740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recovered.com"; sid:545741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recovery.net"; sid:545742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19refi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19refi.com"; sid:545743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-refi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-refi.com"; sid:545744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refi.com"; sid:545745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-refinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-refinance.com"; sid:545746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refinance.com"; sid:545747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19refi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19refi.net"; sid:545748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-refi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-refi.net"; sid:545749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refi.net"; sid:545750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regina.com"; sid:545751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19register.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19register.com"; sid:545752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehabilitation.com"; sid:545753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefandsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefandsupport.com"; sid:545754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefcheck.com"; sid:545755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.fund"; sid:545756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefmoney.com"; sid:545757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reminder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reminder.com"; sid:545758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotejobs.com"; sid:545759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resilience.com"; sid:545760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcemap.com"; sid:545761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restoration.com"; sid:545762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rpptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rpptest.com"; sid:545763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysigns.com"; sid:545764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanificazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanificazione.com"; sid:545765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sanitizer.com"; sid:545766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scanner.com"; sid:545767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19score.com"; sid:545768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shipt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shipt.com"; sid:545769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shot.com"; sid:545770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-signs.com"; sid:545771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.singles"; sid:545772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusiness.com"; sid:545773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessgrants.com"; sid:545774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smallbusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smallbusinessloan.com"; sid:545775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sos.com"; sid:545776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19speaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19speaks.com"; sid:545777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-specialdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-specialdeals.com"; sid:545778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19specialdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19specialdeals.com"; sid:545779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialdeals.com"; sid:545780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srl.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srl.net"; sid:545781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srl.shoes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srl.shoes"; sid:545782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistics.net"; sid:545783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stats.net"; sid:545784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-status-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-status-now.com"; sid:545785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayhomeessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayhomeessentials.com"; sid:545786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterile.com"; sid:545787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stewards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stewards.com"; sid:545788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stories.com"; sid:545789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storys.com"; sid:545790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strategy.com"; sid:545791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strategy.com"; sid:545792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19streaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19streaming.com"; sid:545793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stress.com"; sid:545794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19struggle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19struggle.com"; sid:545795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studio.com"; sid:545796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supersupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supersupplies.com"; sid:545797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplychain.com"; sid:545798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplychain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplychain.net"; sid:545799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-supply.com"; sid:545800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.network"; sid:545801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surplus.com"; sid:545802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swab.com"; sid:545803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomtracker.com"; sid:545804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxexpert.com"; sid:545805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxnews.com"; sid:545806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxupdates.com"; sid:545807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teens.com"; sid:545808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-telehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-telehealth.com"; sid:545809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing-kit.com"; sid:545810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.zone"; sid:545811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theory.com"; sid:545812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermometer.com"; sid:545813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermometer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermometer.net"; sid:545814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19think.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19think.com"; sid:545815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19think.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19think.net"; sid:545816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thinktank.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thinktank.net"; sid:545817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19throatswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19throatswab.com"; sid:545818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tipjar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tipjar.com"; sid:545819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracing.com"; sid:545820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracing.net"; sid:545821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-track.com"; sid:545822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerapp.com"; sid:545823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackr.com"; sid:545824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-traveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-traveldeals.com"; sid:545825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19traveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19traveldeals.com"; sid:545826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveldeals.com"; sid:545827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tr.com"; sid:545828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tr.com"; sid:545829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tribe.com"; sid:545830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trucking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trucking.com"; sid:545831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uabot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uabot.com"; sid:545832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updated.com"; sid:545833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updateph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updateph.com"; sid:545834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uploads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uploads.com"; sid:545835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-usainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-usainfo.com"; sid:545836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.biz"; sid:545837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-us.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-us.net"; sid:545838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19us.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19us.net"; sid:545839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelawyer.com"; sid:545840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimcompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimcompensation.com"; sid:545841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimcompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimcompensationfund.com"; sid:545842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-info.com"; sid:545843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virus.net"; sid:545844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusprevention.com"; sid:545845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusu.com"; sid:545846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virusupdates.com"; sid:545847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ward.com"; sid:545848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warrior.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warrior.net"; sid:545849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warriors.com"; sid:545850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warriors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warriors.net"; sid:545851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatdoyouneed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatdoyouneed.com"; sid:545852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wills.com"; sid:545853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wine.com"; sid:545854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worlddatacenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worlddatacenter.com"; sid:545855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldhealth.com"; sid:545856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019book.com"; sid:545857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019-facts.com"; sid:545858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020products.com"; sid:545859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20marketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20marketing.com"; sid:545860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3dkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3dkit.com"; sid:545861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4catholics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4catholics.com"; sid:545862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid6pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid6pack.com"; sid:545863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid6pak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid6pak.com"; sid:545864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid808.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid808.com"; sid:545865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-888.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-888.com"; sid:545866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-888.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-888.net"; sid:545867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid888.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid888.net"; sid:545868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-88.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-88.net"; sid:545869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19traveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19traveldeals.com"; sid:545870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacil.com"; sid:545871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacn.com"; sid:545872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacomida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacomida.com"; sid:545873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacsglobalregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacsglobalregistry.com"; sid:545874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaftermath.com"; sid:545875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alliance.com"; sid:545876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalmanac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalmanac.com"; sid:545877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanaesthesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanaesthesia.com"; sid:545878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcoronacleaning.com"; sid:545879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangel.com"; sid:545880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytherapy.com"; sid:545881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.net"; sid:545882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmy.com"; sid:545883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassessment.com"; sid:545884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidata-ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidata-ma.com"; sid:545885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaustin.com"; sid:545886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawakening.com"; sid:545887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaz.com"; sid:545888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeard.com"; sid:545889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeards.com"; sid:545890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiclaims.com"; sid:545891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bingo.com"; sid:545892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bipapinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bipapinfo.com"; sid:545893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizhelp.com"; sid:545894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblockparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblockparty.com"; sid:545895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbomb.com"; sid:545896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessconsulting.com"; sid:545897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinteruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinteruptionclaim.com"; sid:545898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinteruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinteruption.com"; sid:545899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinteruptiondenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinteruptiondenial.com"; sid:545900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessresponseteam.com"; sid:545901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamgirls.com"; sid:545902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcannabis.com"; sid:545903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardiologycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardiologycare.com"; sid:545904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecanada.com"; sid:545905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareclinic.com"; sid:545906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcat19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcat19.com"; sid:545907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcat.com"; sid:545908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcats.com"; sid:545909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatz.com"; sid:545910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcbdoil.com"; sid:545911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentre.com"; sid:545912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchart.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchart.today"; sid:545913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecknow.com"; sid:545914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clear.com"; sid:545915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.coffee"; sid:545916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoffee.com"; sid:545917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollaborative.com"; sid:545918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-collective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-collective.com"; sid:545919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommand.com"; sid:545920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompute.com"; sid:545921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcepts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcepts.com"; sid:545922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-connection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-connection.com"; sid:545923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnections.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnections.net"; sid:545924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnections.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnections.world"; sid:545925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconquer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconquer.com"; sid:545926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-conversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-conversations.com"; sid:545927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperfield.com"; sid:545928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostume.com"; sid:545929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrestoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrestoration.com"; sid:545930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisconsultants.com"; sid:545931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcunts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcunts.com"; sid:545932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathtoll.com"; sid:545933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebts.com"; sid:545934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensesupplies.com"; sid:545935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddemystified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddemystified.com"; sid:545936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesignermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesignermask.com"; sid:545937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesignermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesignermasks.com"; sid:545938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-drug.com"; sid:545939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideangeometry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideangeometry.com"; sid:545940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlawyer.com"; sid:545941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlawyers.com"; sid:545942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemsfund.com"; sid:545943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendtoday.com"; sid:545944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideogames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideogames.com"; sid:545945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.equipment"; sid:545946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidequipment.com"; sid:545947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.exchange - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.exchange"; sid:545948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-express.com"; sid:545949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfail.com"; sid:545950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecontent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecontent.com"; sid:545951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenow.com"; sid:545952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.zone"; sid:545953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfronliners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfronliners.com"; sid:545954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontliners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontliners.com"; sid:545955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundingaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundingaccess.com"; sid:545956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunding.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunding.co.uk"; sid:545957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundingsupport.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundingsupport.co.uk"; sid:545958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenome.com"; sid:545959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgilant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgilant.com"; sid:545960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgram.com"; sid:545961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrocery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrocery.com"; sid:545962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhacker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhacker.com"; sid:545963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcmc.com"; sid:545964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hcq.com"; sid:545965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcq.com"; sid:545966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthassistance.com"; sid:545967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroproject.com"; sid:545968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheros.com"; sid:545969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhope.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhope.today"; sid:545970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.house"; sid:545971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhr.com"; sid:545972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicu.com"; sid:545973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidideas.com"; sid:545974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidifornia.com"; sid:545975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincentives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincentives.com"; sid:545976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiainitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiainitiative.com"; sid:545977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiainitiave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiainitiave.com"; sid:545978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfous.com"; sid:545979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsightsinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsightsinstitute.com"; sid:545980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaim.com"; sid:545981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancecoverage.com"; sid:545982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-inventory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-inventory.com"; sid:545983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvesting.com"; sid:545984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiota.com"; sid:545985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotas.com"; sid:545986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobassistance.com"; sid:545987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobcenter.com"; sid:545988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobclaims.com"; sid:545989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillers.biz"; sid:545990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillersoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillersoap.com"; sid:545991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkit.net"; sid:545992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsonline.com"; sid:545993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkoala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkoala.com"; sid:545994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabs.net"; sid:545995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlease.com"; sid:545996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegacy.com"; sid:545997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlex.com"; sid:545998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-local.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-local.com"; sid:545999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocal.net"; sid:546000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogs.com"; sid:546001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mapper.com"; sid:546002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeds.net"; sid:546003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialday.com"; sid:546004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmission.com"; sid:546005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletesting.com"; sid:546006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagerelief.com"; sid:546007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmusim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmusim.com"; sid:546008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-my.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-my.com"; sid:546009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyrent.com"; sid:546010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnaija.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnaija.com"; sid:546011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnerds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnerds.com"; sid:546012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnetwork.net"; sid:546013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsletter.com"; sid:546014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewworld.com"; sid:546015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnovel.com"; sid:546016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnovelette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnovelette.com"; sid:546017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobits.com"; sid:546018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomics.com"; sid:546019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlineeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlineeducation.com"; sid:546020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidout.net"; sid:546021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpakistan.com"; sid:546022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.parts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.parts"; sid:546023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpath.com"; sid:546024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayouts.com"; sid:546025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpenpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpenpal.com"; sid:546026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphysio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphysio.com"; sid:546027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpledge.com"; sid:546028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-policy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-policy.com"; sid:546029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidportal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidportal.net"; sid:546030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesupplies.com"; sid:546031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevpak.com"; sid:546032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-progress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-progress.net"; sid:546033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionmask.com"; sid:546034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantine2020.com"; sid:546035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinebunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinebunker.com"; sid:546036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinecooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinecooking.com"; sid:546037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinis.com"; sid:546038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantino.com"; sid:546039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradio.com"; sid:546040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rapid-response-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rapid-response-india.com"; sid:546041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrd.com"; sid:546042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreactions.com"; sid:546043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ready.com"; sid:546044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealtime.com"; sid:546045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovery2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovery2020.com"; sid:546046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregister.com"; sid:546047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehab.com"; sid:546048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehabilitation.com"; sid:546049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcefinder.com"; sid:546050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpp.com"; sid:546051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpphometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpphometest.com"; sid:546052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpptest.com"; sid:546053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrt.com"; sid:546054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrx.net"; sid:546055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrxpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrxpak.com"; sid:546056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sanitize.com"; sid:546057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sanitizers.com"; sid:546058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizingservices.com"; sid:546059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsec.com"; sid:546060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secure.com"; sid:546061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.net"; sid:546062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfcheck.com"; sid:546063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shield-mission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shield-mission.com"; sid:546064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldmission.com"; sid:546065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshipt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshipt.com"; sid:546066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshopping.com"; sid:546067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmash.com"; sid:546068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnz.com"; sid:546069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-solidarity-singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-solidarity-singapore.com"; sid:546070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolution.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolution.net"; sid:546071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaffing.com"; sid:546072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstamp.com"; sid:546073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstestkit.com"; sid:546074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoryz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoryz.com"; sid:546075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstreet.com"; sid:546076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstresstherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstresstherapy.com"; sid:546077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyconnection.com"; sid:546078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsux.com"; sid:546079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtacking.com"; sid:546080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxtriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxtriage.com"; sid:546081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechnology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechnology.net"; sid:546082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenant.com"; sid:546083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest19.com"; sid:546084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-lab.com"; sid:546085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestshop.com"; sid:546086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.tips"; sid:546087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthinking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthinking.com"; sid:546088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthyneighbor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthyneighbor.com"; sid:546089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimesproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimesproject.com"; sid:546090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoy.com"; sid:546091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraker.com"; sid:546092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatment.net"; sid:546093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrek.com"; sid:546094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtribe.com"; sid:546095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrkr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrkr.com"; sid:546096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrue.com"; sid:546097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtutor.com"; sid:546098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtutoring.com"; sid:546099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusatesting.com"; sid:546100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusatesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusatesting.net"; sid:546101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvalencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvalencia.com"; sid:546102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaxx.com"; sid:546103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidville.com"; sid:546104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvip.com"; sid:546105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualdoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualdoctor.com"; sid:546106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualdx.com"; sid:546107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualmd.com"; sid:546108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualvisits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualvisits.com"; sid:546109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus2019.com"; sid:546110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteering.com"; sid:546111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvu.com"; sid:546112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidward.com"; sid:546113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.world"; sid:546114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwills.com"; sid:546115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinners.com"; sid:546116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldstatus.com"; sid:546117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrongfuldeath.com"; sid:546118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesvscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesvscovid-19.com"; sid:546119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesvscovid19.com"; sid:546120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityvscovid.com"; sid:546121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingcorona.com"; sid:546122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingthecorona.com"; sid:546123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crypto4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crypto4corona.com"; sid:546124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptoforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptoforcorona.com"; sid:546125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubacovid19.com"; sid:546126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona.biz"; sid:546127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirus.biz"; sid:546128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19.biz"; sid:546129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid-19.com"; sid:546130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid19.com"; sid:546131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronavirusupdate.com"; sid:546132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascoronarecovery.com"; sid:546133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccovidclean.com"; sid:546134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccovidcleanup.com"; sid:546135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadcoronavirusbounce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadcoronavirusbounce.com"; sid:546136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadcoronavirus.com"; sid:546137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcoronavirusanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcoronavirusanxiety.com"; sid:546138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for declaratiedeplasarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"declaratiedeplasarecoronavirus.com"; sid:546139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeet-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeet-pandemic.com"; sid:546140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeetpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeetpandemic.com"; sid:546141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeetthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeetthepandemic.com"; sid:546142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denunciacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denunciacoronavirus.com"; sid:546143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for der-corona-effekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"der-corona-effekt.com"; sid:546144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descoronate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descoronate.com"; sid:546145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designagainstcorona.com"; sid:546146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectar-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectar-coronavirus.com"; sid:546147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dethronecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dethronecorona.com"; sid:546148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovid19products.com"; sid:546149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digicorona.com"; sid:546150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezioneviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezioneviruscorona.com"; sid:546151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divacoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divacoronas.com"; sid:546152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorforcorona.com"; sid:546153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doeszachhavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doeszachhavecorona.com"; sid:546154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doktercovid5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doktercovid5.com"; sid:546155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid-19.com"; sid:546156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovidsupplies.com"; sid:546157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcovid.com"; sid:546158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcovidvictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcovidvictim.com"; sid:546159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocovid19.com"; sid:546160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocovid19relief.com"; sid:546161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doncovid-19.com"; sid:546162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontpassthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontpassthecorona.com"; sid:546163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drsebicoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drsebicoronakit.com"; sid:546164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dubaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dubaicorona.com"; sid:546165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidhelp.com"; sid:546166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidinfo.com"; sid:546167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emccovid19.com"; sid:546168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid19live.com"; sid:546169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencyprocedurescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencyprocedurescoronavirus.com"; sid:546170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionalsurvivorkitforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionalsurvivorkitforcoronavirus.com"; sid:546171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovid19claims.com"; sid:546172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronacrisis.com"; sid:546173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19.world"; sid:546174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcovid19.com"; sid:546175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicoronavirus.com"; sid:546176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-pen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-pen.com"; sid:546177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-protection.com"; sid:546178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ertecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ertecovid.net"; sid:546179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esterilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esterilcovid.com"; sid:546180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etoncorona.com"; sid:546181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evolucioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evolucioncovid19.com"; sid:546182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ewcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ewcovid.com"; sid:546183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask4covid19.com"; sid:546184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faithandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faithandcovid19.com"; sid:546185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakepandemic.com"; sid:546186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallinginlovewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallinginlovewithcovid19.com"; sid:546187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faqcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faqcovid.com"; sid:546188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fast-coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fast-coronatest.com"; sid:546189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcoronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcoronaloans.com"; sid:546190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for felizcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"felizcorona.com"; sid:546191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffariqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffariqcovid19.com"; sid:546192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirustime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirustime.com"; sid:546193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidtogether.com"; sid:546194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightepidemic.com"; sid:546195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcoronatogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcoronatogether.com"; sid:546196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirussupplies.com"; sid:546197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid-19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid-19supplies.com"; sid:546198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19supplies.com"; sid:546199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidtests.com"; sid:546200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flacovidcleanup.com"; sid:546201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaaction.com"; sid:546202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaaction.net"; sid:546203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridahealthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridahealthcovid19.com"; sid:546204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for focovideo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"focovideo.net"; sid:546205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forbidthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forbidthecovid.com"; sid:546206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for force-majeure-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"force-majeure-coronavirus.com"; sid:546207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foundation-prevention-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foundation-prevention-corona.com"; sid:546208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free4corona.com"; sid:546209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fthecoronavirus.com"; sid:546210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona.party"; sid:546211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirus2020.com"; sid:546212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthispandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthispandemic.com"; sid:546213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckucovid19.com"; sid:546214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckwuhanflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckwuhanflu.com"; sid:546215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundraiseforpandemic.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundraiseforpandemic.solutions"; sid:546216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureofcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureofcoronavirus.biz"; sid:546217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gainesvillecovid.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gainesvillecovid.support"; sid:546218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gatecovid19.com"; sid:546219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaysexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaysexcoronavirus.com"; sid:546220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geo-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geo-covid-19.com"; sid:546221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gestion-impact-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gestion-impact-covid19.com"; sid:546222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronamoney.com"; sid:546223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronamoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronamoney.net"; sid:546224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronanews.com"; sid:546225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronasigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronasigns.com"; sid:546226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatestkit.com"; sid:546227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusreliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusreliefnow.com"; sid:546228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19data.com"; sid:546229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19results.com"; sid:546230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidcare.com"; sid:546231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidmasks.com"; sid:546232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidmoney.com"; sid:546233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidresults.com"; sid:546234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giftcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giftcoronavirus.com"; sid:546235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for girlcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"girlcoronavirus.com"; sid:546236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.club"; sid:546237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goarmybeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goarmybeatcovid19.com"; sid:546238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goawaycovid.com"; sid:546239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid19.com"; sid:546240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcovidnews.com"; sid:546241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodneighbourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodneighbourcovid19.com"; sid:546242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcoronavirus.com"; sid:546243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterthancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterthancorona.com"; sid:546244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterthancorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterthancorona.net"; sid:546245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid-19.com"; sid:546246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hack-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hack-covid.com"; sid:546247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handheldcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handheldcovid19test.com"; sid:546248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handheldcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handheldcovidtest.com"; sid:546249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicoronavirus.today"; sid:546250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinthetimeofcorona.com"; sid:546251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpaftercoronavirus.com"; sid:546252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronavirus.net"; sid:546253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid19survivors.com"; sid:546254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbalcovid19remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbalcovid19remedy.com"; sid:546255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescovid19.com"; sid:546256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofcovid19.com"; sid:546257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofcovid.com"; sid:546258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hicovid.com"; sid:546259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hlpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hlpcovid19.com"; sid:546260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtofightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtofightcovid.com"; sid:546261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventcovid-19.com"; sid:546262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hsseniorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hsseniorcorona.com"; sid:546263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronavirussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronavirussurvivor.com"; sid:546264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronavirussurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronavirussurvivor.net"; sid:546265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronavirussurvivorof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronavirussurvivorof2020.com"; sid:546266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronavirussurvivorof2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronavirussurvivorof2020.net"; sid:546267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icarecovid19.com"; sid:546268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icaughtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icaughtcovid19.com"; sid:546269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidcare.com"; sid:546270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icpcovid.com"; sid:546271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifightcovid.com"; sid:546272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iglesiadelnazarenocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iglesiadelnazarenocorona.com"; sid:546273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotovercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotovercovid-19.com"; sid:546274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotovercovid19.com"; sid:546275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid19.com"; sid:546276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihateucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihateucovid.com"; sid:546277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imadeitthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imadeitthrucovid.com"; sid:546278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunifycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunifycorona.com"; sid:546279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocorona.com"; sid:546280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imovercorona.com"; sid:546281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imstrongerthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imstrongerthancovid19.com"; sid:546282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiagainstcorona.com"; sid:546283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiapandemic.com"; sid:546284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-corona.net"; sid:546285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovid19test.com"; sid:546286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovidtest.com"; sid:546287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronavirushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronavirushometest.com"; sid:546288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19hometest.com"; sid:546289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intellicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intellicovid.com"; sid:546290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intercovid.com"; sid:546291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internet-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internet-covid19.com"; sid:546292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacovid.com"; sid:546293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowncorona.com"; sid:546294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowncovid19.com"; sid:546295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowncovid.com"; sid:546296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iownedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iownedcorona.com"; sid:546297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iownedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iownedcovid19.com"; sid:546298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iownedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iownedcovid.com"; sid:546299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irecoveredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irecoveredcovid19.com"; sid:546300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronaviruscrisisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronaviruscrisisover.com"; sid:546301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusdefeatedyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusdefeatedyet.com"; sid:546302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvidedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvidedcovid.com"; sid:546303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecovid2020.com"; sid:546304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedaglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedaglobalpandemic.com"; sid:546305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for it4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"it4coronavirus.com"; sid:546306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkihavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkihavecovid.com"; sid:546307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivccurescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivccurescoronavirus.com"; sid:546308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincallcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincallcoronav.com"; sid:546309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontraelcovid.com"; sid:546310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmcoronaviruson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmcoronaviruson.com"; sid:546311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmcovid19.com"; sid:546312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepoutcovid.com"; sid:546313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kfw-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kfw-corona.com"; sid:546314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronaout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronaout.com"; sid:546315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcorona.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcorona.run"; sid:546316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasass.com"; sid:546317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickingcovid.com"; sid:546318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickthecorona.com"; sid:546319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19withkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19withkindness.com"; sid:546320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidwithkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidwithkindness.com"; sid:546321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitchenhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitchenhelpcovid19.com"; sid:546322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowcovid.com"; sid:546323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koreanamericanstoriescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koreanamericanstoriescovid19.com"; sid:546324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronacovid19.com"; sid:546325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labancovid19.com"; sid:546326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lanzarotecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lanzarotecovid.com"; sid:546327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laporcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laporcorona.com"; sid:546328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laporcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laporcovid19.com"; sid:546329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirutips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirutips.com"; sid:546330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadbeyondcorona.com"; sid:546331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadershipbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadershipbeyondcorona.com"; sid:546332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningfromthepandemic.com"; sid:546333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebanoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebanoncovid19.com"; sid:546334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leonmedicalcenters-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leonmedicalcenters-coronavirus.com"; sid:546335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcorona.com"; sid:546336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromthepandemic.com"; sid:546337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscrushcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscrushcorona.com"; sid:546338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsdefeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsdefeatcovid19.com"; sid:546339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsdefeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsdefeatcovid19.net"; sid:546340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letterstocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letterstocovid.net"; sid:546341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liebe-in-zeiten-von-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liebe-in-zeiten-von-corona.com"; sid:546342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecoronafree.com"; sid:546343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecovid19.com"; sid:546344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilwuhan.com"; sid:546345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiacovid.com"; sid:546346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for littlewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"littlewuhan.com"; sid:546347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaftercorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaftercorona.club"; sid:546348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19tv.com"; sid:546349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovidfirstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovidfirstresponders.com"; sid:546350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livrocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livrocoronavirus.com"; sid:546351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for llanrhaedrcoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"llanrhaedrcoronasupport.com"; sid:546352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcorona.net"; sid:546353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcoronaviruses.com"; sid:546354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeof-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeof-corona.com"; sid:546355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronafilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronafilm.com"; sid:546356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeof-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeof-coronavirus.com"; sid:546357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidcleanup.com"; sid:546358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madadcorona.com"; sid:546359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for make4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"make4covid.net"; sid:546360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeacoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeacoronamask.com"; sid:546361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeacoronamask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeacoronamask.net"; sid:546362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacoronavirusbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacoronavirusbrasil.com"; sid:546363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovid.com"; sid:546364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maricopacountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maricopacountycovid19.com"; sid:546365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingbeyondcorona.com"; sid:546366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid.com"; sid:546367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid.net"; sid:546368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-anti-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-anti-corona.com"; sid:546369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-for-covid19.com"; sid:546370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-ce-fda-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-ce-fda-covid19.com"; sid:546371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-disposable-protective-equipment-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-disposable-protective-equipment-covid19.com"; sid:546372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcovid.com"; sid:546373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovidcleanup.com"; sid:546374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for me2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"me2corona.com"; sid:546375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediapandemic.com"; sid:546376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcorona.com"; sid:546377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-supplies-for-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-supplies-for-covid-19.com"; sid:546378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medi-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medi-corona.com"; sid:546379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for melcovid19checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"melcovid19checker.com"; sid:546380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metoocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metoocorona.com"; sid:546381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamidadecovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamidadecovidcleanup.com"; sid:546382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mission-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mission-covid19.com"; sid:546383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncovid19.com"; sid:546384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mlivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mlivecovid.com"; sid:546385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidlabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidlabtest.com"; sid:546386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moniteaucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moniteaucovid19.com"; sid:546387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movementtodefeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movementtodefeatcovid19.com"; sid:546388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movementtodefeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movementtodefeatcovid19.net"; sid:546389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for murfreesborocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"murfreesborocoronavirus.com"; sid:546390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicxcovid19.com"; sid:546391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musimcovid.com"; sid:546392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaacademy.com"; sid:546393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababyboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababyboomer.com"; sid:546394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabeard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabeard.com"; sid:546395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaboom.com"; sid:546396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafacemask.com"; sid:546397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafight.com"; sid:546398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruscrisis.com"; sid:546399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusjourney.com"; sid:546400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusresults.com"; sid:546401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19case.com"; sid:546402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covid19-shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covid19-shot.com"; sid:546403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19tester.com"; sid:546404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19testresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19testresults.com"; sid:546405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidclaim.com"; sid:546406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhelp.com"; sid:546407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidinfo.com"; sid:546408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynewcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynewcorona.com"; sid:546409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicpregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicpregnancy.com"; sid:546410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestcoronavirus.com"; sid:546411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacerentiemposdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacerentiemposdecoronavirus.com"; sid:546412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19officecleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19officecleaningservices.com"; sid:546413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcorona.com"; sid:546414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaims.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaims.pro"; sid:546415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19fast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19fast.com"; sid:546416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirustherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirustherapy.com"; sid:546417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ndcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ndcovid.com"; sid:546418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcorona.com"; sid:546419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negativecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negativecorona.com"; sid:546420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neighborhoodsafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neighborhoodsafecovid.com"; sid:546421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacoronavirusattorneys.com"; sid:546422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacovid19attorneys.com"; sid:546423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19testkit.com"; sid:546424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19testkits.com"; sid:546425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycoronavirusattorneys.com"; sid:546426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycoronaviruslawyers.com"; sid:546427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronalawyer.com"; sid:546428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirusattorney.com"; sid:546429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirusattorneys.com"; sid:546430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruslawsuit.com"; sid:546431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19attorney.com"; sid:546432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19lawyer.com"; sid:546433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nigeriacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nigeriacovid19.com"; sid:546434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidcleanup.com"; sid:546435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normalityforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normalityforcovid-19.com"; sid:546436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacovidinfo.com"; sid:546437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiasdelcoronavirus.com"; sid:546438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmycovid-19.com"; sid:546439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmycovid19.com"; sid:546440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmycovid.com"; sid:546441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus-19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus-19oracle.com"; sid:546442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirus2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirus2019.net"; sid:546443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesandcovid-19.com"; sid:546444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesandcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesandcovid-19.net"; sid:546445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursingschoolcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursingschoolcorona.com"; sid:546446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycchristiancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycchristiancoronavirus.com"; sid:546447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronaviruslawyers.com"; sid:546448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidcleanup.com"; sid:546449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruslawyers.com"; sid:546450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidcleanup.com"; sid:546451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocagainstcorona.com"; sid:546452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiobusinesscovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiobusinesscovid19claims.com"; sid:546453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocoronavirusclaims.com"; sid:546454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19claims.com"; sid:546455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okccoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okccoronavirushelp.com"; sid:546456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okccovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okccovid19help.com"; sid:546457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponacoronavirus.com"; sid:546458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oncovid.com"; sid:546459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovideducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovideducation.com"; sid:546460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecovid19.com"; sid:546461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracelcovid-19.com"; sid:546462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracelcovid19.com"; sid:546463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecoronavirus-19.com"; sid:546464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oracle-covid--19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oracle-covid--19.com"; sid:546465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclecovid--19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclecovid--19.com"; sid:546466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraclenovelcoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraclenovelcoronavirus-19.com"; sid:546467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcalecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcalecovid-19.com"; sid:546468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcalecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcalecovid19.com"; sid:546469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncovidtest.com"; sid:546470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourstoriesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourstoriesofcovid.com"; sid:546471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outshinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outshinecorona.com"; sid:546472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outshinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outshinecoronavirus.com"; sid:546473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overheadcoronation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overheadcoronation.net"; sid:546474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovidcleanup.com"; sid:546475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pallicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pallicovid.com"; sid:546476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.life"; sid:546477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020photos.com"; sid:546478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic202x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic202x.com"; sid:546479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-ai.com"; sid:546480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessstartuppackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessstartuppackage.com"; sid:546481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuster.com"; sid:546482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cat.com"; sid:546483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccat.com"; sid:546484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccentre.com"; sid:546485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdata.net"; sid:546486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiced.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiced.com"; sid:546487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfilmchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfilmchallenge.com"; sid:546488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfilmfestival.com"; sid:546489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicheal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicheal.com"; sid:546490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvesting.com"; sid:546491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjustice.com"; sid:546492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclovestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclovestories.com"; sid:546493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclovestory.com"; sid:546494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmarket.com"; sid:546495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmed.com"; sid:546496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedkit.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedkit.bid"; sid:546497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpals.net"; sid:546498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpastoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpastoring.com"; sid:546499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivot.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivot.pro"; sid:546500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivots.com"; sid:546501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivot.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivot.solutions"; sid:546502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpizza.com"; sid:546503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpizzas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpizzas.com"; sid:546504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplates.com"; sid:546505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpotion.com"; sid:546506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prepared.com"; sid:546507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparedkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparedkit.com"; sid:546508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesskit.com"; sid:546509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesskits.com"; sid:546510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionmonth.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionmonth.biz"; sid:546511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprintco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprintco.com"; sid:546512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofstocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofstocks.com"; sid:546513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-protection.com"; sid:546514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionproducts.com"; sid:546515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpup.com"; sid:546516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrate.com"; sid:546517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecovery2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecovery2020.com"; sid:546518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-recovery.com"; sid:546519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresource.net"; sid:546520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-resources.com"; sid:546521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrobotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrobotics.com"; sid:546522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafesex.com"; sid:546523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetypass.com"; sid:546524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetypass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetypass.net"; sid:546525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsandbutter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsandbutter.com"; sid:546526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicschool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicschool.net"; sid:546527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshift.com"; sid:546528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskateco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskateco.com"; sid:546529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsquare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsquare.com"; sid:546530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicssupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicssupply.com"; sid:546531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstories2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstories2020.com"; sid:546532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivor.net"; sid:546533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteach.com"; sid:546534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-therapy.com"; sid:546535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictherapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictherapy.net"; sid:546536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictutor.com"; sid:546537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvoices.com"; sid:546538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentsinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentsinpandemic.com"; sid:546539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partyafterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partyafterpandemic.com"; sid:546540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pawscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pawscorona.com"; sid:546541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofthepandemic.com"; sid:546542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycovidcleanup.com"; sid:546543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phtacoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phtacoronaupdate.com"; sid:546544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pizzavspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pizzavspandemic.com"; sid:546545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pizzavspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pizzavspandemic.net"; sid:546546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pledgecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pledgecoronavirus.com"; sid:546547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pledgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pledgecovid19.com"; sid:546548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadisease.com"; sid:546549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronageneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronageneration.com"; sid:546550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalife.com"; sid:546551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronamovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronamovement.com"; sid:546552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapost.com"; sid:546553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastories.com"; sid:546554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-19.com"; sid:546555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlessons.com"; sid:546556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.com"; sid:546557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.net"; sid:546558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenircovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenircovid19.net"; sid:546559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcorona.biz"; sid:546560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirus.biz"; sid:546561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19.biz"; sid:546562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingthecoronavirus.com"; sid:546563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prinzocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prinzocovid19.com"; sid:546564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profitoverpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profitoverpandemic.com"; sid:546565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profitsoverpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profitsoverpandemic.com"; sid:546566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolcovid.com"; sid:546567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocovid.com"; sid:546568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid.com"; sid:546569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebascoronavirus.com"; sid:546570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prxcoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prxcoronachallenge.com"; sid:546571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologoscoronavirus.com"; sid:546572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychologyofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychologyofcoronavirus.com"; sid:546573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychologyofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychologyofcovid19.com"; sid:546574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychologypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychologypandemic.com"; sid:546575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qbecovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qbecovidtracker.com"; sid:546576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questcovid-19.com"; sid:546577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questcovid19.com"; sid:546578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19.com"; sid:546579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rajcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rajcovidinfo.com"; sid:546580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest-covid19.com"; sid:546581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for real-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"real-coronavirus.com"; sid:546582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatecovid19.com"; sid:546583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realhousewivesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realhousewivesofcorona.com"; sid:546584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtorcovid19.com"; sid:546585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebuildingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebuildingaftercorona.com"; sid:546586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsanwalt-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsanwalt-corona.com"; sid:546587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveredcovid19.com"; sid:546588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remediescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remediescorona.com"; sid:546589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovidspreaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovidspreaders.com"; sid:546590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportingcovid19.com"; sid:546591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for republiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"republiccorona.com"; sid:546592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for researchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"researchcorona.com"; sid:546593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for researchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"researchcovid.com"; sid:546594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondingtocovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondingtocovid19pandemic.com"; sid:546595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondingtocovid19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondingtocovid19pandemic.net"; sid:546596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailvscorona.com"; sid:546597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailvscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailvscorona.net"; sid:546598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reversecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reversecorona.com"; sid:546599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roarcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roarcoronavirus19.com"; sid:546600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roarcoronavirus20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roarcoronavirus20.com"; sid:546601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roarcoronavirus.com"; sid:546602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rpacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rpacovid.com"; sid:546603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ruhlcovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ruhlcovidfund.com"; sid:546604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ruinedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ruinedbycovid.com"; sid:546605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacoronavirus.com"; sid:546606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safesexpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safesexpandemic.com"; sid:546607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid-19.com"; sid:546608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid-19.net"; sid:546609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveyourbusinesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveyourbusinesscovid19.com"; sid:546610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveyourbusinessnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveyourbusinessnowcovid19.com"; sid:546611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-coronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-coronaloans.com"; sid:546612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-coronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-coronavirusloans.com"; sid:546613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loan.com"; sid:546614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloans4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloans4coronavirus.com"; sid:546615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sealcovid19.com"; sid:546616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secure-account-covid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secure-account-covid2020.com"; sid:546617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segurocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segurocovid.com"; sid:546618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sen-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sen-coronavirus.com"; sid:546619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendcoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendcoronasupplies.com"; sid:546620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serangancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serangancovid.com"; sid:546621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for setadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"setadcorona.com"; sid:546622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for severeacuterespiratorysyndromecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"severeacuterespiratorysyndromecoronavirus.com"; sid:546623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharethecarecovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharethecarecovid192020.com"; sid:546624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharethecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharethecovidcare.com"; sid:546625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shield-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shield-coronavirus.com"; sid:546626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shield-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shield-covid.com"; sid:546627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shilajitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shilajitcovid19.com"; sid:546628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shiptcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shiptcorona.com"; sid:546629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shiptcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shiptcoronavirus.com"; sid:546630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shiptcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shiptcovid19.com"; sid:546631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shiptcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shiptcovid.com"; sid:546632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shirtsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shirtsforcorona.com"; sid:546633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoppingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoppingcorona.com"; sid:546634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sigacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sigacorona.com"; sid:546635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skcovid.com"; sid:546636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirus.com"; sid:546637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirusloan.com"; sid:546638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovid19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovid19loan.com"; sid:546639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smokeoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smokeoutcovid19.com"; sid:546640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivialcovid19.com"; sid:546641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soforthilfe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soforthilfe-coronavirus.com"; sid:546642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidaritecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidaritecovid19.com"; sid:546643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soovercorona.com"; sid:546644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soovercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soovercorona.net"; sid:546645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standinguptocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standinguptocoronavirus.com"; sid:546646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standinguptocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standinguptocovid19.com"; sid:546647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuppandemic.com"; sid:546648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuptocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuptocoronavirus.com"; sid:546649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuptocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuptocovid19.com"; sid:546650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomeandkillcorona.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomeandkillcorona.solutions"; sid:546651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomeandkillcorona.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomeandkillcorona.support"; sid:546652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stompcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stompcorona.com"; sid:546653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona-dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona-dz.com"; sid:546654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaeviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaeviction.com"; sid:546655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafund.com"; sid:546656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusnow.net"; sid:546657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusshop.com"; sid:546658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusspreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusspreading.com"; sid:546659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.cat"; sid:546660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19spread.com"; sid:546661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.co - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.co"; sid:546662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stpeterscovidmutualaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stpeterscovidmutualaid.com"; sid:546663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressfreecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressfreecorona.com"; sid:546664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressfreecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressfreecovid19.com"; sid:546665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressfromcorona.com"; sid:546666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressfromcovid19.com"; sid:546667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for successbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"successbeyondcorona.com"; sid:546668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovidsurvivors.com"; sid:546669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportforcovid-19.com"; sid:546670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportforcovid19.com"; sid:546671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportforcovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportforcovidsurvivors.com"; sid:546672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthecoronavirus.net"; sid:546673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviveepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviveepidemic.com"; sid:546674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivepidemic.com"; sid:546675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swagit-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swagit-covid.com"; sid:546676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tablet4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tablet4coronavirus.com"; sid:546677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tablet4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tablet4covid19.com"; sid:546678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tabodi-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tabodi-coronavirus.net"; sid:546679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacoronada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacoronada.com"; sid:546680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacovid.com"; sid:546681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoutcovidbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoutcovidbayarea.com"; sid:546682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcoronatest.com"; sid:546683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid19test.com"; sid:546684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovidtest.com"; sid:546685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-coronavirus-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-coronavirus-france.com"; sid:546686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19yourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19yourself.com"; sid:546687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedocovid19.com"; sid:546688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testeparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testeparacovid19.com"; sid:546689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmeforcovid.com"; sid:546690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmycorona.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmycorona.zone"; sid:546691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thailandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thailandcorona.com"; sid:546692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankacovidhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankacovidhero.com"; sid:546693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcovidheroes.com"; sid:546694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankheroesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankheroesofcovid.com"; sid:546695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechroniclesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechroniclesofcorona.com"; sid:546696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechurchbeyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechurchbeyondcorona.com"; sid:546697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaaffect.com"; sid:546698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabattle.com"; sid:546699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabeervirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabeervirus.com"; sid:546700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadilemma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadilemma.com"; sid:546701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadoctor.com"; sid:546702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafilm.com"; sid:546703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahero.com"; sid:546704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaparty.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaparty.life"; sid:546705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusexperts.com"; sid:546706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustimes.com"; sid:546707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19awakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19awakening.com"; sid:546708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19porn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19porn.com"; sid:546709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidawakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidawakening.com"; sid:546710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchronicles.net"; sid:546711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconnection.com"; sid:546712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcure.net"; sid:546713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidheroproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidheroproject.com"; sid:546714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidianage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidianage.com"; sid:546715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmovie.com"; sid:546716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themediapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themediapandemic.com"; sid:546717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoriginalcoronathemusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoriginalcoronathemusical.com"; sid:546718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicartshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicartshow.com"; sid:546719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicfallout.com"; sid:546720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpivot.com"; sid:546721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicprepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicprepper.com"; sid:546722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepositivitypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepositivitypandemic.com"; sid:546723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovidworld.com"; sid:546724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemic.com"; sid:546725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcovid-19.com"; sid:546726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcorona.com"; sid:546727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisischicagocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisischicagocovid19.com"; sid:546728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivecovid19.com"; sid:546729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncoronalawyer.com"; sid:546730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncovid19lawyer.com"; sid:546731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncovid19lawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncovid19lawyer.net"; sid:546732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todahcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todahcoronavirus.com"; sid:546733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todahcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todahcovid19.com"; sid:546734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontraocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontraocoronavirus.com"; sid:546735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tostopthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tostopthecoronavirus.com"; sid:546736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismusnachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismusnachcorona.com"; sid:546737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovid.net"; sid:546738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19cures.com"; sid:546739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackercoronavirus.com"; sid:546740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackthecovid19.com"; sid:546741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traditionalchinesemedicinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traditionalchinesemedicinecovid19.com"; sid:546742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribecoronavirus.com"; sid:546743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribecovid.com"; sid:546744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trotz-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trotz-corona.net"; sid:546745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for troussecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"troussecovid19.com"; sid:546746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trucovid19.com"; sid:546747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutpandemicflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutpandemicflu.com"; sid:546748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirt-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirt-corona.com"; sid:546749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtcorona.com"; sid:546750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirt-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirt-coronavirus.com"; sid:546751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtcoronavirus.com"; sid:546752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirt-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirt-covid19.com"; sid:546753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtcovid19.com"; sid:546754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uaepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uaepandemic.com"; sid:546755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandcovid.com"; sid:546756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedcovid19.com"; sid:546757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedvscovid.com"; sid:546758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unofficialcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unofficialcoronavirusmask.com"; sid:546759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for update-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"update-covid19.com"; sid:546760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgence-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgence-covid.com"; sid:546761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgencecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgencecovid.com"; sid:546762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronacleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronacleaner.com"; sid:546763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronacleaners.com"; sid:546764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronarecovery.com"; sid:546765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-covid19-per-capita.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-covid19-per-capita.net"; sid:546766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcleanup.com"; sid:546767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidhelp.com"; sid:546768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtracker.com"; sid:546769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v4corona.com"; sid:546770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacoronaclaims.com"; sid:546771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovidclean.com"; sid:546772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovidcleanup.com"; sid:546773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifycorona.com"; sid:546774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimofcovid19.com"; sid:546775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimofcovid.com"; sid:546776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidol-covid19forms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidol-covid19forms.com"; sid:546777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vircovid19.com"; sid:546778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid19.com"; sid:546779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vittimedicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vittimedicovid19.com"; sid:546780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vntestkit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vntestkit-covid19.com"; sid:546781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid19stats.com"; sid:546782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warcoronavirus.com"; sid:546783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waystopreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waystopreventcoronavirus.com"; sid:546784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecountcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecountcovid19.com"; sid:546785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcoronavirus-uae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcoronavirus-uae.com"; sid:546786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcovid.com"; sid:546787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-vs-corona.com"; sid:546788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatdidyouduringthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatdidyouduringthecorona.com"; sid:546789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronavirus.biz"; sid:546790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoinapandemic.com"; sid:546791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencoronavirusends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencoronavirusends.com"; sid:546792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whhatiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whhatiscoronavirus.com"; sid:546793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whosopencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whosopencovid19.com"; sid:546794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcorona.com"; sid:546795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcoronavirus.com"; sid:546796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcovid19.com"; sid:546797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wir-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wir-gegen-corona.com"; sid:546798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingfromhomewithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingfromhomewithcovid-19.com"; sid:546799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingfromhomewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingfromhomewithcovid19.com"; sid:546800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workinthetimeofcorona.net"; sid:546801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercoronavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercoronavir.com"; sid:546802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercoronavirus.com"; sid:546803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldbeforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldbeforecorona.com"; sid:546804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpostcorona.com"; sid:546805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpostcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpostcorona.net"; sid:546806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpcovid19resources.com"; sid:546807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan6868.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan6868.com"; sid:546808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbatmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbatmobile.com"; sid:546809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancc.net"; sid:546810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirustariffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirustariffs.com"; sid:546811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyhfkyy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyhfkyy.com"; sid:546812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyicai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyicai.com"; sid:546813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid-19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid-19oracle.com"; sid:546814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xiaocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xiaocorona.com"; sid:546815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronarengrning-fub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronarengrning-fub.com"; sid:546816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--psiclogosfrentealcovid-yfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--psiclogosfrentealcovid-yfc.com"; sid:546817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19story.com"; sid:546818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourstorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourstorycovid19.com"; sid:546819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yovenciacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yovenciacovid-19.com"; sid:546820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zencorona.com"; sid:546821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zim-covid19-petition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zim-covid19-petition.com"; sid:546822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebycovid.com"; sid:546823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebycovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebycovids19.com"; sid:546824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebythecovid18.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebythecovid18.com"; sid:546825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebythecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebythecovid.com"; sid:546826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebythecovideos19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebythecovideos19.com"; sid:546827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiebythecovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiebythecovids19.com"; sid:546828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiesbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiesbycovid19.com"; sid:546829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiesbythecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiesbythecovid19.com"; sid:546830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1918pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1918pandemic.com"; sid:546831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1againstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1againstcovid19.com"; sid:546832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronacovid19.com"; sid:546833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-thepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-thepandemic.com"; sid:546834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020thepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020thepandemic.com"; sid:546835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4cornerscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4cornerscovid.com"; sid:546836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911-covid.com"; sid:546837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 91coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"91coronado.com"; sid:546838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcsofcoronavirus.com"; sid:546839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid19virus.com"; sid:546840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abqfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abqfightcovid19.com"; sid:546841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actioncovid19.com"; sid:546842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscoronaviruscovid19.com"; sid:546843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectados-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectados-covid19.com"; sid:546844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid19.net"; sid:546845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterccovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterccovid192020.com"; sid:546846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.biz"; sid:546847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronabusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronabusiness.com"; sid:546848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaconsulting.com"; sid:546849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaeconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaeconomy.com"; sid:546850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronarecovery.com"; sid:546851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.today"; sid:546852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid.com"; sid:546853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid.net"; sid:546854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agro-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agro-covid19.com"; sid:546855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agrocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agrocovid19.com"; sid:546856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidefinancierecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidefinancierecovid19.com"; sid:546857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajournalofthecoronayear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajournalofthecoronayear.com"; sid:546858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovid19ppe.com"; sid:546859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alburycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alburycovid.net"; sid:546860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alticeusacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alticeusacovid19.com"; sid:546861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncoronavirus.com"; sid:546862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanacademycovidsafedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanacademycovidsafedentistry.com"; sid:546863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanacademycovidsafedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanacademycovidsafedentists.com"; sid:546864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanacademyofcovidsafedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanacademyofcovidsafedentistry.com"; sid:546865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanacademyofcovidsafedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanacademyofcovidsafedentists.com"; sid:546866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiemposdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiemposdecovid19.com"; sid:546867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiemposdelacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiemposdelacovid19.com"; sid:546868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for an-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"an-covid19.com"; sid:546869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antcovid.com"; sid:546870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.biz"; sid:546871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronakits.com"; sid:546872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamap.com"; sid:546873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.life"; sid:546874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.center"; sid:546875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19-pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19-pharmacy.com"; sid:546876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.solutions"; sid:546877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivcovid.com"; sid:546878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anytimecovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anytimecovid19cleaning.com"; sid:546879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for api-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"api-corona.com"; sid:546880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcovid-19.com"; sid:546881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucoronavirusready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucoronavirusready.com"; sid:546882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artforcorona.com"; sid:546883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionafectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionafectadoscoronavirus.com"; sid:546884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asucovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asucovid19test.com"; sid:546885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronakits.com"; sid:546886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid19testing.com"; sid:546887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlanticnickelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlanticnickelcovid19.com"; sid:546888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacoronaunite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacoronaunite.com"; sid:546889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australian-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australian-corona.com"; sid:546890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocertificazionecovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocertificazionecovid19.club"; sid:546891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocertificazionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocertificazionecovid19.com"; sid:546892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocertificazionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocertificazionecovid.com"; sid:546893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autoevaluacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autoevaluacioncoronavirus.com"; sid:546894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotestcorona.com"; sid:546895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotestcovid19.com"; sid:546896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avestacoronadosprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avestacoronadosprings.com"; sid:546897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaparaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaparaelcoronavirus.com"; sid:546898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19test.com"; sid:546899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babucorona.com"; sid:546900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcy-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcy-coronavirus-covid19.com"; sid:546901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcy-covid19-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcy-covid19-coronavirus.com"; sid:546902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcpcovid19.com"; sid:546903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcovid19.net"; sid:546904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronanow.com"; sid:546905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid-19.net"; sid:546906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidtrial.com"; sid:546907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronafreenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronafreenow.com"; sid:546908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19help.com"; sid:546909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafe-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafe-covid.com"; sid:546910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beware-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beware-corona.com"; sid:546911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizcovid19.com"; sid:546912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackmncovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackmncovidresponse.com"; sid:546913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for block-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"block-coronavirus.com"; sid:546914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookaftercorona.com"; sid:546915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bradfordcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bradfordcovid19.com"; sid:546916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcoronavirus.com"; sid:546917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid19.com"; sid:546918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid19.net"; sid:546919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathingaftercorona.com"; sid:546920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildagainstcovid19.com"; sid:546921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessloanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessloanscoronavirus.com"; sid:546922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bustcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bustcorona.com"; sid:546923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronav1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronav1.com"; sid:546924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-covid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-covid-test.com"; sid:546925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidtestkits.com"; sid:546926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19claims.com"; sid:546927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidcleanup.com"; sid:546928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19claims.com"; sid:546929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camppandemic.com"; sid:546930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carboncleancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carboncleancoronavirus.com"; sid:546931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caughtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caughtcorona.com"; sid:546932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-covid19.com"; sid:546933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cegahcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cegahcovid.com"; sid:546934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronaonline.com"; sid:546935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chillcorona.com"; sid:546936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronaviruspack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronaviruspack.com"; sid:546937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chineseviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chineseviruscorona.com"; sid:546938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chineseviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chineseviruscovid19.com"; sid:546939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christianresponsetocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christianresponsetocovid-19.com"; sid:546940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christianresponsetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christianresponsetocovid19.com"; sid:546941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofcovid.com"; sid:546942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citynews-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citynews-coronavirus.com"; sid:546943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citynews-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citynews-covid19.com"; sid:546944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citytroopscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citytroopscovid-19.com"; sid:546945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityupdates-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityupdates-coronavirus.com"; sid:546946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityupdates-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityupdates-covid19.com"; sid:546947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid.com"; sid:546948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningforcoronavirus.com"; sid:546949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanup-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanup-covid19.com"; sid:546950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cliniccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cliniccoronavirus.com"; sid:546951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedforcorona.com"; sid:546952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid2020.com"; sid:546953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coach-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coach-coronavirus.com"; sid:546954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coastingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coastingcovid.com"; sid:546955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codenamecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codenamecorona.com"; sid:546956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codename-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codename-covid-19.com"; sid:546957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codename-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codename-covid19.com"; sid:546958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeeduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeeduringcovid.com"; sid:546959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colcovid.com"; sid:546960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comcoronavirus.com"; sid:546961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicreliefforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicreliefforcorona.com"; sid:546962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicreliefforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicreliefforcoronavirus.com"; sid:546963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comicreliefforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comicreliefforthecoronavirus.com"; sid:546964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcovid19.com"; sid:546965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for community-covid-19-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"community-covid-19-updates.com"; sid:546966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprarmascarillascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprarmascarillascoronavirus.net"; sid:546967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinedbycorona.com"; sid:546968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinedbycovid19.com"; sid:546969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinedbycovid.com"; sid:546970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecovid.com"; sid:546971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecovid.net"; sid:546972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containingcoronavirus.com"; sid:546973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingwithcovid19.com"; sid:546974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingthroughcovid.com"; sid:546975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coppercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coppercoronavirus.com"; sid:546976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona0.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona0.net"; sid:546977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19aid.com"; sid:546978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19safety.com"; sid:546979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stimulusadvocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stimulusadvocate.com"; sid:546980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-stimulusadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-stimulusadvocates.com"; sid:546981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stimulus-advocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stimulus-advocates.com"; sid:546982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19stimulus.com"; sid:546983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stimulus.com"; sid:546984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona20.net"; sid:546985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaailment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaailment.com"; sid:546986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandbreathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandbreathing.com"; sid:546987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandcovid.com"; sid:546988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-angola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-angola.com"; sid:546989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaangola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaangola.com"; sid:546990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-anspruch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-anspruch.net"; sid:546991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytest.com"; sid:546992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytestkit.com"; sid:546993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantigentest.com"; sid:546994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaappeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaappeals.com"; sid:546995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaappeals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaappeals.net"; sid:546996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartistic.com"; sid:546997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bailout.com"; sid:546998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcylawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcylawgroup.com"; sid:546999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabargain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabargain.com"; sid:547000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabargains.com"; sid:547001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiotest.com"; sid:547002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabliss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabliss.com"; sid:547003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablog2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablog2020.com"; sid:547004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabooguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabooguide.com"; sid:547005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomers.net"; sid:547006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreakup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreakup.com"; sid:547007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrowser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrowser.com"; sid:547008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabubbles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabubbles.net"; sid:547009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburgersandeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburgersandeats.com"; sid:547010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessadviceuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessadviceuk.com"; sid:547011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusiness-strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusiness-strategy.com"; sid:547012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesstips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesstips.com"; sid:547013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster2020.com"; sid:547014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-buttons-and-stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-buttons-and-stickers.com"; sid:547015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalculators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalculators.com"; sid:547016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-calm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-calm.com"; sid:547017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-capital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-capital.com"; sid:547018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalfunds.com"; sid:547019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.center"; sid:547020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarnage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarnage.com"; sid:547021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarnage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarnage.net"; sid:547022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarsprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarsprogram.com"; sid:547023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarsprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarsprogram.net"; sid:547024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacase.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacase.net"; sid:547025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacero.com"; sid:547026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecker.net"; sid:547027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chefinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chefinformation.com"; sid:547028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chefinformationen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chefinformationen.com"; sid:547029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachristandcocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachristandcocktails.com"; sid:547030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicle.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicle.world"; sid:547031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacijfers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacijfers.com"; sid:547032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacipher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacipher.com"; sid:547033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsattorney.com"; sid:547034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactionlawyer.com"; sid:547035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactionlawyers.com"; sid:547036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanhands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanhands.com"; sid:547037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupteams.com"; sid:547038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearinghouse.com"; sid:547039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclips.com"; sid:547040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffeeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffeeshop.com"; sid:547041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombatisrael.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombatisrael.com"; sid:547042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombatisr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombatisr.com"; sid:547043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliance.com"; sid:547044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcertslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcertslive.com"; sid:547045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconf.net"; sid:547046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnected.com"; sid:547047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conomy.com"; sid:547048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-controlling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-controlling.com"; sid:547049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacooks.com"; sid:547050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounsels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounsels.com"; sid:547051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-countdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-countdown.com"; sid:547052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoupon.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoupon.biz"; sid:547053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacov.com"; sid:547054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coverup.com"; sid:547055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaco-vid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaco-vid19.com"; sid:547056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid-19.net"; sid:547057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaco-vid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaco-vid19.net"; sid:547058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidupdate.com"; sid:547059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidupdates.com"; sid:547060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraft.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraft.world"; sid:547061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreative.net"; sid:547062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisinvesting.com"; sid:547063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiselaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiselaw.com"; sid:547064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactivo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactivo.com"; sid:547065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuerpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuerpo.com"; sid:547066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurbcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurbcheck.com"; sid:547067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuring.com"; sid:547068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacypher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacypher.com"; sid:547069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatencheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatencheck.com"; sid:547070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatos.com"; sid:547071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadayz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadayz.com"; sid:547072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dedication.com"; sid:547073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadedication.com"; sid:547074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefense2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefense2020.com"; sid:547075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfectant.com"; sid:547076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetec.com"; sid:547077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detect.com"; sid:547078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevices.com"; sid:547079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiariesfromthe207.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiariesfromthe207.com"; sid:547080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiindonesia.com"; sid:547081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecrisis.com"; sid:547082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseoutbreak.com"; sid:547083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasesigns.com"; sid:547084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasestrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasestrials.com"; sid:547085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasetrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasetrials.com"; sid:547086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-disinfectant.com"; sid:547087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadnatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadnatest.com"; sid:547088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofl.com"; sid:547089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrip.com"; sid:547090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadustmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadustmasks.com"; sid:547091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-edition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-edition.com"; sid:547092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevictionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevictionlawyers.com"; sid:547093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextermination.com"; sid:547094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaezika.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaezika.com"; sid:547095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fakten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fakten.com"; sid:547096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakten.com"; sid:547097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaffiche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaffiche.com"; sid:547098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fighter2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fighter2020.com"; sid:547099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighter2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighter2020.com"; sid:547100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafind.com"; sid:547101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflipside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflipside.com"; sid:547102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafolio.com"; sid:547103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafranceinfos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafranceinfos.com"; sid:547104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecountries.com"; sid:547105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetees.com"; sid:547106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezone2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezone2020.com"; sid:547107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafterparty.com"; sid:547108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagadgetstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagadgetstore.com"; sid:547109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaganic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaganic.com"; sid:547110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gebaeudereinigung-augsburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gebaeudereinigung-augsburg.com"; sid:547111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gebaeudereinigung-augsburg.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gebaeudereinigung-augsburg.net"; sid:547112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagh.com"; sid:547113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirls.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirls.net"; sid:547114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirus.com"; sid:547115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoapp.com"; sid:547116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagood.com"; sid:547117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagray.com"; sid:547118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreatdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreatdepression.com"; sid:547119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreatrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreatrecession.com"; sid:547120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrounded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrounded.com"; sid:547121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagyan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagyan.com"; sid:547122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalters.com"; sid:547123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahappen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahappen.com"; sid:547124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-held.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-held.com"; sid:547125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpglobal.com"; sid:547126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-bundesweit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-bundesweit.com"; sid:547127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-deutschland.com"; sid:547128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-kleinunternehmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-kleinunternehmen.com"; sid:547129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahillschiro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahillschiro.com"; sid:547130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomelab.com"; sid:547131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomelabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomelabs.com"; sid:547132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomelife.com"; sid:547133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hosting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hosting.com"; sid:547134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ideas.com"; sid:547135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpacted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpacted.com"; sid:547136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainainusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainainusa.com"; sid:547137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincentives.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincentives.net"; sid:547138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindia.net"; sid:547139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfopk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfopk.com"; sid:547140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-initaitive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-initaitive.com"; sid:547141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuryattorney.com"; sid:547142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuryattorneys.com"; sid:547143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsa.com"; sid:547144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelawsuit.com"; sid:547145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelawyer.com"; sid:547146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancenow.com"; sid:547147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintheus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintheus.com"; sid:547148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuaa.com"; sid:547149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainua.com"; sid:547150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuda.com"; sid:547151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainusanearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainusanearme.com"; sid:547152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainuss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainuss.com"; sid:547153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvirus.com"; sid:547154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairus-sd.com"; sid:547155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiunsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiunsa.com"; sid:547156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajackpot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajackpot.com"; sid:547157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajackpot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajackpot.net"; sid:547158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajankari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajankari.com"; sid:547159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajatim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajatim.com"; sid:547160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobsguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobsguide.com"; sid:547161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakhabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakhabar.com"; sid:547162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitlabs.com"; sid:547163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoopje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoopje.com"; sid:547164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoopjes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoopjes.com"; sid:547165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise2020.com"; sid:547166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaksa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaksa.com"; sid:547167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyers4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyers4u.com"; sid:547168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legal-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legal-help.com"; sid:547169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalmatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalmatters.com"; sid:547170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalicious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalicious.com"; sid:547171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalife.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalife.network"; sid:547172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live.net"; sid:547173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanerprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanerprogram.com"; sid:547174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalol.com"; sid:547175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loner.com"; sid:547176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalottery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalottery.net"; sid:547177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloves.com"; sid:547178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalovestory.com"; sid:547179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamacro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamacro.com"; sid:547180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamania.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamania.net"; sid:547181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapusa.com"; sid:547182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarijuanadelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarijuanadelivery.com"; sid:547183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketstore.com"; sid:547184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamas.com"; sid:547185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskbrasil.com"; sid:547186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medica.com"; sid:547187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameds.net"; sid:547188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilestones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilestones.com"; sid:547189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionairewebs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionairewebs.com"; sid:547190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-minus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-minus.com"; sid:547191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mit-adhs-kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mit-adhs-kids.com"; sid:547192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoda.com"; sid:547193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-moh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-moh.com"; sid:547194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-moods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-moods.com"; sid:547195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamopup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamopup.com"; sid:547196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamp.com"; sid:547197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamum.com"; sid:547198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanarrative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanarrative.com"; sid:547199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanavirus.com"; sid:547200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews1.com"; sid:547201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews1.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews1.net"; sid:547202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsindia.com"; sid:547203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsinindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsinindia.com"; sid:547204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews-live.com"; sid:547205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsmagazine.com"; sid:547206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronangela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronangela.com"; sid:547207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanonprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanonprofit.com"; sid:547208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanp.com"; sid:547209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanvirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanvirusnewsnow.com"; sid:547210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaolympics2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaolympics2021.com"; sid:547211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorflu.com"; sid:547212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaos.com"; sid:547213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.parts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.parts"; sid:547214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-patrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-patrol.com"; sid:547215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapickup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapickup.com"; sid:547216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.pictures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.pictures"; sid:547217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaploma.com"; sid:547218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapore.com"; sid:547219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaportraits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaportraits.com"; sid:547220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprisonlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprisonlawyer.com"; sid:547221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofgear.com"; sid:547222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmyuber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmyuber.com"; sid:547223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradar19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradar19.com"; sid:547224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronardc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronardc.com"; sid:547225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsfragen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsfragen.com"; sid:547226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryresources.com"; sid:547227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoverytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoverytips.com"; sid:547228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareduction.com"; sid:547229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefdonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefdonation.com"; sid:547230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareportcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareportcard.com"; sid:547231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresolve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresolve.com"; sid:547232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-retreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-retreat.com"; sid:547233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarightsize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarightsize.com"; sid:547234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarunners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarunners.net"; sid:547235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.biz"; sid:547236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyservices.com"; sid:547237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetystore.com"; sid:547238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbafunds.com"; sid:547239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascandal.com"; sid:547240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasceptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasceptic.com"; sid:547241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasceptics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasceptics.com"; sid:547242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnellimpfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnellimpfung.com"; sid:547243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzglas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzglas.com"; sid:547244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzglas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzglas.com"; sid:547245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascure.com"; sid:547246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-serum.com"; sid:547247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashame.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashame.wtf"; sid:547248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldsbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldsbr.com"; sid:547249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashiled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashiled.com"; sid:547250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashortfilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashortfilmfestival.com"; sid:547251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiusa.com"; sid:547252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslive.com"; sid:547253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmart.net"; sid:547254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprinter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprinter.com"; sid:547255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassafety.com"; sid:547256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastateclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastateclosures.com"; sid:547257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-steuerberater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-steuerberater.com"; sid:547258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-steuerberatung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-steuerberatung.com"; sid:547259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastickybomb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastickybomb.com"; sid:547260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulussmeloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulussmeloan.com"; sid:547261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulussmeloan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulussmeloan.net"; sid:547262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastok.com"; sid:547263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportgh.com"; sid:547264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportusa.com"; sid:547265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survey.com"; sid:547266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatacoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatacoma.com"; sid:547267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataker.com"; sid:547268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-team.com"; sid:547269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemps.com"; sid:547270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterminators.com"; sid:547271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testcenter.com"; sid:547272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestiyap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestiyap.com"; sid:547273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testkit-kopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testkit-kopen.com"; sid:547274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-kopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-kopen.com"; sid:547275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-station.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-station.com"; sid:547276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-teststation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-teststation.com"; sid:547277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateststation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateststation.com"; sid:547278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.world"; sid:547279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathebeernotthevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathebeernotthevirus.com"; sid:547280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathing.com"; sid:547281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatined.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatined.world"; sid:547282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatinedworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatinedworld.com"; sid:547283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationtales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationtales.com"; sid:547284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tips.com"; sid:547285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracker.club"; sid:547286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraitors.com"; sid:547287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraka.com"; sid:547288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unemployment.com"; sid:547289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unternehmerinformationen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unternehmerinformationen.com"; sid:547290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurbanimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurbanimpact.com"; sid:547291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19cure.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19cure.world"; sid:547292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19.net"; sid:547293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v19.world"; sid:547294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19.world"; sid:547295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v1.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v1.club"; sid:547296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v1.com"; sid:547297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav1.com"; sid:547298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v1.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v1.net"; sid:547299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav1store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav1store.com"; sid:547300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3center.com"; sid:547301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav3center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav3center.com"; sid:547302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3.club"; sid:547303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3.com"; sid:547304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3.net"; sid:547305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3studio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3studio.com"; sid:547306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3usa.com"; sid:547307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineclaims.com"; sid:547308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinelawyers.com"; sid:547309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineshot.com"; sid:547310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineshots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineshots.com"; sid:547311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavairos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavairos.com"; sid:547312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vakzination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vakzination.com"; sid:547313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavakzination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavakzination.com"; sid:547314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavc.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavc.world"; sid:547315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavente.com"; sid:547316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfree.com"; sid:547317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vibe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vibe.com"; sid:547318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimes.net"; sid:547319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid19help.com"; sid:547320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidiots.com"; sid:547321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavie.com"; sid:547322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavieus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavieus-sd.com"; sid:547323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaville5000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaville5000.com"; sid:547324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir2019.com"; sid:547325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviresnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviresnow.com"; sid:547326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirudnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirudnow.com"; sid:547327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirud-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirud-sd.com"; sid:547328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruis.com"; sid:547329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19fund.com"; sid:547330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1poimt3acres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1poimt3acres.com"; sid:547331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1pointacres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1pointacres.com"; sid:547332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus5krun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus5krun.com"; sid:547333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-advocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-advocates.com"; sid:547334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagoraphobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagoraphobia.com"; sid:547335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidforbusiness.com"; sid:547336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanivelmundial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanivelmundial.com"; sid:547337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietycenter.com"; sid:547338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-api.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-api.net"; sid:547339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapprovedvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapprovedvaccine.com"; sid:547340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarea.com"; sid:547341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaskadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaskadoctor.com"; sid:547342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaskthedoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaskthedoctor.com"; sid:547343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistancehelp.com"; sid:547344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautonomos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautonomos.com"; sid:547345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyclaims.com"; sid:547346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiome.com"; sid:547347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-blogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-blogger.com"; sid:547348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloggers.com"; sid:547349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrainstrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrainstrust.com"; sid:547350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrasilstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrasilstatus.com"; sid:547351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessadvice.com"; sid:547352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptioncoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptioncoverage.com"; sid:547353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionhelp.com"; sid:547354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslegaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslegaladvice.com"; sid:547355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessresourcefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessresourcefinder.com"; sid:547356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-c19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-c19.com"; sid:547357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscantkillthemovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscantkillthemovies.com"; sid:547358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapital.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapital.net"; sid:547359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscardiactest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscardiactest.com"; sid:547360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscardiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscardiology.com"; sid:547361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatalunya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatalunya.com"; sid:547362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscimmppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscimmppe.com"; sid:547363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsattorney.com"; sid:547364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsla.com"; sid:547365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasswarfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasswarfare.com"; sid:547366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbrownsvilletx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbrownsvilletx.com"; sid:547367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcolumbusga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcolumbusga.com"; sid:547368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningeugeneor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningeugeneor.com"; sid:547369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningglendaleca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningglendaleca.com"; sid:547370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninggrandrapidsmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninggrandrapidsmi.com"; sid:547371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninghuntingtonbeachca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninghuntingtonbeachca.com"; sid:547372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmorenovalleyca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmorenovalleyca.com"; sid:547373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnewportnewsva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnewportnewsva.com"; sid:547374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningoverlandparkks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningoverlandparkks.com"; sid:547375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpeoriaaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpeoriaaz.com"; sid:547376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningranchocucamongaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningranchocucamongaca.com"; sid:547377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsantaclaritaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsantaclaritaca.com"; sid:547378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsantarosaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsantarosaca.com"; sid:547379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningspringfieldma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningspringfieldma.com"; sid:547380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtempeaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtempeaz.com"; sid:547381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningvancouverwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningvancouverwa.com"; sid:547382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinical.com"; sid:547383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinicalstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinicalstudy.com"; sid:547384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinicaltrial.com"; sid:547385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontain.com"; sid:547386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontained.com"; sid:547387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscountry.com"; sid:547388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19.life"; sid:547389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19stats.com"; sid:547390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditchallenge.com"; sid:547391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrew.com"; sid:547392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru-sd.com"; sid:547393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelta.com"; sid:547394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-desinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-desinfecting.com"; sid:547395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdetector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdetector.com"; sid:547396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnosislocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnosislocations.com"; sid:547397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdinero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdinero.com"; sid:547398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdisinfecting.com"; sid:547399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfects.com"; sid:547400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseco.com"; sid:547401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployeradvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployeradvice.com"; sid:547402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendofworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendofworld.com"; sid:547403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenow.com"; sid:547404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestrials.com"; sid:547405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevictionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevictionhelp.com"; sid:547406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevictionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevictionlawyers.com"; sid:547407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexpress.com"; sid:547408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactfile.com"; sid:547409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilybusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilybusinessadvice.com"; sid:547410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilybusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilybusinesshelp.com"; sid:547411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fd.com"; sid:547412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfeedback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfeedback.com"; sid:547413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilms.net"; sid:547414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreetrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreetrade.com"; sid:547415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunding.net"; sid:547416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-go-away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-go-away.com"; sid:547417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-grant.com"; sid:547418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrantuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrantuk.com"; sid:547419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreatdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreatdepression.com"; sid:547420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreatrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreatrecession.com"; sid:547421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguncel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguncel.com"; sid:547422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgyan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgyan.com"; sid:547423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappened.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappened.com"; sid:547424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushappened.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushappened.net"; sid:547425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusharm.com"; sid:547426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazard.com"; sid:547427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushighlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushighlights.com"; sid:547428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeforsale.com"; sid:547429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomekits.com"; sid:547430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometest.net"; sid:547431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousingmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousingmarket.com"; sid:547432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitygame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitygame.com"; sid:547433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryattorney.com"; sid:547434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceadvice.com"; sid:547435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjoy.com"; sid:547436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjoyscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjoyscore.com"; sid:547437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjuarez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjuarez.com"; sid:547438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-justice.com"; sid:547439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskid.com"; sid:547440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaundry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaundry.com"; sid:547441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegal.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegal.claims"; sid:547442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsupport.com"; sid:547443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslending.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslending.net"; sid:547444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslie.com"; sid:547445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslives.com"; sid:547446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-stats-finland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-stats-finland.com"; sid:547447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-stats-germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-stats-germany.com"; sid:547448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-stats-norway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-stats-norway.com"; sid:547449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-stats-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-stats-usa.com"; sid:547450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-loan.com"; sid:547451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslostprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslostprofits.com"; sid:547452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslostprofitscoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslostprofitscoverage.com"; sid:547453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslowincomelottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslowincomelottery.com"; sid:547454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadrid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadrid.net"; sid:547455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmagnets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmagnets.com"; sid:547456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketcrash.com"; sid:547457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketcrash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketcrash.net"; sid:547458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedical101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedical101.com"; sid:547459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalstores.com"; sid:547460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-meds.com"; sid:547461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmessage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmessage.com"; sid:547462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmm.com"; sid:547463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmm.net"; sid:547464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnecessity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnecessity.com"; sid:547465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsno.com"; sid:547466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-news.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-news.today"; sid:547467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewvaccine.com"; sid:547468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnieuws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnieuws.com"; sid:547469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnowmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnowmap.com"; sid:547470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomecase.com"; sid:547471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomecases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomecases.com"; sid:547472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnys.com"; sid:547473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-openkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-openkit.net"; sid:547474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusosona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusosona.com"; sid:547475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspharmacystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspharmacystore.com"; sid:547476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-plague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-plague.com"; sid:547477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspredictor.com"; sid:547478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspsychologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspsychologist.com"; sid:547479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspubcrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspubcrawl.com"; sid:547480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrabbithole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrabbithole.com"; sid:547481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-rapid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-rapid-test.com"; sid:547482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatemarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatemarket.com"; sid:547483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecords.com"; sid:547484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreddit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreddit.com"; sid:547485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregion.com"; sid:547486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefstatus.com"; sid:547487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remedy.com"; sid:547488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovalpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovalpro.com"; sid:547489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreportcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreportcard.com"; sid:547490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcelist.com"; sid:547491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresources.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresources.biz"; sid:547492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ruhepol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ruhepol.com"; sid:547493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafelist.com"; sid:547494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sandiego.com"; sid:547495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanitazing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanitazing.com"; sid:547496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizernow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizernow.com"; sid:547497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussceptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussceptic.com"; sid:547498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussceptics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussceptics.com"; sid:547499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscrewingtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscrewingtheworld.com"; sid:547500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussimplified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussimplified.com"; sid:547501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-simulator.com"; sid:547502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-simulator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-simulator.net"; sid:547503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessadvice.com"; sid:547504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-smell-loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-smell-loss.com"; sid:547505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussme.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussme.loans"; sid:547506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmeloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmeloans.com"; sid:547507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmeloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmeloans.net"; sid:547508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-soforthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-soforthilfe.com"; sid:547509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoluations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoluations.com"; sid:547510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusss.com"; sid:547511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-state.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-state.com"; sid:547512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluscash.com"; sid:547513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusmoney.com"; sid:547514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussv.com"; sid:547515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyndrome.com"; sid:547516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyndrome.net"; sid:547517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcentre.com"; sid:547518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingusa.com"; sid:547519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthermometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthermometers.com"; sid:547520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthinktank.com"; sid:547521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustodos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustodos.com"; sid:547522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustotalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustotalcleaning.com"; sid:547523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustour.com"; sid:547524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveltest.com"; sid:547525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialattorney.com"; sid:547526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialattorneys.com"; sid:547527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialvaccine.com"; sid:547528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrouble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrouble.com"; sid:547529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustshirts.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustshirts.world"; sid:547530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuaa.com"; sid:547531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunemployed.com"; sid:547532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurth.com"; sid:547533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusus.com"; sid:547534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineattorney.com"; sid:547535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelaw.com"; sid:547536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusviewer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusviewer.com"; sid:547537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vlogman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vlogman.com"; sid:547538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvzla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvzla.com"; sid:547539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswar.net"; sid:547540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhattoknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhattoknow.com"; sid:547541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhistleblowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhistleblowers.com"; sid:547542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-whls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-whls.com"; sid:547543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswikipedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswikipedia.com"; sid:547544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirysnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirysnow.com"; sid:547545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.vision"; sid:547546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavius-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavius-map.com"; sid:547547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviususa.com"; sid:547548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavography.com"; sid:547549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoris.com"; sid:547550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrisunewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrisunewsnow.com"; sid:547551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavtv.com"; sid:547552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurus-sd.com"; sid:547553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavus.com"; sid:547554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav.world"; sid:547555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashandvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashandvax.com"; sid:547556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-weather-index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-weather-index.com"; sid:547557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wirus.com"; sid:547558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawiz.com"; sid:547559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkercomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkercomp.com"; sid:547560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkerscomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkerscomp.com"; sid:547561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldparties.com"; sid:547562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldparty.com"; sid:547563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayainatbayram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayainatbayram.com"; sid:547564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayainat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayainat.com"; sid:547565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coupecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coupecorona.com"; sid:547566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for courageundercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"courageundercovid.com"; sid:547567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covaidforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covaidforcovid.com"; sid:547568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coverup-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coverup-corona.com"; sid:547569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coverupcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coverupcorona.com"; sid:547570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15.com"; sid:547571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid16.com"; sid:547572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid190racle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid190racle.com"; sid:547573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-10mintestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-10mintestkit.com"; sid:547574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020strain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020strain.com"; sid:547575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1920live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1920live.com"; sid:547576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid195krun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid195krun.com"; sid:547577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accelerator.com"; sid:547578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accelerator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accelerator.net"; sid:547579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actnow.com"; sid:547580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agoraphobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agoraphobia.com"; sid:547581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aids.com"; sid:547582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19almostlivefest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19almostlivefest.com"; sid:547583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analytics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analytics.net"; sid:547584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andfree.com"; sid:547585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andfree.net"; sid:547586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibody.com"; sid:547587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestkit.com"; sid:547588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antiviralsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antiviralsanitizer.com"; sid:547589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19askthedoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19askthedoctor.com"; sid:547590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-assistance.com"; sid:547591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19athome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19athome.com"; sid:547592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomestest.com"; sid:547593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometests.com"; sid:547594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atlas.com"; sid:547595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atlas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atlas.net"; sid:547596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ayudas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ayudas.com"; sid:547597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyattorneys.com"; sid:547598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyfirm.com"; sid:547599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyhelp.com"; sid:547600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylawyers.com"; sid:547601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylegal.com"; sid:547602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylegalhelp.com"; sid:547603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylegalhelpline.com"; sid:547604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19basilicata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19basilicata.com"; sid:547605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-battle.com"; sid:547606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-battle.com"; sid:547607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bayarea.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bayarea.support"; sid:547608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bdtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bdtrack.com"; sid:547609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beds.com"; sid:547610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bengkaliskab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bengkaliskab.com"; sid:547611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19besttestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19besttestkits.com"; sid:547612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biome.com"; sid:547613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19births.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19births.com"; sid:547614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19brazilmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19brazilmap.com"; sid:547615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-br.com"; sid:547616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brides.com"; sid:547617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19budget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19budget.com"; sid:547618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessadvice.com"; sid:547619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessattorneys.com"; sid:547620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscontinuity.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscontinuity.network"; sid:547621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslegaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslegaladvice.com"; sid:547622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrescue.com"; sid:547623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessresourcefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessresourcefinder.com"; sid:547624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canda.com"; sid:547625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cardiactest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cardiactest.com"; sid:547626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cardiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cardiology.com"; sid:547627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19caregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19caregivers.com"; sid:547628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19caregivers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19caregivers.net"; sid:547629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cash.net"; sid:547630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casos.com"; sid:547631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cause.com"; sid:547632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifications.com"; sid:547633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19channel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19channel.com"; sid:547634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chatroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chatroom.com"; sid:547635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19childcaretexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19childcaretexas.com"; sid:547636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimrelief.com"; sid:547637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionattorney.com"; sid:547638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawyers.com"; sid:547639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleansed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleansed.com"; sid:547640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanup.net"; sid:547641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicalstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicalstudy.com"; sid:547642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clinicaltrial.com"; sid:547643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinicaltrials.com"; sid:547644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cmap.com"; sid:547645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commons.com"; sid:547646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantja.com"; sid:547647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantja.com"; sid:547648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantjamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantjamaica.com"; sid:547649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantjamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantjamaica.com"; sid:547650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantjamaica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantjamaica.net"; sid:547651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantjamaica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantjamaica.net"; sid:547652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantja.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantja.net"; sid:547653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantja.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantja.net"; sid:547654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliant.net"; sid:547655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.contractors"; sid:547656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlshop.com"; sid:547657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlstore.com"; sid:547658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controversy.com"; sid:547659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronanews.com"; sid:547660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus.biz"; sid:547661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coverup.com"; sid:547662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coverup.com"; sid:547663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditrepair.com"; sid:547664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crowdfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crowdfunding.com"; sid:547665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cuisine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cuisine.com"; sid:547666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curebook.com"; sid:547667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curetracker.com"; sid:547668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cutaneouslymphoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cutaneouslymphoma.com"; sid:547669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cutaneouslymphoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cutaneouslymphoma.com"; sid:547670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cycling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cycling.com"; sid:547671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailynews.com"; sid:547672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19daybyday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19daybyday.com"; sid:547673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-death.com"; sid:547674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19defeated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19defeated.com"; sid:547675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19depression.com"; sid:547676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnosis.com"; sid:547677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosticskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosticskit.com"; sid:547678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-diary.com"; sid:547679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disaster.com"; sid:547680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disaster.com"; sid:547681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-discussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-discussion.com"; sid:547682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dondeycomoestais.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dondeycomoestais.com"; sid:547683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19download.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19download.com"; sid:547684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drama.com"; sid:547685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dreams.com"; sid:547686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drugs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drugs.net"; sid:547687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugs.net"; sid:547688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugsolution.com"; sid:547689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugsolutions.com"; sid:547690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugsstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugsstore.com"; sid:547691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19duatlon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19duatlon.com"; sid:547692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earth.com"; sid:547693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-economy.com"; sid:547694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-economy.com"; sid:547695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-emergency.com"; sid:547696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-emergency.com"; sid:547697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfunds.com"; sid:547698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeradvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeradvice.com"; sid:547699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-epidemic.com"; sid:547700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ertec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ertec.com"; sid:547701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-espoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-espoir.com"; sid:547702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictionhelp.com"; sid:547703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19evictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19evictions.com"; sid:547704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19explorer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19explorer.com"; sid:547705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exposure.com"; sid:547706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fallout.com"; sid:547707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fallout.com"; sid:547708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familybusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familybusinessadvice.com"; sid:547709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familybusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familybusinesshelp.com"; sid:547710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmgroup.com"; sid:547711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19finder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19finder.com"; sid:547712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firm.com"; sid:547713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fit.com"; sid:547714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fitness.com"; sid:547715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fitness.com"; sid:547716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodsupply.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodsupply.club"; sid:547717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forbusiness.com"; sid:547718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forecasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forecasts.com"; sid:547719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19foreclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19foreclosures.com"; sid:547720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosures.com"; sid:547721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formulas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formulas.com"; sid:547722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-foundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-foundation.com"; sid:547723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-france.com"; sid:547724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fraud.com"; sid:547725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fraudlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fraudlawyer.com"; sid:547726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fraud.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fraud.legal"; sid:547727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frauds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frauds.com"; sid:547728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frauds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frauds.net"; sid:547729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecountries.com"; sid:547730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundraising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundraising.com"; sid:547731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19funds.com"; sid:547732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gags.com"; sid:547733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-garage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-garage.com"; sid:547734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gears.com"; sid:547735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19geometry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19geometry.com"; sid:547736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19girls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19girls.com"; sid:547737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19girls.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19girls.net"; sid:547738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-go-get-me-chipotle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-go-get-me-chipotle.com"; sid:547739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gone.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gone.club"; sid:547740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gone.com"; sid:547741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gone.com"; sid:547742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-graphs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-graphs.net"; sid:547743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-guard.com"; sid:547744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hackpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hackpack.com"; sid:547745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hangout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hangout.com"; sid:547746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hardship.com"; sid:547747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hardship.com"; sid:547748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hardship.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hardship.net"; sid:547749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hardships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hardships.com"; sid:547750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hat.com"; sid:547751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hawaii.com"; sid:547752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthhub.com"; sid:547753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthkit.com"; sid:547754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthreport.com"; sid:547755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthy.com"; sid:547756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herbal.com"; sid:547757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19highlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19highlights.com"; sid:547758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19histories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19histories.com"; sid:547759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeforsale.com"; sid:547760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeforsale.com"; sid:547761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homelab.com"; sid:547762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homereading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homereading.com"; sid:547763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homes.com"; sid:547764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homestest.com"; sid:547765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestingkit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestingkit.life"; sid:547766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkit.life"; sid:547767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometest.net"; sid:547768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hosting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hosting.biz"; sid:547769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hotels.com"; sid:547770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houseparty.com"; sid:547771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19housingmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19housingmarket.com"; sid:547772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingmarket.com"; sid:547773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howto.com"; sid:547774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygienecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygienecertification.com"; sid:547775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygienestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygienestore.com"; sid:547776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygienestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygienestore.com"; sid:547777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ids.com"; sid:547778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19illuminati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19illuminati.com"; sid:547779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunity.net"; sid:547780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19india.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19india.today"; sid:547781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19info.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19info.business"; sid:547782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info-et.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info-et.com"; sid:547783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceadvice.com"; sid:547784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insured.com"; sid:547785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inventions.com"; sid:547786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ita.com"; sid:547787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19joy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19joy.com"; sid:547788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19joyscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19joyscore.com"; sid:547789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19justice.com"; sid:547790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-justice.com"; sid:547791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keysymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keysymptoms.com"; sid:547792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitsonline.com"; sid:547793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k.run"; sid:547794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lab.com"; sid:547795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labcorp.com"; sid:547796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labcorp.com"; sid:547797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laundry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laundry.com"; sid:547798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lavolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lavolunteers.com"; sid:547799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law.biz"; sid:547800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.claims"; sid:547801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawclaims.com"; sid:547802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawpractice.com"; sid:547803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalaction.com"; sid:547804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalcase.com"; sid:547805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalcases.com"; sid:547806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legal.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legal.claims"; sid:547807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalclaims.com"; sid:547808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalclaims.net"; sid:547809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifehack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifehack.com"; sid:547810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lifeinsurance.com"; sid:547811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigationadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigationadvice.com"; sid:547812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanassist.com"; sid:547813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-loan.com"; sid:547814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans-sba.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans-sba.biz"; sid:547815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lockdown.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lockdown.net"; sid:547816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ma.com"; sid:547817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19magnets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19magnets.com"; sid:547818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maping.com"; sid:547819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maui.com"; sid:547820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalstore.com"; sid:547821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalsupplies.com"; sid:547822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalsupply.com"; sid:547823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medic.com"; sid:547824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medics.com"; sid:547825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-meds.com"; sid:547826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorybook.com"; sid:547827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mex.com"; sid:547828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19misinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19misinfo.com"; sid:547829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobile.com"; sid:547830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modification.com"; sid:547831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modifications.com"; sid:547832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19monitoring.com"; sid:547833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moroccoinfomigrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moroccoinfomigrants.com"; sid:547834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movieofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movieofficial.com"; sid:547835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mx.com"; sid:547836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19narrative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19narrative.com"; sid:547837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newvaccine.com"; sid:547838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nonnahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nonnahealth.com"; sid:547839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nonnatech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nonnatech.com"; sid:547840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-normalityco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-normalityco.net"; sid:547841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nurses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nurses.com"; sid:547842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nwo.com"; sid:547843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nwo.com"; sid:547844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nwo.com"; sid:547845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ocgov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ocgov.com"; sid:547846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offroad.com"; sid:547847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offroading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offroading.com"; sid:547848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offroading.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offroading.net"; sid:547849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offroad.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offroad.net"; sid:547850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinecourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinecourse.com"; sid:547851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinekit.com"; sid:547852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paidleavecalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paidleavecalculator.com"; sid:547853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-panacea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-panacea.com"; sid:547854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicbook.com"; sid:547855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-panic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-panic.com"; sid:547856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-panic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-panic.com"; sid:547857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partner.com"; sid:547858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partners.com"; sid:547859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-party.com"; sid:547860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pestcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pestcontrol.com"; sid:547861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pharma.com"; sid:547862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pharmacy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pharmacy.net"; sid:547863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharmacystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharmacystore.com"; sid:547864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pregnancies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pregnancies.com"; sid:547865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prehospitalguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prehospitalguidance.com"; sid:547866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepusa.com"; sid:547867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventionkit.com"; sid:547868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionplan.com"; sid:547869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventivehealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventivehealing.com"; sid:547870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19professionalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19professionalcleaning.com"; sid:547871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19properties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19properties.com"; sid:547872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protections.com"; sid:547873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pubcrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pubcrawl.com"; sid:547874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qa.net"; sid:547875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantine.net"; sid:547876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-quizz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-quizz.com"; sid:547877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ranking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ranking.com"; sid:547878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapid.com"; sid:547879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtest.net"; sid:547880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-realestate.com"; sid:547881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realestate.com"; sid:547882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realestatemarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realestatemarket.com"; sid:547883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatemarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatemarket.com"; sid:547884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recession.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recession.net"; sid:547885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recession.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recession.net"; sid:547886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-re.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-re.com"; sid:547887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reduction.com"; sid:547888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reg.com"; sid:547889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefapplications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefapplications.com"; sid:547890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefonline.com"; sid:547891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relieftoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relieftoday.com"; sid:547892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieftoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieftoday.com"; sid:547893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remediation.com"; sid:547894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-remedy.com"; sid:547895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remedys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remedys.com"; sid:547896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-repair-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-repair-shop.com"; sid:547897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resiliency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resiliency.com"; sid:547898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resolve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resolve.com"; sid:547899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcecentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcecentre.com"; sid:547900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resources.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resources.biz"; sid:547901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riding.com"; sid:547902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskmanagement.com"; sid:547903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-run.com"; sid:547904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedentistry.com"; sid:547905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedentists.com"; sid:547906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetynow.com"; sid:547907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetywear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetywear.com"; sid:547908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanitise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanitise.com"; sid:547909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sba.com"; sid:547910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-scare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-scare.com"; sid:547911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-scare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-scare.com"; sid:547912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sceptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sceptic.com"; sid:547913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sceptics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sceptics.com"; sid:547914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sceptics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sceptics.com"; sid:547915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schutz.com"; sid:547916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-schutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-schutzmaske.com"; sid:547917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schutzmaske.com"; sid:547918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scorecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scorecard.com"; sid:547919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scrubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scrubs.com"; sid:547920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19security.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19security.net"; sid:547921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sessions.com"; sid:547922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ships.com"; sid:547923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signage.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signage.biz"; sid:547924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sleep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sleep.com"; sid:547925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbizfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbizfund.com"; sid:547926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessadvice.com"; sid:547927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinesshelp.com"; sid:547928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sme.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sme.loans"; sid:547929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smeloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smeloans.com"; sid:547930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smeloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smeloans.net"; sid:547931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialcare.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialcare.cymru"; sid:547932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialcare.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialcare.wales"; sid:547933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-somalia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-somalia.net"; sid:547934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spotter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spotter.com"; sid:547935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-starterpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-starterpack.com"; sid:547936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayedhomestayedsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayedhomestayedsafe.com"; sid:547937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayedhomestayedsafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayedhomestayedsafe.net"; sid:547938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stock.com"; sid:547939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stories.net"; sid:547940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliers.com"; sid:547941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesnyc.com"; sid:547942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplydepot.com"; sid:547943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supply.net"; sid:547944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supporthawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supporthawaii.com"; sid:547945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supporthi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supporthi.com"; sid:547946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivorsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivorsclub.com"; sid:547947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivorsclub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivorsclub.net"; sid:547948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19syndrome.com"; sid:547949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syndrome.com"; sid:547950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19syndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19syndrome.net"; sid:547951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syndrome.net"; sid:547952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-syria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-syria.com"; sid:547953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ta.com"; sid:547954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ta.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ta.net"; sid:547955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.biz"; sid:547956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcy.com"; sid:547957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcentre.com"; sid:547958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testingkits.com"; sid:547959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitamerica.com"; sid:547960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitonline.com"; sid:547961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkits.biz"; sid:547962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitusa.com"; sid:547963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.pro"; sid:547964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-rapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-rapid.com"; sid:547965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststations.com"; sid:547966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapeuticsaccelerator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapeuticsaccelerator.net"; sid:547967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermalscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermalscreening.com"; sid:547968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thinktank.com"; sid:547969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19times.com"; sid:547970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tolls.com"; sid:547971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toolbox.com"; sid:547972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.life"; sid:547973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traininggear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traininggear.com"; sid:547974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traitors.com"; sid:547975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-traveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-traveltest.com"; sid:547976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveltest.com"; sid:547977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19treatment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19treatment.net"; sid:547978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trials.com"; sid:547979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialvaccine.com"; sid:547980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19triatlon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19triatlon.com"; sid:547981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustinfo.com"; sid:547982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tunisie.com"; sid:547983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19turkiye.com"; sid:547984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uk.com"; sid:547985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatenow.com"; sid:547986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-updates.net"; sid:547987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19urth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19urth.com"; sid:547988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uy.com"; sid:547989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelaw.com"; sid:547990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19validic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19validic.com"; sid:547991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vendors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vendors.com"; sid:547992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veteranrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veteranrelief.com"; sid:547993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusmask.com"; sid:547994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustracker.com"; sid:547995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualiser.com"; sid:547996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitals.com"; sid:547997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vlog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vlog.com"; sid:547998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19voc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19voc.com"; sid:547999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19war.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19war.city"; sid:548000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-war.com"; sid:548001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-war.com"; sid:548002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warmline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warmline.com"; sid:548003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warmline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warmline.com"; sid:548004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wars.com"; sid:548005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wars.com"; sid:548006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19w.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19w.com"; sid:548007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wd.com"; sid:548008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellnesscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellnesscenters.com"; sid:548009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whattoknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whattoknow.com"; sid:548010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whistleblowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whistleblowers.com"; sid:548011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19zen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19zen.com"; sid:548012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zen.com"; sid:548013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019buster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019buster.com"; sid:548014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019prevention.com"; sid:548015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.plus - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.plus"; sid:548016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2k19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2k19.com"; sid:548017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9team.com"; sid:548018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19app.com"; sid:548019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida20.net"; sid:548020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacate.com"; sid:548021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacid.com"; sid:548022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacommunity.com"; sid:548023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafterparty.com"; sid:548024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aid.com"; sid:548025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid.legal"; sid:548026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaleitat.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaleitat.cat"; sid:548027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-analyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-analyse.com"; sid:548028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-analyse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-analyse.net"; sid:548029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangola.com"; sid:548030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangst.com"; sid:548031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantigen.com"; sid:548032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantigentest.com"; sid:548033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarkansas.com"; sid:548034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatlas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatlas.net"; sid:548035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-attorney.com"; sid:548036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-attorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-attorney.net"; sid:548037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-attorneys.com"; sid:548038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauquebec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauquebec.com"; sid:548039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bailout.com"; sid:548040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-band.com"; sid:548041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidband.com"; sid:548042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidband.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidband.net"; sid:548043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbattle.com"; sid:548044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbd.com"; sid:548045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-blog.com"; sid:548046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboard.com"; sid:548047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonuis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonuis.com"; sid:548048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessadvice.com"; sid:548049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscash.com"; sid:548050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessplan.com"; sid:548051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssurvival.com"; sid:548052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalls.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalls.net"; sid:548053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanadaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanadaupdate.com"; sid:548054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandids.com"; sid:548055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaribbean.com"; sid:548056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchic.com"; sid:548057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcaretexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcaretexas.com"; sid:548058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimslawyer.com"; sid:548059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactions.com"; sid:548060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassics.com"; sid:548061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclips.com"; sid:548062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclusters.com"; sid:548063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoating.com"; sid:548064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoffins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoffins.com"; sid:548065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcohort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcohort.com"; sid:548066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoins.com"; sid:548067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomputers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomputers.com"; sid:548068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconf.com"; sid:548069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontact.net"; sid:548070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontagion.com"; sid:548071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontainment.com"; sid:548072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontext.com"; sid:548073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopper.com"; sid:548074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountdown.com"; sid:548075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcranky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcranky.com"; sid:548076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreate.com"; sid:548077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crisis.com"; sid:548078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushers.com"; sid:548079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeliveries.com"; sid:548080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.delivery"; sid:548081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnosislocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnosislocations.com"; sid:548082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiarynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiarynyc.com"; sid:548083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddirectory.com"; sid:548084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscounts.com"; sid:548085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddistancing.com"; sid:548086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.dog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.dog"; sid:548087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideals.com"; sid:548088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefender.com"; sid:548089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideliminationtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideliminationtest.com"; sid:548090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenterprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenterprise.com"; sid:548091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidents.com"; sid:548092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoconferencing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoconferencing.com"; sid:548093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideofilmmakerchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideofilmmakerchallenge.com"; sid:548094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideohappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideohappyhour.com"; sid:548095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderapp.com"; sid:548096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-essentials.com"; sid:548097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexposer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexposer.com"; sid:548098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpresstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpresstest.com"; sid:548099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextra.com"; sid:548100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarma.com"; sid:548101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfla.com"; sid:548102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoods.com"; sid:548103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraud.com"; sid:548104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudlawyer.com"; sid:548105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudlawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudlawyer.net"; sid:548106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraud.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraud.legal"; sid:548107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraud.net"; sid:548108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrauds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrauds.com"; sid:548109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefood.com"; sid:548110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehelpers.com"; sid:548111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelearning.com"; sid:548112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelessons.com"; sid:548113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreellessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreellessons.com"; sid:548114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.world"; sid:548115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworld.net"; sid:548116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuneral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuneral.com"; sid:548117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgarb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgarb.com"; sid:548118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgencare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgencare.com"; sid:548119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidghana.com"; sid:548120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreatdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreatdepression.com"; sid:548121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreatrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreatrecession.com"; sid:548122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-guard.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-guard.life"; sid:548123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguard.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguard.life"; sid:548124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcaresupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcaresupport.com"; sid:548125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcontrol.com"; sid:548126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.club"; sid:548127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help-map.com"; sid:548128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpmap.com"; sid:548129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelps.com"; sid:548130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherobrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherobrands.com"; sid:548131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhires.com"; sid:548132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhistories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhistories.com"; sid:548133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomestest.com"; sid:548134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhs.com"; sid:548135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianslife.com"; sid:548136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididiot.com"; sid:548137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidids.com"; sid:548138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigation.com"; sid:548139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfstoff.com"; sid:548140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfung.com"; sid:548141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinaction.com"; sid:548142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiaupdate.com"; sid:548143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfolive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfolive.com"; sid:548144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidingeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidingeorgia.com"; sid:548145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylawyer.com"; sid:548146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawsuit.com"; sid:548147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawyer.com"; sid:548148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinusa.com"; sid:548149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotgame.com"; sid:548150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.exposed"; sid:548151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotshub.com"; sid:548152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisation.net"; sid:548153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity19.com"; sid:548154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiut.com"; sid:548155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobsearch.com"; sid:548156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkansas.com"; sid:548157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lawfirm.com"; sid:548158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidl.com"; sid:548159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleadership.com"; sid:548160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalteam.com"; sid:548161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinkroundup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinkroundup.com"; sid:548162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanassist.com"; sid:548163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlost.com"; sid:548164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlouisiana.com"; sid:548165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapped.com"; sid:548166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarin.com"; sid:548167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaritime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaritime.com"; sid:548168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdepot.com"; sid:548169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-maske.com"; sid:548170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mask.life"; sid:548171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.life"; sid:548172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicals.com"; sid:548173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedics.com"; sid:548174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmia.com"; sid:548175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmindmanifestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmindmanifestation.com"; sid:548176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmissouri.com"; sid:548177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyanmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyanmar.com"; sid:548178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn95masks.com"; sid:548179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneayou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneayou.com"; sid:548180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnepalstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnepalstats.com"; sid:548181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidniger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidniger.com"; sid:548182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnola.com"; sid:548183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorcal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorcal.com"; sid:548184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoctors.com"; sid:548185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidog.com"; sid:548186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidok.com"; sid:548187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoklahoma.com"; sid:548188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidometer.com"; sid:548189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlineyardsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlineyardsale.com"; sid:548190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidot.com"; sid:548191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidote.com"; sid:548192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidou.com"; sid:548193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpapers.com"; sid:548194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpe.com"; sid:548195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpestcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpestcontrol.com"; sid:548196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pharmacy.com"; sid:548197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplot.com"; sid:548198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpostive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpostive.com"; sid:548199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofessor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofessor.com"; sid:548200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofbusiness.com"; sid:548201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofbusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofbusiness.net"; sid:548202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpros.com"; sid:548203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionstore.com"; sid:548204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprox.com"; sid:548205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidptsd.com"; sid:548206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidkit.com"; sid:548207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebound.com"; sid:548208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresolve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresolve.com"; sid:548209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresource.net"; sid:548210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrheum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrheum.com"; sid:548211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisks.com"; sid:548212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrn.com"; sid:548213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpm.com"; sid:548214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecorps.com"; sid:548215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentistry.com"; sid:548216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentistry.net"; sid:548217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentists.com"; sid:548218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentists.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentists.net"; sid:548219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehip.com"; sid:548220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeknee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeknee.com"; sid:548221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesurgery.com"; sid:548222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetystore.com"; sid:548223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbahelp.com"; sid:548224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscunts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscunts.com"; sid:548225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorshoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorshoppers.com"; sid:548226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentry.com"; sid:548227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshitlist.com"; sid:548228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinessgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinessgrant.com"; sid:548229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsniff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsniff.com"; sid:548230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstateclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstateclosures.com"; sid:548231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsteps.com"; sid:548232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstock.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstock.today"; sid:548233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-store.com"; sid:548234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudentresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudentresponse.com"; sid:548235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyhub.com"; sid:548236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplylist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplylist.com"; sid:548237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsusa.com"; sid:548238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tech.com"; sid:548239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tech.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tech.net"; sid:548240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenders.com"; sid:548241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcnx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcnx.net"; sid:548242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesten.com"; sid:548243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.net"; sid:548244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststations.com"; sid:548245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtogo.com"; sid:548246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingproject.com"; sid:548247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracks.com"; sid:548248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtr.com"; sid:548249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatments.net"; sid:548250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-triage-tool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-triage-tool.com"; sid:548251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidturnaround.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidturnaround.com"; sid:548252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtwenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtwenty.com"; sid:548253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-unemployment.com"; sid:548254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvc.com"; sid:548255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelaw.com"; sid:548256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelawyer.com"; sid:548257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidva.com"; sid:548258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvendors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvendors.com"; sid:548259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdisinfectant.com"; sid:548260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslitigation.com"; sid:548261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusnow.com"; sid:548262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-sd.com"; sid:548263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus.world"; sid:548264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wars.com"; sid:548265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwithoutfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwithoutfear.com"; sid:548266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwithoutfear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwithoutfear.net"; sid:548267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwm.com"; sid:548268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwm.net"; sid:548269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldupdate.com"; sid:548270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyourself.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyourself.net"; sid:548271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidza.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidza.mobi"; sid:548272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-z.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-z.com"; sid:548273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzen.com"; sid:548274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-zombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-zombie.com"; sid:548275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cowandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cowandcovid19.com"; sid:548276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycoronacomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycoronacomedy.com"; sid:548277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditocovid19.com"; sid:548278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronaclaims.com"; sid:548279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronalaw.com"; sid:548280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronalawyers.com"; sid:548281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatecorona.com"; sid:548282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatedcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatedcoronanews.com"; sid:548283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbcovid-19.com"; sid:548284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbcovid19.com"; sid:548285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbcovidtogether.com"; sid:548286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure-coronavirus.net"; sid:548287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutoffcovid19.com"; sid:548288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutoffcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutoffcovid19.net"; sid:548289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cv19coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cv19coronatest.com"; sid:548290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19post.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19post.com"; sid:548291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid19.com"; sid:548292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataversuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataversuscorona.com"; sid:548293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofcovid19.com"; sid:548294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysofcorona.com"; sid:548295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dc37covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dc37covid19.net"; sid:548296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dceocovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dceocovid19resources.com"; sid:548297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadcorona.com"; sid:548298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debt-bankruptcy-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debt-bankruptcy-coronavirus.com"; sid:548299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debt-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debt-coronavirus-covid19.com"; sid:548300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debt-covid19-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debt-covid19-coronavirus.com"; sid:548301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deconcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deconcovid.com"; sid:548302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendthecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendthecorona.net"; sid:548303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defineepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defineepidemic.com"; sid:548304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for definepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"definepandemic.com"; sid:548305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltacoronaviro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltacoronaviro.com"; sid:548306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandacoronavirus.com"; sid:548307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovidresponsekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovidresponsekit.com"; sid:548308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistcovidresponsekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistcovidresponsekit.com"; sid:548309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncovid.com"; sid:548310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitvscoronavirus.com"; sid:548311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diamondprincesscoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diamondprincesscoronaclaims.com"; sid:548312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diaryofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diaryofcoronavirus.com"; sid:548313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dicascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dicascorona.com"; sid:548314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcovid19.com"; sid:548315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitaljournalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitaljournalcovid19.com"; sid:548316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcovid-19.com"; sid:548317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doecoronavirus.com"; sid:548318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaim.com"; sid:548319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaim.net"; sid:548320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaims.com"; sid:548321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaims.net"; sid:548322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcovid19.com"; sid:548323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontbelievethecoronalie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontbelievethecoronalie.com"; sid:548324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dropcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dropcorona.com"; sid:548325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugs4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugs4coronavirus.com"; sid:548326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugsforcorona.com"; sid:548327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugsforcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugsforcoronaviruses.com"; sid:548328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcoronavirus.com"; sid:548329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringthecoronavirus.com"; sid:548330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duvidascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duvidascoronavirus.com"; sid:548331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecomcovid19.com"; sid:548332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid19.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid19.claims"; sid:548333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid19.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid19.claims"; sid:548334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid-19-claims.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid-19-claims.legal"; sid:548335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid19updates.com"; sid:548336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effcoronavirus.com"; sid:548337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorentiemposdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorentiemposdecovid19.com"; sid:548338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorentiemposdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorentiemposdelcovid19.com"; sid:548339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcovid.com"; sid:548340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenciacovid.com"; sid:548341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronafunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronafunding.com"; sid:548342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencypandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencypandemickit.com"; sid:548343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenzacovid.com"; sid:548344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenzacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenzacovid.net"; sid:548345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emscovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emscovidresponse.com"; sid:548346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encuestacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encuestacoronavirus.com"; sid:548347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19.net"; sid:548348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcovidparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcovidparty.com"; sid:548349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entercorona.com"; sid:548350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entvcovid.com"; sid:548351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.expert"; sid:548352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-goods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-goods.com"; sid:548353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmeaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmeaning.com"; sid:548354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicreport.com"; sid:548355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictrial.com"; sid:548356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicvaccine.com"; sid:548357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventcorona.com"; sid:548358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ewwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ewwcovid.com"; sid:548359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovid19test.com"; sid:548360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for face-mask-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"face-mask-coronavirus.com"; sid:548361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskfightcovid19.com"; sid:548362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskfightscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskfightscoronavirus.com"; sid:548363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskfightscovid19.com"; sid:548364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasksforcovid19.com"; sid:548365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcorona.com"; sid:548366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fake-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fake-pandemic.com"; sid:548367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmplancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmplancovid19.com"; sid:548368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcvscoronavirus.com"; sid:548369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fidcovidtesting.com"; sid:548370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirus2020.com"; sid:548371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19run.com"; sid:548372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid.net"; sid:548373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidrun.com"; sid:548374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingwithcorona.com"; sid:548375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for file-bankruptcy-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"file-bankruptcy-coronavirus.com"; sid:548376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialhelpcovid19.com"; sid:548377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincovidtesting.com"; sid:548378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacurecoronavirus.com"; sid:548379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacurecovid19.com"; sid:548380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19tests.com"; sid:548381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidteting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidteting.com"; sid:548382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcovid19.com"; sid:548383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcovid19.net"; sid:548384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finland-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finland-coronavirus-live-stats.com"; sid:548385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitmdcovidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitmdcovidcenter.com"; sid:548386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flashinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flashinthepandemic.com"; sid:548387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattencoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattencoronacurve.com"; sid:548388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidcleanup.com"; sid:548389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusattorney.com"; sid:548390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusclean.com"; sid:548391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruslaw.com"; sid:548392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruslawyers.com"; sid:548393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19law.com"; sid:548394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19lawyer.com"; sid:548395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidlaw.com"; sid:548396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fluorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fluorcorona.com"; sid:548397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodcoronavirus.com"; sid:548398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for force-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"force-covid19.com"; sid:548399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fpccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fpccovid-19.com"; sid:548400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecorona.com"; sid:548401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromchaostocontrolduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromchaostocontrolduringcorona.com"; sid:548402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecovid.com"; sid:548403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funincovid.com"; sid:548404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamerscovid19.com"; sid:548405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamersvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamersvcovid19.com"; sid:548406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamesvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamesvscovid19.com"; sid:548407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationwuhan.com"; sid:548408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geocovid.com"; sid:548409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirusattorney.com"; sid:548410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronaviruslaw.com"; sid:548411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronaviruslawyer.com"; sid:548412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronaviruslawyers.com"; sid:548413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19attorney.com"; sid:548414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19law.com"; sid:548415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19lawyer.com"; sid:548416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19lawyers.com"; sid:548417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidattorney.com"; sid:548418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidlaw.com"; sid:548419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidlawyer.com"; sid:548420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germany-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germany-coronavirus-live-stats.com"; sid:548421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaviruscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaviruscash.com"; sid:548422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19cash.com"; sid:548423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidaid.com"; sid:548424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidmask.com"; sid:548425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcoronavirus.com"; sid:548426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcoronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcoronavirusmoney.com"; sid:548427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ggoglecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ggoglecovid19.com"; sid:548428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-corona-virus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-corona-virus-test.com"; sid:548429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalepidemicmedicasupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalepidemicmedicasupplier.com"; sid:548430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.vision"; sid:548431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guccicoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guccicoronavirusfacemasks.com"; sid:548432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guccicoronavirusgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guccicoronavirusgloves.com"; sid:548433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackagainstcovid-19.com"; sid:548434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackagainstcovid.com"; sid:548435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackpandemic.com"; sid:548436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizerforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizerforcovid19.com"; sid:548437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizerforsaleforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizerforsaleforcoronavirus.com"; sid:548438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happyincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happyincovid.com"; sid:548439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happy-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happy-pandemic.com"; sid:548440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingfromapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingfromapandemic.com"; sid:548441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heatcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heatcovid.world"; sid:548442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcorona-virus.com"; sid:548443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidpeople.com"; sid:548444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingwithcovid.com"; sid:548445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwitcovid.com"; sid:548446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycoronaviruscheck.com"; sid:548447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiphopcoronavirusinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiphopcoronavirusinitiative.com"; sid:548448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiphopcoronavirusinitiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiphopcoronavirusinitiative.net"; sid:548449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hira-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hira-covid19.net"; sid:548450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirus.com"; sid:548451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeforsalecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeforsalecoronavirus.com"; sid:548452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeforsalecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeforsalecovid-19.com"; sid:548453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeforsalecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeforsalecovid19.com"; sid:548454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housingmarketcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housingmarketcoronavirus.com"; sid:548455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housingmarketcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housingmarketcovid-19.com"; sid:548456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housingmarketcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housingmarketcovid19.com"; sid:548457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcoronavirus2020.com"; sid:548458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivethecoronavirus.com"; sid:548459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtogetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtogetcoronavirus.com"; sid:548460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtohealcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtohealcoronavirus.biz"; sid:548461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoovercomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoovercomecoronavirus.com"; sid:548462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcoronavirus.net"; sid:548463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icaughtcovid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icaughtcovid19.co.uk"; sid:548464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcovidresponse.com"; sid:548465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideacovid.com"; sid:548466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideastofightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideastofightcorona.com"; sid:548467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idscovid19.com"; sid:548468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idscovid19.net"; sid:548469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilovecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilovecovid-19.com"; sid:548470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilovecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilovecovid19.com"; sid:548471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilovethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilovethecoronavirus.com"; sid:548472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19.com"; sid:548473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imstrongerthancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imstrongerthancovid-19.com"; sid:548474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacioncoronavirus.net"; sid:548475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for india-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"india-covid.com"; sid:548476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightsbackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightsbackcorona.com"; sid:548477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscovid.com"; sid:548478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscovid.net"; sid:548479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianaanesthesiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianaanesthesiacovid.com"; sid:548480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovidtests.com"; sid:548481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspiteofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspiteofcorona.com"; sid:548482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19rapidtest.com"; sid:548483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19testkit.com"; sid:548484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalacademyofcovidsafedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalacademyofcovidsafedentistry.com"; sid:548485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalacademyofcovidsafedentistscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalacademyofcovidsafedentistscom.com"; sid:548486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimesofcoronavirus.com"; sid:548487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irindecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irindecorona.com"; sid:548488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusdefeatedyet.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusdefeatedyet.co.uk"; sid:548489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19madeinlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19madeinlab.com"; sid:548490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isjustcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isjustcoronavirus.com"; sid:548491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecorona-virus.com"; sid:548492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvive-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvive-covid19.com"; sid:548493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecovid-19.com"; sid:548494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivecovid19.com"; sid:548495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-192020.com"; sid:548496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.cloud"; sid:548497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.email"; sid:548498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19tees.com"; sid:548499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.uk"; sid:548500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirus20192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirus20192020.com"; sid:548501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatimes.com"; sid:548502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacoronaja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacoronaja.com"; sid:548503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jailcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jailcoronaviruslawyer.com"; sid:548504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jhcovidespanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jhcovidespanol.com"; sid:548505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jmccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jmccovid19.com"; sid:548506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsinthetimeofcorona.com"; sid:548507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joyscorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joyscorecoronavirus.com"; sid:548508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joyscorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joyscorecovid19.com"; sid:548509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jump4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jump4covid19.com"; sid:548510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jumpforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jumpforcovid19.com"; sid:548511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juuva4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juuva4corona.com"; sid:548512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kalbar-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kalbar-covid19.com"; sid:548513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khalchasidimcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khalchasidimcorona.com"; sid:548514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidagainstcorona.com"; sid:548515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnessinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnessinthetimeofcorona.com"; sid:548516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitpandemic.com"; sid:548517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsforpandemics.com"; sid:548518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowhy-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowhy-corona.com"; sid:548519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koalavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koalavscovid.com"; sid:548520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kutcovid-19.com"; sid:548521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kwickscreen-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kwickscreen-covid.com"; sid:548522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorpcovid-19.com"; sid:548523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorpcovid19.com"; sid:548524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidcleanup.com"; sid:548525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirustips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirustips.com"; sid:548526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnfromcovid.com"; sid:548527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letbeatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letbeatcovid.net"; sid:548528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbetcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbetcovid.net"; sid:548529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscorona.com"; sid:548530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsdefeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsdefeatcorona.com"; sid:548531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafter-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafter-covid.com"; sid:548532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lionscovid19.com"; sid:548533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaftercorona.com"; sid:548534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livethroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livethroughcovid19.com"; sid:548535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loanscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loanscovid19.com"; sid:548536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lonergancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lonergancovid19.com"; sid:548537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-corona.net"; sid:548538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronavirus19.com"; sid:548539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-covid-19.com"; sid:548540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetymeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetymeofcorona.com"; sid:548541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcoronarelief.com"; sid:548542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaras-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaras-corona-virus.com"; sid:548543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherina-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherina-coronavirus.com"; sid:548544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masjidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masjidcovid.com"; sid:548545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskfightscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskfightscoronavirus.com"; sid:548546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskfightscovid19.com"; sid:548547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks4covid19.com"; sid:548548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-forcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-forcoronavirus.com"; sid:548549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescovid19.com"; sid:548550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcwcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcwcoronavirus.com"; sid:548551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcwcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcwcovid-19.com"; sid:548552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcwcovid19.com"; sid:548553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdkmwscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdkmwscovid19.com"; sid:548554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meaftercovid19.com"; sid:548555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicine4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicine4coronavirus.com"; sid:548556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicines4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicines4coronavirus.com"; sid:548557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memescorona.com"; sid:548558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamimedcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamimedcovidhelp.com"; sid:548559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for middlesbroughcovid19mutualaid.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"middlesbroughcovid19mutualaid.co.uk"; sid:548560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwaukeecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwaukeecovid19.com"; sid:548561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwaukeecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwaukeecovid.com"; sid:548562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minotcorona.com"; sid:548563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovidsitters.com"; sid:548564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mondkapjes-kopen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mondkapjes-kopen-corona.com"; sid:548565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for money4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"money4corona.com"; sid:548566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for money4coronavid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"money4coronavid19.com"; sid:548567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyforcoronavid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyforcoronavid19.com"; sid:548568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for msmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"msmcovid19.com"; sid:548569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutasicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutasicovid-19.com"; sid:548570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiaries.net"; sid:548571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahealth.com"; sid:548572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasymptoms.com"; sid:548573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronav1design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronav1design.com"; sid:548574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronav1solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronav1solutions.com"; sid:548575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronav3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronav3.com"; sid:548576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronav3studio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronav3studio.com"; sid:548577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirus.life"; sid:548578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.life"; sid:548579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19lockdown.com"; sid:548580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myglobalpandemic.com"; sid:548581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifecovid19.com"; sid:548582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myrepaircoronav1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myrepaircoronav1.com"; sid:548583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysolarcorona-v1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysolarcorona-v1.com"; sid:548584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysolarcoronav1design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysolarcoronav1design.com"; sid:548585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysolarcoronav3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysolarcoronav3.com"; sid:548586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95stopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95stopcorona.com"; sid:548587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaim.com"; sid:548588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaim.net"; sid:548589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronaviruslawyers.com"; sid:548590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claims.com"; sid:548591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcorona.com"; sid:548592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigating-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigating-covid19.com"; sid:548593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbanticovid19.com"; sid:548594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncov-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncov-coronavirus.com"; sid:548595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needcoronahelp.com"; sid:548596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neftlix-covid19-promocion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neftlix-covid19-promocion.com"; sid:548597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicevillecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicevillecovid19.com"; sid:548598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaindia.com"; sid:548599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid9tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid9tees.com"; sid:548600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacovid.com"; sid:548601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecovid19.com"; sid:548602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nonprofitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nonprofitcovid19.com"; sid:548603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norway-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norway-coronavirus-live-stats.com"; sid:548604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcorona.net"; sid:548605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruslegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruslegal.com"; sid:548606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntxcovid19.com"; sid:548607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwacovid-19.com"; sid:548608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwacovid-19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwacovid-19taskforce.com"; sid:548609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysarcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysarcovidupdates.com"; sid:548610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olvgcoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olvgcoronacheck.com"; sid:548611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecoronav3usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecoronav3usa.com"; sid:548612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oneteamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oneteamcovid.com"; sid:548613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid-19relief.com"; sid:548614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid19relief.com"; sid:548615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlineteacherduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlineteacherduringcovid.com"; sid:548616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opcovid.com"; sid:548617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencoronatracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencoronatracking.com"; sid:548618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ost-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ost-covid19.com"; sid:548619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourloveinthetimeofcorona.com"; sid:548620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourworldaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourworldaftercovid-19.com"; sid:548621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourworldaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourworldaftercovid19.com"; sid:548622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcorona.com"; sid:548623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcovid19.com"; sid:548624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcovid.com"; sid:548625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcovideo.com"; sid:548626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronalawyers.com"; sid:548627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paintinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paintinginthetimeofcorona.com"; sid:548628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pancoronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pancoronadiaries.com"; sid:548629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pancoronadiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pancoronadiaries.net"; sid:548630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemia-coronavirus-convid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemia-coronavirus-convid19.com"; sid:548631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemia-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemia-coronavirus-covid19.com"; sid:548632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-aftermath.com"; sid:548633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbags.com"; sid:548634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboxedkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboxedkit.com"; sid:548635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboxkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboxkit.com"; sid:548636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid-19.com"; sid:548637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencybox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencybox.com"; sid:548638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencykit.com"; sid:548639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyprotectionkit.com"; sid:548640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyresponse.com"; sid:548641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyresponsekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyresponsekit.com"; sid:548642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoodtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoodtruck.com"; sid:548643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgobag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgobag.com"; sid:548644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgobox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgobox.com"; sid:548645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguidance.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguidance.bid"; sid:548646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguides.com"; sid:548647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicids.com"; sid:548648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinstitute.com"; sid:548649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclessons.com"; sid:548650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclicense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclicense.com"; sid:548651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifehacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifehacks.com"; sid:548652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmagnets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmagnets.com"; sid:548653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmanagementpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmanagementpolicy.com"; sid:548654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeaning.com"; sid:548655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pack.com"; sid:548656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatriot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatriot.com"; sid:548657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pdf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pdf.net"; sid:548658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpleasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpleasures.com"; sid:548659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicportfolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicportfolio.com"; sid:548660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpositive.com"; sid:548661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednessbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednessbox.com"; sid:548662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepbox.com"; sid:548663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprokit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprokit.com"; sid:548664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofbusiness.com"; sid:548665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.net"; sid:548666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadykit.com"; sid:548667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsetracker.com"; sid:548668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-safety.com"; sid:548669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscreening.com"; sid:548670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.education"; sid:548671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshirts.net"; sid:548672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsinfo.com"; sid:548673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupply.net"; sid:548674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-support.com"; sid:548675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthinktank.com"; sid:548676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictimes.net"; sid:548677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoll.com"; sid:548678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictopeace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictopeace.com"; sid:548679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictopower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictopower.com"; sid:548680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictopurpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictopurpose.com"; sid:548681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrial.com"; sid:548682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicventilator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicventilator.net"; sid:548683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicview.com"; sid:548684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvolunteer.com"; sid:548685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovid19update.com"; sid:548686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovid19updates.com"; sid:548687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovidupdatess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovidupdatess.com"; sid:548688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peakcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peakcovid.com"; sid:548689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peercovid-19.com"; sid:548690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pelosipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pelosipandemic.com"; sid:548691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perucovid19.com"; sid:548692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsofthepandemic.com"; sid:548693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phencovid19.com"; sid:548694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phencovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phencovid19.net"; sid:548695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacoronalawyers.com"; sid:548696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phlcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phlcovidsupply.com"; sid:548697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phonycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phonycovid19.com"; sid:548698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phscorona.com"; sid:548699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phunthuockhutrungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phunthuockhutrungcorona.com"; sid:548700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pictureofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pictureofcorona.com"; sid:548701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pisforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pisforpandemic.com"; sid:548702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcoronalawyers.com"; sid:548703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plancoronavirusencomunidades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plancoronavirusencomunidades.com"; sid:548704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plaquenil-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plaquenil-covid.com"; sid:548705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portalcoronavirus.com"; sid:548706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandcovid19.com"; sid:548707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandmainecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandmainecovid19.com"; sid:548708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandmainecovid19matching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandmainecovid19matching.com"; sid:548709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivenewscovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivenewscovid19.club"; sid:548710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona-age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona-age.com"; sid:548711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaage.com"; sid:548712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacitizen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacitizen.com"; sid:548713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacompany.com"; sid:548714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacountry.com"; sid:548715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadecade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadecade.com"; sid:548716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaeducation.com"; sid:548717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafuture.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafuture.club"; sid:548718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronal.com"; sid:548719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalearning.com"; sid:548720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalism.com"; sid:548721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalism.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalism.net"; sid:548722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalismus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalismus.net"; sid:548723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaop.com"; sid:548724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19jobs.com"; sid:548725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19life.com"; sid:548726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerversuspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerversuspandemic.com"; sid:548727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerversuspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerversuspandemic.net"; sid:548728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayervspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayervspandemic.com"; sid:548729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayervspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayervspandemic.net"; sid:548730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovidprice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovidprice.com"; sid:548731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preppercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preppercovid.com"; sid:548732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisoncoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisoncoronaviruslawyer.com"; sid:548733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-covid19.com"; sid:548734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionfromcovid.com"; sid:548735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-coronavirus.com"; sid:548736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacorona.com"; sid:548737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovidabr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovidabr.com"; sid:548738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychologyandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychologyandcovid-19.com"; sid:548739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punch-out-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punch-out-corona.com"; sid:548740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purecorona.com"; sid:548741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purecovid19.com"; sid:548742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purposethroughpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purposethroughpandemic.com"; sid:548743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pvdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pvdcovid-19.com"; sid:548744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19test.com"; sid:548745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quidprocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quidprocovid.com"; sid:548746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quikpaccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quikpaccovidtest.com"; sid:548747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirusresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirusresults.com"; sid:548748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtesting.com"; sid:548749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidx.com"; sid:548750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcovid.com"; sid:548751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratecoronavirus.com"; sid:548752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdc-covid.com"; sid:548753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidstories.com"; sid:548754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatecoronavirus.com"; sid:548755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatecovid-19.com"; sid:548756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatemarketcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatemarketcoronavirus.com"; sid:548757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatemarketcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatemarketcovid-19.com"; sid:548758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatemarketcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatemarketcovid19.com"; sid:548759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4corona.com"; sid:548760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4corona.net"; sid:548761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4coronavid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4coronavid19.com"; sid:548762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefforcorona.com"; sid:548763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefforcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefforcorona.net"; sid:548764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefforcoronavid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefforcoronavid19.com"; sid:548765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repaircoronav3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repaircoronav3.com"; sid:548766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resilienz-coronakrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resilienz-coronakrise.com"; sid:548767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistancecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistancecovid.com"; sid:548768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourceguideforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourceguideforcovid19.com"; sid:548769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reviewcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reviewcorona.com"; sid:548770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for right2knowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"right2knowcovid19.com"; sid:548771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rosarioscoronademiserere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rosarioscoronademiserere.com"; sid:548772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rrpscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rrpscovid19.com"; sid:548773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid-19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid-19map.com"; sid:548774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeplacestovisitduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeplacestovisitduringcovid19.com"; sid:548775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscov2pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscov2pandemic.com"; sid:548776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid.com"; sid:548777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayno2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayno2corona.com"; sid:548778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynocorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynocorona-virus.com"; sid:548779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynocovid-19.com"; sid:548780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronafunds.com"; sid:548781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-coronavirus.com"; sid:548782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19funds.com"; sid:548783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schuetzen-vor-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schuetzen-vor-corona.com"; sid:548784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzimpfung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzimpfung-corona.com"; sid:548785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzimpfungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzimpfungcorona.com"; sid:548786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzkleidung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzkleidung-corona.com"; sid:548787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmaskecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmaskecorona.com"; sid:548788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenforcovid.com"; sid:548789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningforcovid.com"; sid:548790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcovid.com"; sid:548791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovidcleanup.com"; sid:548792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securecovid.com"; sid:548793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguroparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguroparacoronavirus.com"; sid:548794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semprotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semprotcorona.com"; sid:548795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sencovid-19.com"; sid:548796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servcovid19.com"; sid:548797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serviceaidemondial-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serviceaidemondial-corona.com"; sid:548798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgtiflexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgtiflexcovid19.com"; sid:548799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shiptcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shiptcovid-19.com"; sid:548800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronatees.com"; sid:548801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-covid-19.com"; sid:548802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldibeworriedaboutthecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldibeworriedaboutthecoronaviruses.com"; sid:548803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutdowncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutdowncoronavirus.com"; sid:548804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shutdowncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shutdowncoronavirus.net"; sid:548805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signofcoronavirus.com"; sid:548806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singleviewofthecoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singleviewofthecoronaviruspandemic.com"; sid:548807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sjccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sjccovid.com"; sid:548808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skleptestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skleptestcovid19.com"; sid:548809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessloanscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessloanscovid19.com"; sid:548810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smc-covid19.com"; sid:548811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for societypostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"societypostcovid19.com"; sid:548812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solarcoronav1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solarcoronav1.com"; sid:548813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sonev-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sonev-covid19.com"; sid:548814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscovids19.com"; sid:548815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincovid.com"; sid:548816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speacovid.com"; sid:548817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovidresponse.com"; sid:548818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanetransit-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanetransit-coronavirus.com"; sid:548819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springbreakpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springbreakpandemic.com"; sid:548820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springbreakpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springbreakpandemic.net"; sid:548821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statistics-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statistics-corona.com"; sid:548822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statisticscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statisticscorona.com"; sid:548823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statisticsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statisticsofcorona.com"; sid:548824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidfree.com"; sid:548825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stompcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stompcovid.com"; sid:548826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona24.com"; sid:548827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona-sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona-sign.com"; sid:548828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaviruschain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaviruschain.com"; sid:548829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.pro"; sid:548830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.network"; sid:548831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for store-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"store-covid-19.com"; sid:548832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressfreiere-gesellschaft-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressfreiere-gesellschaft-nach-corona.com"; sid:548833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stscorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stscorona19.com"; sid:548834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stscovid19.com"; sid:548835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sttammanycoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sttammanycoronanews.com"; sid:548836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentaidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentaidpandemic.com"; sid:548837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentaidpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentaidpandemic.net"; sid:548838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studiocoronavirus.com"; sid:548839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studyduringcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studyduringcovid-19.com"; sid:548840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplies4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplies4covid19.com"; sid:548841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survidedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survidedcovid19.com"; sid:548842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivercovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivercovid19.biz"; sid:548843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronapocalypse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronapocalypse2020.com"; sid:548844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecorona-virus.com"; sid:548845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingwithcorona.com"; sid:548846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorscoronavirus.com"; sid:548847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid.com"; sid:548848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swanseacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swanseacovid19.com"; sid:548849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swcovid.com"; sid:548850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacomacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacomacorona.com"; sid:548851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacoronavirus.com"; sid:548852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcoronavirus.com"; sid:548853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techforcovidspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techforcovidspain.com"; sid:548854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tele-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tele-coronavirus.com"; sid:548855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tele-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tele-covid19.com"; sid:548856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tengocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tengocorona.com"; sid:548857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4coronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4coronaviruses.com"; sid:548858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronafree.com"; sid:548859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecoronarapido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecoronarapido.com"; sid:548860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecovid.com"; sid:548861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcoronaviruses.com"; sid:548862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit4corona.com"; sid:548863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests4corona.com"; sid:548864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests-covid19.com"; sid:548865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testscovid.com"; sid:548866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19attorneys.com"; sid:548867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19law.com"; sid:548868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovid-19.com"; sid:548869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebigcoronatv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebigcoronatv.com"; sid:548870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacountdown.com"; sid:548871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries207edition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries207edition.com"; sid:548872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaexperience.com"; sid:548873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaexterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaexterminator.com"; sid:548874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-graph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-graph.com"; sid:548875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakid.com"; sid:548876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaporeproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaporeproject.com"; sid:548877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasong.com"; sid:548878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasutra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasutra.com"; sid:548879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona-v3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona-v3.com"; sid:548880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushoax.com"; sid:548881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusinstitute.com"; sid:548882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusrelief.com"; sid:548883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusreports.com"; sid:548884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussupplystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussupplystore.com"; sid:548885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19conspiracy.com"; sid:548886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19hoax.com"; sid:548887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lockdown.com"; sid:548888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19man.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19man.com"; sid:548889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19nearme.com"; sid:548890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19reports.com"; sid:548891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19shitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19shitlist.com"; sid:548892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19story.com"; sid:548893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidband.com"; sid:548894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcavity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcavity.com"; sid:548895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcheck.com"; sid:548896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleaner.com"; sid:548897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlie.com"; sid:548898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmarket.com"; sid:548899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidoctor.com"; sid:548900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicreporter.com"; sid:548901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicthruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicthruth.com"; sid:548902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid-19.com"; sid:548903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanvirius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanvirius.com"; sid:548904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiscovid19lifethebookgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiscovid19lifethebookgroup.com"; sid:548905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisismybrainoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisismybrainoncovid19.com"; sid:548906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toiletpapercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toiletpapercorona.com"; sid:548907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toloveinthetimeofcorona.com"; sid:548908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for track-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"track-covid-19.net"; sid:548909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcoronavirus.net"; sid:548910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovidsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovidsandiego.com"; sid:548911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackmycorona.com"; sid:548912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trajescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trajescoronavirus.com"; sid:548913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trakcorona.com"; sid:548914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transitionpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transitionpandemic.com"; sid:548915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentcovid-19.com"; sid:548916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpdidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpdidcoronavirus.com"; sid:548917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpepidemic.com"; sid:548918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthofcoronavirus.com"; sid:548919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t-shirtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t-shirtcovid19.com"; sid:548920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tucoronafoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tucoronafoto.com"; sid:548921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuonslecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuonslecovid.com"; sid:548922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for udcovid19smellstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"udcovid19smellstudy.com"; sid:548923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufcovid.com"; sid:548924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealthcovid19.com"; sid:548925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufheathcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufheathcovid.com"; sid:548926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhelthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhelthcovid.com"; sid:548927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandcovid19.com"; sid:548928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicorona.com"; sid:548929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontracovid19.com"; sid:548930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedcovid-19database.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedcovid-19database.com"; sid:548931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedpandemic.com"; sid:548932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaim.com"; sid:548933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaim.net"; sid:548934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaims.com"; sid:548935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaims.net"; sid:548936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatesofcorona.com"; sid:548937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upperhandwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upperhandwuhan.com"; sid:548938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urcorona.com"; sid:548939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-coronavirus-live-stats.com"; sid:548940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaim.com"; sid:548941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaim.net"; sid:548942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaims.com"; sid:548943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaims.net"; sid:548944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscorona-virus.com"; sid:548945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidwatch.com"; sid:548946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ussaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ussaftercovid19.com"; sid:548947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccination-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccination-covid.com"; sid:548948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationcovid.com"; sid:548949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-covid2019.com"; sid:548950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vapingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vapingpandemic.com"; sid:548951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovidcleanup.com"; sid:548952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencialcoronavirus.com"; sid:548953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercoronaday.com"; sid:548954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacoronavirusquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacoronavirusquarantine.com"; sid:548955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona.care"; sid:548956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemicsupplies.com"; sid:548957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitacovid.com"; sid:548958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vnacovid19emergencyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vnacovid19emergencyfund.com"; sid:548959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voluntarioscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voluntarioscovid19.com"; sid:548960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerforcovid19.com"; sid:548961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovidcleanup.com"; sid:548962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warcovid-19.com"; sid:548963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washco-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washco-covid19.com"; sid:548964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellnesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellnesscovid.com"; sid:548965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for welovecorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"welovecorona.club"; sid:548966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wespreadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wespreadcorona.com"; sid:548967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronaclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronaclothing.com"; sid:548968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid.com"; sid:548969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethecovid19.com"; sid:548970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethecovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethecovid19free.com"; sid:548971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethecovid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethecovid19free.net"; sid:548972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethecovidfree.com"; sid:548973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethecovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethecovidfree.net"; sid:548974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethenorthandcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethenorthandcovidfree.com"; sid:548975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethenorthandcovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethenorthandcovidfree.net"; sid:548976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wevegotyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wevegotyoucovid.com"; sid:548977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereiscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereiscovid-19.com"; sid:548978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winovercorona.com"; sid:548979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeawaycorona.com"; sid:548980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wir-gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wir-gegen-corona.net"; sid:548981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingduringapandemic.com"; sid:548982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercorona.net"; sid:548983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronadiaries.com"; sid:548984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronadiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronadiaries.net"; sid:548985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronadiary.com"; sid:548986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronanews.com"; sid:548987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcorona.com"; sid:548988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan16.com"; sid:548989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchufalvyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchufalvyou.com"; sid:548990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancurse.com"; sid:548991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanguozhen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanguozhen.com"; sid:548992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhaninterfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhaninterfashion.com"; sid:548993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirustube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirustube.com"; sid:548994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronaviruslawyer.com"; sid:548995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvjailcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvjailcoronaviruslawyer.com"; sid:548996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvprisoncoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvprisoncoronaviruslawyer.com"; sid:548997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwiiicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwiiicovid19.com"; sid:548998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronavirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronavirus-sd.com"; sid:548999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwmcoronavirus.com"; sid:549000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwufhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwufhealthcovid.com"; sid:549001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid.com"; sid:549002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-entschdigung-swb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-entschdigung-swb.net"; sid:549003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-gncelsalgnvakalar-nwc35l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-gncelsalgnvakalar-nwc35l.com"; sid:549004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--entschdigung-corona-lwb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--entschdigung-corona-lwb.net"; sid:549005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yamhillcountycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yamhillcountycovid-19.com"; sid:549006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcoronavirusoficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcoronavirusoficial.com"; sid:549007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcoronavirusoficial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcoronavirusoficial.net"; sid:549008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovid19.com"; sid:549009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovid19.net"; sid:549010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zusammengegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zusammengegencorona.com"; sid:549011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 101corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"101corona.com"; sid:549012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronatest.com"; sid:549013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18restaurantsdeliveryduringcoronaviruscrisis.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18restaurantsdeliveryduringcoronaviruscrisis.cloud"; sid:549014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronacure.com"; sid:549015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusprevention.com"; sid:549016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirussurvivor.com"; sid:549017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19.net"; sid:549018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-19survivor.com"; sid:549019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-covid.com"; sid:549020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicmovie.com"; sid:549021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021pandemic.com"; sid:549022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21dayscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21dayscorona.com"; sid:549023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247coronaviruschat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247coronaviruschat.com"; sid:549024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24x7coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24x7coronavirus.com"; sid:549025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30minutecovidtest.com"; sid:549026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411covid.com"; sid:549027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4coronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4coronavirustest.com"; sid:549028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidfree.com"; sid:549029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidtest.com"; sid:549030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5for1covid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5for1covid19challenge.com"; sid:549031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5for1covidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5for1covidchallenge.com"; sid:549032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911mycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911mycorona.com"; sid:549033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911-pandemic.com"; sid:549034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911pandemic.com"; sid:549035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid19info.com"; sid:549036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovid19test.com"; sid:549037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronavirussolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronavirussolution.com"; sid:549038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acucorona.com"; sid:549039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscovid.com"; sid:549040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosxcoronavirus.com"; sid:549041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affectedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affectedbycovid19.com"; sid:549042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aginginatimeofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aginginatimeofpandemic.com"; sid:549043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahefcoronavirusdestek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahefcoronavirusdestek.com"; sid:549044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahoralacoronalallevoyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahoralacoronalallevoyo.com"; sid:549045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidcovid19.com"; sid:549046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidecorona.com"; sid:549047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovidtest.com"; sid:549048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alerta-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alerta-coronavirus.com"; sid:549049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecoronacongo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecoronacongo.com"; sid:549050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for algeriacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"algeriacovid19.com"; sid:549051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliment-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliment-covid19.com"; sid:549052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovid-19.com"; sid:549053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronavirusupdates.com"; sid:549054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleswaszaehlt-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleswaszaehlt-corona.com"; sid:549055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleswaszaehltcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleswaszaehltcorona.com"; sid:549056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alltestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alltestcovid19.com"; sid:549057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amicovid19.com"; sid:549058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analyticpoweredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analyticpoweredcovid19.com"; sid:549059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anno-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anno-corona.com"; sid:549060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annocorona.com"; sid:549061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anno-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anno-covid.com"; sid:549062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annocovid.com"; sid:549063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti19covid.com"; sid:549064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovidtest.com"; sid:549065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona2020.com"; sid:549066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-run.com"; sid:549067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus2020.com"; sid:549068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusbay.com"; sid:549069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.center"; sid:549070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpharma.com"; sid:549071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.solutions"; sid:549072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apostcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apostcovidworld.com"; sid:549073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argentinacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argentinacovid.com"; sid:549074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociaciondeafectadosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociaciondeafectadosporcoronavirus.com"; sid:549075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociaciondevictimascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociaciondevictimascoronavirus.com"; sid:549076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociaciondevictimasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociaciondevictimasdelcoronavirus.com"; sid:549077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionvictimascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionvictimascoronavirus.com"; sid:549078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurancecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurancecoronatest.com"; sid:549079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomepandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomepandemickits.com"; sid:549080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscovid19supplies.com"; sid:549081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australia-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australia-coronavirus-live-stats.com"; sid:549082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovidvirus.com"; sid:549083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awayfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awayfromcorona.com"; sid:549084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascoronavirus.net"; sid:549085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azecovid19.com"; sid:549086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azecovid19.net"; sid:549087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bancovid.com"; sid:549088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battle-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battle-covid19.com"; sid:549089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beadedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beadedcoronavirus.com"; sid:549090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronanj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronanj.com"; sid:549091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomecovidcleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomecovidcleared.com"; sid:549092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondpandemic.com"; sid:549093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosecuritycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosecuritycovid19.com"; sid:549094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodensee-immobilie-verkaufen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodensee-immobilie-verkaufen-corona.com"; sid:549095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncovid.com"; sid:549096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessbeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessbeyondcovid19.com"; sid:549097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaantibiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaantibiotics.com"; sid:549098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19masknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19masknow.com"; sid:549099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19signs.com"; sid:549100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byevacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byevacoronado.com"; sid:549101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cadeau-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cadeau-covid19.com"; sid:549102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambridgecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambridgecovid.com"; sid:549103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerresourcesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerresourcesforcovid19.com"; sid:549104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannacovid.com"; sid:549105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstcoronavirus.com"; sid:549106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecovid.com"; sid:549107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carethroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carethroughcorona.com"; sid:549108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycoronadeathwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycoronadeathwatch.com"; sid:549109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for center4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"center4corona.com"; sid:549110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for center4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"center4corona.net"; sid:549111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centraldocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centraldocorona.com"; sid:549112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cerntrum4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cerntrum4corona.com"; sid:549113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cerntrum4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cerntrum4corona.net"; sid:549114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengecovid.com"; sid:549115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chekcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chekcovid19.com"; sid:549116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chekcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chekcovid.com"; sid:549117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christianresponsetocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christianresponsetocorona.com"; sid:549118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofcovid19.com"; sid:549119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcorona2020.com"; sid:549120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcorona2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcorona2020.net"; sid:549121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanforcovid19.com"; sid:549122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningupcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningupcovid.com"; sid:549123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearofcovid.com"; sid:549124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearupcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearupcovid-19.com"; sid:549125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloroquinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloroquinacoronavirus.com"; sid:549126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closecovid.com"; sid:549127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combat-corona.com"; sid:549128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commoncovid.com"; sid:549129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityovercovid.com"; sid:549130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecovid.com"; sid:549131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corksagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corksagainstcovid.com"; sid:549132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19bet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19bet.com"; sid:549133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19beverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19beverlyhills.com"; sid:549134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19california.com"; sid:549135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19killers.com"; sid:549136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19rank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19rank.com"; sid:549137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19ranking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19ranking.com"; sid:549138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020crack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020crack.com"; sid:549139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020tracker.com"; sid:549140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-21-uhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-21-uhr.com"; sid:549141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona21uhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona21uhr.com"; sid:549142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona226.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona226.com"; sid:549143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona87.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona87.com"; sid:549144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactually.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactually.com"; sid:549145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-analysis.com"; sid:549146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaankara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaankara.com"; sid:549147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus.net"; sid:549148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apotheke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apotheke.com"; sid:549149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbeitsrecht.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbeitsrecht.net"; sid:549150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasthma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasthma.com"; sid:549151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atemschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atemschutz.com"; sid:549152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattitude.com"; sid:549153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaauctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaauctions.com"; sid:549154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaautoprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaautoprogram.com"; sid:549155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababe2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababe2020.com"; sid:549156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababeez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababeez.com"; sid:549157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababes2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababes2020.com"; sid:549158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiesworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiesworldwide.com"; sid:549159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabackoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabackoff.com"; sid:549160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabags.com"; sid:549161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabailoutcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabailoutcapital.com"; sid:549162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabailoutmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabailoutmoney.com"; sid:549163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabangladesh.com"; sid:549164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabank.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabank.guru"; sid:549165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabar.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabar.restaurant"; sid:549166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabash.com"; sid:549167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabear.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabear.club"; sid:549168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabesmetting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabesmetting.com"; sid:549169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestrijding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestrijding.com"; sid:549170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabettings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabettings.com"; sid:549171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-biclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-biclaim.com"; sid:549172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiclaim.com"; sid:549173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-biclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-biclaims.com"; sid:549174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiclaims.com"; sid:549175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabilgikaynagi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabilgikaynagi.com"; sid:549176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabim.com"; sid:549177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabirrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabirrus.com"; sid:549178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-blox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-blox.com"; sid:549179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabolivia.com"; sid:549180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomereu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomereu.com"; sid:549181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomer.net"; sid:549182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomeruk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomeruk.com"; sid:549183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomerusa.com"; sid:549184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomerusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomerusa.net"; sid:549185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabounceback.com"; sid:549186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreaker.com"; sid:549187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabstrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabstrich.com"; sid:549188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabstrich.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabstrich.net"; sid:549189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabud.net"; sid:549190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuildchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuildchallenge.com"; sid:549191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulos.com"; sid:549192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesscleaners.com"; sid:549193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessfinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessfinancing.com"; sid:549194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-businessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-businessloans.com"; sid:549195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-calc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-calc.com"; sid:549196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-candle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-candle.net"; sid:549197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacane.com"; sid:549198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannabis.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannabis.care"; sid:549199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannabis.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannabis.club"; sid:549200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannabis.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannabis.life"; sid:549201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannabis.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannabis.today"; sid:549202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannabis.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannabis.world"; sid:549203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarcleaner.com"; sid:549204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacenter.net"; sid:549205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ch.com"; sid:549206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckkit.com"; sid:549207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chloroquine.com"; sid:549208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronical.com"; sid:549209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicle2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicle2020.com"; sid:549210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclers.com"; sid:549211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide19.com"; sid:549212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronack.com"; sid:549213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimlaw.com"; sid:549214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimlawyer.com"; sid:549215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimlawyers.com"; sid:549216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclash.com"; sid:549217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanchicago.com"; sid:549218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaner.net"; sid:549219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanindiana.com"; sid:549220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupcrews.com"; sid:549221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclicker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclicker.net"; sid:549222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclock.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclock.life"; sid:549223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloth.com"; sid:549224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloths.com"; sid:549225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolorkit.com"; sid:549226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolorkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolorkits.com"; sid:549227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compensation.com"; sid:549228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliant.com"; sid:549229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-concert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-concert.com"; sid:549230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstructions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstructions.com"; sid:549231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontracting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontracting.com"; sid:549232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacool.com"; sid:549233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopper.com"; sid:549234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19test.com"; sid:549235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidclub.com"; sid:549236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacubes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacubes.com"; sid:549237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacutie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacutie.net"; sid:549238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaigua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaigua.com"; sid:549239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadansonra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadansonra.com"; sid:549240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-database.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-database.com"; sid:549241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealerplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealerplaybook.com"; sid:549242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealerplaybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealerplaybook.net"; sid:549243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademaria.com"; sid:549244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnostic.com"; sid:549245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-discourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-discourse.com"; sid:549246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofilm.com"; sid:549247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrive.com"; sid:549248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dx.com"; sid:549249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaegypts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaegypts.com"; sid:549250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemail.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemail.world"; sid:549251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaem.com"; sid:549252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entertainment.com"; sid:549253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafightclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafightclub.com"; sid:549254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafingercondoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafingercondoms.com"; sid:549255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafingercondoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafingercondoms.net"; sid:549256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafive.com"; sid:549257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeair.com"; sid:549258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefestival.com"; sid:549259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeflorida.com"; sid:549260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetrade.com"; sid:549261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuckbuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuckbuddy.com"; sid:549262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuckoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuckoff.com"; sid:549263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gate.net"; sid:549264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguidelines.com"; sid:549265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunlerim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunlerim.com"; sid:549266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguys.com"; sid:549267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaven.com"; sid:549268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-health-certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-health-certificate.com"; sid:549269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahedge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahedge.com"; sid:549270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelplinenumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelplinenumber.com"; sid:549271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelplinenumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelplinenumbers.com"; sid:549272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpsd.com"; sid:549273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpsolutions.com"; sid:549274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpsouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpsouthdakota.com"; sid:549275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahism.com"; sid:549276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahousingimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahousingimpact.com"; sid:549277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hunter.com"; sid:549278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hunter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hunter.net"; sid:549279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuned.com"; sid:549280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunejobs.com"; sid:549281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunejobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunejobs.net"; sid:549282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainbox.com"; sid:549283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infection-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infection-protection.com"; sid:549284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infektions-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infektions-schutz.com"; sid:549285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insight.net"; sid:549286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurance.claims"; sid:549287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisvirus.com"; sid:549288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaizmir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaizmir.com"; sid:549289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajanitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajanitorial.com"; sid:549290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajump.com"; sid:549291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.club"; sid:549292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillusa.com"; sid:549293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilos.com"; sid:549294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-klartext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-klartext.com"; sid:549295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaklartext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaklartext.com"; sid:549296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise2020.com"; sid:549297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise-deutschland.com"; sid:549298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalackey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalackey.com"; sid:549299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawca.com"; sid:549300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawct.com"; sid:549301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawfl.com"; sid:549302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawil.com"; sid:549303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawla.com"; sid:549304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawli.com"; sid:549305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawnj.com"; sid:549306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawnyc.com"; sid:549307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawteam.com"; sid:549308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawtx.com"; sid:549309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawusa.com"; sid:549310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawwc.com"; sid:549311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronald.com"; sid:549312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleadsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleadsuk.com"; sid:549313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegaladvice.com"; sid:549314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalca.com"; sid:549315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalclaim.com"; sid:549316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalclaimlawyer.com"; sid:549317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalct.com"; sid:549318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalfl.com"; sid:549319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalil.com"; sid:549320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalla.com"; sid:549321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalli.com"; sid:549322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalnj.com"; sid:549323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalnyc.com"; sid:549324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalny.com"; sid:549325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegaltx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegaltx.com"; sid:549326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalusa.com"; sid:549327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalwc.com"; sid:549328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalenders.com"; sid:549329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaletter.com"; sid:549330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalicious.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalicious.net"; sid:549331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalining.com"; sid:549332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalithuania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalithuania.com"; sid:549333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveinfo.com"; sid:549334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivemusicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivemusicfestival.com"; sid:549335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloaninfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloaninfo.com"; sid:549336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loans.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loans.today"; sid:549337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-locator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-locator.com"; sid:549338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamale.com"; sid:549339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanco.com"; sid:549340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanhub.com"; sid:549341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamann.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamann.com"; sid:549342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamans.com"; sid:549343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanstore.com"; sid:549344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanusa.com"; sid:549345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksource.com"; sid:549346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalequipment.com"; sid:549347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedsonline.com"; sid:549348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-memories.com"; sid:549349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameoutahere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameoutahere.com"; sid:549350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamigo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamigo.com"; sid:549351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-missie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-missie.com"; sid:549352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagemodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagemodification.com"; sid:549353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgagemodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgagemodifications.com"; sid:549354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamvsk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamvsk.com"; sid:549355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanana.com"; sid:549356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanation.net"; sid:549357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsgroup.com"; sid:549358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsinfo.com"; sid:549359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewss.com"; sid:549360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanil.com"; sid:549361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronannials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronannials.com"; sid:549362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanostick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanostick.com"; sid:549363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficial.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficial.world"; sid:549364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaloozafest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaloozafest.com"; sid:549365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonalplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonalplan.com"; sid:549366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaperspective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaperspective.com"; sid:549367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphisian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphisian.com"; sid:549368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapilot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapilot.com"; sid:549369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplus.net"; sid:549370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaportrait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaportrait.com"; sid:549371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapot.net"; sid:549372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapowerhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapowerhour.com"; sid:549373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapray.com"; sid:549374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapray.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapray.net"; sid:549375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreach.com"; sid:549376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapredictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapredictions.com"; sid:549377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepplan.com"; sid:549378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmark.com"; sid:549379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapropertyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapropertyloans.com"; sid:549380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protective-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protective-mask.com"; sid:549381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotective-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotective-mask.com"; sid:549382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectmasks.com"; sid:549383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsychiater.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsychiater.net"; sid:549384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsychologist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsychologist.net"; sid:549385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquilt.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquilt.life"; sid:549386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquyyphatphap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquyyphatphap.com"; sid:549387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarcotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarcotics.com"; sid:549388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsberatung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsberatung.net"; sid:549389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecruiting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecruiting.com"; sid:549390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reimbursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reimbursement.com"; sid:549391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarentreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarentreduction.com"; sid:549392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-research.com"; sid:549393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarts-creativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarts-creativity.com"; sid:549394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarwanda-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarwanda-api.com"; sid:549395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafejobs.com"; sid:549396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafejobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafejobs.net"; sid:549397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sanitizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sanitizer.net"; sid:549398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizer.net"; sid:549399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascan.net"; sid:549400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascan.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascan.today"; sid:549401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-science.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-science.com"; sid:549402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeners.com"; sid:549403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreen.net"; sid:549404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasets.com"; sid:549405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas.life"; sid:549406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sneezeguard.com"; sid:549407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialclub.com"; sid:549408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolidarity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolidarity.net"; sid:549409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spuckschutz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spuckschutz.net"; sid:549410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatsau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatsau.com"; sid:549411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastayaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastayaway.com"; sid:549412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastickers.com"; sid:549413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong.foundation"; sid:549414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taeglich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taeglich.com"; sid:549415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataeglich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataeglich.com"; sid:549416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestimony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestimony.com"; sid:549417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkit2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkit2020.com"; sid:549418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestpro.com"; sid:549419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesttool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesttool.com"; sid:549420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathome.com"; sid:549421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathonlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathonlive.com"; sid:549422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimejob.com"; sid:549423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimejob.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimejob.net"; sid:549424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatips.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatips.today"; sid:549425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatollfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatollfree.com"; sid:549426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatransfer.com"; sid:549427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattitude.com"; sid:549428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates-zum-hoeren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates-zum-hoeren.com"; sid:549429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateszumhoeren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateszumhoeren.com"; sid:549430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccine.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccine.uk"; sid:549431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavarian.com"; sid:549432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax.world"; sid:549433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfitchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfitchallenge.com"; sid:549434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfitclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfitclub.com"; sid:549435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfitness.com"; sid:549436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida-19.com"; sid:549437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidas.net"; sid:549438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideos.net"; sid:549439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirale.com"; sid:549440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousantibodies.com"; sid:549441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousantibodiestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousantibodiestest.com"; sid:549442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19screening.com"; sid:549443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus3dprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus3dprint.com"; sid:549444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermathclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermathclean.com"; sid:549445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermathcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermathcleaning.com"; sid:549446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermathgreencleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermathgreencleaning.com"; sid:549447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamnesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamnesty.com"; sid:549448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodiestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodiestest.com"; sid:549449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytesting.com"; sid:549450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusbaby.com"; sid:549451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyresources.com"; sid:549452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyresources.net"; sid:549453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcys.com"; sid:549454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-biclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-biclaim.com"; sid:549455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiclaim.com"; sid:549456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-biclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-biclaims.com"; sid:549457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiclaims.com"; sid:549458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiorecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiorecovery.com"; sid:549459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiosecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiosecurity.com"; sid:549460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblows.com"; sid:549461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbud.net"; sid:549462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalendar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalendar.com"; sid:549463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalifornia.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalifornia.life"; sid:549464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabis.net"; sid:549465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaregivercoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaregivercoach.com"; sid:549466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cases-deaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cases-deaths.com"; sid:549467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimcenter.com"; sid:549468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-claim.com"; sid:549469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimscenter.com"; sid:549470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-claims.com"; sid:549471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean911.com"; sid:549472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleancallnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleancallnow.com"; sid:549473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning911.com"; sid:549474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningecoproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningecoproducts.com"; sid:549475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningforce.com"; sid:549476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanings.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanings.net"; sid:549477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanpro.com"; sid:549478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanservice.com"; sid:549479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupequipment.com"; sid:549480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupservice.com"; sid:549481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-coaching.com"; sid:549482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounts.com"; sid:549483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19cure.com"; sid:549484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-defeated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-defeated.com"; sid:549485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenselawyer.com"; sid:549486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelhi.com"; sid:549487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscoveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscoveries.com"; sid:549488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfactant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfactant.com"; sid:549489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdreams.com"; sid:549490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecofriendlycleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecofriendlycleaning.com"; sid:549491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseforum.com"; sid:549492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-eg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-eg.com"; sid:549493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendirecto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendirecto.com"; sid:549494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenpr.com"; sid:549495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-face-mask-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-face-mask-protection.com"; sid:549496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-facts.com"; sid:549497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfdavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfdavaccine.com"; sid:549498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfonds.com"; sid:549499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcesmillions2workremotely.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcesmillions2workremotely.cloud"; sid:549500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgist.com"; sid:549501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-go.com"; sid:549502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-grants.com"; sid:549503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-healthinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-healthinsurance.com"; sid:549504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-healthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-healthplans.com"; sid:549505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpdesk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpdesk.net"; sid:549506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushistoricdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushistoricdeal.com"; sid:549507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomerelief.com"; sid:549508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusicome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusicome.com"; sid:549509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindiana.com"; sid:549510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformation.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformation.center"; sid:549511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-informations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-informations.com"; sid:549512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurys.com"; sid:549513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurance.claims"; sid:549514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceclaims.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceclaims.claims"; sid:549515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillerz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillerz.com"; sid:549516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-knowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-knowledge.com"; sid:549517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-law-firm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-law-firm.com"; sid:549518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-law-firms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-law-firms.com"; sid:549519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleague.com"; sid:549520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalupdates.com"; sid:549521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusletstalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusletstalk.com"; sid:549522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifestories.com"; sid:549523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-links.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-links.com"; sid:549524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslithuania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslithuania.com"; sid:549525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivereport.com"; sid:549526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-live-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-live-update.com"; sid:549527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveupdatez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveupdatez.com"; sid:549528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanmod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanmod.com"; sid:549529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanmodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanmodifications.com"; sid:549530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanmods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanmods.com"; sid:549531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockout.com"; sid:549532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakers.com"; sid:549533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskfactory.com"; sid:549534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskffp2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskffp2.com"; sid:549535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskffp3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskffp3.com"; sid:549536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskfpp2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskfpp2.com"; sid:549537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskfpp3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskfpp3.com"; sid:549538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskinstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskinstock.com"; sid:549539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskkn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskkn95.com"; sid:549540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskkn95direct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskkn95direct.com"; sid:549541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskkn95supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskkn95supplies.com"; sid:549542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksny.com"; sid:549543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskstocktoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskstocktoday.com"; sid:549544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmediations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmediations.com"; sid:549545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalsuppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalsuppy.com"; sid:549546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorybook.com"; sid:549547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmen.com"; sid:549548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news-online.com"; sid:549549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkcity.com"; sid:549550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ni.com"; sid:549551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ok.com"; sid:549552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruspakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruspakistan.com"; sid:549553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pakistan.com"; sid:549554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspecial.com"; sid:549555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplumber.com"; sid:549556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoker.com"; sid:549557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspositivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspositivity.com"; sid:549558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprobability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprobability.com"; sid:549559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproducts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproducts.net"; sid:549560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspunjab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspunjab.com"; sid:549561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryclaim.com"; sid:549562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelease.com"; sid:549563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefdirectory.com"; sid:549564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefhelp.com"; sid:549565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefnow.com"; sid:549566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefrescuepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefrescuepackage.com"; sid:549567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefservices.com"; sid:549568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-resource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-resource.com"; sid:549569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusroad.com"; sid:549570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safetyplumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safetyplumbers.com"; sid:549571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanitation.com"; sid:549572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sarscov2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sarscov2.com"; sid:549573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscammers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscammers.com"; sid:549574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshanghai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshanghai.com"; sid:549575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussigns.com"; sid:549576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussinbulos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussinbulos.com"; sid:549577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmoke.com"; sid:549578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspy.com"; sid:549579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-statistika.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-statistika.com"; sid:549580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusbill.com"; sid:549581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluscenter.com"; sid:549582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluschecks.com"; sid:549583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulushelp.com"; sid:549584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvival.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvival.tips"; sid:549585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussurvivor.com"; sid:549586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivornetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivornetwork.com"; sid:549587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorsclub.com"; sid:549588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustache.com"; sid:549589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustattoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustattoo.com"; sid:549590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitnow.com"; sid:549591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestme.com"; sid:549592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestmekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestmekit.com"; sid:549593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test.pro"; sid:549594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-tests.com"; sid:549595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestswabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestswabs.com"; sid:549596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthc.com"; sid:549597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthing.com"; sid:549598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthometesting.com"; sid:549599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-timer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-timer.com"; sid:549600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-toolkit.com"; sid:549601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusucks.com"; sid:549602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-u.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-u.net"; sid:549603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusup.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusup.date"; sid:549604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatecalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatecalifornia.com"; sid:549605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatenewyork.com"; sid:549606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatenewyork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatenewyork.net"; sid:549607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatenow.com"; sid:549608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurgicalmask.com"; sid:549609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurgicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurgicalmasks.com"; sid:549610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusux.com"; sid:549611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinationusa.com"; sid:549612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisualizer.com"; sid:549613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruswarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruswarrior.com"; sid:549614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-warrior.com"; sid:549615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarrior.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarrior.net"; sid:549616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswill.com"; sid:549617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswomen.com"; sid:549618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswristband.com"; sid:549619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswristbands.com"; sid:549620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisualiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisualiser.com"; sid:549621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisulizer.com"; sid:549622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavyros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavyros.com"; sid:549623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebsites.com"; sid:549624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-werbe-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-werbe-shop.com"; sid:549625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawinner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawinner.com"; sid:549626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawish.com"; sid:549627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawishes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawishes.com"; sid:549628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawoman.com"; sid:549629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkout.net"; sid:549630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawwiii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawwiii.com"; sid:549631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazentrum.com"; sid:549632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazentrum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazentrum.net"; sid:549633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazin.com"; sid:549634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid100.com"; sid:549635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid14daychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid14daychallenge.com"; sid:549636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18.net"; sid:549637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abtest.com"; sid:549638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abtests.com"; sid:549639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aftermath.com"; sid:549640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agenda.com"; sid:549641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alerter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alerter.com"; sid:549642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anon.com"; sid:549643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19answersnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19answersnow.com"; sid:549644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytesting.com"; sid:549645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-archive.com"; sid:549646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19articles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19articles.com"; sid:549647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-artschive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-artschive.com"; sid:549648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atrisk.com"; sid:549649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atrisk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atrisk.net"; sid:549650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneysatlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneysatlaw.com"; sid:549651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-attorneys.com"; sid:549652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-au.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-au.com"; sid:549653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bailout.com"; sid:549654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankloan.com"; sid:549655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyflorida.com"; sid:549656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcy-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcy-lawyer.com"; sid:549657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcy.net"; sid:549658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyresources.com"; sid:549659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyresources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyresources.net"; sid:549660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banner.com"; sid:549661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baseball.com"; sid:549662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beaches.com"; sid:549663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biosecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biosecurity.com"; sid:549664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biotech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biotech.com"; sid:549665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brandnavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brandnavigator.com"; sid:549666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessloans.com"; sid:549667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessrecovery.com"; sid:549668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buy.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buy.today"; sid:549669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bycounty.com"; sid:549670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canad.com"; sid:549671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carcleaner.com"; sid:549672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carcleaners.com"; sid:549673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19careclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19careclinic.com"; sid:549674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catering.com"; sid:549675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cateringtoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cateringtoronto.com"; sid:549676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19causes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19causes.com"; sid:549677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cermi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cermi.com"; sid:549678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19challenge.com"; sid:549679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkkit.com"; sid:549680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicagotherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicagotherapist.com"; sid:549681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chihuahua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chihuahua.com"; sid:549682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-chinavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-chinavirus.com"; sid:549683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimcenter.com"; sid:549684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-claim.com"; sid:549685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimlaw.com"; sid:549686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimscenter.com"; sid:549687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-class-action.com"; sid:549688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactionlawsuit.com"; sid:549689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-class-actions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-class-actions.com"; sid:549690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningforce.com"; sid:549691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanse.com"; sid:549692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupservice.com"; sid:549693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closings.com"; sid:549694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clothes.com"; sid:549695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cnss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cnss.com"; sid:549696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19colchicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19colchicine.com"; sid:549697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1-9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1-9.com"; sid:549698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19computerrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19computerrepair.com"; sid:549699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contingencyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contingencyplan.com"; sid:549700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corona-virus.com"; sid:549701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cp.com"; sid:549702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crc.com"; sid:549703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19credentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19credentials.com"; sid:549704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cuba.com"; sid:549705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cu.com"; sid:549706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure2020.com"; sid:549707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curveball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curveball.com"; sid:549708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailyreport.com"; sid:549709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-data.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-data.net"; sid:549710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19daybyday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19daybyday.com"; sid:549711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debts.com"; sid:549712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationservice.com"; sid:549713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-defence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-defence.com"; sid:549714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detectionkit.com"; sid:549715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detectionkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detectionkit.net"; sid:549716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectionkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectionkit.net"; sid:549717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detectionkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detectionkits.net"; sid:549718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectionkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectionkits.net"; sid:549719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dgx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dgx.com"; sid:549720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dgx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dgx.com"; sid:549721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diary.net"; sid:549722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-diet.com"; sid:549723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disability.com"; sid:549724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disabilitylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disabilitylawyers.com"; sid:549725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dishes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dishes.com"; sid:549726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfections.com"; sid:549727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disrupted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disrupted.com"; sid:549728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dmv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dmv.com"; sid:549729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drive.com"; sid:549730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drugtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drugtrial.com"; sid:549731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drycleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drycleaners.com"; sid:549732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dx.com"; sid:549733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eforum.com"; sid:549734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19email.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19email.com"; sid:549735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencydentalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencydentalcare.com"; sid:549736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentrights.com"; sid:549737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enews.com"; sid:549738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epicenter.com"; sid:549739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exterminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exterminate.com"; sid:549740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemaskplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemaskplans.com"; sid:549741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19familyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19familyprotection.com"; sid:549742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fdaapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fdaapproved.com"; sid:549743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fdacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fdacure.com"; sid:549744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19federalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19federalaid.com"; sid:549745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.film"; sid:549746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fingercondoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fingercondoms.com"; sid:549747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fingercondoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fingercondoms.net"; sid:549748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flight.com"; sid:549749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodsupply.com"; sid:549750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19force.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19force.com"; sid:549751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forhumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forhumanity.com"; sid:549752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraising.com"; sid:549753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundrecovery.com"; sid:549754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ghostbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ghostbusters.com"; sid:549755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalprep.com"; sid:549756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalreport.com"; sid:549757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gt.com"; sid:549758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guerrilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guerrilla.com"; sid:549759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handsfreeprocess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handsfreeprocess.com"; sid:549760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsfreeprocess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsfreeprocess.com"; sid:549761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthchecker.com"; sid:549762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herald.com"; sid:549763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hire.com"; sid:549764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecleaner.com"; sid:549765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecleaners.com"; sid:549766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homemodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homemodification.com"; sid:549767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homemodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homemodifications.com"; sid:549768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkits.net"; sid:549769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hub.com"; sid:549770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icome.com"; sid:549771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunisation.com"; sid:549772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitytest.com"; sid:549773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-india.com"; sid:549774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiana.com"; sid:549775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19info.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19info.center"; sid:549776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.center"; sid:549777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19information.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19information.center"; sid:549778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inindia.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inindia.life"; sid:549779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurance.claims"; sid:549780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intexas.com"; sid:549781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19italy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19italy.net"; sid:549782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jesi.com"; sid:549783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobfromhome.com"; sid:549784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobsnyc.com"; sid:549785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kauai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kauai.com"; sid:549786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kg.com"; sid:549787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19khabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19khabar.com"; sid:549788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kids.com"; sid:549789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-killer.com"; sid:549790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killerz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killerz.com"; sid:549791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-kits.com"; sid:549792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labproducts.com"; sid:549793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawclaim.com"; sid:549794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-law-firm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-law-firm.com"; sid:549795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-law-firms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-law-firms.com"; sid:549796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalclaim.com"; sid:549797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalclaim.com"; sid:549798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalclaimlawyer.com"; sid:549799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-legal.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-legal.claims"; sid:549800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-legal.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-legal.claims"; sid:549801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalconsulting.com"; sid:549802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalteam.com"; sid:549803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lendingresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lendingresource.com"; sid:549804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lendingresource.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lendingresource.mobi"; sid:549805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lendingresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lendingresource.net"; sid:549806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lit.com"; sid:549807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livereport.com"; sid:549808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmodifications.com"; sid:549809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmods.com"; sid:549810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanservices.com"; sid:549811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19localsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19localsupport.com"; sid:549812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loud.com"; sid:549813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ltf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ltf.com"; sid:549814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mall.com"; sid:549815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maponline.com"; sid:549816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19marketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19marketing.com"; sid:549817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19marketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19marketplace.com"; sid:549818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskprotection.com"; sid:549819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskrelief.com"; sid:549820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalsupplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalsupplychain.com"; sid:549821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medrx.com"; sid:549822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19meme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19meme.com"; sid:549823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.club"; sid:549824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-memorial.com"; sid:549825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.foundation"; sid:549826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.fund"; sid:549827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-memorial-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-memorial-fund.com"; sid:549828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-memorialfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-memorialfund.com"; sid:549829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-memorial-fund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-memorial-fund.net"; sid:549830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.life"; sid:549831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.world"; sid:549832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19militaryfamilyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19militaryfamilyrelief.com"; sid:549833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mission.com"; sid:549834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobiletesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobiletesting.com"; sid:549835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagemodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagemodifications.com"; sid:549836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19n95mask.com"; sid:549837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1-9.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1-9.net"; sid:549838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newscast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newscast.com"; sid:549839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsdaily.com"; sid:549840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nffp2mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nffp2mask.com"; sid:549841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nffp3mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nffp3mask.com"; sid:549842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19number.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19number.com"; sid:549843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oasis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oasis.com"; sid:549844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19olympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19olympics.com"; sid:549845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinecertification.com"; sid:549846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opensource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opensource.com"; sid:549847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oralhistories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oralhistories.com"; sid:549848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oralhistories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oralhistories.net"; sid:549849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ozonetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ozonetreatment.com"; sid:549850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19panic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19panic.com"; sid:549851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partnering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partnering.com"; sid:549852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19partners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19partners.com"; sid:549853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-partners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-partners.com"; sid:549854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payout.com"; sid:549855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payouts.com"; sid:549856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pdx.com"; sid:549857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pk.com"; sid:549858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19planb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19planb.com"; sid:549859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppe.net"; sid:549860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19practicerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19practicerecovery.com"; sid:549861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19press.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19press.com"; sid:549862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19print.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19print.com"; sid:549863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19probability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19probability.com"; sid:549864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19profits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19profits.com"; sid:549865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionnow.com"; sid:549866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectmylifenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectmylifenow.com"; sid:549867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protegete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protegete.com"; sid:549868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychologytoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychologytoday.com"; sid:549869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-quarantine.com"; sid:549870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19questdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19questdiagnostics.com"; sid:549871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19questdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19questdiagnostics.com"; sid:549872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rank.com"; sid:549873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryfund.com"; sid:549874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefbillcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefbillcenter.com"; sid:549875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembers.com"; sid:549876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembers.net"; sid:549877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resistance.com"; sid:549878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcehub.com"; sid:549879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19respiratorytriagescore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19respiratorytriagescore.com"; sid:549880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19respiratorytriagescore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19respiratorytriagescore.net"; sid:549881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseuk.com"; sid:549882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-results.com"; sid:549883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retail.com"; sid:549884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailsurvival.com"; sid:549885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-risk.com"; sid:549886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19roche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19roche.com"; sid:549887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roche.com"; sid:549888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roundtable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roundtable.com"; sid:549889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rts.com"; sid:549890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rts.net"; sid:549891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safe.com"; sid:549892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safedentistry.com"; sid:549893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safedentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safedentists.com"; sid:549894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.net"; sid:549895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyshield.com"; sid:549896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-safe-walking-in-dark-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-safe-walking-in-dark-times.com"; sid:549897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-santepublique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-santepublique.com"; sid:549898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19science.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19science.com"; sid:549899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19service.com"; sid:549900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shield.com"; sid:549901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ship.com"; sid:549902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19signage.com"; sid:549903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simalungun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simalungun.com"; sid:549904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sitters.com"; sid:549905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sitters.com"; sid:549906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smell.com"; sid:549907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smellloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smellloss.com"; sid:549908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smoke.com"; sid:549909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sneezeguard.com"; sid:549910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidarity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidarity.net"; sid:549911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidarity.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidarity.network"; sid:549912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidaritytee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidaritytee.com"; sid:549913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sp.com"; sid:549914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayathome.com"; sid:549915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stimulus.com"; sid:549916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusplan.com"; sid:549917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusprogram.com"; sid:549918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockpile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockpile.com"; sid:549919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19store.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19store.net"; sid:549920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stressrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stressrelief.com"; sid:549921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19studies.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19studies.life"; sid:549922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studies.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studies.life"; sid:549923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19studies.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19studies.study"; sid:549924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sucks.net"; sid:549925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplyorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplyorders.com"; sid:549926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyorders.com"; sid:549927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportsupply.com"; sid:549928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surgicalgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surgicalgloves.com"; sid:549929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomchecker.com"; sid:549930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptom.net"; sid:549931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-symptoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-symptoms.net"; sid:549932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tab.com"; sid:549933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tattoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tattoo.com"; sid:549934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tattoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tattoo.com"; sid:549935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxconsulting.com"; sid:549936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teez.com"; sid:549937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telework.com"; sid:549938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testimonies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testimonies.com"; sid:549939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.today"; sid:549940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testnow.com"; sid:549941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testswab.com"; sid:549942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thc.com"; sid:549943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-thevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-thevaccine.com"; sid:549944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timecapsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timecapsule.com"; sid:549945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-toilet-paper-scare-and-other-tales.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-toilet-paper-scare-and-other-tales.net"; sid:549946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trail.com"; sid:549947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transport.com"; sid:549948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-trends.com"; sid:549949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trends.com"; sid:549950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trial.com"; sid:549951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tunisia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tunisia.com"; sid:549952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvm.com"; sid:549953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uk.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uk.club"; sid:549954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ultra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ultra.com"; sid:549955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatetoday.com"; sid:549956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uy.com"; sid:549957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineaccelerator.com"; sid:549958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineaccelerator.com"; sid:549959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinenews.com"; sid:549960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineonline.com"; sid:549961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineprogram.com"; sid:549962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ventilatorproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ventilatorproject.com"; sid:549963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vietnam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vietnam.com"; sid:549964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vietnam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vietnam.com"; sid:549965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscanada.com"; sid:549966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virus.today"; sid:549967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdate.net"; sid:549968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdate.world"; sid:549969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19visualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19visualizer.com"; sid:549970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualizer.com"; sid:549971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warehouse.com"; sid:549972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19will.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19will.com"; sid:549973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19winner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19winner.com"; sid:549974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19winners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19winners.com"; sid:549975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacelaw.com"; sid:549976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldnews.com"; sid:549977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-world-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-world-virus.com"; sid:549978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wristbands.com"; sid:549979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wristbands.com"; sid:549980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wuhanchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wuhanchina.com"; sid:549981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xxx.com"; sid:549982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1canada.com"; sid:549983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20drugs.com"; sid:549984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20italy.com"; sid:549985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20prevention.com"; sid:549986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20vax.com"; sid:549987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21virus.com"; sid:549988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3t.com"; sid:549989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4work.com"; sid:549990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid95.com"; sid:549991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9andtelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9andtelehealth.com"; sid:549992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabatement.com"; sid:549993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabstrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabstrich.com"; sid:549994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabstrich.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabstrich.net"; sid:549995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabtests.com"; sid:549996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachtransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachtransfer.com"; sid:549997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacr.com"; sid:549998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidads.com"; sid:549999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidage.com"; sid:550000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagents.com"; sid:550001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagreement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagreement.com"; sid:550002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagreements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagreements.com"; sid:550003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairborn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairborn.com"; sid:550004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalcohol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalcohol.com"; sid:550005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaleitat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaleitat.com"; sid:550006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannuities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannuities.com"; sid:550007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannuity.com"; sid:550008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytests.com"; sid:550009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarbitration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarbitration.com"; sid:550010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistanceprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistanceprograms.com"; sid:550011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaudit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaudit.com"; sid:550012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaudits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaudits.com"; sid:550013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavengers-ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavengers-ph.com"; sid:550014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabes.com"; sid:550015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbacteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbacteria.com"; sid:550016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankaccount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankaccount.com"; sid:550017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbank.com"; sid:550018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbanking.com"; sid:550019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcynj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcynj.com"; sid:550020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyny.com"; sid:550021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbed.com"; sid:550022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeds.com"; sid:550023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeneficiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeneficiaries.com"; sid:550024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeneficiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeneficiary.com"; sid:550025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefitpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefitpayments.com"; sid:550026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bg.com"; sid:550027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbillingcodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbillingcodes.com"; sid:550028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbillpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbillpay.com"; sid:550029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidborrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidborrow.com"; sid:550030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidborrower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidborrower.com"; sid:550031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrand.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrand.net"; sid:550032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbubble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbubble.com"; sid:550033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuddies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuddies.com"; sid:550034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuddy.com"; sid:550035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbudget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbudget.com"; sid:550036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscoach.com"; sid:550037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessforum.com"; sid:550038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessforum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessforum.net"; sid:550039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesshelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesshelp.net"; sid:550040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbutton.com"; sid:550041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampaign.com"; sid:550042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanarias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanarias.com"; sid:550043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantstopgood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantstopgood.com"; sid:550044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalloan.com"; sid:550045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalloans.com"; sid:550046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalrelief.com"; sid:550047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarcleaners.com"; sid:550048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarerelief.com"; sid:550049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresa.com"; sid:550050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare-tracker.com"; sid:550051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaretracker.com"; sid:550052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaretrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaretrackers.com"; sid:550053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarfinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarfinancing.com"; sid:550054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarrelief.com"; sid:550055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashcard.com"; sid:550056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashcards.com"; sid:550057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cash.com"; sid:550058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashflow.com"; sid:550059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatalog.com"; sid:550060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidceleb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidceleb.com"; sid:550061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificate.com"; sid:550062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertification.com"; sid:550063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchallenges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchallenges.com"; sid:550064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcarerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcarerelief.com"; sid:550065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildrelief.com"; sid:550066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcinema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcinema.com"; sid:550067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidck.com"; sid:550068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimlawyer.com"; sid:550069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuit.com"; sid:550070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninspect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninspect.com"; sid:550071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.ltd"; sid:550072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupcrew.com"; sid:550073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearance.com"; sid:550074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicalfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicalfrontline.com"; sid:550075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosure.com"; sid:550076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosures.com"; sid:550077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclutch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclutch.com"; sid:550078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoding.com"; sid:550079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollective.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollective.fyi"; sid:550080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolony.com"; sid:550081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolor.com"; sid:550082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorkit.com"; sid:550083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorkits.com"; sid:550084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorrun.com"; sid:550085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolors.com"; sid:550086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunication.com"; sid:550087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitywellnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitywellnesscenter.com"; sid:550088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomparer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomparer.com"; sid:550089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcern.com"; sid:550090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcondition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcondition.com"; sid:550091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconditions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconditions.com"; sid:550092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontagious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontagious.com"; sid:550093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontest2020.com"; sid:550094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooks.com"; sid:550095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coronavirus.net"; sid:550096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatebailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatebailout.com"; sid:550097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporation.com"; sid:550098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcost.com"; sid:550099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcosts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcosts.com"; sid:550100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovering.com"; sid:550101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrafting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrafting.com"; sid:550102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcard.com"; sid:550103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcards.com"; sid:550104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditinsurance.com"; sid:550105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscalming.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscalming.center"; sid:550106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisishelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisishelp.com"; sid:550107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriticalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriticalresources.com"; sid:550108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruises.com"; sid:550109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrumbcatcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrumbcatcher.com"; sid:550110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrusades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrusades.com"; sid:550111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutie.com"; sid:550112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddaddy.com"; sid:550113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatabase.com"; sid:550114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebitcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebitcard.com"; sid:550115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebitcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebitcards.com"; sid:550116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeductions.com"; sid:550117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeferment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeferment.com"; sid:550118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnostic.com"; sid:550119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddirectdeposit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddirectdeposit.com"; sid:550120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilitybenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilitybenefits.com"; sid:550121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisability.com"; sid:550122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilityinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilityinsurance.com"; sid:550123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterarea.com"; sid:550124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterareas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterareas.com"; sid:550125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterhelp.com"; sid:550126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterloan.com"; sid:550127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctornote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctornote.com"; sid:550128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctorsnote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctorsnote.com"; sid:550129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocumentation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocumentation.com"; sid:550130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonation.com"; sid:550131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddpi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddpi.com"; sid:550132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugcombo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugcombo.com"; sid:550133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugtherapy.com"; sid:550134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrycleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrycleaners.com"; sid:550135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidearlytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidearlytest.com"; sid:550136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideep.com"; sid:550137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyfund.com"; sid:550138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployee.com"; sid:550139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployeerights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployeerights.com"; sid:550140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployerrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployerrights.com"; sid:550141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlaw.com"; sid:550142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentifier.com"; sid:550143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentify.com"; sid:550144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentity.com"; sid:550145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepedemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepedemic.com"; sid:550146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideviction.com"; sid:550147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictions.com"; sid:550148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevisualizer.com"; sid:550149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexemption.com"; sid:550150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexemptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexemptions.com"; sid:550151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpenses.com"; sid:550152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpert.com"; sid:550153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexposed.com"; sid:550154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextension.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextension.com"; sid:550155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextensions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextensions.com"; sid:550156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexterminator.com"; sid:550157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidez.com"; sid:550158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemaskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemaskn95.com"; sid:550159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactcheck.com"; sid:550160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.fail"; sid:550161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfallout.com"; sid:550162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyrelief.com"; sid:550163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialrelief.com"; sid:550164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoodrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoodrelief.com"; sid:550165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforbearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforbearance.com"; sid:550166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidform.com"; sid:550167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeandproudtobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeandproudtobe.com"; sid:550168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendly.com"; sid:550169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundraising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundraising.com"; sid:550170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundsfilinghelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundsfilinghelper.com"; sid:550171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundstransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundstransfer.com"; sid:550172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfysio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfysio.com"; sid:550173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeek.com"; sid:550174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgerms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgerms.com"; sid:550175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.gifts - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.gifts"; sid:550176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgirl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgirl.com"; sid:550177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgloves.com"; sid:550178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgold.com"; sid:550179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.golf"; sid:550180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgotmelike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgotmelike.com"; sid:550181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovassistance.com"; sid:550182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgov.com"; sid:550183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovernmentassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovernmentassistance.com"; sid:550184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovernment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovernment.com"; sid:550185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovhelp.com"; sid:550186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgown.com"; sid:550187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgowns.com"; sid:550188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraduation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraduation.com"; sid:550189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraduations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraduations.com"; sid:550190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraduations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraduations.net"; sid:550191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreed.com"; sid:550192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreeting.com"; sid:550193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-group.com"; sid:550194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguarantee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguarantee.com"; sid:550195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguaranteed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguaranteed.com"; sid:550196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-guardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-guardian.com"; sid:550197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhair.com"; sid:550198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandshake.com"; sid:550199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhangover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhangover.com"; sid:550200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhardship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhardship.com"; sid:550201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhazard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhazard.com"; sid:550202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhazards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhazards.com"; sid:550203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthinformation.com"; sid:550204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthrelief.com"; sid:550205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheat.com"; sid:550206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheld.com"; sid:550207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelparmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelparmy.com"; sid:550208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelphu.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelphu.co.uk"; sid:550209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroes.net"; sid:550210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhipaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhipaa.com"; sid:550211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomefinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomefinancing.com"; sid:550212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeless.com"; sid:550213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomerelief.com"; sid:550214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousecleaners.com"; sid:550215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousefinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousefinancing.com"; sid:550216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhouserelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhouserelief.com"; sid:550217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhow.com"; sid:550218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhypnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhypnosis.com"; sid:550219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiario.com"; sid:550220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidilization.com"; sid:550221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunejobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunejobs.net"; sid:550222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincomeloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincomeloss.com"; sid:550223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfluenza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfluenza.com"; sid:550224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhaler.com"; sid:550225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhalers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhalers.com"; sid:550226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstallment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstallment.com"; sid:550227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstallments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstallments.com"; sid:550228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsured.com"; sid:550229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurer.com"; sid:550230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurers.com"; sid:550231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruption.com"; sid:550232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintown.com"; sid:550233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestigation.com"; sid:550234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestigations.com"; sid:550235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestment.com"; sid:550236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestments.com"; sid:550237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvoice.com"; sid:550238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvoices.com"; sid:550239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvoicing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvoicing.com"; sid:550240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiomtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiomtees.com"; sid:550241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotly.com"; sid:550242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotrumpet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotrumpet.com"; sid:550243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidip.com"; sid:550244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidizer19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidizer19.com"; sid:550245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjourney.com"; sid:550246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkashmir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkashmir.com"; sid:550247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkhabar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkhabar.com"; sid:550248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidhelp.com"; sid:550249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller2020.com"; sid:550250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerpros.com"; sid:550251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkind.com"; sid:550252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkoncerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkoncerts.com"; sid:550253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkreations.com"; sid:550254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-labs.com"; sid:550255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawclaim.com"; sid:550256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyernewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyernewjersey.com"; sid:550257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyernewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyernewyork.com"; sid:550258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyernj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyernj.com"; sid:550259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyernyc.com"; sid:550260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerny.com"; sid:550261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleave.com"; sid:550262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegaladvice.com"; sid:550263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalrights.com"; sid:550264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegislation.com"; sid:550265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-leitat.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-leitat.cat"; sid:550266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-leitat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-leitat.com"; sid:550267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-leitat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-leitat.net"; sid:550268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlemonade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlemonade.com"; sid:550269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlemons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlemons.com"; sid:550270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlendingrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlendingrelief.com"; sid:550271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliabilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliabilities.com"; sid:550272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliability.com"; sid:550273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlicense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlicense.com"; sid:550274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlicensing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlicensing.com"; sid:550275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivemusicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivemusicfestival.com"; sid:550276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivestats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivestats.com"; sid:550277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocation.com"; sid:550278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogokits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogokits.com"; sid:550279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlungs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlungs.com"; sid:550280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmadlibs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmadlibs.com"; sid:550281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmall.com"; sid:550282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanagement.com"; sid:550283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapping.com"; sid:550284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmappingproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmappingproject.com"; sid:550285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasken.com"; sid:550286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatata.com"; sid:550287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalbilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalbilling.com"; sid:550288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalbills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalbills.com"; sid:550289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicaltests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicaltests.com"; sid:550290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemory.com"; sid:550291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmissedpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmissedpayments.com"; sid:550292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgageassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgageassistance.com"; sid:550293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagefund.com"; sid:550294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmultivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmultivitamin.com"; sid:550295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmultivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmultivitamins.com"; sid:550296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutation.com"; sid:550297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmvi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmvi.com"; sid:550298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmys.com"; sid:550299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyths.com"; sid:550300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnature.com"; sid:550301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnavigator.com"; sid:550302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegligence.com"; sid:550303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnepal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnepal.net"; sid:550304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneunzehn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneunzehn.com"; sid:550305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneutralize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneutralize.com"; sid:550306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnew.com"; sid:550307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen2020.com"; sid:550308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnonprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnonprofit.com"; sid:550309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnote.com"; sid:550310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-now.com"; sid:550311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnow.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnow.world"; sid:550312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobituaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobituaries.com"; sid:550313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobituary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobituary.com"; sid:550314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffers.com"; sid:550315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinewellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinewellness.com"; sid:550316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidontour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidontour.com"; sid:550317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoom.com"; sid:550318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorigin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorigin.com"; sid:550319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidownership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidownership.com"; sid:550320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpact.com"; sid:550321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatent.com"; sid:550322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientbilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientbilling.com"; sid:550323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientcare.com"; sid:550324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaycheck.com"; sid:550325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaychecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaychecks.com"; sid:550326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayercodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayercodes.com"; sid:550327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayer.com"; sid:550328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayment.com"; sid:550329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayorcodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayorcodes.com"; sid:550330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayor.com"; sid:550331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidperil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidperil.com"; sid:550332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidperils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidperils.com"; sid:550333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpermit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpermit.com"; sid:550334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpetinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpetinfo.com"; sid:550335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacies.com"; sid:550336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacybilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacybilling.com"; sid:550337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphi.com"; sid:550338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphysician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphysician.com"; sid:550339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphysicians.com"; sid:550340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicies.com"; sid:550341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolitics.com"; sid:550342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoor.com"; sid:550343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpopulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpopulation.com"; sid:550344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpredictor.com"; sid:550345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prep.com"; sid:550346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreschool.com"; sid:550347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescribers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescribers.com"; sid:550348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescribing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescribing.com"; sid:550349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacy.com"; sid:550350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacyinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacyinformation.com"; sid:550351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacylaw.com"; sid:550352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacylaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacylaws.com"; sid:550353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacyrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacyrules.com"; sid:550354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofessional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofessional.com"; sid:550355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofessionals.com"; sid:550356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofit.com"; sid:550357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofits.com"; sid:550358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprogram.com"; sid:550359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprom.com"; sid:550360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproms.com"; sid:550361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproms.net"; sid:550362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproperties.com"; sid:550363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproperty.com"; sid:550364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprophylaxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprophylaxis.com"; sid:550365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionsupplies.com"; sid:550366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprovider.com"; sid:550367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproviders.com"; sid:550368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpulse.com"; sid:550369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpulse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpulse.net"; sid:550370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrad.com"; sid:550371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtests.com"; sid:550372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestate.com"; sid:550373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealproperties.com"; sid:550374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealproperty.com"; sid:550375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreceipt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreceipt.com"; sid:550376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreceipts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreceipts.com"; sid:550377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecords.com"; sid:550378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryfund.com"; sid:550379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregulation.com"; sid:550380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreimbursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreimbursement.com"; sid:550381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreimbursements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreimbursements.com"; sid:550382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelapse.com"; sid:550383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcheck.com"; sid:550384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefchecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefchecks.com"; sid:550385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefhelp.com"; sid:550386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembers.com"; sid:550387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrents.com"; sid:550388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescuepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescuepackage.com"; sid:550389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescueplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescueplan.com"; sid:550390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestart.com"; sid:550391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestore.com"; sid:550392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestrictions.com"; sid:550393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresume.com"; sid:550394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretirement.com"; sid:550395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretirementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretirementplan.com"; sid:550396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretirementsavings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretirementsavings.com"; sid:550397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretreat.com"; sid:550398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidribbons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidribbons.com"; sid:550399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskfactors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskfactors.com"; sid:550400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecontractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecontractors.com"; sid:550401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeguards.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeguards.world"; sid:550402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafejobs.com"; sid:550403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafejobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafejobs.net"; sid:550404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe.net"; sid:550405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferoofers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferoofers.com"; sid:550406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetygear.com"; sid:550407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetynet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetynet.com"; sid:550408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafteyshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafteyshield.com"; sid:550409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalud.com"; sid:550410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizers.com"; sid:550411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsars.com"; sid:550412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsavings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsavings.com"; sid:550413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen.net"; sid:550414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorrelief.com"; sid:550415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseries.com"; sid:550416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortage.com"; sid:550417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortages.com"; sid:550418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshutdown.com"; sid:550419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsickleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsickleave.com"; sid:550420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsickpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsickpay.com"; sid:550421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitters.com"; sid:550422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinesscoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinesscoach.com"; sid:550423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinesssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinesssupport.com"; sid:550424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmetamorphosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmetamorphosis.com"; sid:550425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialclub.com"; sid:550426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialisolation.com"; sid:550427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsol.com"; sid:550428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsources.com"; sid:550429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspain.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspain.today"; sid:550430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspending.com"; sid:550431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspotter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspotter.com"; sid:550432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstigma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstigma.com"; sid:550433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluspackage.com"; sid:550434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstressrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstressrelief.com"; sid:550435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudentrelief.com"; sid:550436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsualizer.com"; sid:550437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsubsidies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsubsidies.com"; sid:550438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupply.net"; sid:550439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyus.com"; sid:550440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportcommunity.com"; sid:550441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxassistance.com"; sid:550442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxbreak.com"; sid:550443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxbreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxbreaks.com"; sid:550444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxdeduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxdeduction.com"; sid:550445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxdeductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxdeductions.com"; sid:550446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxes.com"; sid:550447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxform.com"; sid:550448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxforms.com"; sid:550449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxfree.com"; sid:550450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxhelp.com"; sid:550451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxrefund.com"; sid:550452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxrefunds.com"; sid:550453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxupdate.com"; sid:550454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxupdates.com"; sid:550455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemporaryrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemporaryrelief.com"; sid:550456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterm.com"; sid:550457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterms.com"; sid:550458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcentre.com"; sid:550459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tester.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tester.net"; sid:550460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtester.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtester.net"; sid:550461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthome.com"; sid:550462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.house"; sid:550463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting19.com"; sid:550464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcenter.com"; sid:550465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.solutions"; sid:550466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsystem.com"; sid:550467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthemovie.com"; sid:550468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthemovie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthemovie.net"; sid:550469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheseries.com"; sid:550470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheshow.com"; sid:550471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtn.com"; sid:550472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-today.com"; sid:550473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoken.com"; sid:550474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtouch.com"; sid:550475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerap.com"; sid:550476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerindia.com"; sid:550477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransmission.com"; sid:550478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-travel.com"; sid:550479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentcenters.com"; sid:550480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentplan.com"; sid:550481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trials.net"; sid:550482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrustfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrustfund.com"; sid:550483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtvseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtvseries.com"; sid:550484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtvshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtvshow.com"; sid:550485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunify.com"; sid:550486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduum.com"; sid:550487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacation.com"; sid:550488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvendorcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvendorcheck.com"; sid:550489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilators.com"; sid:550490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ventures.com"; sid:550491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-video.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-video.com"; sid:550492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vip.com"; sid:550493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualscreen.com"; sid:550494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19vax.com"; sid:550495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus20.com"; sid:550496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus20vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus20vax.com"; sid:550497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscare.com"; sid:550498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdrug.com"; sid:550499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdrugs.com"; sid:550500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdrugs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdrugs.net"; sid:550501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprevention.com"; sid:550502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprevention.net"; sid:550503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprevention.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprevention.world"; sid:550504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusvax.com"; sid:550505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisa.com"; sid:550506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisalizer.com"; sid:550507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizar.com"; sid:550508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualiz.com"; sid:550509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualize.com"; sid:550510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizermap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizermap.com"; sid:550511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuliser.com"; sid:550512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisulizer.com"; sid:550513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvizualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvizualizer.com"; sid:550514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.vote - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.vote"; sid:550515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaiver.com"; sid:550516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaivers.com"; sid:550517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebeat.com"; sid:550518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiretransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiretransfer.com"; sid:550519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwise.com"; sid:550520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkerlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkerlawsuit.com"; sid:550521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkingcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkingcapital.com"; sid:550522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldwide.com"; sid:550523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldwide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldwide.net"; sid:550524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristbands.com"; sid:550525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwriteoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwriteoff.com"; sid:550526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwriteoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwriteoffs.com"; sid:550527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxchange.com"; sid:550528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxchng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxchng.com"; sid:550529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxix.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxix.net"; sid:550530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyyc.com"; sid:550531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzones.com"; sid:550532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createinthetimeofcorona.com"; sid:550533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesvscoronavirus.com"; sid:550534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cricketvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cricketvscorona.com"; sid:550535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crmtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crmtcovid19.com"; sid:550536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcoronaonline.com"; sid:550537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcoronav.com"; sid:550538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingcovid.com"; sid:550539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cura-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cura-covid19.com"; sid:550540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirusmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirusmd.com"; sid:550541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcovid2019.com"; sid:550542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforthecommoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforthecommoncovid.com"; sid:550543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cut4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cut4covid.com"; sid:550544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daancovid19.com"; sid:550545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datoscoronavirus.com"; sid:550546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadlycoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadlycoronavirus19.com"; sid:550547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathbycorona.com"; sid:550548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistsagainstcoronavirus.com"; sid:550549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depressedaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depressedaboutcovid19.com"; sid:550550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dermacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dermacorona.com"; sid:550551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarsuperficiecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarsuperficiecoronavirus.com"; sid:550552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid19.com"; sid:550553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dgxcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dgxcovid-19.com"; sid:550554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dgxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dgxcovid19.com"; sid:550555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecovid-19.com"; sid:550556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for die-corona-luege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"die-corona-luege.com"; sid:550557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcovid.com"; sid:550558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitaljournalcovid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitaljournalcovid19.co.uk"; sid:550559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorciosporelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorciosporelcoronavirus.com"; sid:550560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronacure.com"; sid:550561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid-19cure.com"; sid:550562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid19cure.com"; sid:550563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogwalkingduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogwalkingduringapandemic.com"; sid:550564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for downwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"downwithcovid19.com"; sid:550565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecovid-19.com"; sid:550566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecovid.com"; sid:550567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycorona.com"; sid:550568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycoronavirustest.com"; sid:550569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid.com"; sid:550570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebookcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebookcoronavirus.com"; sid:550571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronaaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronaaid.com"; sid:550572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronaid.com"; sid:550573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid-19-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid-19-claim.com"; sid:550574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid19-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid19-claim.com"; sid:550575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid-19-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid-19-claims.com"; sid:550576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid19claims.com"; sid:550577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid-19-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid-19-claims.com"; sid:550578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid19claims.com"; sid:550579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid-19.com"; sid:550580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidaid.com"; sid:550581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for electrostaticcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"electrostaticcovid.com"; sid:550582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elretocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elretocoronavirus.com"; sid:550583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emcorona.com"; sid:550584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emcovid.com"; sid:550585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycorona.com"; sid:550586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid19supplies.com"; sid:550587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid.com"; sid:550588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emswest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emswest-covid.com"; sid:550589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emswest-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emswest-covid.net"; sid:550590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encuestacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encuestacovid19.net"; sid:550591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronapandemic.com"; sid:550592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirusanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirusanxiety.com"; sid:550593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endthecorona.com"; sid:550594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endthecovid19.com"; sid:550595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enoughofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enoughofcovid19.com"; sid:550596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epandemickits.com"; sid:550597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicorona.com"; sid:550598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemichelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemichelp.com"; sid:550599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatecovid-19.com"; sid:550600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcoronaoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcoronaoutlet.com"; sid:550601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europe-sings-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europe-sings-against-corona.com"; sid:550602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expectingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expectingcovid.com"; sid:550603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid19.com"; sid:550604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for face-the-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"face-the-corona.com"; sid:550605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faithoverfearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faithoverfearcovid19.com"; sid:550606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farewellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farewellcovid19.com"; sid:550607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcovid19.net"; sid:550608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19store.com"; sid:550609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingthepandemic.com"; sid:550610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filecovidbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filecovidbankruptcy.com"; sid:550611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19info.com"; sid:550612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingpeaceinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingpeaceinpandemic.com"; sid:550613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponsepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponsepandemics.com"; sid:550614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattencorona.com"; sid:550615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattenthatcovid19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattenthatcovid19curve.com"; sid:550616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronalawyer.com"; sid:550617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-coronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-coronaviruslawyer.com"; sid:550618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flyacovid-19flag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flyacovid-19flag.com"; sid:550619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forumcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forumcoronavirus.com"; sid:550620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forumpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forumpandemic.com"; sid:550621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeofcovid.com"; sid:550622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirus.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirus.clothing"; sid:550623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirusmall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirusmall.com"; sid:550624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirusshop.com"; sid:550625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthiscorona.com"; sid:550626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-you-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-you-corona.com"; sid:550627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycovid19decals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycovid19decals.com"; sid:550628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamingcovidchac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamingcovidchac.com"; sid:550629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gegen-corona-immun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gegen-corona-immun.com"; sid:550630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsamgegencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsamgegencovid.com"; sid:550631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geocovid19.com"; sid:550632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronafunds.com"; sid:550633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettingthrucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettingthrucorona.com"; sid:550634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalanticovid19.com"; sid:550635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronacommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronacommunity.com"; sid:550636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-covid19.com"; sid:550637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-covid19.net"; sid:550638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemictees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemictees.com"; sid:550639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocleanforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocleanforcovid.com"; sid:550640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocleanforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocleanforcovid.net"; sid:550641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.club"; sid:550642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidconnect.com"; sid:550643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gogocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gogocovid.com"; sid:550644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goingcovid19.com"; sid:550645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gothcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gothcorona.com"; sid:550646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterbostonagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterbostonagainstcorona.com"; sid:550647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencleaningcoronavirusaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencleaningcoronavirusaftermath.com"; sid:550648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guerracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guerracovid-19.com"; sid:550649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid19hn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid19hn.com"; sid:550650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hacovidmatata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hacovidmatata.com"; sid:550651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsoapforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsoapforcoronavirus.com"; sid:550652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagcoronavirus.com"; sid:550653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagcovid-19.com"; sid:550654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagcovid19.com"; sid:550655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinsurancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinsurancecoronavirus.com"; sid:550656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heart4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heart4covid.com"; sid:550657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellohub-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellohub-covid19.com"; sid:550658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid-19.com"; sid:550659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcoronadebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcoronadebt.com"; sid:550660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hindari-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hindari-covid-19.com"; sid:550661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hindustanfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hindustanfightscorona.com"; sid:550662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecorona.com"; sid:550663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecovid19.com"; sid:550664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecovidfree.com"; sid:550665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeforcovid19.com"; sid:550666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtohandleyourcoronavirusfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtohandleyourcoronavirusfears.com"; sid:550667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibmcovidcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibmcovidcommunity.com"; sid:550668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ich-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ich-gegen-corona.com"; sid:550669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidyourmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidyourmom.com"; sid:550670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilmuancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilmuancorona.com"; sid:550671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immobilie-verkaufen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immobilie-verkaufen-corona.com"; sid:550672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incentivi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incentivi-covid19.com"; sid:550673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacurecovid19.com"; sid:550674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightcorona.com"; sid:550675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocoronaviruses.com"; sid:550676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injectioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injectioncorona.com"; sid:550677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatefightingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatefightingpandemic.com"; sid:550678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatefightingpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatefightingpandemics.com"; sid:550679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internetcovid19.com"; sid:550680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internet-covid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internet-covid19.today"; sid:550681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internet-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internet-covid.com"; sid:550682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internetcovid.com"; sid:550683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irecoveredfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irecoveredfromcovid19.com"; sid:550684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthewuhanvirus.com"; sid:550685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthewuhanvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthewuhanvirus.net"; sid:550686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkihavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkihavecoronavirus.com"; sid:550687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ittookapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ittookapandemic.com"; sid:550688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaypeakcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaypeakcovid19resources.com"; sid:550689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jlacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jlacovid19.com"; sid:550690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jotcovid19.com"; sid:550691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justicelacovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justicelacovid19response.com"; sid:550692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karenacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karenacovid19.com"; sid:550693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keralafightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keralafightscorona.com"; sid:550694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kicksomecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kicksomecovid.com"; sid:550695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcountycoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcountycoronafund.com"; sid:550696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcountycoronafund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcountycoronafund.net"; sid:550697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcountycovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcountycovidfund.com"; sid:550698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcountycovidfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcountycovidfund.net"; sid:550699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kits-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kits-covid19.com"; sid:550700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for klartext-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"klartext-corona.com"; sid:550701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for klartextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"klartextcorona.com"; sid:550702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowcovid-19.com"; sid:550703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laxacovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laxacovid-19.net"; sid:550704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningthroughcovid.com"; sid:550705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leben-in-zeiten-von-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leben-in-zeiten-von-corona.com"; sid:550706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebicoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebicoronavirusmask.com"; sid:550707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsskillthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsskillthecorona.com"; sid:550708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19book.com"; sid:550709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftrecorona-virus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftrecorona-virus.life"; sid:550710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforandftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforandftercorona.com"; sid:550711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronastatus.com"; sid:550712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronastrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronastrong.com"; sid:550713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronastrong.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronastrong.net"; sid:550714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lloydscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lloydscovid-19.com"; sid:550715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockcoronavirus.com"; sid:550716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncorona.com"; sid:550717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lost-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lost-corona.com"; sid:550718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacovid.com"; sid:550719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronablog.com"; sid:550720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-intimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-intimeofcorona.com"; sid:550721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luvinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luvinthetimeofcovid.com"; sid:550722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronamoney.com"; sid:550723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparacovid19.com"; sid:550724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managecovid19.com"; sid:550725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapcovid.com"; sid:550726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maps-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maps-coronavirus.com"; sid:550727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriott-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriott-coronavirus.com"; sid:550728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcoronavirus.com"; sid:550729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriott-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriott-covid19.com"; sid:550730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcovid19.com"; sid:550731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcovid19-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcovid19-response.com"; sid:550732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcovid19response.com"; sid:550733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksale-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksale-coronavirus.com"; sid:550734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for med-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"med-covid.com"; sid:550735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medform-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medform-covid-19.com"; sid:550736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediacovid.com"; sid:550737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcovidmasks.com"; sid:550738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmaskforcoronavirus.com"; sid:550739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid-19.com"; sid:550740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid-19.net"; sid:550741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid-2019.com"; sid:550742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid2019.com"; sid:550743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid-2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid-2019.net"; sid:550744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineforcovid2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineforcovid2019.net"; sid:550745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicovida.com"; sid:550746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid19.com"; sid:550747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for misscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"misscovid.com"; sid:550748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncovid19game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncovid19game.com"; sid:550749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missioncovid.com"; sid:550750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncovid19.com"; sid:550751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncovid19.net"; sid:550752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncovid.com"; sid:550753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncovid.net"; sid:550754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moondancecovid19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moondancecovid19relieffund.com"; sid:550755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosquitospreadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosquitospreadcoronavirus.com"; sid:550756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosquitospreadcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosquitospreadcoronavirus.net"; sid:550757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosquitospreadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosquitospreadcovid.com"; sid:550758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosquitospreadcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosquitospreadcovid.net"; sid:550759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvcovid19eviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvcovid19eviction.com"; sid:550760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycompanycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycompanycovid19.com"; sid:550761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronagame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronagame.com"; sid:550762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahelp.com"; sid:550763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahelp.net"; sid:550764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19claim.com"; sid:550765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19cure.com"; sid:550766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19studies.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19studies.study"; sid:550767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidchronicles.com"; sid:550768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidscore.com"; sid:550769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstory.net"; sid:550770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myepidemicmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myepidemicmap.com"; sid:550771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95-coronavirus.com"; sid:550772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid.com"; sid:550773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95forcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95forcoronavirus.com"; sid:550774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95masksaleforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95masksaleforcoronavirus.com"; sid:550775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95masksforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95masksforcoronavirus.com"; sid:550776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95salecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95salecoronavirus.com"; sid:550777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nanokillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nanokillcovid19.com"; sid:550778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nanokillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nanokillcovid.com"; sid:550779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for national-corona-virus-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"national-corona-virus-claim.com"; sid:550780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for national-corona-virus-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"national-corona-virus-claims.com"; sid:550781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for national-covid-19-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"national-covid-19-claim.com"; sid:550782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claim.com"; sid:550783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for national-covid-19-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"national-covid-19-claims.com"; sid:550784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationwidecoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationwidecoronaclaims.com"; sid:550785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalprevention-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalprevention-coronavirus.com"; sid:550786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccoronavirusdenials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccoronavirusdenials.com"; sid:550787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19denials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19denials.com"; sid:550788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netcovid19.com"; sid:550789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforgetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforgetcoronavirus.com"; sid:550790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforgetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforgetcovid.com"; sid:550791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscovid19.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscovid19.fund"; sid:550792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixcovid.com"; sid:550793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixcovid.net"; sid:550794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidroofers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidroofers.com"; sid:550795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomascorona.com"; sid:550796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normalityaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normalityaftercovid.com"; sid:550797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northwellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northwellcovid.com"; sid:550798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for not-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"not-covid19.com"; sid:550799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronatees.com"; sid:550800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusclaims.com"; sid:550801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nucoronavirus.com"; sid:550802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirusbankruptcy.com"; sid:550803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronabusinesscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronabusinesscleaners.com"; sid:550804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronacarcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronacarcleaner.com"; sid:550805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronahomecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronahomecleaner.com"; sid:550806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronahomecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronahomecleaners.com"; sid:550807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for observatoriocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"observatoriocovid-19.com"; sid:550808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for on-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"on-covid19.com"; sid:550809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecallcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecallcoronaclean.com"; sid:550810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecallcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecallcovid19cleaning.com"; sid:550811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecovid.com"; sid:550812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestepcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestepcovid19test.com"; sid:550813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestepcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestepcovid19tests.com"; sid:550814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovidtest.com"; sid:550815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlycoronavirus.com"; sid:550816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovidpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovidpledge.com"; sid:550817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecoronavirus.com"; sid:550818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openthroughcoronavirus.com"; sid:550819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openthroughcovid19.com"; sid:550820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openthroughoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openthroughoutcoronavirus.com"; sid:550821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openthroughoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openthroughoutcovid19.com"; sid:550822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ormincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ormincovid19.com"; sid:550823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osgoodeproperties-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osgoodeproperties-covid19.com"; sid:550824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19.com"; sid:550825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19.life"; sid:550826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecovid.com"; sid:550827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packandcleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packandcleancovid19.com"; sid:550828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packcleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packcleancovid19.com"; sid:550829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pak-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pak-covid19.com"; sid:550830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandapandemic.com"; sid:550831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemia-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemia-coronavirus.com"; sid:550832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2019.com"; sid:550833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactionforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactionforce.com"; sid:550834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvisory.com"; sid:550835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicanxiety.com"; sid:550836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicassist.com"; sid:550837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicathomekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicathomekits.com"; sid:550838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicblockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicblockchain.com"; sid:550839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareers.com"; sid:550840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-chef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-chef.com"; sid:550841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccleaning.com"; sid:550842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiagnostic.com"; sid:550843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdreams.com"; sid:550844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicenews.com"; sid:550845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglobalprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglobalprep.com"; sid:550846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgolf.com"; sid:550847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-guide.com"; sid:550848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelp-google.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelp-google.com"; sid:550849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelpline.com"; sid:550850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclothing.com"; sid:550851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedgear.com"; sid:550852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-online.com"; sid:550853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphd.com"; sid:550854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaydates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaydates.com"; sid:550855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprecaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprecaution.com"; sid:550856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepdepot.com"; sid:550857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproduction.com"; sid:550858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprovider.com"; sid:550859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelieffund.com"; sid:550860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseconsulting.com"; sid:550861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsekits.com"; sid:550862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.net"; sid:550863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsetraining.com"; sid:550864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsetraining.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsetraining.net"; sid:550865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriskinsuranceact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriskinsuranceact.com"; sid:550866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicseo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicseo.com"; sid:550867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicservice.com"; sid:550868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshirt.com"; sid:550869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplycenter.com"; sid:550870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplystore.com"; sid:550871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalkit.net"; sid:550872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteeco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteeco.com"; sid:550873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictee.com"; sid:550874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictesterkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictesterkits.com"; sid:550875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwedding.com"; sid:550876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworldnews.com"; sid:550877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallacovid19.com"; sid:550878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracoronalamia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracoronalamia.com"; sid:550879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracoronalamia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracoronalamia.net"; sid:550880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paycovid.com"; sid:550881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcovido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcovido.com"; sid:550882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pdxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pdxcovid19.com"; sid:550883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pensacolacovid19sanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pensacolacovid19sanitize.com"; sid:550884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pensacolacovidsanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pensacolacovidsanitize.com"; sid:550885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for picturesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"picturesofcorona.com"; sid:550886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plan-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plan-corona.com"; sid:550887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformavictimascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformavictimascovid19.com"; sid:550888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poccoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poccoronavirustest.com"; sid:550889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poctestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poctestforcoronavirus.com"; sid:550890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portalcovid19.com"; sid:550891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for porziocovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"porziocovid19resources.com"; sid:550892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivenewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivenewscovid19.com"; sid:550893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalismus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalismus.com"; sid:550894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapeople.com"; sid:550895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid19solutions.com"; sid:550896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19solutions.com"; sid:550897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covidsolutions.com"; sid:550898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicconference.com"; sid:550899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicprofits.com"; sid:550900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicreality.com"; sid:550901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsummit.com"; sid:550902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poweringthroughthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poweringthroughthepandemic.com"; sid:550903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovid19.com"; sid:550904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovidsupplies.com"; sid:550905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praytoendcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praytoendcorona.com"; sid:550906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnantduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnantduringcorona.com"; sid:550907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepforpandemic.com"; sid:550908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingcovid-19.com"; sid:550909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventscoronavirus.com"; sid:550910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previenecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previenecovid19.com"; sid:550911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previenecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previenecovid.com"; sid:550912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profcovid.com"; sid:550913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecta-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecta-coronavirus.com"; sid:550914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectfromcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectfromcoronavirus.life"; sid:550915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovid-19.com"; sid:550916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivepandemicgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivepandemicgear.com"; sid:550917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezione-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezione-covid19.com"; sid:550918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proudtobecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proudtobecovidfree.com"; sid:550919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid19mexico.com"; sid:550920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid19monterrey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid19monterrey.com"; sid:550921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovidmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovidmexico.com"; sid:550922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovidmonterrey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovidmonterrey.com"; sid:550923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puertoricocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puertoricocovid19.com"; sid:550924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pune-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pune-corona.com"; sid:550925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qrcovid19.com"; sid:550926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qrcovid.com"; sid:550927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarentinecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarentinecovids.com"; sid:550928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questdiagnosticscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questdiagnosticscovid-19.com"; sid:550929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questdiagnosticscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questdiagnosticscovid19.com"; sid:550930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioncoronavirus.com"; sid:550931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioncovidchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioncovidchaos.com"; sid:550932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronavirustest.com"; sid:550933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19tests.com"; sid:550934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtest.com"; sid:550935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quit4covidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quit4covidnyc.com"; sid:550936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quit4covidnyc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quit4covidnyc.net"; sid:550937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitforcovidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitforcovidnyc.com"; sid:550938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quizcontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quizcontraocorona.com"; sid:550939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19kits.com"; sid:550940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportecovid.com"; sid:550941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochecovid-19.com"; sid:550942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochecovid19.com"; sid:550943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochediabetescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochediabetescovid-19.com"; sid:550944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochediabetescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochediabetescovid19.com"; sid:550945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runforcorona.com"; sid:550946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samentegencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samentegencovid19.com"; sid:550947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjosecovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjosecovid19survivor.com"; sid:550948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjosestrongcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjosestrongcovid19.com"; sid:550949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santandercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santandercoronavirus.com"; sid:550950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscov2-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscov2-corona.com"; sid:550951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscov2-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscov2-covid19.com"; sid:550952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscov2-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscov2-pandemic.com"; sid:550953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saudicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saudicorona.com"; sid:550954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovid.com"; sid:550955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scaredaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scaredaboutcovid19.com"; sid:550956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolcovid19.com"; sid:550957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovidstrackeri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovidstrackeri.com"; sid:550958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seopandemic.com"; sid:550959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-gegen-corona-immun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-gegen-corona-immun.com"; sid:550960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sessions-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sessions-covid19.com"; sid:550961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgbcovid19.com"; sid:550962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronavirustest.com"; sid:550963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simonassocies-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simonassocies-covid19.com"; sid:550964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sing-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sing-against-corona.com"; sid:550965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singagainstcorona.com"; sid:550966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbcovid19.com"; sid:550967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialiolationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialiolationcovid19.com"; sid:550968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialisolationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialisolationcovid19.com"; sid:550969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spokanecovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spokanecovid19help.com"; sid:550970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standup2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standup2corona.com"; sid:550971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startcoronaviruscleaning.com"; sid:550972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsvscovid.com"; sid:550973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stats-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stats-covid19.com"; sid:550974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stats-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stats-covid19.net"; sid:550975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statsoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statsoncovid.com"; sid:550976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemvcovid19.com"; sid:550977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus.world"; sid:550978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19cameroun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19cameroun.com"; sid:550979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19japan.com"; sid:550980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.life"; sid:550981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidspread.com"; sid:550982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.team"; sid:550983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovid19.com"; sid:550984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storecovid-19.com"; sid:550985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strongerthancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strongerthancovid.com"; sid:550986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suivicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suivicovid19.com"; sid:550987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovid-19.com"; sid:550988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcovid2020.com"; sid:550989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorof2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorof2020pandemic.com"; sid:550990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorof2020pandemic.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorof2020pandemic.mobi"; sid:550991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorof2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorof2020pandemic.net"; sid:550992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcovid.com"; sid:550993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t1dcovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t1dcovid19study.com"; sid:550994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taegliches-corona-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taegliches-corona-update.com"; sid:550995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taeglichescoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taeglichescoronaupdate.com"; sid:550996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tagcorona.com"; sid:550997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamecovid.com"; sid:550998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampabaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampabaycovid.com"; sid:550999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronaattorney.com"; sid:551000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronalawyer.com"; sid:551001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapcorona.com"; sid:551002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taptapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taptapcorona.com"; sid:551003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthcoronavirus.com"; sid:551004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teletherapycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teletherapycovid19.com"; sid:551005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terrazza-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terrazza-corona.net"; sid:551006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid-19now.com"; sid:551007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-kit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-kit-covid19.com"; sid:551008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidocoronavirus.com"; sid:551009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidocovid19.com"; sid:551010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testscovid-19.com"; sid:551011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidcollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidcollaborative.com"; sid:551012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaifightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaifightcovid.com"; sid:551013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatstupidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatstupidcorona.com"; sid:551014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecommoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecommoncovid.com"; sid:551015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiariesblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiariesblog.com"; sid:551016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadr.com"; sid:551017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafiles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafiles.net"; sid:551018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaguru.com"; sid:551019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronajournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronajournals.com"; sid:551020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakiller.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakiller.net"; sid:551021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanetworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanetworks.com"; sid:551022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapage.com"; sid:551023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapalooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapalooza.com"; sid:551024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashelter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashelter.com"; sid:551025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasucks.com"; sid:551026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaupdate.com"; sid:551027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscurve.com"; sid:551028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusremedy.com"; sid:551029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusvaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusvaccine.net"; sid:551030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19coronavirus.com"; sid:551031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19game.com"; sid:551032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcampaign.com"; sid:551033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcare.com"; sid:551034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcaretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcaretracker.com"; sid:551035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchroniclespodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchroniclespodcast.com"; sid:551036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfront.com"; sid:551037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidioms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidioms.com"; sid:551038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovids.com"; sid:551039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsymptoms.com"; sid:551040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtreatment.com"; sid:551041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidworld.com"; sid:551042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatamericanpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatamericanpandemic.com"; sid:551043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelockdowndiariescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelockdowndiariescovid19.com"; sid:551044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpal.com"; sid:551045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpantrycookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpantrycookbook.com"; sid:551046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpapers.com"; sid:551047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicplanner.com"; sid:551048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpro.com"; sid:551049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsolution.com"; sid:551050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-politics-of-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-politics-of-covid-19.com"; sid:551051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovid-19.com"; sid:551052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesymptomsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesymptomsofcovid.com"; sid:551053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tijuanasincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tijuanasincoronavirus.com"; sid:551054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontorealestatepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontorealestatepandemic.com"; sid:551055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackdowncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackdowncorona.com"; sid:551056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingthepandemic.com"; sid:551057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovid19stories.com"; sid:551058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcausedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcausedcovid19.com"; sid:551059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turkey-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turkey-coronavirus-live-stats.com"; sid:551060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidcollab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidcollab.com"; sid:551061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ujacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ujacovidrelief.com"; sid:551062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unioncountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unioncountycovid.com"; sid:551063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united-kingdom-coronavirus-live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united-kingdom-coronavirus-live-stats.com"; sid:551064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskingcovid-19.com"; sid:551065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskingcovid19.com"; sid:551066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskingcovid.com"; sid:551067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmenssanierung-corona-krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmenssanierung-corona-krise.com"; sid:551068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatemecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatemecorona.com"; sid:551069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronahelp.com"; sid:551070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronastats.com"; sid:551071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19help.com"; sid:551072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19help.com"; sid:551073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronalaw.com"; sid:551074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronalegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronalegal.com"; sid:551075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaloans.com"; sid:551076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtrends.com"; sid:551077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uwmtacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uwmtacovid19.com"; sid:551078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vale-verdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vale-verdecovid19.com"; sid:551079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxcovid19.com"; sid:551080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencerocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencerocorona.com"; sid:551081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for versuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"versuscovid19.com"; sid:551082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimacovid19.com"; sid:551083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimascovid19.net"; sid:551084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovidclinic.com"; sid:551085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualsolutionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualsolutionscovid19.com"; sid:551086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona.media"; sid:551087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-corona-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-corona-updates.com"; sid:551088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusesepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusesepidemic.com"; sid:551089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemicshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemicshirts.com"; sid:551090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamincandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamincandcoronavirus.com"; sid:551091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vittimecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vittimecovid19.com"; sid:551092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerforcovid.com"; sid:551093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscoronavirus.com"; sid:551094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscovid19.com"; sid:551095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waltoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waltoncovid19.com"; sid:551096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watchforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watchforcorona.com"; sid:551097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid2020.com"; sid:551098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefinishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefinishcorona.com"; sid:551099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellcorona.com"; sid:551100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellcovid19triage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellcovid19triage.com"; sid:551101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellhealth-covid19triage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellhealth-covid19triage.com"; sid:551102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-sing-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-sing-against-corona.com"; sid:551103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesingagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesingagainstcorona.com"; sid:551104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westandagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westandagainstcovid19.com"; sid:551105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcorona2020.com"; sid:551106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid2020.com"; sid:551107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedpandemic2020.com"; sid:551108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencovidisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencovidisover.com"; sid:551109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheretogoinangolacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheretogoinangolacovid-19.com"; sid:551110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-coronavirus.com"; sid:551111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wicovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wicovidtracker.com"; sid:551112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willyougetcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willyougetcovid19.life"; sid:551113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wohnung-verkaufen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wohnung-verkaufen-corona.com"; sid:551114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecovid.com"; sid:551115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingwithcovid.com"; sid:551116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workinthetimeofcorona.com"; sid:551117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronasday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronasday.com"; sid:551118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronastats.com"; sid:551119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-covid-19.com"; sid:551120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid-19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid-19stats.com"; sid:551121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19stats.com"; sid:551122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcupcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcupcoronavirus.com"; sid:551123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwide-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwide-covid19.com"; sid:551124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for writingawrongcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"writingawrongcovid19.com"; sid:551125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbook.com"; sid:551126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbrands.com"; sid:551127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchuanjun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchuanjun.com"; sid:551128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclothing.com"; sid:551129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoverup.com"; sid:551130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanify.com"; sid:551131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmarketing.com"; sid:551132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpartners.com"; sid:551133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantextiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantextiles.com"; sid:551134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirussurvivor.com"; sid:551135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwuhansurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwuhansurvivor.net"; sid:551136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronacount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronacount.com"; sid:551137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovid19map.com"; sid:551138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--alleswaszhlt-corona-owb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--alleswaszhlt-corona-owb.com"; sid:551139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--alleswaszhltcorona-ttb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--alleswaszhltcorona-ttb.com"; sid:551140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--asociacinafectadoscoronavirus-22c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--asociacinafectadoscoronavirus-22c.com"; sid:551141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--asociacindevictimasporcoronavirus-7gd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--asociacindevictimasporcoronavirus-7gd.com"; sid:551142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronahjlp-k6a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronahjlp-k6a.com"; sid:551143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-tglich-ifb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-tglich-ifb.com"; sid:551144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronatglich-mcb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronatglich-mcb.com"; sid:551145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronayardmedevlet-n0cb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronayardmedevlet-n0cb.com"; sid:551146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--tgliche-corona-updates-04b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--tgliche-corona-updates-04b.com"; sid:551147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--tglichecoronaupdates-bzb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--tglichecoronaupdates-bzb.com"; sid:551148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--tgliches-corona-update-04b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--tgliches-corona-update-04b.com"; sid:551149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--tglichescoronaupdate-bzb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--tglichescoronaupdate-bzb.com"; sid:551150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--vctimacoronavirus-dvb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--vctimacoronavirus-dvb.com"; sid:551151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomeinformocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomeinformocovid19.com"; sid:551152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialputocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialputocoronavirus.com"; sid:551153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosupereacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosupereacovid-19.com"; sid:551154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosupereacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosupereacovid19.com"; sid:551155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youandcoronavirus.com"; sid:551156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaguide.com"; sid:551157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19mask.com"; sid:551158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidjourney.com"; sid:551159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovids.com"; sid:551160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourpandemicpartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourpandemicpartner.com"; sid:551161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourpandemicpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourpandemicpartners.com"; sid:551162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0corona.com"; sid:551163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0coronavirus.com"; sid:551164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 112corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"112corona.com"; sid:551165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 112coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"112coronavirus.com"; sid:551166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 112covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"112covid.com"; sid:551167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid.com"; sid:551168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronacrisis.com"; sid:551169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus19.com"; sid:551170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mincovid.com"; sid:551171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m-n95mask-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m-n95mask-covid19.com"; sid:551172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronaviruscovid19.com"; sid:551173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovid19.com"; sid:551174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aceiteanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aceiteanticoronavirus.com"; sid:551175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoptahospitalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoptahospitalcovid19.com"; sid:551176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadocovid.com"; sid:551177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid19alicante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid19alicante.com"; sid:551178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid19benidorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid19benidorm.com"; sid:551179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-corona.net"; sid:551180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcorona.net"; sid:551181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidcovid.com"; sid:551182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airagainstcovid.com"; sid:551183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-covid-19.com"; sid:551184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliments-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliments-covid19.com"; sid:551185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19disinfection.com"; sid:551186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alphacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alphacovid.com"; sid:551187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alquilersolidariocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alquilersolidariocovid19.com"; sid:551188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amedcovid.com"; sid:551189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatcovid19.com"; sid:551190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americansbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americansbeatcovid19.com"; sid:551191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anothercovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anothercovidiot.com"; sid:551192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronachip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronachip.com"; sid:551193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronachips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronachips.com"; sid:551194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronainjection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronainjection.com"; sid:551195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronainjections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronainjections.com"; sid:551196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronapill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronapill.com"; sid:551197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronapills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronapills.com"; sid:551198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.center"; sid:551199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19araras.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19araras.life"; sid:551200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcoronavirus.com"; sid:551201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apollo13covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apollo13covid19.com"; sid:551202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcovid.com"; sid:551203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivoscoronavirus.com"; sid:551204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkofthecovid.net"; sid:551205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofcorona.net"; sid:551206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ascovid.com"; sid:551207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askaboutcovid19.com"; sid:551208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionafectadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionafectadoscovid19.com"; sid:551209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionvictimasdelcoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionvictimasdelcoronaviruscovid19.com"; sid:551210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assamcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assamcorona.com"; sid:551211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asthma-and-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asthma-and-corona.com"; sid:551212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecorona.com"; sid:551213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for au-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"au-covid.net"; sid:551214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscovid19.com"; sid:551215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australicovid19.com"; sid:551216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australicovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australicovid19now.com"; sid:551217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awas-adacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awas-adacorona.com"; sid:551218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awas-viruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awas-viruscorona.com"; sid:551219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aycovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aycovidresponse.com"; sid:551220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovidcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovidcr.com"; sid:551221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baguiocovidfront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baguiocovidfront.com"; sid:551222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastardcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastardcorona.com"; sid:551223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battleofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battleofcorona.com"; sid:551224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battleofwuhan.com"; sid:551225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcbeforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcbeforecorona.com"; sid:551226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beacoronasafebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beacoronasafebusiness.com"; sid:551227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcovid19.com"; sid:551228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcovid.com"; sid:551229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronasafebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronasafebusiness.com"; sid:551230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsafe.com"; sid:551231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benantaihewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benantaihewuhan.com"; sid:551232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronacleaners.com"; sid:551233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronadoctor.com"; sid:551234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronadoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronadoctors.com"; sid:551235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronanurses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronanurses.com"; sid:551236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusgifts.com"; sid:551237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bewarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bewarecoronavirus.com"; sid:551238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhopalfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhopalfightscorona.com"; sid:551239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenhascovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenhascovid19.biz"; sid:551240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigclean-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigclean-covid19.com"; sid:551241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosecuritycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosecuritycoronavirus.com"; sid:551242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitacoracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitacoracovid19.com"; sid:551243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackswancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackswancoronavirus.com"; sid:551244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackswancoronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackswancoronavirus.mobi"; sid:551245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackswancoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackswancoronavirus.net"; sid:551246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blog-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blog-corona.com"; sid:551247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid.com"; sid:551248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bremercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bremercovid19.com"; sid:551249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brg-coronavirus-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brg-coronavirus-covid.com"; sid:551250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessaftercovid.com"; sid:551251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidrelief.com"; sid:551252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19medicalsupplies.com"; sid:551253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-corona.com"; sid:551254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19epidemic.com"; sid:551255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirushelp.com"; sid:551256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19help.com"; sid:551257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capefearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capefearcoronavirus.com"; sid:551258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cash4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cash4covid.com"; sid:551259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalystcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalystcovid.com"; sid:551260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cautioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cautioncovid-19.com"; sid:551261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdpandemic.com"; sid:551262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdacovid.com"; sid:551263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cecilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cecilcovid.com"; sid:551264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cellexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cellexcovid.com"; sid:551265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengecovid-19.com"; sid:551266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartcovid.com"; sid:551267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check-corona.com"; sid:551268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcorona.com"; sid:551269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chscoronavirus.com"; sid:551270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chscoronavirus.net"; sid:551271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizensagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizensagainstcovid-19.com"; sid:551272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizensagainstcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizensagainstcovid-19.net"; sid:551273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizensagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizensagainstcovid.com"; sid:551274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcovid.com"; sid:551275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncoronavirus.net"; sid:551276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedbycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedbycoronavirus.com"; sid:551277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocktailcoronavirusofmarseille.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocktailcoronavirusofmarseille.com"; sid:551278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cockycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cockycorona.com"; sid:551279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collect4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collect4corona.com"; sid:551280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collet4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collet4corona.com"; sid:551281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colouragainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colouragainstcorona.com"; sid:551282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona2020.com"; sid:551283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for community4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"community4covid.com"; sid:551284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concertforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concertforcorona.com"; sid:551285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinement-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinement-coronavirus.com"; sid:551286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinement-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinement-coronavirus.net"; sid:551287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contentforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contentforcovid.com"; sid:551288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corazycoronacompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corazycoronacompany.com"; sid:551289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19armor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19armor.com"; sid:551290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19businessrelief.com"; sid:551291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19ppe.com"; sid:551292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19tarunno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19tarunno.com"; sid:551293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19wall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19wall.com"; sid:551294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona24th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona24th.com"; sid:551295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2virus.com"; sid:551296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanarchy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanarchy.com"; sid:551297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandclean.com"; sid:551298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaward.com"; sid:551299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababynames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababynames.com"; sid:551300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabadge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabadge.com"; sid:551301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabailoutcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabailoutcalculator.com"; sid:551302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bankrupt.com"; sid:551303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcy-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcy-attorney.com"; sid:551304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabaund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabaund.com"; sid:551305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-birthday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-birthday.com"; sid:551306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboob.com"; sid:551307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabooz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabooz.com"; sid:551308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabound.com"; sid:551309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrilliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrilliant.com"; sid:551310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrokeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrokeme.com"; sid:551311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabux.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabux.net"; sid:551312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacabaret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacabaret.com"; sid:551313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalendars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalendars.com"; sid:551314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalorie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalorie.com"; sid:551315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalories.com"; sid:551316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.care"; sid:551317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacated.com"; sid:551318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatholicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatholicresponse.com"; sid:551319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacating.com"; sid:551320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationofficial.com"; sid:551321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacausedmybankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacausedmybankruptcy.com"; sid:551322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaceuticals.com"; sid:551323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharitys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharitys.com"; sid:551324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharts.net"; sid:551325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckus.com"; sid:551326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclespart1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclespart1.com"; sid:551327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclespart1.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclespart1.net"; sid:551328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacinema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacinema.com"; sid:551329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaim.net"; sid:551330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsadjuster.com"; sid:551331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimscourt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimscourt.com"; sid:551332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanservice.com"; sid:551333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacockup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacockup.com"; sid:551334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoldcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoldcare.com"; sid:551335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoldcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoldcare.net"; sid:551336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoli.com"; sid:551337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommission.com"; sid:551338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommons.com"; sid:551339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconomics.com"; sid:551340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookie.com"; sid:551341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookingrecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookingrecipes.com"; sid:551342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreations.net"; sid:551343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreditrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreditrepair.com"; sid:551344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.life"; sid:551345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacultures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacultures.com"; sid:551346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazes.com"; sid:551347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazzle.com"; sid:551348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealsdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealsdelivered.com"; sid:551349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealsdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealsdelivery.com"; sid:551350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtremoval.com"; sid:551351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-de-vida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-de-vida.com"; sid:551352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-de-vida.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-de-vida.net"; sid:551353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiabetes.com"; sid:551354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiploma2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiploma2020.com"; sid:551355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadirectory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadirectory.net"; sid:551356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasteraid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasteraid.com"; sid:551357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonald.com"; sid:551358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadummy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadummy.com"; sid:551359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaecology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaecology.com"; sid:551360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-emojis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-emojis.com"; sid:551361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenzymes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenzymes.com"; sid:551362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessential.com"; sid:551363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fallzahlen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fallzahlen.com"; sid:551364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaferien.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaferien.net"; sid:551365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fighters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fighters.net"; sid:551366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finanzen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finanzen.com"; sid:551367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finanzen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finanzen.net"; sid:551368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforward.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforward.fyi"; sid:551369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforza.com"; sid:551370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecash.com"; sid:551371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuerza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuerza.com"; sid:551372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundingservices.com"; sid:551373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafund.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafund.life"; sid:551374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagametime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagametime.com"; sid:551375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagiftbasket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagiftbasket.com"; sid:551376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagive.com"; sid:551377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglas.com"; sid:551378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglow.com"; sid:551379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagovtmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagovtmoney.com"; sid:551380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrit.com"; sid:551381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguate.com"; sid:551382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahammer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahammer.com"; sid:551383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandle.com"; sid:551384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandouts.com"; sid:551385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheadline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheadline.com"; sid:551386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp4u.com"; sid:551387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp4u.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp4u.net"; sid:551388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp-center.com"; sid:551389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahero.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahero.net"; sid:551390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hobby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hobby.com"; sid:551391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahobby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahobby.com"; sid:551392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hook.com"; sid:551393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahorrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahorrors.com"; sid:551394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immune.com"; sid:551395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmun.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmun.net"; sid:551396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfung.net"; sid:551397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincentives.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincentives.biz"; sid:551398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincharts.com"; sid:551399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindianews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindianews.com"; sid:551400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo4u.com"; sid:551401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-injury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-injury.com"; sid:551402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaires-carcassonne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaires-carcassonne.com"; sid:551403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairshelp.com"; sid:551404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairshelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairshelp.net"; sid:551405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakadai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakadai.com"; sid:551406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakapow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakapow.com"; sid:551407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidco.com"; sid:551408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakirana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakirana.com"; sid:551409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakode.com"; sid:551410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleadership.com"; sid:551411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegality.com"; sid:551412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lie.com"; sid:551413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalink.net"; sid:551414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocals.com"; sid:551415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loss.com"; sid:551416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloveproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloveproject.com"; sid:551417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluxuryvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluxuryvacations.com"; sid:551418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadeinchina.com"; sid:551419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketloss.com"; sid:551420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketlosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketlosses.com"; sid:551421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskmission.com"; sid:551422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskx.com"; sid:551423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamdnutraceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamdnutraceuticals.com"; sid:551424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameasure.com"; sid:551425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicals.com"; sid:551426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameltdown.com"; sid:551427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionaire.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionaire.net"; sid:551428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionairereview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionairereview.com"; sid:551429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronammune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronammune.com"; sid:551430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronammunees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronammunees.com"; sid:551431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronammunies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronammunies.com"; sid:551432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamor.com"; sid:551433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mortgage.com"; sid:551434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamsg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamsg.com"; sid:551435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanarchy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanarchy.com"; sid:551436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneedtoknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneedtoknow.com"; sid:551437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneoldu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneoldu.net"; sid:551438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanepal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanepal.net"; sid:551439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanout.com"; sid:551440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutraceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutraceuticals.com"; sid:551441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaontology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaontology.com"; sid:551442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-or-allergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-or-allergy.com"; sid:551443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-orchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-orchester.com"; sid:551444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorchester.com"; sid:551445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-orchestra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-orchestra.com"; sid:551446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorchestra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorchestra.com"; sid:551447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-or-dustmiteallergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-or-dustmiteallergy.com"; sid:551448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparodi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparodi.com"; sid:551449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparty.net"; sid:551450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapass.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapass.life"; sid:551451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapestcontrolservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapestcontrolservice.com"; sid:551452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeutics.com"; sid:551453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanning.com"; sid:551454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapow.com"; sid:551455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprivacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprivacy.com"; sid:551456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofs.com"; sid:551457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareboot.com"; sid:551458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareboot.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareboot.fyi"; sid:551459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareform.com"; sid:551460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefbill.com"; sid:551461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefbills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefbills.com"; sid:551462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefforbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefforbiz.com"; sid:551463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefhotline.com"; sid:551464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefservices.com"; sid:551465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieftoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieftoday.com"; sid:551466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieftoday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieftoday.net"; sid:551467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarenthelp.com"; sid:551468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-retter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-retter.com"; sid:551469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretter.com"; sid:551470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarewards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarewards.com"; sid:551471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rid.com"; sid:551472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyshirt.com"; sid:551473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasatylist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasatylist.com"; sid:551474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbl.com"; sid:551475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascar.com"; sid:551476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascare2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascare2020.com"; sid:551477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-score.com"; sid:551478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreened.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreened.com"; sid:551479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasell.com"; sid:551480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasharp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasharp.com"; sid:551481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaships.com"; sid:551482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasidewalkart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasidewalkart.com"; sid:551483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiperi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiperi.com"; sid:551484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnews.com"; sid:551485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolved.com"; sid:551486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecie.com"; sid:551487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspiel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspiel.com"; sid:551488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspikes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspikes.com"; sid:551489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspuckschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspuckschutz.com"; sid:551490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilizes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilizes.com"; sid:551491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stik.com"; sid:551492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastik.com"; sid:551493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulusbill.com"; sid:551494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluscalculator.com"; sid:551495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluschecks.com"; sid:551496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulushelp.com"; sid:551497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockloss.com"; sid:551498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastocklosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastocklosses.com"; sid:551499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopp.com"; sid:551500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastorys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastorys.com"; sid:551501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastretch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastretch.com"; sid:551502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplies.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplies.life"; sid:551503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurge.com"; sid:551504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurges.com"; sid:551505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurgical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurgical.com"; sid:551506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurgicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurgicals.com"; sid:551507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurveys.com"; sid:551508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivor-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivor-2020.com"; sid:551509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswat.com"; sid:551510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatale.com"; sid:551511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxeshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxeshelp.com"; sid:551512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelethon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelethon.com"; sid:551513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-kits.com"; sid:551514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatetangga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatetangga.com"; sid:551515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaticks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaticks.com"; sid:551516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimepuzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimepuzzles.com"; sid:551517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatized.com"; sid:551518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoxin.com"; sid:551519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracker.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracker.life"; sid:551520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracker.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracker.pro"; sid:551521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerpro.com"; sid:551522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackster.com"; sid:551523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrax.com"; sid:551524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaultima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaultima.com"; sid:551525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauncovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauncovered.com"; sid:551526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvc.com"; sid:551527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavalue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavalue.com"; sid:551528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcleane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcleane.com"; sid:551529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-versicherung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-versicherung.net"; sid:551530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viraltimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viraltimes.com"; sid:551531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral-times.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral-times.guru"; sid:551532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19help.com"; sid:551533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19us.com"; sid:551534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus786.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus786.com"; sid:551535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus99.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus99.com"; sid:551536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabogados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabogados.com"; sid:551537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactions.com"; sid:551538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusadvisors.com"; sid:551539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidloan.com"; sid:551540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidloans.com"; sid:551541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidpackage.com"; sid:551542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidreliefandeconomicsecurityact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidreliefandeconomicsecurityact.com"; sid:551543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhaiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhaiti.com"; sid:551544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusantidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusantidote.com"; sid:551545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietyteletherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietyteletherapy.com"; sid:551546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarmy.com"; sid:551547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassault.com"; sid:551548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbacklash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbacklash.com"; sid:551549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbadfaith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbadfaith.com"; sid:551550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutadvisors.com"; sid:551551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutcalculator.com"; sid:551552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutconsultants.com"; sid:551553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionclaims.com"; sid:551554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusbusters.com"; sid:551555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-buzz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-buzz.com"; sid:551556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaresact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaresact.com"; sid:551557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cases.com"; sid:551558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschallenges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschallenges.com"; sid:551559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschaplaincorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschaplaincorps.com"; sid:551560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschroniclesvol1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschroniclesvol1.com"; sid:551561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschroniclesvol1.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschroniclesvol1.net"; sid:551562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaim.biz"; sid:551563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclarity.com"; sid:551564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleankit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleankit.com"; sid:551565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleantips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleantips.com"; sid:551566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinicaltrialfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinicaltrialfinder.com"; sid:551567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinical-trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinical-trials.com"; sid:551568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclipboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclipboards.com"; sid:551569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoronavirus.com"; sid:551570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatabreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatabreach.com"; sid:551571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdataportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdataportal.com"; sid:551572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtattorney.com"; sid:551573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtcase.com"; sid:551574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtdefense.com"; sid:551575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtloan.com"; sid:551576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseattorney.com"; sid:551577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-destroyed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-destroyed.com"; sid:551578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdestroyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdestroyers.com"; sid:551579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasehelp.com"; sid:551580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdruglawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdruglawsuits.com"; sid:551581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrugtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrugtrial.com"; sid:551582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrugtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrugtrials.com"; sid:551583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruselimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruselimination.com"; sid:551584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruseliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruseliminators.com"; sid:551585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusexperts.com"; sid:551586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposuretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposuretracker.com"; sid:551587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfearteletherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfearteletherapy.com"; sid:551588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilmfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilmfest.com"; sid:551589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforever.com"; sid:551590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedog.com"; sid:551591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreenow.com"; sid:551592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreetoday.com"; sid:551593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfumagation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfumagation.com"; sid:551594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgamechanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgamechanger.com"; sid:551595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgargle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgargle.com"; sid:551596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgforce.com"; sid:551597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgiftbasket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgiftbasket.com"; sid:551598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgiftbaskets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgiftbaskets.com"; sid:551599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobally.com"; sid:551600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgucci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgucci.com"; sid:551601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusgurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusgurus.com"; sid:551602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgurus.com"; sid:551603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandouts.com"; sid:551604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushardshipdiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushardshipdiscount.com"; sid:551605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcenters.com"; sid:551606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthservices.com"; sid:551607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushell.com"; sid:551608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpcare.net"; sid:551609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelplineweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelplineweb.com"; sid:551610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousinghelp.com"; sid:551611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-illness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-illness.com"; sid:551612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpacthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpacthelp.com"; sid:551613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincentivi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincentivi.com"; sid:551614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-injury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-injury.com"; sid:551615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinlawyer.com"; sid:551616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinromania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinromania.com"; sid:551617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-in-ua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-in-ua.com"; sid:551618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-killers.com"; sid:551619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatinoamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatinoamerica.com"; sid:551620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalcases.com"; sid:551621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanprograms.com"; sid:551622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocalresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocalresponse.com"; sid:551623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslv.com"; sid:551624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskandgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskandgear.com"; sid:551625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksale-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksale-n95.com"; sid:551626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksaleusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksaleusa.com"; sid:551627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.life"; sid:551628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskworld.com"; sid:551629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmass.com"; sid:551630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmdkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmdkit.com"; sid:551631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmealprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmealprep.com"; sid:551632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeals.com"; sid:551633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmit.com"; sid:551634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmu.com"; sid:551635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmutualaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmutualaid.com"; sid:551636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewscenter.com"; sid:551637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusniches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusniches.com"; sid:551638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorthwesternmutual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorthwesternmutual.com"; sid:551639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnpl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnpl.com"; sid:551640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-online.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-online.pro"; sid:551641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-online-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-online-test.com"; sid:551642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-onlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-onlinetest.com"; sid:551643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopportunity.com"; sid:551644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparalelo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparalelo.com"; sid:551645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspennsylvania.com"; sid:551646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspictures.com"; sid:551647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspitt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspitt.com"; sid:551648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspittsburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspittsburgh.com"; sid:551649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreguntas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreguntas.com"; sid:551650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreparationkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreparationkit.com"; sid:551651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepsupply.com"; sid:551652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofits.com"; sid:551653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofed.com"; sid:551654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotections.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotections.net"; sid:551655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproved.com"; sid:551656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproven.com"; sid:551657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqc.com"; sid:551658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-quicktest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-quicktest.net"; sid:551659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrebates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrebates.net"; sid:551660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryadvisors.com"; sid:551661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryconsultants.com"; sid:551662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-refugees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-refugees.com"; sid:551663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefsolutions.com"; sid:551664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieftoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieftoday.com"; sid:551665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrental.com"; sid:551666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrentals.com"; sid:551667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseteams.com"; sid:551668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrobots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrobots.com"; sid:551669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ru.com"; sid:551670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetybook.com"; sid:551671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetydepot.com"; sid:551672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyshelf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyshelf.com"; sid:551673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizeny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizeny.com"; sid:551674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussavannah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussavannah.com"; sid:551675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussavings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussavings.com"; sid:551676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sex.com"; sid:551677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussneezeguard.com"; sid:551678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussneezeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussneezeguards.com"; sid:551679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-solutions.com"; sid:551680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussolutions.com"; sid:551681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialists.com"; sid:551682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stats.net"; sid:551683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusadvice.com"; sid:551684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusadvisors.com"; sid:551685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluscalculator.com"; sid:551686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusconsultants.com"; sid:551687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusfunds.com"; sid:551688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusgps.com"; sid:551689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluspackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluspackages.com"; sid:551690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockmarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockmarketcrash.com"; sid:551691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrands.com"; sid:551692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussupply.com"; sid:551693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxresources.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxresources.biz"; sid:551694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustee-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustee-shirt.com"; sid:551695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteeshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteeshirt.com"; sid:551696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustee-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustee-shirts.com"; sid:551697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglocator.com"; sid:551698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnm.com"; sid:551699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesto.com"; sid:551700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustory.com"; sid:551701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustory.net"; sid:551702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineavailable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineavailable.com"; sid:551703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusverdadero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusverdadero.com"; sid:551704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-versicherung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-versicherung.com"; sid:551705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteernetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteernetwork.com"; sid:551706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteernetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteernetwork.net"; sid:551707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoterguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoterguide.com"; sid:551708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-warriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-warriors.com"; sid:551709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweb.net"; sid:551710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweed.net"; sid:551711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxkiller.com"; sid:551712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisionsongcontest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisionsongcontest.com"; sid:551713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vital-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vital-guard.com"; sid:551714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoterguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoterguide.com"; sid:551715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldorder.com"; sid:551716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawtf.com"; sid:551717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayogi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayogi.com"; sid:551718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countrywideaustralicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countrywideaustralicovid19.com"; sid:551719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covered4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covered4covid.com"; sid:551720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveredcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveredcorona.com"; sid:551721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192030.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192030.com"; sid:551722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-3dprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-3dprinting.com"; sid:551723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abogado.com"; sid:551724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advocacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advocacy.com"; sid:551725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advocates.com"; sid:551726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidloan.com"; sid:551727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allhandsondeck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allhandsondeck.com"; sid:551728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alliances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alliances.com"; sid:551729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19analytics.com"; sid:551730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-analytics.com"; sid:551731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andme.com"; sid:551732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19archives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19archives.com"; sid:551733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19argentina.com"; sid:551734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assay.com"; sid:551735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assays.com"; sid:551736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomeworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomeworkout.com"; sid:551737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19atty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19atty.com"; sid:551738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atty.com"; sid:551739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19australia.com"; sid:551740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19australia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19australia.net"; sid:551741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19award.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19award.com"; sid:551742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awards.com"; sid:551743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19badge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19badge.com"; sid:551744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankrupt.com"; sid:551745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bat.com"; sid:551746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birkenhead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birkenhead.com"; sid:551747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19biz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19biz.com"; sid:551748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blood.com"; sid:551749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buddysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buddysystem.com"; sid:551750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscontinuityconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscontinuityconsulting.com"; sid:551751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscontinuityexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscontinuityexperts.com"; sid:551752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscontinuitysurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscontinuitysurvival.com"; sid:551753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calisurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calisurvivor.com"; sid:551754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-canada.com"; sid:551755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cancerinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cancerinformation.com"; sid:551756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cancerresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cancerresources.com"; sid:551757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19caresact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19caresact.com"; sid:551758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caresact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caresact.com"; sid:551759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cars.com"; sid:551760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashnow.com"; sid:551761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedcleaningservices.com"; sid:551762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chances.com"; sid:551763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chinesevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chinesevirus.com"; sid:551764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimsadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimsadjuster.com"; sid:551765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimslaw.com"; sid:551766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimslawyer.com"; sid:551767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearshields.com"; sid:551768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19congress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19congress.com"; sid:551769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-consulting.com"; sid:551770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corruption.com"; sid:551771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cpd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cpd.com"; sid:551772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-credit.com"; sid:551773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisis2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisis2020.com"; sid:551774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailytracker.com"; sid:551775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathlist.com"; sid:551776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19defenseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19defenseattorney.com"; sid:551777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenseattorney.com"; sid:551778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19defenselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19defenselawyer.com"; sid:551779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenselawyer.com"; sid:551780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detalles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detalles.com"; sid:551781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-diary.com"; sid:551782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19direct.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19direct.care"; sid:551783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterloan.com"; sid:551784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diytest.com"; sid:551785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doit.com"; sid:551786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtrial.com"; sid:551787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtrials.com"; sid:551788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dx.com"; sid:551789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dx.net"; sid:551790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19egstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19egstatus.com"; sid:551791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfunding.com"; sid:551792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19encuesta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19encuesta.com"; sid:551793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialbusiness.com"; sid:551794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialbusinessescleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialbusinessescleaning.com"; sid:551795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialbusinesses.com"; sid:551796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialbusinessesjanitorialnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialbusinessesjanitorialnashville.com"; sid:551797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-essentials.com"; sid:551798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialservice.com"; sid:551799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialservice.net"; sid:551800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialservices.com"; sid:551801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialservices.net"; sid:551802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19essentialsstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19essentialsstore.com"; sid:551803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialworker.com"; sid:551804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialworkers.com"; sid:551805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19estateplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19estateplan.com"; sid:551806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experts.net"; sid:551807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposuretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposuretracker.com"; sid:551808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faceshield.com"; sid:551809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faceshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faceshields.com"; sid:551810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financing.com"; sid:551811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fluvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fluvaccine.com"; sid:551812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fluvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fluvaccines.com"; sid:551813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fogging.com"; sid:551814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fogging.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fogging.net"; sid:551815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeusa.com"; sid:551816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19funding.com"; sid:551817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-funding.com"; sid:551818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19funding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19funding.net"; sid:551819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-funding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-funding.net"; sid:551820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funding.net"; sid:551821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundingsolutions.com"; sid:551822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gardian.com"; sid:551823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gargle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gargle.com"; sid:551824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gargle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gargle.com"; sid:551825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalstats.com"; sid:551826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goaerobic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goaerobic.life"; sid:551827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gov.com"; sid:551828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19govreliefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19govreliefs.com"; sid:551829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handgel.com"; sid:551830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcenters.com"; sid:551831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthlaw.com"; sid:551832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthlaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthlaw.net"; sid:551833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthservices.com"; sid:551834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpinghand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpinghand.com"; sid:551835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helprelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helprelief.com"; sid:551836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpusa.com"; sid:551837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.zone"; sid:551838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hilfe.com"; sid:551839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.holdings - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.holdings"; sid:551840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.holdings - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.holdings"; sid:551841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebase.com"; sid:551842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehealth.com"; sid:551843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-honesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-honesty.com"; sid:551844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incanada.com"; sid:551845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19india.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19india.life"; sid:551846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inis.com"; sid:551847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-injury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-injury.com"; sid:551848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmemorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmemorium.com"; sid:551849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmemory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmemory.com"; sid:551850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19innovators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19innovators.com"; sid:551851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19international.com"; sid:551852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19italia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19italia.net"; sid:551853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19king.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19king.com"; sid:551854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19km.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19km.com"; sid:551855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laos.com"; sid:551856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latinoamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latinoamerica.com"; sid:551857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitattorneys.com"; sid:551858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lbs.com"; sid:551859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalconcerns.com"; sid:551860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalconsulting.com"; sid:551861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveinfo.com"; sid:551862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livesmatter.com"; sid:551863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loan.net"; sid:551864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lv.com"; sid:551865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lvsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lvsurvivor.com"; sid:551866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mali.com"; sid:551867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mapdash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mapdash.com"; sid:551868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marmaris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marmaris.com"; sid:551869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskcompany.com"; sid:551870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masksanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masksanitizers.com"; sid:551871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskstore.com"; sid:551872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masksupply.com"; sid:551873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicaldevice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicaldevice.com"; sid:551874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmasksupply.com"; sid:551875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalsupplier.com"; sid:551876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medtech.com"; sid:551877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorium.com"; sid:551878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorium.net"; sid:551879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memoryboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memoryboard.com"; sid:551880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19messageboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19messageboard.com"; sid:551881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meters.com"; sid:551882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19militarysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19militarysupport.com"; sid:551883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mit.com"; sid:551884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moviegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moviegame.com"; sid:551885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mtg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mtg.com"; sid:551886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19muststop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19muststop.com"; sid:551887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutualaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutualaid.com"; sid:551888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutualaidgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutualaidgroup.com"; sid:551889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutualaidgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutualaidgroup.com"; sid:551890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mw.com"; sid:551891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19n95maskssupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19n95maskssupplier.com"; sid:551892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nccoronavirusemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nccoronavirusemploymentlaw.com"; sid:551893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newengland.com"; sid:551894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorksurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorksurvivor.com"; sid:551895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19niches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19niches.com"; sid:551896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nm.com"; sid:551897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19north.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19north.com"; sid:551898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19northwesternmutual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19northwesternmutual.com"; sid:551899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19noticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19noticias.com"; sid:551900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nuveen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nuveen.com"; sid:551901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nuveen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nuveen.com"; sid:551902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nuveen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nuveen.net"; sid:551903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nuveen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nuveen.net"; sid:551904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19off.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19off.com"; sid:551905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19og.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19og.com"; sid:551906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineinfo.com"; sid:551907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinesupplies.com"; sid:551908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinesupplies.com"; sid:551909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ont.com"; sid:551910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opinions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opinions.com"; sid:551911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-or-allergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-or-allergy.com"; sid:551912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outcome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outcome.com"; sid:551913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19package.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19package.com"; sid:551914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pakistan.com"; sid:551915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pause.com"; sid:551916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pause.com"; sid:551917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pawnshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pawnshop.com"; sid:551918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pawnshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pawnshops.com"; sid:551919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19peru.com"; sid:551920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ph.com"; sid:551921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19platform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19platform.com"; sid:551922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19platform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19platform.com"; sid:551923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19playlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19playlist.com"; sid:551924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pledge.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pledge.center"; sid:551925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pod.com"; sid:551926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pod.com"; sid:551927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pods.com"; sid:551928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pods.com"; sid:551929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pregnancy.com"; sid:551930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prevention-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prevention-kit.com"; sid:551931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prevention.net"; sid:551932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19primer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19primer.com"; sid:551933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pros.com"; sid:551934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionshield.com"; sid:551935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionshields.com"; sid:551936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qrpc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qrpc.com"; sid:551937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantineworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantineworkout.com"; sid:551938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19questions.com"; sid:551939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quilt.com"; sid:551940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rader-for-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rader-for-japan.com"; sid:551941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19real.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19real.com"; sid:551942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19record.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19record.com"; sid:551943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refocus.com"; sid:551944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefbill.com"; sid:551945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefbill.com"; sid:551946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rental.com"; sid:551947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentals.com"; sid:551948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentstrike.com"; sid:551949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19report2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19report2020.com"; sid:551950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reviews.com"; sid:551951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safety.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safety.co.uk"; sid:551952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetydecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetydecals.com"; sid:551953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetykit.com"; sid:551954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyproducts.com"; sid:551955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetysolutions.com"; sid:551956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19santizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19santizers.com"; sid:551957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbafunds.com"; sid:551958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbl.com"; sid:551959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screeningtest.com"; sid:551960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningtest.com"; sid:551961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19secret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19secret.com"; sid:551962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfreport.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfreport.education"; sid:551963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19senegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19senegal.com"; sid:551964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serenity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serenity.com"; sid:551965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19share.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19share.com"; sid:551966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shippingoffshore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shippingoffshore.com"; sid:551967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialscience.com"; sid:551968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solidarityresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solidarityresponse.com"; sid:551969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistic.com"; sid:551970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluschecks.com"; sid:551971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluspackage.com"; sid:551972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stl.com"; sid:551973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-studies.com"; sid:551974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studiesgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studiesgroup.com"; sid:551975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sucked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sucked.com"; sid:551976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sucks.net"; sid:551977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19superstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19superstore.com"; sid:551978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-supply-chain-models.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-supply-chain-models.com"; sid:551979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplychainmodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplychainmodels.com"; sid:551980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplylocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplylocator.com"; sid:551981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyltd.com"; sid:551982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyonline.com"; sid:551983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-survivors.com"; sid:551984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptoms.net"; sid:551985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tech.com"; sid:551986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19techsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19techsupport.com"; sid:551987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testes.com"; sid:551988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testinglocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testinglocator.com"; sid:551989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglocator.com"; sid:551990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitshop.com"; sid:551991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitss.com"; sid:551992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitstore.com"; sid:551993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitt.com"; sid:551994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitz.com"; sid:551995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsandmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsandmasks.com"; sid:551996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-shop.com"; sid:551997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thrivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thrivers.com"; sid:551998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tiaabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tiaabank.com"; sid:551999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tiaabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tiaabank.com"; sid:552000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tiaabank.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tiaabank.net"; sid:552001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tiaabank.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tiaabank.net"; sid:552002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tiaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tiaa.com"; sid:552003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tiaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tiaa.com"; sid:552004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tiaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tiaa.net"; sid:552005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tiaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tiaa.net"; sid:552006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toc.com"; sid:552007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackd.com"; sid:552008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transitions.com"; sid:552009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trc.com"; sid:552010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19triagewi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19triagewi.com"; sid:552011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tshirts.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tshirts.life"; sid:552012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usamemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usamemorial.com"; sid:552013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usmap.com"; sid:552014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usvi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usvi.com"; sid:552015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vermont.com"; sid:552016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdata.com"; sid:552017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualizar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualizar.com"; sid:552018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19volunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19volunteer.com"; sid:552019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19volunteering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19volunteering.com"; sid:552020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wecanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wecanhelp.com"; sid:552021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19welfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19welfare.com"; sid:552022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wholesalemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wholesalemasks.com"; sid:552023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19winners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19winners.com"; sid:552024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-workout.com"; sid:552025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-workout.com"; sid:552026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worlds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worlds.com"; sid:552027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldtracker.com"; sid:552028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19xplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19xplained.com"; sid:552029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xplained.com"; sid:552030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yourrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yourrights.com"; sid:552031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zc.com"; sid:552032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019-protect.com"; sid:552033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019rapidtest.com"; sid:552034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.biz"; sid:552035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2023.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2023.com"; sid:552036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20canada.com"; sid:552037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20canada.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20canada.net"; sid:552038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20uk.com"; sid:552039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid30250.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid30250.com"; sid:552040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid615.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid615.com"; sid:552041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccountant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccountant.com"; sid:552042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccounting.com"; sid:552043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadam.com"; sid:552044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadministration.com"; sid:552045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadviser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadviser.com"; sid:552046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagain.com"; sid:552047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagenda.com"; sid:552048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidtrack.com"; sid:552049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidansg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidansg.com"; sid:552050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodies.com"; sid:552051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-appro-auto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-appro-auto.com"; sid:552052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-apps.com"; sid:552053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidash.net"; sid:552054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauditing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauditing.com"; sid:552055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauditor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauditor.com"; sid:552056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauditors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauditors.com"; sid:552057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauditservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauditservice.com"; sid:552058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauditservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauditservices.com"; sid:552059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautofinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautofinancing.com"; sid:552060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautoloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautoloan.com"; sid:552061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautoloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautoloans.com"; sid:552062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidav.com"; sid:552063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaward.com"; sid:552064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawards.com"; sid:552065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbadge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbadge.com"; sid:552066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailoutadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailoutadvisors.com"; sid:552067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailoutcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailoutcalculator.com"; sid:552068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailoutconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailoutconsultants.com"; sid:552069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailouthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailouthelp.com"; sid:552070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblank.com"; sid:552071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtestkit.com"; sid:552072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbolivia.com"; sid:552073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bond.com"; sid:552074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboy.com"; sid:552075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbud.com"; sid:552076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbud.net"; sid:552077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessfinder.com"; sid:552078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessfunds.com"; sid:552079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-businessrelief.com"; sid:552080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalifornia.com"; sid:552081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancelledmywedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancelledmywedding.com"; sid:552082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaredisasterteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaredisasterteam.com"; sid:552083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareforce.com"; sid:552084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.life"; sid:552085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarenassau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarenassau.com"; sid:552086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarenow.com"; sid:552087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareteam.com"; sid:552088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareteam.net"; sid:552089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarloan.com"; sid:552090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarloans.com"; sid:552091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcars.com"; sid:552092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchurchaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchurchaid.com"; sid:552093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchurchaid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchurchaid.net"; sid:552094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclarity.com"; sid:552095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaner19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaner19.com"; sid:552096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsolutions.com"; sid:552097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansafe.com"; sid:552098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclowns.com"; sid:552099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcmp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcmp.com"; sid:552100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommander.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommander.com"; sid:552101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialcredit.com"; sid:552102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommericalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommericalcleaning.com"; sid:552103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommission.com"; sid:552104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplaint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplaint.com"; sid:552105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplaints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplaints.com"; sid:552106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplete.com"; sid:552107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconexions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconexions.com"; sid:552108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfidentiality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfidentiality.com"; sid:552109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconn.com"; sid:552110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnections24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnections24.com"; sid:552111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconscious.com"; sid:552112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstructionsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstructionsigns.com"; sid:552113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumercredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumercredit.com"; sid:552114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracer.com"; sid:552115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolgh.com"; sid:552116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontroltower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontroltower.com"; sid:552117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcordoba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcordoba.com"; sid:552118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorruption.com"; sid:552119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreations.com"; sid:552120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreations.net"; sid:552121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcardrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcardrelief.com"; sid:552122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcrisis.com"; sid:552123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcrunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcrunch.com"; sid:552124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditlenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditlenders.com"; sid:552125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditlending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditlending.com"; sid:552126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditor.com"; sid:552127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditors.com"; sid:552128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrating.com"; sid:552129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditratings.com"; sid:552130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditreport.com"; sid:552131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrisk.com"; sid:552132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrisks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrisks.com"; sid:552133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditscore.com"; sid:552134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditsqueeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditsqueeze.com"; sid:552135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscalmingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscalmingcenter.com"; sid:552136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriticalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriticalcare.com"; sid:552137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrypto.com"; sid:552138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure2020.com"; sid:552139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcured.net"; sid:552140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcybersecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcybersecurity.com"; sid:552141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailyupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailyupdate.com"; sid:552142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddanstaville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddanstaville.com"; sid:552143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddanstaville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddanstaville.net"; sid:552144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathlist.com"; sid:552145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-detector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-detector.com"; sid:552146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiarybcn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiarybcn.com"; sid:552147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddigital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddigital.com"; sid:552148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddistribution.com"; sid:552149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddistributor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddistributor.com"; sid:552150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddistributors.com"; sid:552151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd.net"; sid:552152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-doc.com"; sid:552153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-doka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-doka.com"; sid:552154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddosage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddosage.com"; sid:552155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddose.com"; sid:552156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugcocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugcocktail.com"; sid:552157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugsupply.com"; sid:552158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidee.com"; sid:552159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyfunds.com"; sid:552160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyloan.com"; sid:552161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencuesta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencuesta.com"; sid:552162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenkarterri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenkarterri.com"; sid:552163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidequip.com"; sid:552164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidequipped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidequipped.com"; sid:552165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidequipt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidequipt.com"; sid:552166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-er.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-er.com"; sid:552167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialaf.com"; sid:552168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetector.com"; sid:552169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidethics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidethics.com"; sid:552170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexplore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexplore.com"; sid:552171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaction.com"; sid:552172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfest2020.com"; sid:552173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialaccounting.com"; sid:552174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialaid.com"; sid:552175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialaudit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialaudit.com"; sid:552176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialhelp.com"; sid:552177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialreporting.com"; sid:552178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialreports.com"; sid:552179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialsupport.com"; sid:552180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfl.com"; sid:552181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-forum.com"; sid:552182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebeds.com"; sid:552183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeconstruction.com"; sid:552184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlinehero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlinehero.com"; sid:552185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlineheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlineheroes.com"; sid:552186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfumers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfumers.com"; sid:552187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfumigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfumigation.com"; sid:552188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgel.net"; sid:552189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgigs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgigs.com"; sid:552190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgiving.com"; sid:552191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalhackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalhackathon.com"; sid:552192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrowth.com"; sid:552193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguards.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguards.net"; sid:552194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguideapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguideapp.com"; sid:552195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandle.com"; sid:552196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhawaii.com"; sid:552197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcw.com"; sid:552198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhead.com"; sid:552199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcareresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcareresourcecenter.com"; sid:552200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthemergency.com"; sid:552201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthservice.com"; sid:552202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthservices.com"; sid:552203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthsupply.com"; sid:552204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheloan.com"; sid:552205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheloc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheloc.com"; sid:552206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.network"; sid:552207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpr.com"; sid:552208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hero.com"; sid:552209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhf.com"; sid:552210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhiring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhiring.com"; sid:552211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomedecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomedecon.com"; sid:552212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeowner.com"; sid:552213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeremedies.com"; sid:552214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomes.com"; sid:552215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitallawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitallawsuit.com"; sid:552216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhost.com"; sid:552217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotel.com"; sid:552218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhou.com"; sid:552219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousinggroup.com"; sid:552220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousingservice.com"; sid:552221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousingservices.com"; sid:552222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhugs.com"; sid:552223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidig.com"; sid:552224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidillinois.com"; sid:552225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitycheck.com"; sid:552226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitytest.com"; sid:552227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiainsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiainsights.com"; sid:552228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindustrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindustrial.com"; sid:552229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insuranceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insuranceprotection.com"; sid:552230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestor.com"; sid:552231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestors.com"; sid:552232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirecto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirecto.com"; sid:552233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjail.com"; sid:552234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobfair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobfair.com"; sid:552235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobfinder.com"; sid:552236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid2020.com"; sid:552237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid24.com"; sid:552238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkindness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkindness.net"; sid:552239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidking.com"; sid:552240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkisses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkisses.com"; sid:552241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitmx.com"; sid:552242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabels.com"; sid:552243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabels.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabels.net"; sid:552244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lacaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lacaf.com"; sid:552245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.land - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.land"; sid:552246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleaserelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleaserelief.com"; sid:552247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalclaims.com"; sid:552248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-legalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-legalrights.com"; sid:552249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlens.com"; sid:552250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidletter.com"; sid:552251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidload.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidload.com"; sid:552252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlosangeles.com"; sid:552253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaker.com"; sid:552254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpractice.com"; sid:552255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.care"; sid:552256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksupply.com"; sid:552257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksusa.com"; sid:552258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmass.com"; sid:552259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmdnutraceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmdnutraceuticals.com"; sid:552260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmdviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmdviruskit.com"; sid:552261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-measures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-measures.com"; sid:552262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalexpert.com"; sid:552263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalexperts.com"; sid:552264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalpracticehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalpracticehelp.com"; sid:552265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsupplier.com"; sid:552266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-meds.com"; sid:552267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeltdown.com"; sid:552268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmillion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmillion.com"; sid:552269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgageloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgageloan.com"; sid:552270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgageloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgageloans.com"; sid:552271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmsp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmsp.com"; sid:552272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutualaidgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutualaidgroup.com"; sid:552273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyass.com"; sid:552274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnannies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnannies.com"; sid:552275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnanny.com"; sid:552276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnanny.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnanny.net"; sid:552277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnc.com"; sid:552278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearyou.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearyou.net"; sid:552279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnerd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnerd.com"; sid:552280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewdeal.com"; sid:552281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewjersey.com"; sid:552282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsnetwork.com"; sid:552283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnials.com"; sid:552284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnolaready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnolaready.com"; sid:552285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursecorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursecorp.com"; sid:552286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnurse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnurse.net"; sid:552287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnutraceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnutraceuticals.com"; sid:552288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnuveen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnuveen.com"; sid:552289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnuveen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnuveen.net"; sid:552290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnystate.com"; sid:552291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabel.com"; sid:552292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabeldrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabeldrug.com"; sid:552293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabeldrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabeldrugs.com"; sid:552294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabelmedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabelmedication.com"; sid:552295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabelmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabelmedicine.com"; sid:552296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabelprescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabelprescription.com"; sid:552297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabelprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabelprescriptions.com"; sid:552298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabeltreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabeltreatment.com"; sid:552299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofflabeluse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofflabeluse.com"; sid:552300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidolar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidolar.com"; sid:552301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopedia.com"; sid:552302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoptimizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoptimizer.com"; sid:552303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidozone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidozone.com"; sid:552304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpacks.com"; sid:552305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpalliative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpalliative.com"; sid:552306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicmasks.com"; sid:552307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparties.com"; sid:552308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaymentplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaymentplan.com"; sid:552309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpdx.com"; sid:552310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpenn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpenn.com"; sid:552311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pep.com"; sid:552312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpep.com"; sid:552313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalloan.com"; sid:552314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacysupplies.com"; sid:552315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacywholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacywholesale.com"; sid:552316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanb.com"; sid:552317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidporn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidporn.net"; sid:552318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidportland.com"; sid:552319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositive.net"; sid:552320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidposter.com"; sid:552321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpot.com"; sid:552322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpot.net"; sid:552323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppelawsuit.com"; sid:552324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppelawyer.com"; sid:552325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreneur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreneur.com"; sid:552326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescriber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescriber.com"; sid:552327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescriptions.com"; sid:552328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventandcure.com"; sid:552329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprizes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprizes.com"; sid:552330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprocessing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprocessing.com"; sid:552331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprocurement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprocurement.com"; sid:552332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectshop.com"; sid:552333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquest.com"; sid:552334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrating.com"; sid:552335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidratings.com"; sid:552336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebate.com"; sid:552337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreboundhiring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreboundhiring.com"; sid:552338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreboundjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreboundjobs.com"; sid:552339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreboundstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreboundstaff.com"; sid:552340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreboundstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreboundstaffing.com"; sid:552341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidre.com"; sid:552342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryadvisors.com"; sid:552343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryconsultants.com"; sid:552344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryhelp.com"; sid:552345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryloans.com"; sid:552346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredsupplygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredsupplygear.com"; sid:552347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefbill.com"; sid:552348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefconsulting.com"; sid:552349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefhousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefhousing.com"; sid:552350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefmoney.com"; sid:552351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotework.com"; sid:552352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenaissance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenaissance.com"; sid:552353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenaissance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenaissance.net"; sid:552354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenter.com"; sid:552355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponder.com"; sid:552356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponder.net"; sid:552357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsestations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsestations.com"; sid:552358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretentioncredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretentioncredit.com"; sid:552359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretentiontaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretentiontaxcredit.com"; sid:552360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskcompliance.com"; sid:552361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskinsurance.com"; sid:552362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeid.com"; sid:552363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizersusa.com"; sid:552364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscholars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscholars.com"; sid:552365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscrubandwinlotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscrubandwinlotto.com"; sid:552366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secure-operator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secure-operator.com"; sid:552367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseeindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseeindia.com"; sid:552368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftestkit.com"; sid:552369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorhelp.com"; sid:552370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsguard.net"; sid:552371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield.net"; sid:552372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmbadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmbadvisors.com"; sid:552373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmbconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmbconsultants.com"; sid:552374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmbhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmbhelp.com"; sid:552375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusadvisors.com"; sid:552376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluscalculator.com"; sid:552377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusconsultants.com"; sid:552378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulushelp.com"; sid:552379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluspackage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluspackage.net"; sid:552380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrike.com"; sid:552381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-style.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-style.com"; sid:552382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummary.com"; sid:552383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplierusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplierusa.com"; sid:552384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplylocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplylocator.com"; sid:552385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplystore.com"; sid:552386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxaccounting.com"; sid:552387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxcompliance.com"; sid:552388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxexpert.com"; sid:552389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxexperts.com"; sid:552390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxservice.com"; sid:552391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxservices.com"; sid:552392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterminator.com"; sid:552393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestaz.com"; sid:552394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.center"; sid:552395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsetx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsetx.com"; sid:552396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkits.net"; sid:552397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestuk.com"; sid:552398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteymi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteymi.com"; sid:552399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthegame.com"; sid:552400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiaabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiaabank.com"; sid:552401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiaabank.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiaabank.net"; sid:552402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiaa.com"; sid:552403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiaa.net"; sid:552404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoc.com"; sid:552405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtpa.com"; sid:552406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrak.com"; sid:552407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransitions.com"; sid:552408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.net"; sid:552409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trax.com"; sid:552410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusnews.com"; sid:552411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvets.com"; sid:552412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvets.net"; sid:552413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirginia.com"; sid:552414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruskiller.com"; sid:552415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruskit.com"; sid:552416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusmdkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusmdkit.com"; sid:552417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualisar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualisar.com"; sid:552418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualuzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualuzer.com"; sid:552419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteersbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteersbd.com"; sid:552420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvouchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvouchers.com"; sid:552421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwar.net"; sid:552422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarplan.com"; sid:552423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashington.com"; sid:552424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweed.com"; sid:552425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweed.net"; sid:552426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwelfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwelfare.com"; sid:552427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwholesale.com"; sid:552428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwholesaledrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwholesaledrug.com"; sid:552429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwholesaledrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwholesaledrugs.com"; sid:552430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwholesaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwholesaler.com"; sid:552431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wi.net"; sid:552432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwineteen.com"; sid:552433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkremotely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkremotely.com"; sid:552434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldalerts.com"; sid:552435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyouth.com"; sid:552436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cq-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cq-covid19.com"; sid:552437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craemrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craemrcovid19.com"; sid:552438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityagainstcorona.com"; sid:552439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crecovid.com"; sid:552440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronicasdecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronicasdecorona.com"; sid:552441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronicasdecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronicasdecorona.net"; sid:552442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruzaltacontraocorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruzaltacontraocorona.life"; sid:552443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cucinapandemica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cucinapandemica.com"; sid:552444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadoscovid19.com"; sid:552445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curitibacontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curitibacontraocorona.com"; sid:552446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvshrcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvshrcovidsupport.com"; sid:552447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingageofcorona.com"; sid:552448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingcorona.com"; sid:552449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingtimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingtimeofcorona.com"; sid:552450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dawuhantuan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dawuhantuan.com"; sid:552451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcovid.com"; sid:552452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for declaratie-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"declaratie-covid19.net"; sid:552453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronaquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronaquiz.com"; sid:552454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeat-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeat-covid.com"; sid:552455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovids.com"; sid:552456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltacovid19.com"; sid:552457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deluxepandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deluxepandemickit.com"; sid:552458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designersagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designersagainstcoronavirus.com"; sid:552459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecoronavirus.com"; sid:552460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectiecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectiecorona.com"; sid:552461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitlifecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitlifecovid19.com"; sid:552462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deutschlandgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deutschlandgegencorona.com"; sid:552463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfdubcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfdubcorona.com"; sid:552464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcoronafund.com"; sid:552465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diamundialdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diamundialdelcoronavirus.com"; sid:552466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dirtycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dirtycoronavirus.com"; sid:552467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disabilityandpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disabilityandpandemic.com"; sid:552468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronadisease.com"; sid:552469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dj-corona.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dj-corona.party"; sid:552470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documenting-a-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documenting-a-pandemic.com"; sid:552471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingapandemic.com"; sid:552472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doiqualifyforcoronastimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doiqualifyforcoronastimulus.com"; sid:552473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaim.biz"; sid:552474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcoronavirusclaims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcoronavirusclaims.biz"; sid:552475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doncoronavirus.com"; sid:552476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dumbcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dumbcorona.com"; sid:552477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for durhamfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"durhamfightscovid19.com"; sid:552478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthflowerscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthflowerscorona.com"; sid:552479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidya.com"; sid:552480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edwincoronaramos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edwincoronaramos.com"; sid:552481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effyoucovid19.com"; sid:552482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ehpad-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ehpad-corona.com"; sid:552483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elsalvadorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elsalvadorcovid19.com"; sid:552484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenciascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenciascovid19.com"; sid:552485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadesinfeccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadesinfeccioncoronavirus.com"; sid:552486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encuestacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encuestacovid19.com"; sid:552487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encuestacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encuestacovid.com"; sid:552488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcoronavirus.life"; sid:552489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enpremierelignecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enpremierelignecovid19.com"; sid:552490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entraidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entraidecovid.com"; sid:552491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epiccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epiccoronavirus.com"; sid:552492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicclinic.com"; sid:552493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpost.com"; sid:552494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ericsercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ericsercovid19.com"; sid:552495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erkekcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erkekcovid.com"; sid:552496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapedcovid19.com"; sid:552497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escudocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escudocovid.com"; sid:552498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopianscombatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopianscombatcovid.com"; sid:552499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everyoneagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everyoneagainstcovid19.com"; sid:552500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evvcovidresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evvcovidresponsefund.com"; sid:552501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exterminatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exterminatecorona.com"; sid:552502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcorona.com"; sid:552503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshieldcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshieldcoronavirus.com"; sid:552504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcoronavirus.com"; sid:552505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facingcovid.com"; sid:552506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesfirstcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesfirstcoronavirusresponse.com"; sid:552507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farewellcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farewellcorona.com"; sid:552508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronakit.com"; sid:552509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid.com"; sid:552510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for favelaposcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"favelaposcorona.com"; sid:552511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for favelasemcorona.rio - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"favelasemcorona.rio"; sid:552512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.center"; sid:552513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19virus.com"; sid:552514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialsurvivalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialsurvivalcovid19.com"; sid:552515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingcovid.com"; sid:552516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finger-prickbloodtestsamplesforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finger-prickbloodtestsamplesforcovid-19.com"; sid:552517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingerprickbloodtestsamplesforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingerprickbloodtestsamplesforcovid-19.com"; sid:552518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingerprickcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingerprickcovid-19.com"; sid:552519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingerprickcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingerprickcovid19.com"; sid:552520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finracorona.com"; sid:552521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcovid19.com"; sid:552522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnessincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnessincovid19.com"; sid:552523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flaipercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flaipercovid19.net"; sid:552524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattencovid19.com"; sid:552525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronaclaims.com"; sid:552526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19bankruptcy.com"; sid:552527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19lawsuit.com"; sid:552528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruslawsuit.com"; sid:552529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19bankruptcy.com"; sid:552530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forecastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forecastcovid19.com"; sid:552531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidloans.com"; sid:552532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidshot.com"; sid:552533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidsupplies.com"; sid:552534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidsupply.com"; sid:552535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtesting.com"; sid:552536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtests.com"; sid:552537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtreatment.com"; sid:552538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidvaccine.com"; sid:552539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidvaccines.com"; sid:552540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidvaccineshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidvaccineshot.com"; sid:552541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthatcorona.com"; sid:552542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuhqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuhqcovid19.com"; sid:552543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukcovid.com"; sid:552544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funkcorona.com"; sid:552545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funkcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funkcorona.net"; sid:552546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gagnervscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gagnervscovid19.com"; sid:552547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gdcorona.com"; sid:552548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencoronavirus.com"; sid:552549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gen-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gen-covid.com"; sid:552550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcoronavirus.com"; sid:552551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcoronavirus.net"; sid:552552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genxcovidtank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genxcovidtank.com"; sid:552553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgecovid19.com"; sid:552554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronasmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronasmart.com"; sid:552555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronastimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronastimulus.com"; sid:552556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsmart.com"; sid:552557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidstimulus.com"; sid:552558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global2020pandemic.com"; sid:552559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19summit.com"; sid:552560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicresearchcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicresearchcenter.com"; sid:552561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicresearch.com"; sid:552562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronastats.com"; sid:552563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for go-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"go-corona-virus.com"; sid:552564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidgo.com"; sid:552565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godovercorona.com"; sid:552566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godovercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godovercorona.net"; sid:552567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotyacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotyacovid.com"; sid:552568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govcorona.com"; sid:552569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greaterthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greaterthancovid19.com"; sid:552570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greenageforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greenageforcovid.com"; sid:552571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gwcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gwcovid19testing.com"; sid:552572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gwcovid19testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gwcovid19testing.net"; sid:552573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrisburgcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrisburgcoronaviruslawyer.com"; sid:552574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrisburgcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrisburgcovid19lawyer.com"; sid:552575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haycovidcerca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haycovidcerca.com"; sid:552576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcwcovid.com"; sid:552577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help4covid.com"; sid:552578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronastimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronastimulus.com"; sid:552579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid19usa.com"; sid:552580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidindia.com"; sid:552581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid.com"; sid:552582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmecorona.com"; sid:552583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hemppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hemppandemic.com"; sid:552584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hireawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hireawaycovid.com"; sid:552585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecovid.com"; sid:552586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmrc-refund-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmrc-refund-covid19.com"; sid:552587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hobattutocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hobattutocovid-19.com"; sid:552588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeopathy-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeopathy-covid-19.com"; sid:552589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homesolutionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homesolutionscoronavirus.com"; sid:552590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcovidfund.com"; sid:552591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcovidfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcovidfund.net"; sid:552592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocovid19.com"; sid:552593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hugecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hugecoronavirus.com"; sid:552594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humcocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humcocovid19.com"; sid:552595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humcocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humcocovid19.net"; sid:552596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypotesisaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypotesisaboutcovid19.com"; sid:552597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iacovidess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iacovidess.com"; sid:552598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacovid19survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacovid19survivor.net"; sid:552599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-beat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-beat-corona.com"; sid:552600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid19club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid19club.com"; sid:552601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ichgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ichgegencorona.com"; sid:552602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idreamofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idreamofcovid.com"; sid:552603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iescapedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iescapedcovid19.com"; sid:552604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifacedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifacedcovid19.com"; sid:552605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikilledcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikilledcovid19.com"; sid:552606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikilledthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikilledthecorona.com"; sid:552607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronavirus.com"; sid:552608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19survivor.com"; sid:552609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incentivicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incentivicoronavirus.com"; sid:552610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscorona.life"; sid:552611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiancovid19.com"; sid:552612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectioncorona.com"; sid:552613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectioncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectioncorona.net"; sid:552614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumoscorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumoscorona-virus.com"; sid:552615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internetcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internetcovid-19.com"; sid:552616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcovidornot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcovidornot.com"; sid:552617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itkillscorona.com"; sid:552618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsmymoneycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsmymoneycorona.com"; sid:552619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for japancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"japancorona.com"; sid:552620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jedicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jedicovid19.com"; sid:552621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jedicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jedicovid19.net"; sid:552622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewishresourcescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewishresourcescoronavirus.com"; sid:552623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobpandemic.com"; sid:552624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobspandemic.com"; sid:552625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jogjalawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jogjalawancorona.com"; sid:552626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joyboxxcovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joyboxxcovid19hometestkit.com"; sid:552627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jp-coronavirus.com"; sid:552628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontraelcoronavirus.com"; sid:552629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntossomosmaisfortediganaoacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntossomosmaisfortediganaoacovid19.com"; sid:552630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice-coronavirus.com"; sid:552631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice-covid19.com"; sid:552632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justkillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justkillcorona.com"; sid:552633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kabylie-stopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kabylie-stopcovid-19.com"; sid:552634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kadimaagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kadimaagainstcoronavirus.com"; sid:552635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecovid.com"; sid:552636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecovidvirus.com"; sid:552637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kits4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kits4covid19.com"; sid:552638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95maskcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95maskcoronavirus.com"; sid:552639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95salecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95salecoronavirus.com"; sid:552640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kocovid.com"; sid:552641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuchtocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuchtocorona.com"; sid:552642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronahelp.com"; sid:552643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronainjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronainjury.com"; sid:552644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronalawyer.com"; sid:552645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcoronavirus.com"; sid:552646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lalistacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lalistacovid.com"; sid:552647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laocovid19.com"; sid:552648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcorona.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcorona.legal"; sid:552649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyers4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyers4covid19.com"; sid:552650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ldn-knightscorona-exgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ldn-knightscorona-exgames.com"; sid:552651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leathercovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leathercovidmask.com"; sid:552652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for le-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"le-coronavirus.com"; sid:552653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ledc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ledc-covid19.com"; sid:552654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcovid-19.com"; sid:552655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid-19.com"; sid:552656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lexcovid19.com"; sid:552657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-after-corona.com"; sid:552658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-aftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-aftercovid19.com"; sid:552659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-in-the-times-of-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-in-the-times-of-covid-19.com"; sid:552660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimesofcovid-19.com"; sid:552661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcovid19.net"; sid:552662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronanewsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronanewsindia.com"; sid:552663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronatest.com"; sid:552664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidfestival.com"; sid:552665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingincovid19denial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingincovid19denial.com"; sid:552666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loancovid19.com"; sid:552667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid19.com"; sid:552668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locatecovid.com"; sid:552669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lose-your-covid-19-workout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lose-your-covid-19-workout.com"; sid:552670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostmoneyincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostmoneyincorona.com"; sid:552671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostmoneyincorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostmoneyincorona.net"; sid:552672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveageofcorona.com"; sid:552673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthecoronavirus.com"; sid:552674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.biz"; sid:552675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona-virus.com"; sid:552676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luvinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luvinthetimeofcoronavirus.com"; sid:552677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luvinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luvinthetimeofcovid19.com"; sid:552678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainpp-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainpp-covid19.com"; sid:552679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maisons-de-retraite-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maisons-de-retraite-corona.com"; sid:552680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparas-stop-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparas-stop-coronavirus.com"; sid:552681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingcovid19.com"; sid:552682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacovid.com"; sid:552683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-4-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-4-coronavirus.com"; sid:552684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-anti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-anti-covid19.com"; sid:552685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskengegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskengegencorona.com"; sid:552686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskpandemic.com"; sid:552687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksagainstcoronavirus.com"; sid:552688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-covid.com"; sid:552689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid.com"; sid:552690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquelibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquelibrecovid19.com"; sid:552691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matacovid.com"; sid:552692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maykhukhuancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maykhukhuancovid19.com"; sid:552693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcovid19.com"; sid:552694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.com"; sid:552695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.life"; sid:552696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meandcorona.com"; sid:552697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid.net"; sid:552698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metrocoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metrocoronaviruscleaning.com"; sid:552699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocontracovid.com"; sid:552700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancitycovid19.com"; sid:552701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovidresourcegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovidresourcegroup.com"; sid:552702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindlesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindlesscovid.com"; sid:552703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minhocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minhocovid19.com"; sid:552704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitcoronavirus.com"; sid:552705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitcovid19.com"; sid:552706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacoronavaccine.com"; sid:552707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacoronavirustreatment.com"; sid:552708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneycovid19.com"; sid:552709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moniteurcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moniteurcovid19.com"; sid:552710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mt-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mt-wuhan.com"; sid:552711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for music-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"music-against-corona.com"; sid:552712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicagainstcorona.com"; sid:552713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musik-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musik-gegen-corona.com"; sid:552714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musikgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musikgegencorona.com"; sid:552715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutualaidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutualaidcoronavirus.com"; sid:552716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabavariae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabavariae.com"; sid:552717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-guard.com"; sid:552718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapass.com"; sid:552719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19chronicles.com"; sid:552720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19risk.com"; sid:552721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19studies.com"; sid:552722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19study.com"; sid:552723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmoney.com"; sid:552724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidq.com"; sid:552725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95masksalecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95masksalecoronavirus.com"; sid:552726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nannycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nannycovid.com"; sid:552727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nannycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nannycovid.net"; sid:552728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19essentialbusinesscommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19essentialbusinesscommercialcleaning.com"; sid:552729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nashvillecovid19essentialbusinessescleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nashvillecovid19essentialbusinessescleaning.com"; sid:552730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaim.biz"; sid:552731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusclaims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusclaims.biz"; sid:552732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccoronavirusemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccoronavirusemploymentlaw.com"; sid:552733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19registry.com"; sid:552734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19registry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19registry.net"; sid:552735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcorona.net"; sid:552736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcocovid.com"; sid:552737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronacopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronacopper.com"; sid:552738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidcopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidcopper.com"; sid:552739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noestassoloconelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noestassoloconelcovid.com"; sid:552740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomascovid19.com"; sid:552741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normaliza-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normaliza-covid19.com"; sid:552742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northwesternmutualcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northwesternmutualcoronavirus.com"; sid:552743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northwesternmutualcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northwesternmutualcovid19.com"; sid:552744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notouchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notouchcorona.com"; sid:552745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nottodaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nottodaycovid.com"; sid:552746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nurses4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nurses4covid.com"; sid:552747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursingcovid.com"; sid:552748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencorona.com"; sid:552749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencorona.net"; sid:552750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencoronavirus.com"; sid:552751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencoronavirus.net"; sid:552752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveen-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveen-covid19.com"; sid:552753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid-19.com"; sid:552754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid19.com"; sid:552755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveen-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveen-covid19.net"; sid:552756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid-19.net"; sid:552757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid19.net"; sid:552758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveen-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveen-covid.com"; sid:552759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid.com"; sid:552760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveen-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveen-covid.net"; sid:552761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuveencovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuveencovid.net"; sid:552762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronaviruscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronaviruscompensation.com"; sid:552763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronaviruslawsuit.com"; sid:552764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusbankruptcy.com"; sid:552765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusbk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusbk.com"; sid:552766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruscompensation.com"; sid:552767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusdebtrelief.com"; sid:552768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirushelp.com"; sid:552769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19help.com"; sid:552770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ob-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ob-corona.com"; sid:552771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occufit-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occufit-coronavirus.com"; sid:552772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialwuhanvirus.com"; sid:552773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ogcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ogcovid19.com"; sid:552774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid.net"; sid:552775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklacovid19.com"; sid:552776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oneagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oneagainstcorona.com"; sid:552777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirusservice.com"; sid:552778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourceagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourceagainstcovid19.com"; sid:552779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organiccoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organiccoronakiller.com"; sid:552780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirusbankruptcy.com"; sid:552781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirusbk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirusbk.com"; sid:552782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirusdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirusdebt.com"; sid:552783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirusdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirusdebtrelief.com"; sid:552784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronaviruslawyer.com"; sid:552785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirusrelief.com"; sid:552786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovid19claim.com"; sid:552787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovid19lawyer.com"; sid:552788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovidclaim.com"; sid:552789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for padhaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"padhaicorona.com"; sid:552790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic20twenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic20twenty.com"; sid:552791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicage.com"; sid:552792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaidkit.com"; sid:552793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemica.net"; sid:552794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbailout.com"; sid:552795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbody.com"; sid:552796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbody.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbody.net"; sid:552797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessstimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessstimuluspackage.com"; sid:552798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-care.com"; sid:552799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccbd.com"; sid:552800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchange.com"; sid:552801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.cleaning"; sid:552802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-corona.com"; sid:552803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdrone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdrone.com"; sid:552804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicequipment.com"; sid:552805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicethics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicethics.com"; sid:552806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicethics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicethics.net"; sid:552807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichackathon.com"; sid:552808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichandyman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichandyman.com"; sid:552809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichemp.com"; sid:552810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnationals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnationals.com"; sid:552811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewsnetwork.com"; sid:552812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnow.net"; sid:552813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconmymind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconmymind.com"; sid:552814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemi-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemi-corona.com"; sid:552815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpaintball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpaintball.com"; sid:552816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparty2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparty2020.com"; sid:552817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpets.com"; sid:552818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplumbing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplumbing.com"; sid:552819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoetics.com"; sid:552820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prepper.com"; sid:552821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpricing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpricing.com"; sid:552822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofsolutions.com"; sid:552823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreflection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreflection.com"; sid:552824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelief.fund"; sid:552825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetykits.com"; sid:552826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetymasks.com"; sid:552827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetystore.com"; sid:552828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetystores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetystores.com"; sid:552829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsixpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsixpack.com"; sid:552830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-survivor.com"; sid:552831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-survivor.net"; sid:552832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteachers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteachers.com"; sid:552833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechhack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechhack.com"; sid:552834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthegame.com"; sid:552835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictopivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictopivot.com"; sid:552836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoys.com"; sid:552837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrackers.com"; sid:552838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvent.com"; sid:552839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwineclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwineclub.com"; sid:552840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partenoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partenoncovid.com"; sid:552841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passovercovid19.com"; sid:552842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for payrentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"payrentcorona.com"; sid:552843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pdxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pdxcovid.com"; sid:552844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovid19claim.com"; sid:552845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perucovid.com"; sid:552846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pestcontrolcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pestcontrolcovid19.com"; sid:552847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsandcovid19.com"; sid:552848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcoronavirus.com"; sid:552849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phdpandemic.com"; sid:552850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinkacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinkacorona.com"; sid:552851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pollcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pollcovid19.com"; sid:552852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaarchitecture.com"; sid:552853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.fyi"; sid:552854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaplan.com"; sid:552855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19care.com"; sid:552856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.fyi"; sid:552857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcare.com"; sid:552858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidconnection.com"; sid:552859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicparty.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicparty.co.uk"; sid:552860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid-19signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid-19signs.com"; sid:552861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procme-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procme-covid19.com"; sid:552862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pro-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pro-coronavirus.net"; sid:552863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovid19.com"; sid:552864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcoronadiary.com"; sid:552865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionanimale-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionanimale-covid19.com"; sid:552866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourselfagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourselfagainstcorona.com"; sid:552867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quizcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quizcovid19.com"; sid:552868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceagainstcovid19.com"; sid:552869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rampurfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rampurfightscorona.com"; sid:552870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecovidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecovidstatus.com"; sid:552871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realworld-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realworld-covid19.com"; sid:552872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realwuhanvirus.com"; sid:552873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtshilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtshilfe-corona.com"; sid:552874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtshilfe-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtshilfe-corona.net"; sid:552875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for refugees-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"refugees-corona.com"; sid:552876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for report-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"report-corona.com"; sid:552877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid.net"; sid:552878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourcepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourcepandemic.com"; sid:552879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondingtocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondingtocoronavirus.com"; sid:552880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondingtocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondingtocovid19.com"; sid:552881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ressourcescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ressourcescovid19.com"; sid:552882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantsfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantsfightingcovid.com"; sid:552883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rhgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rhgcovid19.com"; sid:552884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runagainstcorona5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runagainstcorona5k.com"; sid:552885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovidtesting.com"; sid:552886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeincovid.com"; sid:552887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samentegencoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samentegencoronaonline.com"; sid:552888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizercovid19.com"; sid:552889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savannahcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savannahcoronavirus.com"; sid:552890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayno2covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayno2covid-19.com"; sid:552891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronaloancenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronaloancenter.com"; sid:552892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19disasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19disasterloan.com"; sid:552893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloancovid19.com"; sid:552894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scancovid.com"; sid:552895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screen4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screen4covid.com"; sid:552896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwedbycorona.com"; sid:552897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seccorona.com"; sid:552898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcollectioncoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcollectioncoronavirustest.com"; sid:552899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid19tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid19tracking.com"; sid:552900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcorona.com"; sid:552901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellmycovid.com"; sid:552902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendcoronahugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendcoronahugs.com"; sid:552903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendcoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendcoronalove.com"; sid:552904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementcovid19.com"; sid:552905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shabbatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shabbatcovid19.com"; sid:552906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shuncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shuncoronavirus.com"; sid:552907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for silvercoronalining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"silvercoronalining.com"; sid:552908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simscovid.com"; sid:552909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skncorona.com"; sid:552910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slank-adacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slank-adacorona.com"; sid:552911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaycovid.com"; sid:552912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smansafightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smansafightcorona.com"; sid:552913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smilecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smilecoronavirus.com"; sid:552914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smokecovid19out.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smokecovid19out.com"; sid:552915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalpandemicpaintball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalpandemicpaintball.com"; sid:552916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutioncovid.com"; sid:552917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionsforcovid19.com"; sid:552918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solveforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solveforcovid19.com"; sid:552919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparcovidresponse.com"; sid:552920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparrowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparrowcoronavirus.com"; sid:552921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spiritualguidanceforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spiritualguidanceforcoronavirus.com"; sid:552922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadcovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadcovidmap.com"; sid:552923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ssullivancovidpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ssullivancovidpage.com"; sid:552924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovid-19.com"; sid:552925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovid19.com"; sid:552926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovid-19.net"; sid:552927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayfreeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayfreeofcorona.com"; sid:552928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.solutions"; sid:552929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronatiruvallur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronatiruvallur.com"; sid:552930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.fund"; sid:552931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusglobal.com"; sid:552932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.network"; sid:552933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidfaso.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidfaso.net"; sid:552934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppandemic.net"; sid:552935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stormcovidglobalhackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stormcovidglobalhackathon.com"; sid:552936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for streetsmartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"streetsmartcovid19.com"; sid:552937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for streetsmartcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"streetsmartcovid.com"; sid:552938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studycovid-19.com"; sid:552939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studycovid19.com"; sid:552940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplycovid.com"; sid:552941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surfcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surfcorona.com"; sid:552942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipingintheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipingintheageofcorona.com"; sid:552943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipingintheageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipingintheageofcoronavirus.com"; sid:552944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipingintheageofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipingintheageofcovid19.com"; sid:552945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipinginthetimeofcorona.com"; sid:552946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipinginthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipinginthetimeofcoronavirus.com"; sid:552947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swipinginthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swipinginthetimeofcovid19.com"; sid:552948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for take-corona-away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"take-corona-away.com"; sid:552949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talktokidsaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talktokidsaboutcoronavirus.com"; sid:552950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronavirus.com"; sid:552951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenhocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenhocovid19.com"; sid:552952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcorona-ecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcorona-ecuador.com"; sid:552953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-coronavirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-coronavirus.pro"; sid:552954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testescovid19.com"; sid:552955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing4coronavirus.com"; sid:552956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit4coronavirus.com"; sid:552957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnacovid19.com"; sid:552958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnacovid.com"; sid:552959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirusloans.com"; sid:552960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidclaim.com"; sid:552961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidinsurance.com"; sid:552962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidloans.com"; sid:552963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidrelief.com"; sid:552964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2020covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2020covid-19.com"; sid:552965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechronicleofpandemiccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechronicleofpandemiccoronavirus.com"; sid:552966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechronicleofpandemiccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechronicleofpandemiccovid-19.com"; sid:552967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaaward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaaward.com"; sid:552968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaawards.com"; sid:552969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachroniclesvol1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachroniclesvol1.com"; sid:552970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachroniclesvol1.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachroniclesvol1.net"; sid:552971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacleaningservice.com"; sid:552972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacleanup.com"; sid:552973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-effect.com"; sid:552974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaoutbreak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaoutbreak2020.com"; sid:552975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronator.com"; sid:552976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatrack.com"; sid:552977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19award.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19award.com"; sid:552978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19awards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19awards.com"; sid:552979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19cure.net"; sid:552980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19hometest.com"; sid:552981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19masks.com"; sid:552982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19studies.com"; sid:552983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19study.com"; sid:552984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid20site.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid20site.com"; sid:552985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidapi.com"; sid:552986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovididiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovididiots.com"; sid:552987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covidiot.com"; sid:552988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedaythattheworlddefeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedaythattheworlddefeatthecoronavirus.com"; sid:552989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedaythattheworlddefeatthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedaythattheworlddefeatthecovid-19.com"; sid:552990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedeadlycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedeadlycoronavirus.com"; sid:552991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thendofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thendofcovid19.com"; sid:552992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theofficialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theofficialcoronavirus.com"; sid:552993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theofficialwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theofficialwuhanvirus.com"; sid:552994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicofcoronavirus.com"; sid:552995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealwuhanvirus.com"; sid:552996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcorona.com"; sid:552997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcorona.net"; sid:552998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcoronavirus.com"; sid:552999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcoronavirus.net"; sid:553000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabank-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabank-covid19.com"; sid:553001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid-19.com"; sid:553002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid19.com"; sid:553003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabank-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabank-covid19.net"; sid:553004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid-19.net"; sid:553005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid19.net"; sid:553006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabank-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabank-covid.com"; sid:553007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid.com"; sid:553008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabank-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabank-covid.net"; sid:553009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaabankcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaabankcovid.net"; sid:553010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacorona.com"; sid:553011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacorona.net"; sid:553012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacoronavirus.com"; sid:553013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacoronavirus.net"; sid:553014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaa-covid19.com"; sid:553015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid-19.com"; sid:553016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid19.com"; sid:553017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaa-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaa-covid19.net"; sid:553018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid-19.net"; sid:553019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid19.net"; sid:553020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaa-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaa-covid.com"; sid:553021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid.com"; sid:553022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaa-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaa-covid.net"; sid:553023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiaacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiaacovid.net"; sid:553024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tincovid19.com"; sid:553025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforcovid19.com"; sid:553026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoparacovid.com"; sid:553027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontracoronavirus.com"; sid:553028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toncacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toncacovid19.com"; sid:553029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidph.com"; sid:553030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trcovid19.com"; sid:553031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triadcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triadcovidresponse.com"; sid:553032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscovid.com"; sid:553033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovidtest.com"; sid:553034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tunisiaagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tunisiaagainstcorona.com"; sid:553035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tunisiaaginstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tunisiaaginstcorona.com"; sid:553036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twcovid2019.com"; sid:553037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimacorona.com"; sid:553038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undercovidagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undercovidagent.com"; sid:553039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicovid.com"; sid:553040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosxcovid19.com"; sid:553041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaim.biz"; sid:553042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusclaims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusclaims.biz"; sid:553043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedxcovid19.com"; sid:553044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unplugcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unplugcovid19.com"; sid:553045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgence-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgence-corona.com"; sid:553046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronatracker.com"; sid:553047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusclassaction.com"; sid:553048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruslawsuit.com"; sid:553049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19info.com"; sid:553050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19match.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19match.com"; sid:553051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19news.com"; sid:553052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidmap.com"; sid:553053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaim.biz"; sid:553054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusclaims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusclaims.biz"; sid:553055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidgraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidgraphs.com"; sid:553056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacontraelcoronavirus.com"; sid:553057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimasxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimasxcoronavirus.com"; sid:553058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victime-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victime-coronavirus.com"; sid:553059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victime-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victime-covid19.com"; sid:553060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viewcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viewcovid19.com"; sid:553061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteercovid-19.com"; sid:553062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteercovid19.com"; sid:553063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteercovid.com"; sid:553064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscovidunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscovidunited.com"; sid:553065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscovidunited.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscovidunited.net"; sid:553066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtcovid.com"; sid:553067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vyruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vyruscorona.com"; sid:553068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacoronavirushelp.com"; sid:553069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid19help.com"; sid:553070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warriorsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warriorsagainstcoronavirus.com"; sid:553071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watchcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watchcorona.net"; sid:553072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovid19fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovid19fighters.com"; sid:553073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid19club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid19club.com"; sid:553074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid19.net"; sid:553075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weescapedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weescapedcovid19.com"; sid:553076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellbeingincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellbeingincovid19.com"; sid:553077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid19.life"; sid:553078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid19th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid19th.com"; sid:553079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19info.com"; sid:553080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19news.com"; sid:553081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldtestcovid19.com"; sid:553082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldvscovid.com"; sid:553083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwide-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwide-covid19.net"; sid:553084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanaijia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanaijia.com"; sid:553085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbioweapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbioweapon.com"; sid:553086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclanwealth.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclanwealth.management"; sid:553087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandolls.com"; sid:553088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandxb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandxb.com"; sid:553089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjingyan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjingyan.com"; sid:553090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansixunjia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansixunjia.com"; sid:553091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantoys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantoys.net"; sid:553092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanweb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanweb.net"; sid:553093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwiggle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwiggle.com"; sid:553094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwnuveencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwnuveencovid19.com"; sid:553095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwnuveencovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwnuveencovid19.net"; sid:553096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtiaabankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtiaabankcovid19.com"; sid:553097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtiaabankcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtiaabankcovid19.net"; sid:553098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtiaacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtiaacovid19.com"; sid:553099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtiaacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtiaacovid19.net"; sid:553100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xgscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xgscovid19.com"; sid:553101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-trkiye-3ob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-trkiye-3ob.com"; sid:553102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-trkiye-3ob.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-trkiye-3ob.net"; sid:553103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirshaber-7vb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirshaber-7vb.com"; sid:553104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusexpos-qqb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusexpos-qqb.com"; sid:553105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mycovid19expos-okb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mycovid19expos-okb.com"; sid:553106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xoxocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xoxocorona.com"; sid:553107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yotambienperdiconelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yotambienperdiconelcoronavirus.com"; sid:553108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youandcorona.com"; sid:553109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youraustralicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youraustralicovid19.com"; sid:553110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaexpert.com"; sid:553111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19rights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19rights.com"; sid:553112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidexpert.com"; sid:553113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidrights.com"; sid:553114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcovid.com"; sid:553115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhan.net"; sid:553116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecoronacheck.com"; sid:553117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecoronatest.com"; sid:553118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covid.today"; sid:553119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus.ltd"; sid:553120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247coronaadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247coronaadvance.com"; sid:553121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247coronafinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247coronafinance.com"; sid:553122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247coronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247coronaloans.com"; sid:553123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247coronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247coronarelief.com"; sid:553124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4pandemic.com"; sid:553125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 902coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"902coronado.com"; sid:553126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911-corona.com"; sid:553127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadocovid19.com"; sid:553128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosclausulacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosclausulacoronavirus.com"; sid:553129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accioncivilcoronavirus.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accioncivilcoronavirus.legal"; sid:553130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualcoronamap.com"; sid:553131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosgestioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosgestioncoronavirus.com"; sid:553132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosgestioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosgestioncovid19.com"; sid:553133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosnegligenciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosnegligenciacovid.com"; sid:553134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.world"; sid:553135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcoronavirus.solutions"; sid:553136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aivscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aivscovid19.com"; sid:553137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajuda-epidemica.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajuda-epidemica.club"; sid:553138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronaloan.com"; sid:553139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliyuncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliyuncovid19.com"; sid:553140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allo-coronavirus.com"; sid:553141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allocoronavirus.net"; sid:553142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allo-covid19.com"; sid:553143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allocovid19.com"; sid:553144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allovercovid19.com"; sid:553145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafirstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafirstcoronavirus.com"; sid:553146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafirstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafirstcovid-19.com"; sid:553147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafirstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafirstcovid19.com"; sid:553148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafirstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafirstpandemic.com"; sid:553149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanas-contracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanas-contracovid19.com"; sid:553150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanascontracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanascontracovid-19.com"; sid:553151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorenlostiemposdelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorenlostiemposdelcovid.com"; sid:553152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona24.com"; sid:553153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaequipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaequipments.com"; sid:553154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusarmy.com"; sid:553155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusrebellion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusrebellion.com"; sid:553156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19virus.com"; sid:553157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.club"; sid:553158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.expert"; sid:553159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipandemiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipandemiacovid19.com"; sid:553160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aplausoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aplausoscovid-19.com"; sid:553161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apocalypsepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apocalypsepandemic.com"; sid:553162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apocalypticcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apocalypticcoronavirus.com"; sid:553163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apocalypticcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apocalypticcovid19.com"; sid:553164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apocalypticpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apocalypticpandemic.com"; sid:553165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apoioscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apoioscovid19.com"; sid:553166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apparelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apparelcovid19.com"; sid:553167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appreciatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appreciatecorona.com"; sid:553168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescoronavirus.com"; sid:553169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aptekacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aptekacovid.com"; sid:553170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ar-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ar-covid19.com"; sid:553171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artagainstcovid19.com"; sid:553172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askmscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askmscorona.com"; sid:553173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atemschutzmaske-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atemschutzmaske-corona.com"; sid:553174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviscorona.com"; sid:553175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for axudacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"axudacovid.com"; sid:553176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasalavacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasalavacovid19.com"; sid:553177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasarabacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasarabacovid19.com"; sid:553178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirusloan.com"; sid:553179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirusloans.com"; sid:553180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azithromycincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azithromycincovid19.com"; sid:553181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babiescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babiescorona.com"; sid:553182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baby-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baby-corona.com"; sid:553183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahraincoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahraincoronasurvey.com"; sid:553184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrieracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrieracovid19.com"; sid:553185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskincoronavirus.com"; sid:553186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskincovid-19.com"; sid:553187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskincovid19.com"; sid:553188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskin-robbinscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskin-robbinscoronavirus.com"; sid:553189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskinrobbinscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskinrobbinscoronavirus.com"; sid:553190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskin-robbinscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskin-robbinscovid-19.com"; sid:553191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskin-robbinscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskin-robbinscovid19.com"; sid:553192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskinrobbinscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskinrobbinscovid-19.com"; sid:553193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baskinrobbinscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baskinrobbinscovid19.com"; sid:553194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayarealgbtqcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayarealgbtqcovidrelief.com"; sid:553195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona.today"; sid:553196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.wales"; sid:553197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforeandaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforeandaftercorona.com"; sid:553198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovid19.com"; sid:553199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belgiumresistance-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belgiumresistance-covid19.com"; sid:553200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepandemicfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepandemicfree.com"; sid:553201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidtest.com"; sid:553202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercovid19filtration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercovid19filtration.com"; sid:553203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhagcorona.com"; sid:553204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bid-covid.com"; sid:553205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidcovid.com"; sid:553206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcoin4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcoin4covid19.com"; sid:553207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for booksfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"booksfromthepandemic.com"; sid:553208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brcoronavirus.com"; sid:553209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brcovid-19.com"; sid:553210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brcovid19.com"; sid:553211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildacovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildacovidshield.com"; sid:553212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bunnycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bunnycorona.com"; sid:553213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessesagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessesagainstcoronavirus.com"; sid:553214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyebyebyecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyebyebyecorona.com"; sid:553215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19pandemic.com"; sid:553216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidaid.com"; sid:553217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidclaim.com"; sid:553218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidinjury.com"; sid:553219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callawaycovid19.com"; sid:553220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambatpandemic.com"; sid:553221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacorona.com"; sid:553222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacoronaupdate.com"; sid:553223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadavscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadavscovid19.com"; sid:553224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadavscovid.com"; sid:553225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capcorona.com"; sid:553226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capscorona.com"; sid:553227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturing-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturing-corona.com"; sid:553228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturingcorona.com"; sid:553229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretacovid.com"; sid:553230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casecoronavirus.com"; sid:553231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caseofcorona.com"; sid:553232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbncovid19credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbncovid19credit.com"; sid:553233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbncovid19intervention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbncovid19intervention.com"; sid:553234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirussafetycompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirussafetycompliant.com"; sid:553235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chapelhillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chapelhillcoronavirus.com"; sid:553236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid.com"; sid:553237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid.net"; sid:553238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chaucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chaucorona.com"; sid:553239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check-covid-19.com"; sid:553240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmycorona.com"; sid:553241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofthecorona.com"; sid:553242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronavirusconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronavirusconspiracy.com"; sid:553243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusconspiracy.com"; sid:553244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirussettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirussettlement.com"; sid:553245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cibercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cibercovid19.com"; sid:553246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cibercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cibercovid.com"; sid:553247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim4covid19.com"; sid:553248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcovid-19.com"; sid:553249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcovid19.com"; sid:553250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimsforcoronavirus.com"; sid:553251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimsforcovid19.com"; sid:553252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clapscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clapscovid-19.com"; sid:553253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanup-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanup-coronavirus.com"; sid:553254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmycorona.com"; sid:553255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comabtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comabtcorona.com"; sid:553256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comabtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comabtcovid.com"; sid:553257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comingoutofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comingoutofcorona.com"; sid:553258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compensationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compensationcovid19.com"; sid:553259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovid19t-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovid19t-shirts.com"; sid:553260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copewithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copewithcovid-19.com"; sid:553261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovidsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovidsummit.com"; sid:553262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corkskickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corkskickcovid.com"; sid:553263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19distance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19distance.com"; sid:553264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19distancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19distancing.com"; sid:553265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19memes.com"; sid:553266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19memes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19memes.net"; sid:553267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19store.com"; sid:553268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2sale.com"; sid:553269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-360.com"; sid:553270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona411loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona411loan.com"; sid:553271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona5g.com"; sid:553272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-911.com"; sid:553273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadjuster.com"; sid:553274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaafscherming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaafscherming.com"; sid:553275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapplication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapplication.com"; sid:553276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaraby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaraby.com"; sid:553277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarchive.com"; sid:553278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaark.com"; sid:553279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atemschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atemschutzmaske.com"; sid:553280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatemschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatemschutzmaske.com"; sid:553281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaus.com"; sid:553282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababynews.com"; sid:553283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabanking.com"; sid:553284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankingcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankingcrisis.com"; sid:553285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcysupport.com"; sid:553286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegonecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegonecom.com"; sid:553287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabig2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabig2.com"; sid:553288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiratnagar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiratnagar.com"; sid:553289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizrelief.com"; sid:553290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablog.net"; sid:553291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabookdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabookdrive.com"; sid:553292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabroadcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabroadcast.com"; sid:553293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabro.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabro.wtf"; sid:553294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabryggerier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabryggerier.com"; sid:553295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburgers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburgers.com"; sid:553296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessadvance.com"; sid:553297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessideas.com"; sid:553298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronac19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronac19.com"; sid:553299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacable.com"; sid:553300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacache.com"; sid:553301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacackle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacackle.com"; sid:553302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapshield.com"; sid:553303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarefund.com"; sid:553304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaregivers.com"; sid:553305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarekit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarekit.net"; sid:553306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareusa.com"; sid:553307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesworldwide.com"; sid:553308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashadvance.com"; sid:553309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash.com"; sid:553310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicless.com"; sid:553311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningmi.com"; sid:553312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansolutions.com"; sid:553313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclip.com"; sid:553314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclobber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclobber.com"; sid:553315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomicbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomicbooks.com"; sid:553316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommander.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommander.com"; sid:553317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontractlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontractlaw.com"; sid:553318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontroloffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontroloffice.com"; sid:553319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookiecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookiecompany.com"; sid:553320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacov2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacov2.com"; sid:553321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19virusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19virusmasks.com"; sid:553322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacracker.com"; sid:553323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafty.com"; sid:553324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreaked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreaked.com"; sid:553325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacred.com"; sid:553326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisishelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisishelp.com"; sid:553327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrook.com"; sid:553328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrud.com"; sid:553329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrybaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrybaby.com"; sid:553330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactive.com"; sid:553331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacutters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacutters.com"; sid:553332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dad.com"; sid:553333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadad.com"; sid:553334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadataworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadataworld.com"; sid:553335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathsmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathsmatter.com"; sid:553336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevelopments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevelopments.com"; sid:553337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevletyardimi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevletyardimi.com"; sid:553338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadimwit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadimwit.com"; sid:553339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease2019.com"; sid:553340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-domain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-domain.com"; sid:553341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-domain-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-domain-sale.com"; sid:553342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomainsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomainsale.com"; sid:553343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadome.com"; sid:553344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadunce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadunce.com"; sid:553345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaease.com"; sid:553346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyhelp.com"; sid:553347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyrelief.com"; sid:553348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-eu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-eu.com"; sid:553349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacialhair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacialhair.com"; sid:553350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafastsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafastsupplies.com"; sid:553351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafate.com"; sid:553352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafayrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafayrus.com"; sid:553353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeirwsgofalcymdeithasol.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeirwsgofalcymdeithasol.cymru"; sid:553354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafisio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafisio.com"; sid:553355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecampaign.com"; sid:553356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetown.com"; sid:553357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezonefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezonefestival.com"; sid:553358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriday.com"; sid:553359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriendlyjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriendlyjobs.com"; sid:553360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafter.com"; sid:553361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundraise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundraise.com"; sid:553362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gesichtsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gesichtsschutz.com"; sid:553363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagotcha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagotcha.com"; sid:553364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagraphicnovels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagraphicnovels.com"; sid:553365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahardware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahardware.com"; sid:553366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthfitness.com"; sid:553367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheilung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheilung.com"; sid:553368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpco.com"; sid:553369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpwanted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpwanted.com"; sid:553370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfen.net"; sid:553371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hits.com"; sid:553372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholdem.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholdem.club"; sid:553373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecheck.com"; sid:553374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomesupplies.com"; sid:553375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahowl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahowl.com"; sid:553376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidme.com"; sid:553377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiggpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiggpositive.com"; sid:553378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfstoff.com"; sid:553379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiatimes.com"; sid:553380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfos.net"; sid:553381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiot.com"; sid:553382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisvirus.net"; sid:553383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitem.com"; sid:553384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajewelry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajewelry.net"; sid:553385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajim.com"; sid:553386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jio.com"; sid:553387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobless.com"; sid:553388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakavach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakavach.com"; sid:553389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidcompany.com"; sid:553390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsathome.com"; sid:553391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kompakt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kompakt.com"; sid:553392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakosher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakosher.com"; sid:553393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakut.com"; sid:553394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakut.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakut.net"; sid:553395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalayoffs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalayoffs.net"; sid:553396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegs.com"; sid:553397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalertone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalertone.com"; sid:553398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive-feed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive-feed.com"; sid:553399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivenewsapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivenewsapp.com"; sid:553400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloansnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloansnow.com"; sid:553401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lotse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lotse.com"; sid:553402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalotse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalotse.com"; sid:553403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalovestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalovestories.com"; sid:553404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalytics.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalytics.pro"; sid:553405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-maladie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-maladie.com"; sid:553406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mama.com"; sid:553407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaska.com"; sid:553408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskoficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskoficial.com"; sid:553409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskworld.com"; sid:553410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameaning.com"; sid:553411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medaille.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medaille.com"; sid:553412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedaille.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedaille.com"; sid:553413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medaillen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medaillen.com"; sid:553414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedaillen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedaillen.com"; sid:553415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorybook.com"; sid:553416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meter.com"; sid:553417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamindset.com"; sid:553418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mom.com"; sid:553419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamosa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamosa.com"; sid:553420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mum.com"; sid:553421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamundo.com"; sid:553422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundschutzmaske.com"; sid:553423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamundschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamundschutzmaske.com"; sid:553424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-neu-isenburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-neu-isenburg.com"; sid:553425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-neu-isenburg.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-neu-isenburg.net"; sid:553426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-no-baka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-no-baka.com"; sid:553427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotifier.com"; sid:553428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotyourowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotyourowner.com"; sid:553429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanovels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanovels.com"; sid:553430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanut.com"; sid:553431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofmercy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofmercy.com"; sid:553432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaokie.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaokie.club"; sid:553433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoshop.com"; sid:553434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutcome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutcome.com"; sid:553435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pal.com"; sid:553436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemi.com"; sid:553437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaperwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaperwork.com"; sid:553438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayadvance.com"; sid:553439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapie.com"; sid:553440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pilot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pilot.com"; sid:553441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapix.com"; sid:553442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-plague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-plague.com"; sid:553443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplagues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplagues.com"; sid:553444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypseblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypseblog.com"; sid:553445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoop.com"; sid:553446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionusa.com"; sid:553447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofcompanies.com"; sid:553448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproxy.com"; sid:553449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarave.com"; sid:553450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefconnect.com"; sid:553451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefloans.com"; sid:553452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieftigers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieftigers.com"; sid:553453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefund.com"; sid:553454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarescuekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarescuekit.com"; sid:553455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarig.com"; sid:553456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafecare.com"; sid:553457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafecarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafecarekit.com"; sid:553458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safety-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safety-masks.com"; sid:553459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbamoney.com"; sid:553460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasgraphicnovels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasgraphicnovels.com"; sid:553461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashare.com"; sid:553462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashift.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashift.net"; sid:553463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shock.com"; sid:553464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashrink.com"; sid:553465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmovies.com"; sid:553466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocialism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocialism.com"; sid:553467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastalent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastalent.com"; sid:553468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatusmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatusmt.com"; sid:553469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stimulus.com"; sid:553470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stream.com"; sid:553471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresscounseling.com"; sid:553472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesco.com"; sid:553473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesonline.com"; sid:553474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesplus.com"; sid:553475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesstore.com"; sid:553476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurprise.com"; sid:553477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatained.com"; sid:553478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateeshirts.com"; sid:553479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.cloud"; sid:553480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesters.net"; sid:553481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting.biz"; sid:553482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting.cloud"; sid:553483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-violet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-violet.com"; sid:553484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiger.com"; sid:553485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimeco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimeco.com"; sid:553486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimetees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimetees.com"; sid:553487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatotal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatotal.com"; sid:553488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracig.com"; sid:553489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracig.com"; sid:553490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack-idg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack-idg.com"; sid:553491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack-iga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack-iga.com"; sid:553492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trackig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trackig.com"; sid:553493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack-ig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack-ig.com"; sid:553494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackig.com"; sid:553495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack-igm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack-igm.com"; sid:553496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatransformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatransformation.com"; sid:553497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelclub.com"; sid:553498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurdu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurdu.com"; sid:553499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19cure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19cure.biz"; sid:553500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v1.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v1.biz"; sid:553501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-v3.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-v3.biz"; sid:553502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccines.net"; sid:553503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxine.com"; sid:553504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavermont.com"; sid:553505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversicherung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversicherung.net"; sid:553506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictorygardens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictorygardens.net"; sid:553507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictus.com"; sid:553508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictus.world"; sid:553509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid2019.com"; sid:553510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-videos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-videos.com"; sid:553511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral-times.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral-times.today"; sid:553512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirien.com"; sid:553513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviriskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviriskiller.com"; sid:553514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19supplies.com"; sid:553515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19testkits.com"; sid:553516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-actu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-actu.com"; sid:553517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-apocalypse.com"; sid:553518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautoloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautoloans.com"; sid:553519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbahia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbahia.com"; sid:553520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyca.com"; sid:553521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyhelp.com"; sid:553522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyinfo.com"; sid:553523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyinfo.net"; sid:553524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeard.com"; sid:553525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbilgi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbilgi.com"; sid:553526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbills.com"; sid:553527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessadvisory.com"; sid:553528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesshelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesshelper.com"; sid:553529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareforall.com"; sid:553530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarfinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarfinancing.com"; sid:553531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarfinancing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarfinancing.net"; sid:553532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarloans.com"; sid:553533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashhelp.com"; sid:553534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashnow.com"; sid:553535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinaconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinaconspiracy.com"; sid:553536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschineseconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschineseconspiracy.com"; sid:553537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscina.com"; sid:553538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimattorney.com"; sid:553539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsdirect.com"; sid:553540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsline.com"; sid:553541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningco.net"; sid:553542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupcrew.com"; sid:553543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clear.com"; sid:553544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clothing.com"; sid:553545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-dashboard.com"; sid:553546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscpa.com"; sid:553547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditcheck.com"; sid:553548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrediterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrediterror.com"; sid:553549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditfix.com"; sid:553550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditnow.com"; sid:553551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdad.com"; sid:553552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-dashboard.com"; sid:553553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtconsolidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtconsolidation.com"; sid:553554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtconsolidation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtconsolidation.net"; sid:553555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentistnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentistnyc.com"; sid:553556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesk.com"; sid:553557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterrelief.net"; sid:553558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantsolution.com"; sid:553559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdystopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdystopia.com"; sid:553560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicrecovery.com"; sid:553561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-eliminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-eliminator.com"; sid:553562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentassistance.com"; sid:553563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentassistance.net"; sid:553564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentclaims.com"; sid:553565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemplymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemplymentlaw.com"; sid:553566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusengraficos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusengraficos.com"; sid:553567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepicenter.com"; sid:553568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescarekit.com"; sid:553569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescarekit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescarekit.net"; sid:553570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevil.com"; sid:553571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-face-mask.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-face-mask.today"; sid:553572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfhaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfhaloans.com"; sid:553573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfhaloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfhaloans.net"; sid:553574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilingservice.com"; sid:553575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilingservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilingservice.net"; sid:553576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilters.com"; sid:553577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrance.net"; sid:553578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreehome.com"; sid:553579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrontline.com"; sid:553580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgame.net"; sid:553581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentloan.com"; sid:553582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentloan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentloan.net"; sid:553583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentloans.com"; sid:553584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentloans.net"; sid:553585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-graph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-graph.com"; sid:553586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealings.com"; sid:553587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcareprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcareprovider.com"; sid:553588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushh.com"; sid:553589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomehelp.com"; sid:553590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeimprovementtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeimprovementtaskforce.com"; sid:553591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeloans.com"; sid:553592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeloans.net"; sid:553593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeowner.com"; sid:553594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeowner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeowner.net"; sid:553595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeowners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeowners.com"; sid:553596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeowners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeowners.net"; sid:553597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomerefinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomerefinance.com"; sid:553598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomerefinance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomerefinance.net"; sid:553599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.immo - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.immo"; sid:553600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusindia.com"; sid:553601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationnow.com"; sid:553602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-inrealtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-inrealtime.com"; sid:553603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobassistance.com"; sid:553604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobassistance.net"; sid:553605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-journals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-journals.com"; sid:553606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskefalonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskefalonia.com"; sid:553607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskn95.com"; sid:553608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknowledgehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknowledgehub.com"; sid:553609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawnj.com"; sid:553610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyeronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyeronline.com"; sid:553611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyers4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyers4u.com"; sid:553612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalcrisis.com"; sid:553613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifecoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifecoaching.com"; sid:553614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-limit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-limit.com"; sid:553615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live.world"; sid:553616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloangroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloangroup.com"; sid:553617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanspro.com"; sid:553618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-map.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-map.life"; sid:553619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks-usa.com"; sid:553620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-masks.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-masks.world"; sid:553621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mask.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mask.world"; sid:553622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemoirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemoirs.com"; sid:553623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneynow.com"; sid:553624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgageinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgageinfo.com"; sid:553625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturopathy.com"; sid:553626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnettoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnettoyage.com"; sid:553627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews2020.com"; sid:553628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.guru"; sid:553629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandemonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandemonic.com"; sid:553630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemonic.com"; sid:553631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemonium.com"; sid:553632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaperwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaperwork.com"; sid:553633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparties.com"; sid:553634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientresources.com"; sid:553635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaymentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaymentrelief.com"; sid:553636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspaymentrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspaymentrelief.net"; sid:553637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspitch.com"; sid:553638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusporn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusporn.net"; sid:553639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppestore.com"; sid:553640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspy.com"; sid:553641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqueenelizabeth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqueenelizabeth.com"; sid:553642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.red - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.red"; sid:553643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefund.com"; sid:553644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remember.com"; sid:553645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrise.com"; sid:553646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafefood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafefood.com"; sid:553647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetycompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetycompliant.com"; sid:553648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyshield.com"; sid:553649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalesandmarketingtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalesandmarketingtaskforce.com"; sid:553650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitationusa.com"; sid:553651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbafinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbafinancing.com"; sid:553652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselfcheck.com"; sid:553653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoes.com"; sid:553654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoutout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoutout.com"; sid:553655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinesstaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinesstaskforce.com"; sid:553656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulusnow.com"; sid:553657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stories.com"; sid:553658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyworld.com"; sid:553659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorstories.com"; sid:553660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxcheck.com"; sid:553661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tech.com"; sid:553662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit2020.com"; sid:553663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitsale.com"; sid:553664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestok.com"; sid:553665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsale.com"; sid:553666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.services"; sid:553667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustmugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustmugs.com"; sid:553668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdats.com"; sid:553669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusviz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusviz.com"; sid:553670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyley.com"; sid:553671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruw.com"; sid:553672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruz.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruz.club"; sid:553673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisualizar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisualizar.com"; sid:553674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsc.com"; sid:553675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavt.com"; sid:553676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweb.net"; sid:553677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawheel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawheel.com"; sid:553678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawow.com"; sid:553679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazonessolidarios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazonessolidarios.com"; sid:553680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192019.com"; sid:553681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020deathknell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020deathknell.com"; sid:553682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountability.com"; sid:553683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19age.com"; sid:553684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agent777.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agent777.com"; sid:553685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andculture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andculture.com"; sid:553686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andwellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andwellness.com"; sid:553687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyresults.com"; sid:553688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antibodytest.com"; sid:553689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ap.com"; sid:553690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aph.com"; sid:553691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-apocalypse.com"; sid:553692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ataglance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ataglance.com"; sid:553693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-attorneydirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-attorneydirectory.com"; sid:553694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-attorneysatlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-attorneysatlaw.com"; sid:553695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19audio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19audio.com"; sid:553696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19away.com"; sid:553697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azcoalition.com"; sid:553698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backtobasics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backtobasics.com"; sid:553699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyca.com"; sid:553700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barrier.com"; sid:553701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barriers.com"; sid:553702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bestbusinesspractices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bestbusinesspractices.com"; sid:553703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bingo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bingo.net"; sid:553704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bodrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bodrum.com"; sid:553705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boycott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boycott.com"; sid:553706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bulksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bulksupply.com"; sid:553707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessadvisory.com"; sid:553708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessbankruptcy.com"; sid:553709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessdebtrelief.com"; sid:553710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessfunding.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessfunding.today"; sid:553711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessgrants.com"; sid:553712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessgrants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessgrants.net"; sid:553713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinfo.com"; sid:553714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinfo.com"; sid:553715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloanassistance.com"; sid:553716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloanassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloanassistance.net"; sid:553717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business.loans"; sid:553718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloans.net"; sid:553719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessrefocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessrefocus.com"; sid:553720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrelief.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrelief.loans"; sid:553721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-asheville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-asheville.com"; sid:553722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-asheville.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-asheville.net"; sid:553723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms.com"; sid:553724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-losangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-losangeles.com"; sid:553725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-losangeles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-losangeles.net"; sid:553726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms.net"; sid:553727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-northcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-northcarolina.com"; sid:553728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-northcarolina.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-northcarolina.net"; sid:553729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-orangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-orangecounty.com"; sid:553730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-orangecounty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-orangecounty.net"; sid:553731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-sanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-sanfrancisco.com"; sid:553732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-sanfrancisco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-sanfrancisco.net"; sid:553733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19campaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19campaign.com"; sid:553734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19caps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19caps.com"; sid:553735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caretest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caretest.com"; sid:553736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.today"; sid:553737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashhelp.com"; sid:553738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19centre.com"; sid:553739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certification.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certification.biz"; sid:553740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chapter13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chapter13.com"; sid:553741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chapter7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chapter7.com"; sid:553742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19charity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19charity.net"; sid:553743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checker.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checker.life"; sid:553744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chickensoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chickensoup.com"; sid:553745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanser.com"; sid:553746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupcrew.com"; sid:553747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanup.net"; sid:553748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupnow.com"; sid:553749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinical.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinical.solutions"; sid:553750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coalition.com"; sid:553751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coffee.com"; sid:553752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commitment.com"; sid:553753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communities.com"; sid:553754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communitycoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communitycoalition.com"; sid:553755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compare.com"; sid:553756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complex.com"; sid:553757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-confirmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-confirmed.com"; sid:553758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conspiracytheories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conspiracytheories.com"; sid:553759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contractor.com"; sid:553760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaalert.com"; sid:553761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruskits.com"; sid:553762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.corsica - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.corsica"; sid:553763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19couplescoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19couplescoaching.com"; sid:553764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19couplesteletherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19couplesteletherapy.com"; sid:553765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19couplestherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19couplestherapy.com"; sid:553766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureme.com"; sid:553767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dailytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dailytracker.com"; sid:553768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dairy.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dairy.life"; sid:553769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathknell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathknell.com"; sid:553770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debate.com"; sid:553771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decontaminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decontaminate.com"; sid:553772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalresource.com"; sid:553773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalresource.net"; sid:553774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19depot.com"; sid:553775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detective.com"; sid:553776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19digest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19digest.com"; sid:553777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digitalarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digitalarchive.com"; sid:553778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dinnermusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dinnermusic.com"; sid:553779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectingservice.com"; sid:553780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dystopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dystopia.com"; sid:553781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dystopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dystopia.com"; sid:553782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-easy-english-guide-for-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-easy-english-guide-for-today.com"; sid:553783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economicrecovery.com"; sid:553784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elearning.com"; sid:553785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elearning.com"; sid:553786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emergencyfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emergencyfunding.com"; sid:553787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyloans.com"; sid:553788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyloans.net"; sid:553789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyservices.com"; sid:553790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyservices.net"; sid:553791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19encdmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19encdmx.com"; sid:553792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19erased.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19erased.com"; sid:553793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19er.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19er.com"; sid:553794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentia.com"; sid:553795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialaf.com"; sid:553796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exchange.com"; sid:553797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exit.com"; sid:553798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ezchart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ezchart.com"; sid:553799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-faces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-faces.com"; sid:553800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familytoolkit.com"; sid:553801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filingservice.com"; sid:553802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filingservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filingservice.net"; sid:553803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialassistance.com"; sid:553804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financial.com"; sid:553805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstdefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstdefence.com"; sid:553806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19followupcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19followupcare.com"; sid:553807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-formation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-formation.com"; sid:553808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formation.com"; sid:553809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forum.net"; sid:553810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesingles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesingles.com"; sid:553811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundingalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundingalerts.com"; sid:553812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundingmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundingmonitor.com"; sid:553813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraise.com"; sid:553814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundraisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundraisers.com"; sid:553815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gearshop.com"; sid:553816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gem.com"; sid:553817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ghana.com"; sid:553818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalsupplies.com"; sid:553819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalsupplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalsupplies.net"; sid:553820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grandjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grandjury.com"; sid:553821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grandjury.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grandjury.net"; sid:553822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19grants.com"; sid:553823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guatemala.com"; sid:553824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-health.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-health.net"; sid:553825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpnetwork.com"; sid:553826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helps.com"; sid:553827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpspot.com"; sid:553828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpspots.com"; sid:553829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpwanted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpwanted.com"; sid:553830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hg.com"; sid:553831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecheck.com"; sid:553832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homefitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homefitness.com"; sid:553833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehelp.com"; sid:553834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-homelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-homelife.com"; sid:553835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homestore.com"; sid:553836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19horror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19horror.com"; sid:553837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalsupplies.com"; sid:553838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoy.com"; sid:553839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunityband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunityband.com"; sid:553840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impactregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impactregistry.com"; sid:553841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inafrica.com"; sid:553842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19index.com"; sid:553843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-informations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-informations.com"; sid:553844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-infor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-infor.net"; sid:553845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhometestkit.com"; sid:553846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19initiatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19initiatives.com"; sid:553847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19initiatives.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19initiatives.net"; sid:553848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innigeria.com"; sid:553849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-inworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-inworld.com"; sid:553850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iraq.com"; sid:553851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iscancelled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iscancelled.com"; sid:553852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ita.com"; sid:553853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19italia.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19italia.club"; sid:553854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-italy.com"; sid:553855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jewelry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jewelry.com"; sid:553856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jobloss.com"; sid:553857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobsboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobsboard.com"; sid:553858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kleen.com"; sid:553859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kohls.com"; sid:553860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kohls.com"; sid:553861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laredo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laredo.com"; sid:553862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalcrisis.com"; sid:553863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lespremiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lespremiers.com"; sid:553864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19line.com"; sid:553865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livedata.com"; sid:553866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19living.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19living.com"; sid:553867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19madness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19madness.com"; sid:553868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19madness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19madness.com"; sid:553869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makeover.com"; sid:553870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mask.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mask.supply"; sid:553871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskworld.com"; sid:553872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masterclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masterclass.com"; sid:553873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medisupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medisupply.com"; sid:553874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19med.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19med.support"; sid:553875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorybook.com"; sid:553876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movement.com"; sid:553877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musicreliefbyspotify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musicreliefbyspotify.com"; sid:553878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myonie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myonie.com"; sid:553879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nasal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nasal.com"; sid:553880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalhotline.com"; sid:553881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-navigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-navigator.com"; sid:553882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nc.com"; sid:553883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19needs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19needs.com"; sid:553884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nepal.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nepal.support"; sid:553885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nettoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nettoyage.com"; sid:553886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nettoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nettoyage.com"; sid:553887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsflash.com"; sid:553888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-newsroom.com"; sid:553889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsroom.com"; sid:553890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-newsroom.com"; sid:553891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19njpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19njpro.com"; sid:553892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-normal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-normal.com"; sid:553893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19northernireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19northernireland.com"; sid:553894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ottawa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ottawa.com"; sid:553895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19outreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19outreach.com"; sid:553896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemic.net"; sid:553897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemictoomuchworldofpain.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemictoomuchworldofpain.cloud"; sid:553898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemonic.com"; sid:553899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemonic.com"; sid:553900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemonium.com"; sid:553901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemonium.com"; sid:553902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19papua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19papua.com"; sid:553903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parties.com"; sid:553904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pins.com"; sid:553905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19planet.com"; sid:553906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19police.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19police.com"; sid:553907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-portal.com"; sid:553908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-portal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-portal.net"; sid:553909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-positivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-positivity.com"; sid:553910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pred.com"; sid:553911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19predict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19predict.com"; sid:553912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prestamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prestamos.com"; sid:553913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19projects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19projects.com"; sid:553914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projects.com"; sid:553915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protec.com"; sid:553916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectioncanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectioncanada.com"; sid:553917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protections.com"; sid:553918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionusa.com"; sid:553919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pv.com"; sid:553920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinegames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinegames.com"; sid:553921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapid-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapid-test-kit.com"; sid:553922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reality.com"; sid:553923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryloans.com"; sid:553924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-register4assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-register4assessment.com"; sid:553925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registered.com"; sid:553926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefdirectory.com"; sid:553927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefstimulus.com"; sid:553928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembered.com"; sid:553929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19removal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19removal.net"; sid:553930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19removed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19removed.com"; sid:553931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescuekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescuekit.com"; sid:553932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescueteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescueteam.com"; sid:553933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratoryaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratoryaid.com"; sid:553934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19returns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19returns.com"; sid:553935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19returns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19returns.com"; sid:553936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revolution.com"; sid:553937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rns.com"; sid:553938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rns.com"; sid:553939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19robots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19robots.com"; sid:553940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sars.com"; sid:553941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sars.com"; sid:553942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sars-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sars-coronavirus.com"; sid:553943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sars-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sars-test-kit.com"; sid:553944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sarstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sarstestkit.com"; sid:553945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sars-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sars-test-kits.com"; sid:553946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sarstestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sarstestkits.com"; sid:553947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaattorneys.com"; sid:553948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbafinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbafinancing.com"; sid:553949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sba-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sba-loans.com"; sid:553950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-scan.com"; sid:553951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-self-defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-self-defense.com"; sid:553952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfreport.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfreport.community"; sid:553953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfreport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfreport.net"; sid:553954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftest.net"; sid:553955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shield.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shield.net"; sid:553956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shields.com"; sid:553957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shoes.com"; sid:553958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shortagestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shortagestore.com"; sid:553959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19silverlining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19silverlining.com"; sid:553960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19silverlinings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19silverlinings.com"; sid:553961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smelltaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smelltaste.com"; sid:553962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19songs.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19songs.club"; sid:553963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19songs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19songs.com"; sid:553964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19songs.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19songs.life"; sid:553965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sound.com"; sid:553966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southafrica.com"; sid:553967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-spain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-spain.com"; sid:553968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stat.com"; sid:553969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stim.com"; sid:553970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusbill.com"; sid:553971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulushelp.com"; sid:553972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suckssticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suckssticker.com"; sid:553973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyhelp.com"; sid:553974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplynetwork.com"; sid:553975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supports.com"; sid:553976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsstories.com"; sid:553977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomscensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomscensus.com"; sid:553978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxamnesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxamnesty.com"; sid:553979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxamnesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxamnesty.com"; sid:553980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxamnestyprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxamnestyprogram.com"; sid:553981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxamnestyprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxamnestyprogram.com"; sid:553982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxcredits.com"; sid:553983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-teamrefocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-teamrefocus.com"; sid:553984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tech.com"; sid:553985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tents.com"; sid:553986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdatabase.com"; sid:553987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testit.com"; sid:553988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-kits.com"; sid:553989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testkitten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testkitten.com"; sid:553990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testmalta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testmalta.com"; sid:553991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testme.com"; sid:553992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testyourself.com"; sid:553993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theband.com"; sid:553994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-toolkit.com"; sid:553995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracker.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracker.info"; sid:553996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trackers.com"; sid:553997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transmission.com"; sid:553998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ultrasound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ultrasound.com"; sid:553999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ultrasound.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ultrasound.net"; sid:554000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uncovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uncovered.com"; sid:554001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19universities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19universities.com"; sid:554002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19us.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19us.life"; sid:554003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19valuesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19valuesets.com"; sid:554004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vent.com"; sid:554005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vent.com"; sid:554006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ventilator.com"; sid:554007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ventilators.com"; sid:554008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vent.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vent.net"; sid:554009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vent.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vent.net"; sid:554010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushometest.com"; sid:554011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusrelief.com"; sid:554012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusselfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusselfcheck.com"; sid:554013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualisar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualisar.com"; sid:554014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wales.com"; sid:554015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warningsys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warningsys.com"; sid:554016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellbeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellbeing.com"; sid:554017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-world.com"; sid:554018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19world.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19world.today"; sid:554019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wristband.com"; sid:554020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019india.com"; sid:554021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.biz"; sid:554022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.group"; sid:554023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20masks.com"; sid:554024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2.net"; sid:554025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9clean.com"; sid:554026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9protection.com"; sid:554027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactivitylog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactivitylog.com"; sid:554028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvocate.com"; sid:554029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagainsthumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagainsthumanity.com"; sid:554030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-age.com"; sid:554031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalyser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalyser.com"; sid:554032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalyzer.com"; sid:554033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcovid.com"; sid:554034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangel.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangel.club"; sid:554035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-app-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-app-alert.com"; sid:554036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp-alert.com"; sid:554037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappalert.com"; sid:554038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-app.com"; sid:554039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassassin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassassin.com"; sid:554040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorney.net"; sid:554041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneynyc.com"; sid:554042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneyny.com"; sid:554043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaudio.com"; sid:554044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-away.com"; sid:554045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-baby.com"; sid:554046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbell.com"; sid:554047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidberlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidberlin.com"; sid:554048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbills.com"; sid:554049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbisualizer.com"; sid:554050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizloans.com"; sid:554051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloc.com"; sid:554052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonus.com"; sid:554053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboomer.com"; sid:554054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bot.com"; sid:554055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbucks.com"; sid:554056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessbankruptcy.com"; sid:554057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessdebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessdebtrelief.com"; sid:554058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessfunding.com"; sid:554059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessgrant.com"; sid:554060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesshub.com"; sid:554061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusiness.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusiness.support"; sid:554062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcacerolazo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcacerolazo.net"; sid:554063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcafe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcafe.club"; sid:554064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cam.com"; sid:554065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepack.com"; sid:554066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaretest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaretest.com"; sid:554067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.today"; sid:554068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcases.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcases.today"; sid:554069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheatsheet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheatsheet.com"; sid:554070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcisualizer.com"; sid:554071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanco.com"; sid:554072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancolorado.com"; sid:554073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancrew.com"; sid:554074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleandenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleandenver.com"; sid:554075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaned.com"; sid:554076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clean.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clean.life"; sid:554077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleen.com"; sid:554078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcllr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcllr.com"; sid:554079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcllrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcllrs.com"; sid:554080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoaches.com"; sid:554081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackpgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackpgh.com"; sid:554082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanies.com"; sid:554083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanies.net"; sid:554084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplex.com"; sid:554085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomputer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomputer.com"; sid:554086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomputer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomputer.net"; sid:554087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfessionals.com"; sid:554088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-connector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-connector.com"; sid:554089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultations.com"; sid:554090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovidcovid.com"; sid:554091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcre.com"; sid:554092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisfund.com"; sid:554093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcross.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcross.com"; sid:554094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuba.com"; sid:554095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcube.com"; sid:554096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomproducts.com"; sid:554097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddaybyday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddaybyday.com"; sid:554098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddayxday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddayxday.com"; sid:554099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-delivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-delivery.com"; sid:554100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddemocrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddemocrew.com"; sid:554101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiversions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiversions.com"; sid:554102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocstories.com"; sid:554103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconsult.com"; sid:554104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedwestand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedwestand.com"; sid:554105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideinformation.com"; sid:554106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eliminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eliminator.com"; sid:554107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideliminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideliminator.com"; sid:554108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelivery.com"; sid:554109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyloans.com"; sid:554110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyloans.net"; sid:554111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo.club"; sid:554112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideographer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideographer.com"; sid:554113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideolawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideolawyer.com"; sid:554114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideopals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideopals.com"; sid:554115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentials.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentials.today"; sid:554116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eu.com"; sid:554117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictionhelp.com"; sid:554118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexo.com"; sid:554119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshields.com"; sid:554120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix.net"; sid:554121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluvaccine.com"; sid:554122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeclean.com"; sid:554123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecleaning.com"; sid:554124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemask.com"; sid:554125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlinepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlinepro.com"; sid:554126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgains.com"; sid:554127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgearshop.com"; sid:554128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgetout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgetout.com"; sid:554129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-grief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-grief.com"; sid:554130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhackers.com"; sid:554131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhardos.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhardos.club"; sid:554132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealp.com"; sid:554133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcheck.com"; sid:554134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnetwork.com"; sid:554135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-heroes.com"; sid:554136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecare.com"; sid:554137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoodie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoodie.com"; sid:554138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoodie.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoodie.mobi"; sid:554139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoodie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoodie.net"; sid:554140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhunters.com"; sid:554141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidians.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidians.net"; sid:554142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-id.com"; sid:554143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidid-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidid-us.com"; sid:554144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididus.com"; sid:554145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-igxpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-igxpress.com"; sid:554146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityband.com"; sid:554147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-india.com"; sid:554148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfocard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfocard.com"; sid:554149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformationtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformationtesting.com"; sid:554150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.today"; sid:554151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestmenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestmenthelp.com"; sid:554152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot2020.com"; sid:554153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidision.com"; sid:554154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjewelry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjewelry.com"; sid:554155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kid.net"; sid:554156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidshelp.com"; sid:554157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkohls.com"; sid:554158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuit.net"; sid:554159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidled.com"; sid:554160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidless.com"; sid:554161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlettershome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlettershome.com"; sid:554162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlibre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlibre.com"; sid:554163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlive.net"; sid:554164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanattorneys.com"; sid:554165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanlaw.com"; sid:554166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansnow.com"; sid:554167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocalcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocalcommunity.com"; sid:554168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlysis.com"; sid:554169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmania.com"; sid:554170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-map.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-map.world"; sid:554171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingplan.com"; sid:554172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.supply"; sid:554173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicaleducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicaleducation.com"; sid:554174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalequipment.com"; sid:554175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorial.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorial.world"; sid:554176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemories.com"; sid:554177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmisinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmisinfo.com"; sid:554178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobcg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobcg.com"; sid:554179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodcg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodcg.com"; sid:554180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodelingproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodelingproject.com"; sid:554181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonitor.net"; sid:554182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonitors.com"; sid:554183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnanoclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnanoclean.com"; sid:554184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-navigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-navigator.com"; sid:554185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnazi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnazi.com"; sid:554186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-net.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-net.com"; sid:554187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsmap.com"; sid:554188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidng19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidng19.com"; sid:554189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidng.com"; sid:554190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidodo.com"; sid:554191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonenine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonenine2020.com"; sid:554192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pakistan.com"; sid:554193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicstore.com"; sid:554194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pocxpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pocxpress.com"; sid:554195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-poster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-poster.com"; sid:554196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-posters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-posters.com"; sid:554197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpozuelo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpozuelo.com"; sid:554198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpray.com"; sid:554199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventpac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventpac.com"; sid:554200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevo.com"; sid:554201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofiles.com"; sid:554202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofiteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofiteers.com"; sid:554203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofplan.com"; sid:554204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpure.com"; sid:554205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqq.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqq.club"; sid:554206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqq.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqq.life"; sid:554207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqqonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqqonline.com"; sid:554208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqqonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqqonline.net"; sid:554209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidracing.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidracing.club"; sid:554210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradiology.com"; sid:554211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremote.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremote.care"; sid:554212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescuekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescuekit.com"; sid:554213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resource-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resource-map.com"; sid:554214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resource-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resource-map.net"; sid:554215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-response.com"; sid:554216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsefund.com"; sid:554217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.services"; sid:554218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestaffing.com"; sid:554219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestaffing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestaffing.net"; sid:554220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.net"; sid:554221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyposter.com"; sid:554222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyposters.com"; sid:554223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sba-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sba-loans.com"; sid:554224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreens.com"; sid:554225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreens.net"; sid:554226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreentest.com"; sid:554227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfcare.com"; sid:554228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsepush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsepush.com"; sid:554229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserum.com"; sid:554230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheild.com"; sid:554231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheild.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheild.net"; sid:554232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskunkworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskunkworks.com"; sid:554233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmelltest.com"; sid:554234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsms.com"; sid:554235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnitch.com"; sid:554236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialhour.com"; sid:554237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsound.com"; sid:554238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsource.com"; sid:554239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstarterpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstarterpack.com"; sid:554240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluscheck.com"; sid:554241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluschecks.com"; sid:554242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stimulus-navigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stimulus-navigator.com"; sid:554243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluswatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluswatch.com"; sid:554244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluswatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluswatch.net"; sid:554245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stop.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stop.pro"; sid:554246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstruck.com"; sid:554247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.style"; sid:554248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplychains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplychains.com"; sid:554249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplynetwork.com"; sid:554250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalguides.com"; sid:554251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalkits.com"; sid:554252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-syndicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-syndicate.com"; sid:554253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyndicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyndicate.com"; sid:554254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteaching.com"; sid:554255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdatabase.com"; sid:554256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttoday.com"; sid:554257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheme.com"; sid:554258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtourism.com"; sid:554259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtourist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtourist.com"; sid:554260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtours.com"; sid:554261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingapp.com"; sid:554262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidualizer.com"; sid:554263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunion.com"; sid:554264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurdu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurdu.com"; sid:554265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.vacations - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.vacations"; sid:554266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaluesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaluesets.com"; sid:554267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaluesets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaluesets.net"; sid:554268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviaualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviaualizer.com"; sid:554269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virtualconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virtualconference.com"; sid:554270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.guru"; sid:554271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus-mask.com"; sid:554272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusrelief.com"; sid:554273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisaulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisaulizer.com"; sid:554274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvissualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvissualizer.com"; sid:554275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuailzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuailzer.com"; sid:554276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuaizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuaizer.com"; sid:554277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualier.com"; sid:554278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualixer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualixer.com"; sid:554279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualiza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualiza.com"; sid:554280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizee.com"; sid:554281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizers.com"; sid:554282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizet.com"; sid:554283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizr.com"; sid:554284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizrr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizrr.com"; sid:554285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizwr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizwr.com"; sid:554286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuallizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuallizer.com"; sid:554287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualoser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualoser.com"; sid:554288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualozar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualozar.com"; sid:554289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualozer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualozer.com"; sid:554290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualzer.com"; sid:554291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisulizar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisulizar.com"; sid:554292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuslizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuslizer.com"; sid:554293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisyalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisyalizer.com"; sid:554294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviualizer.com"; sid:554295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvn.com"; sid:554296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoice.com"; sid:554297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvosualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvosualizer.com"; sid:554298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvsualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvsualizer.com"; sid:554299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvusualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvusualizer.com"; sid:554300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwords.com"; sid:554301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworklog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworklog.com"; sid:554302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplace.com"; sid:554303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplaceposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplaceposter.com"; sid:554304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplaceposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplaceposters.com"; sid:554305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldteam.com"; sid:554306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristband.com"; sid:554307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristband.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristband.net"; sid:554308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackedbycorona.com"; sid:554309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craftersagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craftersagainstcovid19.com"; sid:554310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crappycoronavirushousewife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crappycoronavirushousewife.com"; sid:554311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cricketvscorona.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cricketvscorona.co.uk"; sid:554312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisteam-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisteam-covid19.com"; sid:554313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdsourcedcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdsourcedcovidresponse.com"; sid:554314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct-covid-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct-covid-ai.com"; sid:554315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidtesting.com"; sid:554316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for databasecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"databasecovid-19.com"; sid:554317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataforcorona.com"; sid:554318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataforcovid19.com"; sid:554319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for day-after-corona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"day-after-corona-covid.com"; sid:554320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysofwineandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysofwineandcorona.com"; sid:554321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddcoronavirus.com"; sid:554322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddcovid-19.com"; sid:554323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddcovid19.com"; sid:554324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminatecovid-19.com"; sid:554325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-covid19.com"; sid:554326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-covid.com"; sid:554327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminationcovid.com"; sid:554328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronavirus19.com"; sid:554329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deisinfection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deisinfection-covid.com"; sid:554330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dercoronaeffekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dercoronaeffekt.com"; sid:554331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirus.net"; sid:554332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionylimpiezacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionylimpiezacoronavirus.com"; sid:554333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecioncovid19.com"; sid:554334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacoronavirus.com"; sid:554335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncovid19.com"; sid:554336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidtesting.com"; sid:554337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dianejohncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dianejohncovid.com"; sid:554338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dichcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dichcovid19.com"; sid:554339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didtrumpcallcoronavirusahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didtrumpcallcoronavirusahoax.com"; sid:554340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dietkhuancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dietkhuancovid.com"; sid:554341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorceinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorceinthetimeofcorona.com"; sid:554342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovidtest.com"; sid:554343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnkncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnkncoronavirus.com"; sid:554344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnkncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnkncovid-19.com"; sid:554345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnkncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnkncovid19.com"; sid:554346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecoronavirus.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecoronavirus.chat"; sid:554347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovid19.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovid19.chat"; sid:554348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovid.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovid.chat"; sid:554349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacovid19.com"; sid:554350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateyourcoronabucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateyourcoronabucks.com"; sid:554351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for don-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"don-coronavirus.com"; sid:554352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donecovid.com"; sid:554353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dons-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dons-coronavirus.com"; sid:554354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dopocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dopocorona.com"; sid:554355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dr2drcovidzim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dr2drcovidzim.com"; sid:554356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugsincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugsincovid19.com"; sid:554357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkincoronavirus.com"; sid:554358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkincovid-19.com"; sid:554359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkincovid19.com"; sid:554360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkin-donutscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkin-donutscoronavirus.com"; sid:554361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkindonutscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkindonutscoronavirus.com"; sid:554362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkin-donutscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkin-donutscovid-19.com"; sid:554363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkin-donutscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkin-donutscovid19.com"; sid:554364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkindonutscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkindonutscovid-19.com"; sid:554365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dunkindonutscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dunkindonutscovid19.com"; sid:554366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcovid.com"; sid:554367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economicepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economicepidemic.com"; sid:554368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for econopandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"econopandemics.com"; sid:554369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorenlostiemposdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorenlostiemposdelcovid19.com"; sid:554370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcovid19virus.com"; sid:554371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elearningcovid19-aphp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elearningcovid19-aphp.com"; sid:554372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elearningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elearningcovid19.com"; sid:554373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenciacovid19.com"; sid:554374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronavirusmasks.com"; sid:554375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidusa.com"; sid:554376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enewscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enewscoronavirus.com"; sid:554377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.center"; sid:554378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccloud.com"; sid:554379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdoctor.com"; sid:554380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsafe.com"; sid:554381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictest.com"; sid:554382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecovid19now.com"; sid:554383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eritreacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eritreacovid-19.com"; sid:554384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etccovid.com"; sid:554385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everybodyvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everybodyvscovid.com"; sid:554386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for excovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"excovid19.com"; sid:554387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exocovid.com"; sid:554388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecovid19.com"; sid:554389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcorona.com"; sid:554390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronabizloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronabizloans.com"; sid:554391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19loans.com"; sid:554392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearthewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearthewuhan.com"; sid:554393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffp1coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffp1coronavirusmask.com"; sid:554394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffp2coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffp2coronavirusmask.com"; sid:554395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffp3coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffp3coronavirusmask.com"; sid:554396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffpcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffpcoronavirusmask.com"; sid:554397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fieldnotesfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fieldnotesfromthepandemic.com"; sid:554398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight2corona.com"; sid:554399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-against-corona.com"; sid:554400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.biz"; sid:554401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusshirts.com"; sid:554402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidfrontline.com"; sid:554403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidfrontline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidfrontline.net"; sid:554404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingthenextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingthenextcorona.com"; sid:554405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmcovid-19.com"; sid:554406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmcovid19.com"; sid:554407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacoviddentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacoviddentist.com"; sid:554408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronaviruslawyer.com"; sid:554409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid-19.com"; sid:554410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirusclaim.com"; sid:554411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirusclaims.com"; sid:554412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidclaim.com"; sid:554413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidinjury.com"; sid:554414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19claim.com"; sid:554415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flycovid.com"; sid:554416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fopcovid19.com"; sid:554417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fopcovid19.net"; sid:554418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcovid19.com"; sid:554419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fr-covid19.com"; sid:554420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19healthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19healthcheck.com"; sid:554421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidservices.com"; sid:554422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcovid-19.com"; sid:554423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcovid19.com"; sid:554424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocovid411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocovid411.com"; sid:554425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocovidaid.com"; sid:554426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona2020.com"; sid:554427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcorona.club"; sid:554428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronatips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronatips.com"; sid:554429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavirusshirts.com"; sid:554430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundcovid.com"; sid:554431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundforcovid19.com"; sid:554432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundraiseforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundraiseforcovid19.com"; sid:554433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funeralcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funeralcorona.com"; sid:554434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuoricorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuoricorona.com"; sid:554435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamecoronavirus.com"; sid:554436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaylordpoppcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaylordpoppcovid19.com"; sid:554437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidchat.com"; sid:554438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gesichtsschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gesichtsschutz-corona.com"; sid:554439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronainfo.com"; sid:554440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusloan.com"; sid:554441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusloans.com"; sid:554442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19care.com"; sid:554443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidtracker.com"; sid:554444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpeacecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpeacecovid-19.com"; sid:554445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpeacecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpeacecovid19.com"; sid:554446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.life"; sid:554447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.com"; sid:554448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewsoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewsoncorona.com"; sid:554449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govpandemic.com"; sid:554450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for granvillecovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"granvillecovidaid.com"; sid:554451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gryphoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gryphoncovid19.com"; sid:554452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gvcovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gvcovidaid.com"; sid:554453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrisburgcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrisburgcoronavirus.com"; sid:554454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrisburgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrisburgcovid19.com"; sid:554455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcovid.com"; sid:554456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcovid-19.com"; sid:554457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcovid.com"; sid:554458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingforcoronavirus.com"; sid:554459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingforcovid19.com"; sid:554460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helenacovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helenacovid19resources.com"; sid:554461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help2covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help2covid-19.com"; sid:554462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronavictims.com"; sid:554463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingbusinessessurvivethruandthriveaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingbusinessessurvivethruandthriveaftercovid-19.com"; sid:554464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmecovid19.com"; sid:554465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-stop-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-stop-corona.com"; sid:554466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.community"; sid:554467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.healthcare"; sid:554468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.international"; sid:554469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.today"; sid:554470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid.world"; sid:554471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpteam-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpteam-covid19.com"; sid:554472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroes4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroes4corona.com"; sid:554473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescontraelcovid.com"; sid:554474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescoronavirus.com"; sid:554475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescovid.com"; sid:554476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historiasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historiasdelcoronavirus.com"; sid:554477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holycorona.com"; sid:554478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecheckcorona.com"; sid:554479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecheckcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecheckcorona.net"; sid:554480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronascreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronascreen.com"; sid:554481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronascreening.com"; sid:554482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homereliefcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homereliefcovid19.com"; sid:554483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotline-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotline-covid-19.com"; sid:554484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houseboundbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houseboundbycovid19.com"; sid:554485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howicuredmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howicuredmycorona.com"; sid:554486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodjduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodjduringcoronavirus.com"; sid:554487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hpcovid19.com"; sid:554488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hsscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hsscovid.com"; sid:554489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hvpcovid.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hvpcovid.report"; sid:554490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid.net"; sid:554491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifigetcoronaigetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifigetcoronaigetcorona.com"; sid:554492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifoughtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifoughtcorona.com"; sid:554493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatethecoronavirus.com"; sid:554494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecovid.club"; sid:554495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid19responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid19responsefund.com"; sid:554496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid19responsefund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid19responsefund.net"; sid:554497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidhome.com"; sid:554498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inbound-corona-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inbound-corona-support.com"; sid:554499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacoronavirusnews.com"; sid:554500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovidfund.com"; sid:554501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightcovid19.com"; sid:554502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiaincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiaincovid19.com"; sid:554503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for india-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"india-vs-corona.com"; sid:554504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovids19.com"; sid:554505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informecovid19.com"; sid:554506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoscovid19-bf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoscovid19-bf.com"; sid:554507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infotomellosocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infotomellosocovid19.com"; sid:554508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspectifycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspectifycovid.com"; sid:554509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19tests.com"; sid:554510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronaover.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronaover.net"; sid:554511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusoveryet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusoveryet.com"; sid:554512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthepandemicoveryet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthepandemicoveryet.com"; sid:554513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-corona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-corona-covid.com"; sid:554514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jackscoronatips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jackscoronatips.com"; sid:554515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksontncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksontncovid.com"; sid:554516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewelrycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewelrycorona.com"; sid:554517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewelrycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewelrycovid19.com"; sid:554518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsaftercorona.com"; sid:554519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jsparedes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jsparedes-covid19.com"; sid:554520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jumpforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jumpforcovid.com"; sid:554521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kampfgegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kampfgegencorona.com"; sid:554522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karenscoronacopingproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karenscoronacopingproject.com"; sid:554523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khaosancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khaosancovid19.com"; sid:554524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khukhuancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khukhuancovid.com"; sid:554525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khutrungcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khutrungcovid-19.com"; sid:554526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickingcovid19.com"; sid:554527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killedcoronavirus.com"; sid:554528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercovid.com"; sid:554529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit4testingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit4testingcovid19.com"; sid:554530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticorona.com"; sid:554531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowthecovid19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowthecovid19curve.com"; sid:554532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowyourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowyourcovid19.com"; sid:554533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowyourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowyourcovid.com"; sid:554534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kohlsccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kohlsccoronavirus.com"; sid:554535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kohlscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kohlscorona.com"; sid:554536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kohlscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kohlscovid-19.com"; sid:554537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kohlscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kohlscovid19.com"; sid:554538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kohlscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kohlscovid.com"; sid:554539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for konflikthilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"konflikthilfe-corona.com"; sid:554540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kormouncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kormouncovid19.com"; sid:554541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ktvbcovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ktvbcovid-19info.com"; sid:554542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwaitcoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwaitcoronasurvey.com"; sid:554543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcovid19.com"; sid:554544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagoswillbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagoswillbeatcovid19.com"; sid:554545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laredocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laredocovid19.com"; sid:554546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavage-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavage-covid-19.com"; sid:554547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerscovid19.com"; sid:554548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ldn-knightswatchstream-coronaexgamescom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ldn-knightswatchstream-coronaexgamescom.com"; sid:554549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnaboutthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnaboutthecoronavirus.com"; sid:554550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lembatalawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lembatalawancovid19.com"; sid:554551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid18testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid18testing.com"; sid:554552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19.com"; sid:554553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19test.com"; sid:554554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid-19testing.com"; sid:554555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid29testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid29testing.com"; sid:554556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid9testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid9testing.com"; sid:554557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilycovidtesting.com"; sid:554558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiacoronavirus.com"; sid:554559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiacovid19.com"; sid:554560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacoronavirus.net"; sid:554561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacovid19.com"; sid:554562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for litcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"litcovid.com"; sid:554563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for live-after-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"live-after-covid19.com"; sid:554564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirus.net"; sid:554565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19.today"; sid:554566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidupdates.com"; sid:554567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livelaughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livelaughcoronavirus.com"; sid:554568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livelaughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livelaughcovid19.com"; sid:554569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for llanrhystudcovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"llanrhystudcovidaid.com"; sid:554570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovidnews.com"; sid:554571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localfoodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localfoodcovid19.com"; sid:554572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lollycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lollycovid19testing.com"; sid:554573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveincoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveincoronatime.com"; sid:554574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveincoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveincoronatimes.com"; sid:554575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthecoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthecoronatime.com"; sid:554576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthecoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthecoronatimes.com"; sid:554577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.biz"; sid:554578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.cloud"; sid:554579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeof-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeof-covid-19.com"; sid:554580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovelaughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovelaughcorona.com"; sid:554581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovinthetimeofcoronavirus.com"; sid:554582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovinthetimeofcovid19.com"; sid:554583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ltccovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ltccovidupdate.com"; sid:554584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mai-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mai-covid19.com"; sid:554585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makingitthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makingitthroughcorona.com"; sid:554586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maladescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maladescoronavirus.com"; sid:554587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maladiescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maladiescoronavirus.com"; sid:554588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarascaseirascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarascaseirascovid19.com"; sid:554589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarascovid19.com"; sid:554590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid-19.com"; sid:554591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherine-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherine-covid.com"; sid:554592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matsucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matsucovid.com"; sid:554593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.today"; sid:554594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.world"; sid:554595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medscoronavirus.com"; sid:554596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for melawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"melawancorona.com"; sid:554597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcoaltioncovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcoaltioncovid19response.com"; sid:554598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metalepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metalepidemic.com"; sid:554599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocontraelcovid.com"; sid:554600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirusclaim.com"; sid:554601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirusclaims.com"; sid:554602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19claim.com"; sid:554603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19claims.com"; sid:554604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindcorona.com"; sid:554605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mindstrong-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mindstrong-covid19.com"; sid:554606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicovid.com"; sid:554607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mmccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mmccovid.com"; sid:554608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for molliespandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"molliespandemicparty.com"; sid:554609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movimentoscontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movimentoscontracovid19.com"; sid:554610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtcovidclean.com"; sid:554611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicamexicocitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicamexicocitycovid19.com"; sid:554612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicamexicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicamexicocovid19.com"; sid:554613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiccovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiccovidrelief.com"; sid:554614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiccovidrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiccovidrelief.net"; sid:554615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaadvance.com"; sid:554616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacheck.com"; sid:554617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadays.com"; sid:554618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadoc.com"; sid:554619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadoctor.com"; sid:554620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadrugs.com"; sid:554621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafunds.com"; sid:554622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaliveapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaliveapp.com"; sid:554623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronastore.com"; sid:554624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushometest.com"; sid:554625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-coronawear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-coronawear.com"; sid:554626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19wedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19wedding.com"; sid:554627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidchallenge.com"; sid:554628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhome.com"; sid:554629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfreecovid.com"; sid:554630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmaskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmaskit.com"; sid:554631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmaskus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmaskus.com"; sid:554632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncoronavirus19.com"; sid:554633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19isfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19isfake.com"; sid:554634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negligenciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negligenciacovid19.com"; sid:554635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negligenciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negligenciacovid.com"; sid:554636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negligenciamedicacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negligenciamedicacovid.com"; sid:554637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalfightscorona.com"; sid:554638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyage-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyage-covid-19.com"; sid:554639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neurocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neurocovid.com"; sid:554640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news12coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news12coronavirus.com"; sid:554641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-coronavirus.net"; sid:554642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-pandemic.com"; sid:554643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhs-covid19.com"; sid:554644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscovid19.com"; sid:554645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidclaim.com"; sid:554646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidinjury.com"; sid:554647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nnycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nnycovid19.com"; sid:554648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaagain.com"; sid:554649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronas.com"; sid:554650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19news.com"; sid:554651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nofearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nofearcorona.com"; sid:554652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcentraloregoncoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcentraloregoncoronavirusresponse.com"; sid:554653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notagcovid19.com"; sid:554654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronaviruscheck.com"; sid:554655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nucontracorona.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nucontracorona.digital"; sid:554656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19antibody.com"; sid:554657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19antibodyresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19antibodyresults.com"; sid:554658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidclaim.com"; sid:554659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidconnect.com"; sid:554660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidinjury.com"; sid:554661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nypdcovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nypdcovidppe.com"; sid:554662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscovid19map.com"; sid:554663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscovid19relief.com"; sid:554664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscovidrelief.com"; sid:554665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nzcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nzcovid19stats.com"; sid:554666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for odishacovidupdates.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"odishacovidupdates.life"; sid:554667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offficialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offficialcorona.com"; sid:554668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offficialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offficialcoronavirus.com"; sid:554669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offficiallycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offficiallycorona.com"; sid:554670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirustest.com"; sid:554671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialteamcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialteamcoronabusters.com"; sid:554672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronacure.com"; sid:554673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronadrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronadrugs.com"; sid:554674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronahelp.com"; sid:554675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronashop.com"; sid:554676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronasupport.com"; sid:554677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronaviruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronaviruscheck.com"; sid:554678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onupanamacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onupanamacovid19.com"; sid:554679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opendatacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opendatacovid.com"; sid:554680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationkillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationkillcovid.com"; sid:554681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcoronaclaim.com"; sid:554682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ottawaagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ottawaagainstcorona.com"; sid:554683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ottawacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ottawacovid19.com"; sid:554684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19response.com"; sid:554685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourpandemicdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourpandemicdiary.com"; sid:554686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozcovidsolutions.com"; sid:554687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.today"; sid:554688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.world"; sid:554689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicanxietydisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicanxietydisorder.com"; sid:554690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-apocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-apocalypse.com"; sid:554691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicawards.com"; sid:554692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbalm.com"; sid:554693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-chronicles.com"; sid:554694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-chronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-chronicles.net"; sid:554695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.coffee"; sid:554696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdistribution.com"; sid:554697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdistributors.com"; sid:554698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdystopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdystopia.com"; sid:554699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.film"; sid:554700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflow.com"; sid:554701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoundation.com"; sid:554702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichoax.com"; sid:554703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicland.com"; sid:554704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclitigation.com"; sid:554705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicneeds.com"; sid:554706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pandemonium.com"; sid:554707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperspective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperspective.com"; sid:554708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpjs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpjs.com"; sid:554709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpriorities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpriorities.com"; sid:554710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofcoffee.com"; sid:554711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofplan.com"; sid:554712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofportfolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofportfolio.com"; sid:554713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresearch.net"; sid:554714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsetraining.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsetraining.biz"; sid:554715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-simulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-simulation.com"; sid:554716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsound.com"; sid:554717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsource.com"; sid:554718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-store.com"; sid:554719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategist.com"; sid:554720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvival.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvival.life"; sid:554721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvival.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvival.network"; sid:554722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvival.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvival.solutions"; sid:554723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalsolutions.com"; sid:554724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.wtf"; sid:554725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictracker.world"; sid:554726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicum.com"; sid:554727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicupdate.net"; sid:554728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvideocollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvideocollective.com"; sid:554729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicware.com"; sid:554730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwar.net"; sid:554731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicweek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicweek.com"; sid:554732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwholesaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwholesaler.com"; sid:554733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwholesalers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwholesalers.com"; sid:554734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemonium-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemonium-pandemic.com"; sid:554735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemoniumpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemoniumpandemic.com"; sid:554736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantaucorona88.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantaucorona88.com"; sid:554737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for payforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"payforcovid19.com"; sid:554738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ph-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ph-covid19.com"; sid:554739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19.com"; sid:554740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcoronavirus.com"; sid:554741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovid19.com"; sid:554742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformacoronavirus.com"; sid:554743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformacoronavirus.net"; sid:554744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformagalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformagalcoronavirus.com"; sid:554745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformalegalafectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformalegalafectadoscoronavirus.com"; sid:554746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poetrypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poetrypandemic.com"; sid:554747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portraitsofapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portraitsofapandemic.com"; sid:554748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscoronavirus.com"; sid:554749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona19.world"; sid:554750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaparties.com"; sid:554751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasyndroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasyndroom.com"; sid:554752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronawishes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronawishes.com"; sid:554753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlife.com"; sid:554754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmanager.com"; sid:554755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicanxiety.com"; sid:554756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicanxietydisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicanxietydisorder.com"; sid:554757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicdisorder.com"; sid:554758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.net"; sid:554759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicstress.com"; sid:554760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepare4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepare4pandemic.com"; sid:554761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingthenextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingthenextcorona.com"; sid:554762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princecharlescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princecharlescoronavirus.com"; sid:554763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proactivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proactivecorona.com"; sid:554764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovid19mask.com"; sid:554765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pro-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pro-covid.com"; sid:554766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proformula-coronavirus-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proformula-coronavirus-fr.com"; sid:554767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projecttostopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projecttostopcovid19.com"; sid:554768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proseinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proseinthepandemic.com"; sid:554769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectworldcovid19.com"; sid:554770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycovid19.com"; sid:554771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puzzlesforthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puzzlesforthepandemic.com"; sid:554772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pycorona.com"; sid:554773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pycoronavirus.com"; sid:554774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questionscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questionscovid-19.com"; sid:554775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19results.com"; sid:554776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratemycovid19haircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratemycovid19haircut.com"; sid:554777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rcovid.com"; sid:554778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionescoronavirus.com"; sid:554779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacovid19.com"; sid:554780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacovid.com"; sid:554781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidnow.com"; sid:554782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidnow.net"; sid:554783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rekodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rekodcovid19.com"; sid:554784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for removecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"removecovid19.com"; sid:554785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respondtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respondtocovid.com"; sid:554786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retocovid19chihuahua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retocovid19chihuahua.com"; sid:554787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rucovid.com"; sid:554788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycovid.com"; sid:554789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyfromcovid19.com"; sid:554790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samecovid.com"; sid:554791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizationcovid19.com"; sid:554792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanscovid.com"; sid:554793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-cov-2pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-cov-2pandemic.com"; sid:554794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19testkit.com"; sid:554795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19testkits.com"; sid:554796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savefromcovid19.com"; sid:554797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronadisasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronadisasterloan.com"; sid:554798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronadisasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronadisasterloans.com"; sid:554799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-covid-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-covid-loans.com"; sid:554800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovid19.com"; sid:554801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scotiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scotiacovid19.com"; sid:554802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsttestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsttestcoronavirus.com"; sid:554803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsttestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsttestcovid19.com"; sid:554804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selling-despite-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selling-despite-covid-19.com"; sid:554805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-covid-19.com"; sid:554806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronamerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronamerch.com"; sid:554807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecoronatest.com"; sid:554808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skscoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skscoronavirusrelief.com"; sid:554809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbizcoronaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbizcoronaloan.com"; sid:554810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirushelp.com"; sid:554811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovidloan.com"; sid:554812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovid.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovid.loans"; sid:554813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovidloans.com"; sid:554814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solasalonstudios-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solasalonstudios-covid19.com"; sid:554815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucioncoronavirus.com"; sid:554816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionscoronavirus.com"; sid:554817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionscovid-19.com"; sid:554818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somersetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somersetcovid19.com"; sid:554819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springercovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springercovid-19test.com"; sid:554820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springercovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springercovid19test.com"; sid:554821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovid19.net"; sid:554822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statistics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statistics-covid19.com"; sid:554823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statscovid-19.com"; sid:554824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staybackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staybackcorona.com"; sid:554825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stimuluspackagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stimuluspackagecoronavirus.com"; sid:554826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaspreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaspreading.com"; sid:554827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusa.com"; sid:554828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus.today"; sid:554829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnigeria.com"; sid:554830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcovid.com"; sid:554831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for subitomascherinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"subitomascherinecovid.com"; sid:554832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suncoastcares4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suncoastcares4covid.com"; sid:554833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for superiorcoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"superiorcoronaclean.com"; sid:554834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supply4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supply4covid19.com"; sid:554835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for support4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"support4corona.com"; sid:554836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronalockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronalockdown.com"; sid:554837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronatogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronatogether.com"; sid:554838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecoronalockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecoronalockdown.com"; sid:554839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swocovid19.com"; sid:554840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tagcovid19.com"; sid:554841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takcovid.com"; sid:554842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcoronabuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcoronabuster.com"; sid:554843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcoronabuster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcoronabuster.net"; sid:554844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcoronabusters.com"; sid:554845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for team-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"team-covid19.com"; sid:554846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teslacoronahoaxflatearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teslacoronahoaxflatearth.com"; sid:554847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testacorona.com"; sid:554848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19ec.com"; sid:554849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovids.com"; sid:554850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testthecorona.com"; sid:554851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texas-covid-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texas-covid-loans.com"; sid:554852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovidcenter.com"; sid:554853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechinacoronavirusconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechinacoronavirusconspiracy.com"; sid:554854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechinesecoronavirusconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechinesecoronavirusconspiracy.com"; sid:554855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacheck.com"; sid:554856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadad.com"; sid:554857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaexpress.com"; sid:554858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaextinction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaextinction.com"; sid:554859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalegacy.com"; sid:554860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalounge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalounge.com"; sid:554861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaofmercy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaofmercy.com"; sid:554862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaresistantfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaresistantfamily.com"; sid:554863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusaffect.com"; sid:554864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruschinaconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruschinaconspiracy.com"; sid:554865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruschineseconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruschineseconspiracy.com"; sid:554866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.directory"; sid:554867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruseffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruseffect.com"; sid:554868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusexposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusexposed.com"; sid:554869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspandemicnews.com"; sid:554870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustimeline.com"; sid:554871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19counsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19counsel.com"; sid:554872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19disaster.com"; sid:554873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19event.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19event.com"; sid:554874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19generation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19generation.com"; sid:554875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19patient.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19patient.care"; sid:554876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19patient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19patient.com"; sid:554877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19patient.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19patient.life"; sid:554878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19patient.management - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19patient.management"; sid:554879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19storyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19storyproject.com"; sid:554880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcommunity.com"; sid:554881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcrew.com"; sid:554882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgame.com"; sid:554883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsource.com"; sid:554884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtoday.com"; sid:554885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercorona2020.com"; sid:554886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercorona-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercorona-covid19.com"; sid:554887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-day-after-corona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-day-after-corona-covid.com"; sid:554888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercorona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercorona-covid.com"; sid:554889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefactscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefactscovid19.com"; sid:554890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegiftofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegiftofcorona.com"; sid:554891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegiftofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegiftofcovid19.com"; sid:554892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehistoryofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehistoryofcovid19.com"; sid:554893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoffficialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoffficialcorona.com"; sid:554894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoffficialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoffficialcoronavirus.com"; sid:554895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thercovid.com"; sid:554896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecovidtimes.com"; sid:554897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecovidtimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecovidtimes.net"; sid:554898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesocialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesocialcorona.com"; sid:554899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timecapsulecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timecapsulecovid19.com"; sid:554900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timepasscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timepasscorona.com"; sid:554901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top-corona.com"; sid:554902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalcoronacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalcoronacases.com"; sid:554903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid-19.com"; sid:554904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid19.com"; sid:554905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid-19.net"; sid:554906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid19.net"; sid:554907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toyota-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toyota-corona.com"; sid:554908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trabajobienestarsocialcovid19clm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trabajobienestarsocialcovid19clm.com"; sid:554909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19linebot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19linebot.com"; sid:554910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transit-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transit-covid-19.com"; sid:554911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercorona.com"; sid:554912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trucovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trucovid19test.com"; sid:554913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidclaim.com"; sid:554914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidinjury.com"; sid:554915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universityofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universityofcovid.com"; sid:554916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universityofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universityofcovid.net"; sid:554917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for update-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"update-covid.com"; sid:554918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirus.net"; sid:554919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronacleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronacleanup.com"; sid:554920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronacounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronacounter.com"; sid:554921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoviddeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoviddeaths.com"; sid:554922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidsupply.com"; sid:554923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinazionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinazionecovid19.com"; sid:554924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valecovid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valecovid19challenge.com"; sid:554925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valledebravocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valledebravocovid19.com"; sid:554926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorcovid19.com"; sid:554927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for villagesafetycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"villagesafetycovid.com"; sid:554928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virologyofcovid-19.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virologyofcovid-19.golf"; sid:554929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualepidemic.com"; sid:554930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronaid.com"; sid:554931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidasistencianegocios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidasistencianegocios.com"; sid:554932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidasistencianegocios.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidasistencianegocios.net"; sid:554933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprestamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprestamos.com"; sid:554934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprestamosgobierno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprestamosgobierno.com"; sid:554935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprestamosgobierno.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprestamosgobierno.net"; sid:554936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprestamos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprestamos.net"; sid:554937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogamasnegocio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogamasnegocio.com"; sid:554938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogamasnegocio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogamasnegocio.net"; sid:554939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogramas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogramas.com"; sid:554940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogramasgobierno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogramasgobierno.com"; sid:554941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogramasgobierno.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogramasgobierno.net"; sid:554942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprogramas.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprogramas.loan"; sid:554943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viveracovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viveracovid19rapidtest.com"; sid:554944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warncorona.com"; sid:554945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wascoshermangilliamcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wascoshermangilliamcovid-19.com"; sid:554946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcorona.club"; sid:554947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid19.com"; sid:554948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillsthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillsthecoronavirus.com"; sid:554949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whenwillcovid19end.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whenwillcovid19end.com"; sid:554950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willtrumpgetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willtrumpgetcorona.com"; sid:554951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for windwardcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"windwardcovid.com"; sid:554952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winvscoronavirus.com"; sid:554953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaupdates.com"; sid:554954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidmap.com"; sid:554955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidtracker.com"; sid:554956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldfightscorona.com"; sid:554957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicfoundation.com"; sid:554958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicresearch.com"; sid:554959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for writinginatimeofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"writinginatimeofpandemic.com"; sid:554960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfluisjesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfluisjesus.com"; sid:554961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankow.com"; sid:554962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpokertour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpokertour.com"; sid:554963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanscoronavirus.com"; sid:554964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid-19kohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid-19kohls.com"; sid:554965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19kohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19kohls.com"; sid:554966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovidkohls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovidkohls.com"; sid:554967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwkohlsccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwkohlsccoronavirus.com"; sid:554968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwkohlscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwkohlscorona.com"; sid:554969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwkohlscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwkohlscovid-19.com"; sid:554970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwkohlscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwkohlscovid19.com"; sid:554971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwkohlscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwkohlscovid.com"; sid:554972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid.life"; sid:554973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xrpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xrpcovid19.com"; sid:554974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xxxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xxxcorona.com"; sid:554975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomamagotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomamagotcorona.com"; sid:554976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomatealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomatealcoronavirus.com"; sid:554977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomatealcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomatealcoronavirus.net"; sid:554978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusbankruptcy.com"; sid:554979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19bankruptcy.com"; sid:554980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-covid-19-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-covid-19-risk.com"; sid:554981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-covid19-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-covid19-risk.com"; sid:554982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19risk.com"; sid:554983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19risk.com"; sid:554984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19story.com"; sid:554985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-covid-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-covid-risk.com"; sid:554986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidrisk.com"; sid:554987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zm-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zm-covid-19.com"; sid:554988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 112covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"112covid-19.com"; sid:554989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidfieldlane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidfieldlane.com"; sid:554990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19shadesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19shadesofcovid.com"; sid:554991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19shadesofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19shadesofcovid.net"; sid:554992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusmedsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusmedsupplies.com"; sid:554993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20covid19.com"; sid:554994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20covid19.net"; sid:554995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 42snaps-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"42snaps-covid19.com"; sid:554996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbott-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbott-covid19.com"; sid:554997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovid19.com"; sid:554998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbvie-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbvie-covid19.com"; sid:554999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbviecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbviecovid19.com"; sid:555000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abiliticbtpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abiliticbtpandemic.com"; sid:555001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovid.com"; sid:555002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accountantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accountantcoronavirus.com"; sid:555003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidwarrior.com"; sid:555004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actioncoronavirus.com"; sid:555005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activecovid.com"; sid:555006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affordablecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affordablecoronavirustest.com"; sid:555007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africantechcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africantechcovid19response.com"; sid:555008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronabanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronabanking.com"; sid:555009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronahelp.com"; sid:555010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronasupport.com"; sid:555011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-covid-19.com"; sid:555012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akbroadcasterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akbroadcasterscovid19.com"; sid:555013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alarmacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alarmacoronavirus.com"; sid:555014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allanticovid.com"; sid:555015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidkiller.com"; sid:555016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all-vs-corona.com"; sid:555017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allycoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allycoronavirusinfo.com"; sid:555018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanpandemicfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanpandemicfoundation.com"; sid:555019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ammatrading-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ammatrading-covid-19.com"; sid:555020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amoreaitempidelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amoreaitempidelcoronavirus.com"; sid:555021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiemposdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiemposdecoronavirus.com"; sid:555022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ams-covid19services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ams-covid19services.com"; sid:555023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anascoronavirusbrunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anascoronavirusbrunch.com"; sid:555024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anothertypeofcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anothertypeofcovidvirus.com"; sid:555025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus-hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus-hope.com"; sid:555026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkiller.com"; sid:555027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemicgoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemicgoods.com"; sid:555028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apdlawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apdlawancorona.com"; sid:555029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appecovid19.com"; sid:555030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applcovid19.com"; sid:555031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecovid1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecovid1.com"; sid:555032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecovid29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecovid29.com"; sid:555033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applrcovid19.com"; sid:555034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applysbacoronavirusaid.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applysbacoronavirusaid.loans"; sid:555035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedrefund-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedrefund-covid-19.com"; sid:555036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovid.com"; sid:555037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for art4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"art4covid.com"; sid:555038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artandcorona.com"; sid:555039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artincoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artincoronatimes.com"; sid:555040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artisgreaterthancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artisgreaterthancovid.com"; sid:555041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociaciondeafectadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociaciondeafectadoscovid19.com"; sid:555042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionvictimascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionvictimascovid19.com"; sid:555043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assure-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assure-coronavirus.com"; sid:555044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assuretechcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assuretechcovidtest.com"; sid:555045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackofthecoronazombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackofthecoronazombies.com"; sid:555046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneysforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneysforcoronavirus.com"; sid:555047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atypeofcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atypeofcovidvirus.com"; sid:555048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocatcovid.com"; sid:555049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ay-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ay-corona.com"; sid:555050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovid19.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovid19.legal"; sid:555051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for az-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"az-corona.com"; sid:555052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronaviruses.com"; sid:555053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid-2019.com"; sid:555054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bendthecovid19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bendthecovid19curve.com"; sid:555055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bensoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bensoncovid19.com"; sid:555056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-corona-joke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-corona-joke.com"; sid:555057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-corona-jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-corona-jokes.com"; sid:555058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusbusinessloans.com"; sid:555059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusmasksale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusmasksale.com"; sid:555060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biencoronamalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biencoronamalcorona.com"; sid:555061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bincangcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bincangcorona.com"; sid:555062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcovid.com"; sid:555063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodycorona.com"; sid:555064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bonuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bonuscovid.com"; sid:555065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingpandemic.com"; sid:555066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildforcovid19.com"; sid:555067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildforcovid19.net"; sid:555068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidmoney.com"; sid:555069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronacide.com"; sid:555070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19.com"; sid:555071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19coronavirus.com"; sid:555072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19covid.com"; sid:555073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcenter-covid-unioeste-foz.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcenter-covid-unioeste-foz.academy"; sid:555074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmcorona.com"; sid:555075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcoronafever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcoronafever.com"; sid:555076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canada-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canada-covid-19.com"; sid:555077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerthroughcorona.com"; sid:555078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerthroughcovid.com"; sid:555079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canvasforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canvasforcorona.com"; sid:555080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstcorona.com"; sid:555081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashwizcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashwizcovid19.com"; sid:555082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casualcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casualcorona.com"; sid:555083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cccpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cccpcoronavirus.com"; sid:555084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cchscovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cchscovidresponse.com"; sid:555085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcorona.com"; sid:555086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcovid19.com"; sid:555087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cegahcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cegahcoronavirus.com"; sid:555088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cegahcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cegahcovid-19.com"; sid:555089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycoronaclub.com"; sid:555090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebswithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebswithcovid-19.com"; sid:555091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirusclean.com"; sid:555092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid-19.com"; sid:555093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmycovid.com"; sid:555094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronavirusmask.com"; sid:555095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christcoronavirus.com"; sid:555096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofcoronavirus.com"; sid:555097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cicovid19.com"; sid:555098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencovidtracker.com"; sid:555099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycoronavirusclinic.com"; sid:555100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovid19clinic.com"; sid:555101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovid19.com"; sid:555102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovidclinic.com"; sid:555103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovid.com"; sid:555104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcovideurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcovideurope.com"; sid:555105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanup-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanup-covid.com"; sid:555106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cliniccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cliniccovid.com"; sid:555107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for code4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"code4covid.com"; sid:555108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codingforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codingforcovid.net"; sid:555109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19us.com"; sid:555110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsensecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsensecovid.com"; sid:555111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityagainstcovid.com"; sid:555112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compassionpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compassionpandemic.com"; sid:555113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprarmascarillascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprarmascarillascovid19.com"; sid:555114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conducttestforcovid-19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conducttestforcovid-19.cloud"; sid:555115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid19ride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid19ride.com"; sid:555116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid19run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid19run.com"; sid:555117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingthroughcovid.com"; sid:555118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingwithcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingwithcovid.club"; sid:555119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolcorona.com"; sid:555120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copyduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copyduringcovid.com"; sid:555121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coreavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coreavscovid.com"; sid:555122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona01.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona01.com"; sid:555123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona108.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona108.life"; sid:555124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona15min.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona15min.com"; sid:555125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona15minutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona15minutes.com"; sid:555126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona180.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona180.com"; sid:555127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona190.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona190.com"; sid:555128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19ind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19ind.com"; sid:555129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19merchandise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19merchandise.com"; sid:555130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19trade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19trade.com"; sid:555131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020club.com"; sid:555132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020conference.com"; sid:555133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advisor.com"; sid:555134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-agenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-agenda.com"; sid:555135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaainusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaainusa.com"; sid:555136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalcoholvape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalcoholvape.com"; sid:555137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandrealestate.com"; sid:555138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandthepanics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandthepanics.com"; sid:555139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarchipelago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarchipelago.com"; sid:555140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaavirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaavirus-sd.com"; sid:555141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-az.com"; sid:555142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegonna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegonna.com"; sid:555143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabehandlung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabehandlung.com"; sid:555144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabench.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabench.com"; sid:555145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizloan.com"; sid:555146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboneher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboneher.com"; sid:555147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboox.com"; sid:555148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuff.com"; sid:555149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessclaim.com"; sid:555150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessshelp.com"; sid:555151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessspartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessspartner.com"; sid:555152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessspartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessspartners.com"; sid:555153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacain.com"; sid:555154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalculator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalculator.net"; sid:555155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacard.net"; sid:555156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareer.com"; sid:555157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.zone"; sid:555158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesupdate.com"; sid:555159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashcalculator.com"; sid:555160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationusa.com"; sid:555161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacbdrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacbdrx.com"; sid:555162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacfo.com"; sid:555163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckarona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckarona.com"; sid:555164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacircles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacircles.net"; sid:555165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacirususa.com"; sid:555166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimconsulting.com"; sid:555167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean19.com"; sid:555168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanrx.com"; sid:555169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanrx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanrx.net"; sid:555170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanxxx.com"; sid:555171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclever.com"; sid:555172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoin.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoin.club"; sid:555173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolony.com"; sid:555174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacon.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacon.biz"; sid:555175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-concept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-concept.com"; sid:555176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcerts.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcerts.club"; sid:555177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consultant.com"; sid:555178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacts.net"; sid:555179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontribution.com"; sid:555180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacosmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacosmo.com"; sid:555181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-counselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-counselor.com"; sid:555182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounterpakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounterpakistan.com"; sid:555183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacross.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacross.net"; sid:555184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacult.com"; sid:555185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurative.com"; sid:555186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.expert"; sid:555187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurrentstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurrentstatus.com"; sid:555188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurse.com"; sid:555189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurtain.com"; sid:555190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacxclusive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacxclusive.com"; sid:555191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-der-film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-der-film.com"; sid:555192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadethroned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadethroned.com"; sid:555193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadirectie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadirectie.com"; sid:555194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.directory"; sid:555195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterloan.com"; sid:555196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-discounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-discounter.com"; sid:555197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadone.com"; sid:555198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadovirus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadovirus-sd.com"; sid:555199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-drive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-drive.com"; sid:555200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenusa.com"; sid:555201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafap.com"; sid:555202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiction.com"; sid:555203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.life"; sid:555204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-force.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-force.com"; sid:555205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforward.com"; sid:555206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriend.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriend.net"; sid:555207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafront.com"; sid:555208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunds.net"; sid:555209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagame.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagame.biz"; sid:555210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagram.net"; sid:555211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrub.com"; sid:555212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaberleri.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaberleri.net"; sid:555213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthinfo.com"; sid:555214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpline.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpline.world"; sid:555215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.tax"; sid:555216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahemprx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahemprx.com"; sid:555217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahint.com"; sid:555218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahints.com"; sid:555219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomerelief.com"; sid:555220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hope.com"; sid:555221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahymne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahymne.com"; sid:555222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainbd.com"; sid:555223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainchina.com"; sid:555224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiacases.com"; sid:555225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformationmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformationmarkets.com"; sid:555226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaininusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaininusa.com"; sid:555227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuryclaim.com"; sid:555228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-instanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-instanttest.com"; sid:555229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancedispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancedispute.com"; sid:555230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancedisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancedisputes.com"; sid:555231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelies.com"; sid:555232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-interresiert-mich.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-interresiert-mich.net"; sid:555233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaish.com"; sid:555234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaissance2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaissance2020.com"; sid:555235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaissance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaissance.net"; sid:555236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobs.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobs.international"; sid:555237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakavachapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakavachapp.com"; sid:555238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakebaad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakebaad.com"; sid:555239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakinder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakinder.net"; sid:555240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakooky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakooky.com"; sid:555241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaidoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaidoff.com"; sid:555242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalauf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalauf.com"; sid:555243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalauf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalauf.net"; sid:555244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearnings.com"; sid:555245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalimelight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalimelight.com"; sid:555246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloansonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloansonline.com"; sid:555247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogy.net"; sid:555248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalove.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalove.net"; sid:555249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaids.com"; sid:555250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-management.com"; sid:555251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-manager.com"; sid:555252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamark.com"; sid:555253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskchallenge.com"; sid:555254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.life"; sid:555255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalinformation.com"; sid:555256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedinfo.com"; sid:555257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamenu.com"; sid:555258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamessenger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamessenger.com"; sid:555259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronammunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronammunity.com"; sid:555260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamobil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamobil.com"; sid:555261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoneynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoneynow.com"; sid:555262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronampa.com"; sid:555263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamt.com"; sid:555264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronao1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronao1.com"; sid:555265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaokie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaokie.com"; sid:555266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-online-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-online-test.com"; sid:555267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorca.com"; sid:555268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoven.com"; sid:555269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapact.com"; sid:555270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapakket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapakket.com"; sid:555271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicheroes.com"; sid:555272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaycheck.com"; sid:555273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeak2020.com"; sid:555274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pedia.com"; sid:555275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapergilahkau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapergilahkau.com"; sid:555276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapergilahkaula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapergilahkaula.com"; sid:555277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pets.com"; sid:555278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplusone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplusone.com"; sid:555279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-poll.com"; sid:555280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ppe.com"; sid:555281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarally.com"; sid:555282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealities.com"; sid:555283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebellion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebellion.com"; sid:555284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recoveryfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recoveryfund.com"; sid:555285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelease.com"; sid:555286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.directory"; sid:555287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief.world"; sid:555288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremove.com"; sid:555289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremoved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremoved.com"; sid:555290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-response.com"; sid:555291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyitems.com"; sid:555292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyproduct.com"; sid:555293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasahayata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasahayata.com"; sid:555294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasba.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasba.net"; sid:555295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascrubber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascrubber.com"; sid:555296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-selbsttest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-selbsttest.net"; sid:555297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfkit.com"; sid:555298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasjaal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasjaal.com"; sid:555299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmeds.com"; sid:555300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreadstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreadstats.com"; sid:555301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasrilanka.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasrilanka.life"; sid:555302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastand.com"; sid:555303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimuluscourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimuluscourse.com"; sid:555304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-strategy.com"; sid:555305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrong.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrong.biz"; sid:555306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalhacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalhacks.com"; sid:555307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorcorps.com"; sid:555308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomscheck.com"; sid:555309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesten.net"; sid:555310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheraphy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheraphy.com"; sid:555311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-things-to-do.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-things-to-do.com"; sid:555312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathingstodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathingstodo.com"; sid:555313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-timeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-timeline.com"; sid:555314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.life"; sid:555315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.today"; sid:555316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.world"; sid:555317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatlas.com"; sid:555318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatophelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatophelp.com"; sid:555319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-turkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-turkey.com"; sid:555320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatyme.com"; sid:555321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-uk.com"; sid:555322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unterkunft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unterkunft.com"; sid:555323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates.life"; sid:555324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav2.com"; sid:555325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinum.com"; sid:555326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavakalari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavakalari.com"; sid:555327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavape.com"; sid:555328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavault.com"; sid:555329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavclean.com"; sid:555330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventures.net"; sid:555331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavern.com"; sid:555332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverveling.com"; sid:555333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidafestival.com"; sid:555334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavieusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavieusnow.com"; sid:555335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaview.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaview.net"; sid:555336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirious.com"; sid:555337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisinusa.com"; sid:555338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris-map.com"; sid:555339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirissd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirissd.com"; sid:555340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirius-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirius-response.com"; sid:555341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviriusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviriusresponse.com"; sid:555342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirous-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirous-sd.com"; sid:555343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruc.com"; sid:555344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruisnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruisnewsnow.com"; sid:555345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirunsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirunsnow.com"; sid:555346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus0sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus0sd.com"; sid:555347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.guru"; sid:555348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19reliefbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19reliefbill.com"; sid:555349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountant.com"; sid:555350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidhelp.com"; sid:555351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidresources.com"; sid:555352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandre.com"; sid:555353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandzombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandzombies.com"; sid:555354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-as.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-as.com"; sid:555355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneycolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneycolorado.com"; sid:555356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawareness2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawareness2020.com"; sid:555357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusazassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusazassistance.com"; sid:555358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusazcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusazcentral.com"; sid:555359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusazhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusazhelp.com"; sid:555360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarter.com"; sid:555361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bigbang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bigbang.com"; sid:555362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbizaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbizaid.com"; sid:555363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildingservices.com"; sid:555364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessassistance.com"; sid:555365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalvin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalvin.com"; sid:555366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarpetcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarpetcleaning.com"; sid:555367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscases.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscases.club"; sid:555368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscases.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscases.today"; sid:555369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaseupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaseupdate.com"; sid:555370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatastrophe.com"; sid:555371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsgroup.com"; sid:555372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasscase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasscase.com"; sid:555373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusclean.com"; sid:555374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.equipment"; sid:555375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanup.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanup.support"; sid:555376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-compilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-compilation.com"; sid:555377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompilation.com"; sid:555378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplex.com"; sid:555379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcussion.com"; sid:555380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-counter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-counter.com"; sid:555381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrediterrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrediterrors.com"; sid:555382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscredithack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscredithack.com"; sid:555383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditrepair.com"; sid:555384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditreport.com"; sid:555385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditrestoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditrestoration.com"; sid:555386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscult.com"; sid:555387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscymru.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscymru.wales"; sid:555388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailyreport.com"; sid:555389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathcase.com"; sid:555390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentalrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentalrelief.com"; sid:555391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscriminationlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscriminationlawyer.com"; sid:555392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasefyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasefyi.com"; sid:555393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyloan.com"; sid:555394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-employment-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-employment-law.com"; sid:555395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenpuertorico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenpuertorico.com"; sid:555396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesnewsnow.com"; sid:555397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvaccine.net"; sid:555398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-evil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-evil.com"; sid:555399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposurecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposurecase.com"; sid:555400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposureclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposureclass.com"; sid:555401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposurelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposurelawsuit.com"; sid:555402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemaskprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemaskprotection.com"; sid:555403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactory.com"; sid:555404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfha.com"; sid:555405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgiving.com"; sid:555406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgood.com"; sid:555407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoverment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoverment.com"; sid:555408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gp.com"; sid:555409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitaldelmar.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitaldelmar.cat"; sid:555410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalsupplies.com"; sid:555411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hub.com"; sid:555412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushypnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushypnosis.com"; sid:555413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-injured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-injured.com"; sid:555414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusin.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusin.life"; sid:555415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-innovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-innovation.com"; sid:555416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceguide.com"; sid:555417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinthechurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinthechurch.com"; sid:555418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuit123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuit123.com"; sid:555419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalguide.com"; sid:555420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-statistics.com"; sid:555421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanforgiveness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanforgiveness.com"; sid:555422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloannc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloannc.com"; sid:555423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.markets - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.markets"; sid:555424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksandtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksandtestkits.com"; sid:555425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskservices.com"; sid:555426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalkits.com"; sid:555427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalsupplystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalsupplystore.com"; sid:555428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedsolutions.com"; sid:555429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedsupplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedsupplys.com"; sid:555430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-memorial.com"; sid:555431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmodel.com"; sid:555432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnows.com"; sid:555433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsroom.com"; sid:555434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkstate.com"; sid:555435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnote.com"; sid:555436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnov.com"; sid:555437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oklahoma.com"; sid:555438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoncruiseships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoncruiseships.com"; sid:555439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonusa.com"; sid:555440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicdefense.com"; sid:555441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspath.com"; sid:555442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspercapita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspercapita.com"; sid:555443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppi.com"; sid:555444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspredicted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspredicted.com"; sid:555445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspressers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspressers.com"; sid:555446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproactivehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproactivehealth.com"; sid:555447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pro.com"; sid:555448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprojectprotect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprojectprotect.net"; sid:555449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pro.net"; sid:555450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublictest.com"; sid:555451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rapid-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rapid-test-kit.com"; sid:555452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffundfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffundfraud.com"; sid:555453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.clothing"; sid:555454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussafety.com"; sid:555455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyconsultant.com"; sid:555456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyconsultants.com"; sid:555457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyconsulting.com"; sid:555458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyexperts.com"; sid:555459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyposters.com"; sid:555460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.support"; sid:555461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysupport.com"; sid:555462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitationequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitationequipment.com"; sid:555463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaver.com"; sid:555464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussba7a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussba7a.com"; sid:555465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscene.com"; sid:555466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-schutzschild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-schutzschild.com"; sid:555467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussd.com"; sid:555468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthasia.com"; sid:555469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialistnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialistnyc.com"; sid:555470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussport.com"; sid:555471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-spread-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-spread-statistics.com"; sid:555472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ss.com"; sid:555473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stimuluschecks.com"; sid:555474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulus-checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulus-checks.com"; sid:555475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluscourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluscourse.com"; sid:555476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stimuluspackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stimuluspackages.com"; sid:555477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstopsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstopsnow.com"; sid:555478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrength.com"; sid:555479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplys.com"; sid:555480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvives.com"; sid:555481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcase.com"; sid:555482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestclassaction.com"; sid:555483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing-center.com"; sid:555484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingkits.net"; sid:555485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitpro.com"; sid:555486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestshop.com"; sid:555487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthemovie2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthemovie2020.com"; sid:555488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimulus.com"; sid:555489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustnow.com"; sid:555490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.trading - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.trading"; sid:555491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrailer.com"; sid:555492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrailer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrailer.net"; sid:555493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrailers.com"; sid:555494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuda.com"; sid:555495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ultraviolet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ultraviolet.com"; sid:555496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususnow.com"; sid:555497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinecompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinecompanies.com"; sid:555498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtualconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtualconference.com"; sid:555499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteerhawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteerhawaii.com"; sid:555500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteer.net"; sid:555501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-weapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-weapon.com"; sid:555502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweapons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweapons.com"; sid:555503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-weddings-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-weddings-covid-19.com"; sid:555504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkwear.com"; sid:555505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld19.com"; sid:555506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathcase.com"; sid:555507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruznewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruznewsnow.com"; sid:555508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru.zone"; sid:555509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisrusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisrusnow.com"; sid:555510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviurs-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviurs-sd.com"; sid:555511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviusinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviusinusa.com"; sid:555512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviusinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviusinus.com"; sid:555513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavjrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavjrus.com"; sid:555514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-voice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-voice.com"; sid:555515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaythegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaythegame.com"; sid:555516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhistle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhistle.com"; sid:555517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-winners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-winners.com"; sid:555518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wohnung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wohnung.com"; sid:555519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawordmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawordmeter.com"; sid:555520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkwear.com"; sid:555521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworlds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworlds.com"; sid:555522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaww.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaww.com"; sid:555523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-yoga.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-yoga.club"; sid:555524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covd19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covd19pandemic.com"; sid:555525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertcovid19.com"; sid:555526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertcovid.com"; sid:555527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10nj.com"; sid:555528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15min.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15min.com"; sid:555529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15minutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15minutes.com"; sid:555530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid180.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid180.com"; sid:555531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1915.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1915.com"; sid:555532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192021.com"; sid:555533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192022.com"; sid:555534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1924hr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1924hr.com"; sid:555535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abatementservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abatementservices.com"; sid:555536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-abbott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-abbott.com"; sid:555537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abbott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abbott.com"; sid:555538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-abbvie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-abbvie.com"; sid:555539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abbvie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abbvie.com"; sid:555540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accion.com"; sid:555541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19affectedfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19affectedfinder.com"; sid:555542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aidhelp.com"; sid:555543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidresources.com"; sid:555544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-albania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-albania.com"; sid:555545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anonymous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anonymous.com"; sid:555546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anywhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anywhere.com"; sid:555547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19apps.com"; sid:555548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorney2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorney2020.com"; sid:555549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorney2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorney2020.com"; sid:555550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-austria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-austria.com"; sid:555551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bakery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bakery.com"; sid:555552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ball.com"; sid:555553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ball.com"; sid:555554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bands.com"; sid:555555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcies.com"; sid:555556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bestcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bestcure.com"; sid:555557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bi.com"; sid:555558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birth.com"; sid:555559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthdefectlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthdefectlawyer.com"; sid:555560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthdefectslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthdefectslawyer.com"; sid:555561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizaid.com"; sid:555562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blame.com"; sid:555563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blitz.com"; sid:555564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bot.net"; sid:555565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessadvice.com"; sid:555566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessclaim.net"; sid:555567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessclaims.com"; sid:555568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessconsulting.com"; sid:555569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessfunding.com"; sid:555570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinsuranceclaims.com"; sid:555571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinsuranceclaims.com"; sid:555572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslaw.com"; sid:555573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cares.com"; sid:555574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-carnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-carnival.com"; sid:555575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catastrophe.com"; sid:555576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chatbot.com"; sid:555577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checker.club"; sid:555578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chef.com"; sid:555579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cie.com"; sid:555580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-classaction.com"; sid:555581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.company"; sid:555582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.company"; sid:555583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.contractors"; sid:555584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.contractors"; sid:555585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.equipment"; sid:555586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.equipment"; sid:555587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.expert"; sid:555588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnyc.com"; sid:555589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.services"; sid:555590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.solutions"; sid:555591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.supplies"; sid:555592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.systems"; sid:555593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.tips"; sid:555594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.tips"; sid:555595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.today"; sid:555596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning.today"; sid:555597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clean.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clean.tips"; sid:555598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupservices.com"; sid:555599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cloud.com"; sid:555600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coders.com"; sid:555601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19communityrelief-iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19communityrelief-iowa.com"; sid:555602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-compensation.com"; sid:555603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compilation.com"; sid:555604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-compilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-compilation.com"; sid:555605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compilation.com"; sid:555606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conceptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conceptions.com"; sid:555607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concussion.com"; sid:555608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consulting.com"; sid:555609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coop.com"; sid:555610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coping.com"; sid:555611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronainfo.com"; sid:555612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus.tools"; sid:555613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19corp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19corp.com"; sid:555614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datajam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datajam.com"; sid:555615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataregistry.com"; sid:555616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decals.com"; sid:555617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19delhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19delhi.com"; sid:555618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-denmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-denmark.com"; sid:555619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dispute.com"; sid:555620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distanceapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distanceapp.com"; sid:555621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dmc.com"; sid:555622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donate.net"; sid:555623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donation.net"; sid:555624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dreamteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dreamteam.com"; sid:555625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ec.com"; sid:555626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19economy.com"; sid:555627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ehs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ehs.com"; sid:555628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvador.com"; sid:555629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elsalvador.com"; sid:555630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencydentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencydentists.com"; sid:555631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyresponse.com"; sid:555632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19endgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19endgame.com"; sid:555633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19environmental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19environmental.com"; sid:555634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-equipment.com"; sid:555635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ermergencydentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ermergencydentists.com"; sid:555636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-et-web-api.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-et-web-api.net"; sid:555637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ety.com"; sid:555638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19europa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19europa.com"; sid:555639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faceshield.com"; sid:555640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsheet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsheet.net"; sid:555641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19familycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19familycare.com"; sid:555642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19films.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19films.com"; sid:555643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstresponder.com"; sid:555644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freshair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freshair.com"; sid:555645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-frontlineheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-frontlineheroes.com"; sid:555646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19frontlinemedics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19frontlinemedics.com"; sid:555647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fuckoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fuckoff.com"; sid:555648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funds.net"; sid:555649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gala.com"; sid:555650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-germany.com"; sid:555651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentclaimsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentclaimsgroup.com"; sid:555652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gsk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gsk.com"; sid:555653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gsk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gsk.com"; sid:555654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guidlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guidlines.com"; sid:555655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halloffame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halloffame.com"; sid:555656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hallofshame.com"; sid:555657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halloween.com"; sid:555658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19haritasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19haritasi.com"; sid:555659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haritasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haritasi.com"; sid:555660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harvest.com"; sid:555661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthapp.com"; sid:555662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcare.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcare.center"; sid:555663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcare.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcare.company"; sid:555664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthdata.com"; sid:555665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthdata.net"; sid:555666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthguide.com"; sid:555667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help24hr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help24hr.com"; sid:555668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpguide.com"; sid:555669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.guru"; sid:555670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.pro"; sid:555671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hero.com"; sid:555672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homegoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homegoods.com"; sid:555673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homescreen.com"; sid:555674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hometestkit.com"; sid:555675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19images.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19images.com"; sid:555676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ime.com"; sid:555677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunisation.com"; sid:555678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19india.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19india.email"; sid:555679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-informe.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-informe.life"; sid:555680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-injured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-injured.com"; sid:555681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injured.com"; sid:555682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inkenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inkenya.com"; sid:555683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instantscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instantscreen.com"; sid:555684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-instanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-instanttest.com"; sid:555685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insuranceattorneys.com"; sid:555686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceattorneys.com"; sid:555687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurance-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurance-claims.com"; sid:555688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancelawyers.com"; sid:555689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawyers.com"; sid:555690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelie.com"; sid:555691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelies.com"; sid:555692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-intel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-intel.com"; sid:555693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-iran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-iran.com"; sid:555694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ireland.com"; sid:555695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-italy.com"; sid:555696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19items.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19items.com"; sid:555697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-iwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-iwc.com"; sid:555698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jnj.com"; sid:555699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jnj.com"; sid:555700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19join.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19join.com"; sid:555701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-journal.com"; sid:555702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19journals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19journals.com"; sid:555703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kfc.com"; sid:555704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19klean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19klean.com"; sid:555705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawline.com"; sid:555706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-legal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-legal.com"; sid:555707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaldreamteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaldreamteam.com"; sid:555708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalfaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalfaq.com"; sid:555709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelp.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelp.center"; sid:555710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelp.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelp.services"; sid:555711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lending.com"; sid:555712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lendingresource.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lendingresource.biz"; sid:555713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loannc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loannc.com"; sid:555714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19look.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19look.com"; sid:555715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lung.com"; sid:555716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-market.com"; sid:555717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingplan.com"; sid:555718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mascarillas.com"; sid:555719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19matters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19matters.com"; sid:555720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalaid.com"; sid:555721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalhelp.com"; sid:555722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalinformation.com"; sid:555723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalinformation.com"; sid:555724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicals.com"; sid:555725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicinenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicinenow.com"; sid:555726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medinfo.com"; sid:555727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medinfo.com"; sid:555728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medsupplies.com"; sid:555729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialsite.com"; sid:555730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19merchandisevip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19merchandisevip.com"; sid:555731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merchandisevip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merchandisevip.com"; sid:555732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merchant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merchant.com"; sid:555733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-merck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-merck.com"; sid:555734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merck.com"; sid:555735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19metadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19metadata.com"; sid:555736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigationservices.com"; sid:555737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mt.com"; sid:555738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naija.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naija.com"; sid:555739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalday.com"; sid:555740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalholidayday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalholidayday.com"; sid:555741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalmemorial.com"; sid:555742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalmonument.com"; sid:555743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nedir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nedir.com"; sid:555744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-netherlands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-netherlands.com"; sid:555745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19networktracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19networktracker.com"; sid:555746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newstracker.com"; sid:555747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkcity.com"; sid:555748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nhs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nhs.com"; sid:555749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19northamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19northamerica.com"; sid:555750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-norway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-norway.com"; sid:555751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-norwegian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-norwegian.com"; sid:555752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-novartis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-novartis.com"; sid:555753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19novartis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19novartis.com"; sid:555754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nycjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nycjobs.com"; sid:555755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19obituaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19obituaries.com"; sid:555756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19obituary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19obituary.com"; sid:555757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oc.com"; sid:555758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oncruiseships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oncruiseships.com"; sid:555759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19open.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19open.com"; sid:555760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oz.com"; sid:555761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicus.com"; sid:555762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pfizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pfizer.com"; sid:555763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pfizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pfizer.com"; sid:555764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppe.biz"; sid:555765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesupply.com"; sid:555766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppi.com"; sid:555767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pregnancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pregnancy.com"; sid:555768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19primarycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19primarycare.com"; sid:555769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procurement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procurement.com"; sid:555770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19publisher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19publisher.com"; sid:555771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktest.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktest.life"; sid:555772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapiddiagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapiddiagnosis.com"; sid:555773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapiddx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapiddx.com"; sid:555774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapid-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapid-test-kit.com"; sid:555775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19re.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19re.com"; sid:555776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverd.com"; sid:555777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverd.net"; sid:555778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffundfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffundfraud.com"; sid:555779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefnetwork.com"; sid:555780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remediationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remediationservices.com"; sid:555781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembrance.com"; sid:555782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repos.com"; sid:555783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19research.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19research.world"; sid:555784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcehub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcehub.net"; sid:555785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsealliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsealliance.com"; sid:555786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-roche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-roche.com"; sid:555787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19romania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19romania.com"; sid:555788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-royalcaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-royalcaribbean.com"; sid:555789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19royalfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19royalfamily.com"; sid:555790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-russia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-russia.com"; sid:555791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.net"; sid:555792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyposters.com"; sid:555793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetystickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetystickers.com"; sid:555794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetystickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetystickers.com"; sid:555795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sa.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sa.life"; sid:555796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitationservices.com"; sid:555797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitationservicessydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitationservicessydney.com"; sid:555798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitationsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitationsydney.com"; sid:555799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitized.com"; sid:555800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanofi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanofi.com"; sid:555801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanofi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanofi.com"; sid:555802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.sarl - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.sarl"; sid:555803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-saudiarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-saudiarabia.com"; sid:555804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-scams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-scams.com"; sid:555805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-schnelltest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-schnelltest.net"; sid:555806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19score.com"; sid:555807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19score.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19score.net"; sid:555808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sec.com"; sid:555809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-serologie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-serologie.com"; sid:555810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-settlement.com"; sid:555811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-share.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-share.com"; sid:555812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sharing.com"; sid:555813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shopsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shopsigns.com"; sid:555814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shopsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shopsigns.com"; sid:555815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sma.com"; sid:555816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessclaim.com"; sid:555817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.biz"; sid:555818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southasia.com"; sid:555819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-southkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-southkorea.com"; sid:555820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-spain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-spain.com"; sid:555821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spreadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spreadmap.com"; sid:555822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sticker.com"; sid:555823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulasloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulasloan.com"; sid:555824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluseducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluseducation.com"; sid:555825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusfunds.com"; sid:555826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliesaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliesaustralia.com"; sid:555827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplys.com"; sid:555828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supporters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supporters.com"; sid:555829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.group"; sid:555830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalguidemn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalguidemn.com"; sid:555831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorusa.com"; sid:555832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swat.com"; sid:555833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swat.com"; sid:555834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sweden.com"; sid:555835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-swizterland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-swizterland.com"; sid:555836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.sydney"; sid:555837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tapabocas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tapabocas.com"; sid:555838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxcanada.com"; sid:555839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxplan.com"; sid:555840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxresolution.com"; sid:555841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tax.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tax.solutions"; sid:555842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telethon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telethon.com"; sid:555843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testclassaction.com"; sid:555844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.company"; sid:555845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19--testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19--testing.com"; sid:555846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testingkit.com"; sid:555847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.life"; sid:555848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.life"; sid:555849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitnow.com"; sid:555850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tf.com"; sid:555851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theraphy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theraphy.com"; sid:555852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapy.net"; sid:555853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tldr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tldr.com"; sid:555854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracking.com"; sid:555855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatment.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatment.center"; sid:555856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatment.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatment.clinic"; sid:555857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19--treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19--treatment.com"; sid:555858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatment.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatment.expert"; sid:555859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatment.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatment.guide"; sid:555860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatment.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatment.tips"; sid:555861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trust.com"; sid:555862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustfund.com"; sid:555863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19t-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19t-shirts.com"; sid:555864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-turkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-turkey.com"; sid:555865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uae.com"; sid:555866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usapandemic.com"; sid:555867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.center"; sid:555868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.company"; sid:555869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacs.com"; sid:555870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veterans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veterans.com"; sid:555871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virus2020.com"; sid:555872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscare.com"; sid:555873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscleaner.com"; sid:555874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscleaners.com"; sid:555875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscleaners.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscleaners.house"; sid:555876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruscleaning.com"; sid:555877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusnow.com"; sid:555878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussdefense.com"; sid:555879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19volunteer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19volunteer.net"; sid:555880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vpn.com"; sid:555881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19walmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19walmart.com"; sid:555882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warningsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warningsigns.com"; sid:555883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wasfv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wasfv.com"; sid:555884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19watertreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19watertreatment.com"; sid:555885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wear.net"; sid:555886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatnow.com"; sid:555887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatnowinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatnowinfo.com"; sid:555888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplaceposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplaceposters.com"; sid:555889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workwear.com"; sid:555890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldmemorial.com"; sid:555891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldmonument.com"; sid:555892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldpandemic.com"; sid:555893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldstory.com"; sid:555894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19yoga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19yoga.com"; sid:555895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19z.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19z.com"; sid:555896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019cash.com"; sid:555897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019finance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019finance.com"; sid:555898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019funds.com"; sid:555899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019memorial.com"; sid:555900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020merch.com"; sid:555901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20gearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20gearshop.com"; sid:555902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20lab.com"; sid:555903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21gearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21gearshop.com"; sid:555904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid234.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid234.com"; sid:555905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida-20.com"; sid:555906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida-20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida-20.net"; sid:555907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabbott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabbott.com"; sid:555908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacare.com"; sid:555909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-action.com"; sid:555910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-action.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-action.net"; sid:555911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaction.net"; sid:555912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaffirmations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaffirmations.com"; sid:555913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidguide.com"; sid:555914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidrelief.com"; sid:555915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidall.com"; sid:555916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamins.com"; sid:555917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandmoney.com"; sid:555918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandrealestate.com"; sid:555919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-anxiety.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-anxiety.report"; sid:555920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.net"; sid:555921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidara.com"; sid:555922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartsresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartsresponse.com"; sid:555923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatarstrat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatarstrat.com"; sid:555924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatgetixhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatgetixhealth.com"; sid:555925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedone.com"; sid:555926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelgique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelgique.com"; sid:555927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelgium.com"; sid:555928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbgone.com"; sid:555929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizaid.com"; sid:555930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizfunding.com"; sid:555931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizfunds.com"; sid:555932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-blog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-blog.net"; sid:555933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblooddrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblooddrive.com"; sid:555934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrain.com"; sid:555935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrussels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrussels.com"; sid:555936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessclaim.com"; sid:555937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessloss.com"; sid:555938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessstimulus.com"; sid:555939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbyregion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbyregion.com"; sid:555940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidc19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidc19.com"; sid:555941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantina.com"; sid:555942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.net"; sid:555943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare747.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare747.com"; sid:555944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcares757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcares757.com"; sid:555945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashforcars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashforcars.com"; sid:555946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasual.com"; sid:555947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckbot.com"; sid:555948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaim.net"; sid:555949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsconsulting.com"; sid:555950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcussion.com"; sid:555951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcussions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcussions.com"; sid:555952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvos.com"; sid:555953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronanews.com"; sid:555954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporateresponsibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporateresponsibility.com"; sid:555955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounter.net"; sid:555956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovert.com"; sid:555957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrap.com"; sid:555958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscenter.com"; sid:555959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuts.com"; sid:555960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddallas.com"; sid:555961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatacollective.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatacollective.fyi"; sid:555962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensekit.com"; sid:555963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetroit.com"; sid:555964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddfw.com"; sid:555965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnosisfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnosisfrontline.com"; sid:555966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnosispro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnosispro.com"; sid:555967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscriminationattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscriminationattorney.com"; sid:555968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscriminationlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscriminationlawyer.com"; sid:555969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddispute.com"; sid:555970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddl.com"; sid:555971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddmc.com"; sid:555972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonate.net"; sid:555973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidead.com"; sid:555974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidegrenier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidegrenier.com"; sid:555975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideliveries.com"; sid:555976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-equip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-equip.com"; sid:555977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideurope.com"; sid:555978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideuso.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideuso.club"; sid:555979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsheet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsheet.net"; sid:555980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfield.com"; sid:555981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinders.com"; sid:555982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinish.com"; sid:555983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirings.com"; sid:555984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirings.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirings.net"; sid:555985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedom2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedom2020.com"; sid:555986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedomchachacha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedomchachacha.com"; sid:555987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfund.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfund.world"; sid:555988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgala.com"; sid:555989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidharitasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidharitasi.com"; sid:555990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthdata.com"; sid:555991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthdata.net"; sid:555992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhfh.com"; sid:555993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomescreen.com"; sid:555994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotspot.com"; sid:555995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhrpulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhrpulse.com"; sid:555996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhub.net"; sid:555997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimages.com"; sid:555998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidime.com"; sid:555999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunetest.com"; sid:556000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunisation.com"; sid:556001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunization.com"; sid:556002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfoworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfoworld.com"; sid:556003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryattorney.com"; sid:556004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryclaim.com"; sid:556005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspection.com"; sid:556006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstantscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstantscreen.com"; sid:556007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.insure"; sid:556008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinventions.com"; sid:556009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocracy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocracy.net"; sid:556010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistance.com"; sid:556011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistancing.com"; sid:556012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorces.com"; sid:556013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid.net"; sid:556014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsgirlfriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsgirlfriend.com"; sid:556015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller19.com"; sid:556016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller19.net"; sid:556017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearningcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearningcenter.com"; sid:556018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalguide.com"; sid:556019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlicare.com"; sid:556020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlie.com"; sid:556021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivedata.com"; sid:556022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlive.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlive.watch"; sid:556023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivewatch.com"; sid:556024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloannc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloannc.com"; sid:556025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocalmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocalmap.com"; sid:556026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlytics.com"; sid:556027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanufacturer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanufacturer.com"; sid:556028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapportal.com"; sid:556029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapportal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapportal.net"; sid:556030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskskn95.com"; sid:556031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksn95.com"; sid:556032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasq.com"; sid:556033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsolution.com"; sid:556034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsolutions.com"; sid:556035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsuppliers.com"; sid:556036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicine.net"; sid:556037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedmallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedmallaw.com"; sid:556038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeters.com"; sid:556039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mh.com"; sid:556040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmidwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmidwest.com"; sid:556041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidml.com"; sid:556042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodelling.com"; sid:556043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmolise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmolise.com"; sid:556044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-monsters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-monsters.com"; sid:556045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurphy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurphy.com"; sid:556046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmy.com"; sid:556047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnationalday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnationalday.com"; sid:556048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearyoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearyoy.com"; sid:556049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnesryou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnesryou.com"; sid:556050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneuro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneuro.com"; sid:556051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenclaim.com"; sid:556052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenclaims.com"; sid:556053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteencure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteencure.com"; sid:556054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenhelp.com"; sid:556055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteeninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteeninsurance.com"; sid:556056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenmovie.com"; sid:556057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenpill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenpill.com"; sid:556058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenshot.com"; sid:556059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenshots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenshots.com"; sid:556060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenvaccine.com"; sid:556061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenvac.com"; sid:556062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnj19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnj19.com"; sid:556063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnme.com"; sid:556064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomo.com"; sid:556065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnow.net"; sid:556066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnp.com"; sid:556067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidochsner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidochsner.com"; sid:556068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidohs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidohs.com"; sid:556069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol-50.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol-50.com"; sid:556070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol50.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol50.com"; sid:556071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol-50.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol-50.net"; sid:556072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonation.com"; sid:556073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoos.com"; sid:556074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidosh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidosh.com"; sid:556075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverview.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverview.net"; sid:556076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidow.com"; sid:556077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemonium.com"; sid:556078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparkcities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparkcities.com"; sid:556079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayrollprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayrollprotection.com"; sid:556080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpet.com"; sid:556081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonetest.com"; sid:556082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplots.com"; sid:556083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppi.com"; sid:556084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheck.com"; sid:556085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevention.net"; sid:556086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionposters.com"; sid:556087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpui.com"; sid:556088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqc.com"; sid:556089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-quiz.com"; sid:556090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquotes.com"; sid:556091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidranger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidranger.com"; sid:556092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidranking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidranking.com"; sid:556093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rapidtest.com"; sid:556094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrator.com"; sid:556095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreams.com"; sid:556096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recruitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recruitment.com"; sid:556097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecruitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecruitment.com"; sid:556098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreinvent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreinvent.com"; sid:556099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefbank.com"; sid:556100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefform.com"; sid:556101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembered.com"; sid:556102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenaissance.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenaissance.biz"; sid:556103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseinitiative.com"; sid:556104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrl.com"; sid:556105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyitems.com"; sid:556106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetystickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetystickers.com"; sid:556107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaga.com"; sid:556108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsante.com"; sid:556109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsantesecurite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsantesecurite.com"; sid:556110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscantest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscantest.com"; sid:556111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-screen.com"; sid:556112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshelterinplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshelterinplace.com"; sid:556113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sim.com"; sid:556114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbizloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbizloans.com"; sid:556115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsonly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsonly.com"; sid:556116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsprays.com"; sid:556117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsst.com"; sid:556118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatetesting.com"; sid:556119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatetesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatetesting.net"; sid:556120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats2020.com"; sid:556121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaycation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaycation.com"; sid:556122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilise.com"; sid:556123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusloans.com"; sid:556124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoreonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoreonline.com"; sid:556125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategies.com"; sid:556126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstroke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstroke.com"; sid:556127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvival.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvival.guide"; sid:556128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorcorps.com"; sid:556129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorusa.com"; sid:556130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomcheck.com"; sid:556131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomscheck.com"; sid:556132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsystems.com"; sid:556133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaped.com"; sid:556134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxcoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxcoping.com"; sid:556135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxteam.com"; sid:556136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelahealth.com"; sid:556137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelehealthdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelehealthdirectory.com"; sid:556138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelepsychiatry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelepsychiatry.com"; sid:556139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelethon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelethon.com"; sid:556140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdallas.com"; sid:556141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdfw.com"; sid:556142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingaustin.com"; sid:556143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.center"; sid:556144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingdallas.com"; sid:556145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingdfw.com"; sid:556146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsitega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsitega.com"; sid:556147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmurphy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmurphy.com"; sid:556148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpa.com"; sid:556149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestparkcities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestparkcities.com"; sid:556150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsearch.com"; sid:556151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheclown.com"; sid:556152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-the-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-the-movie.com"; sid:556153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthemusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthemusical.com"; sid:556154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackibg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackibg.com"; sid:556155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackijg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackijg.com"; sid:556156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracking.com"; sid:556157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackng.com"; sid:556158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtradecooperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtradecooperation.com"; sid:556159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraxking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraxking.com"; sid:556160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidttacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidttacking.com"; sid:556161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtuary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtuary.com"; sid:556162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tv.com"; sid:556163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidua.com"; sid:556164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccine-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccine-tracker.com"; sid:556165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacs.com"; sid:556166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvendorcheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvendorcheck.net"; sid:556167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvern.com"; sid:556168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictory.com"; sid:556169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidview.com"; sid:556170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizaer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizaer.com"; sid:556171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.life"; sid:556172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwayne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwayne.com"; sid:556173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwidows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwidows.com"; sid:556174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkwear.com"; sid:556175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldday.com"; sid:556176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldhealth.com"; sid:556177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld.life"; sid:556178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwsusom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwsusom.com"; sid:556179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzip.com"; sid:556180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crewkernecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crewkernecovid-19.com"; sid:556181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisresolve-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisresolve-covid-19.com"; sid:556182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisresolvecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisresolvecovid-19.com"; sid:556183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisisresolvecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisisresolvecovid19.com"; sid:556184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdfightcovid19.com"; sid:556185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csacovid.com"; sid:556186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cupidduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cupidduringcovid.com"; sid:556187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid.today"; sid:556188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curefromcoronavirus.com"; sid:556189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid.com"; sid:556190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidtest.com"; sid:556191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for darbecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"darbecovid-19.com"; sid:556192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data2slowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data2slowcovid19.com"; sid:556193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data2slowcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data2slowcovid19.net"; sid:556194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data2slowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data2slowcovid.com"; sid:556195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data2slowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data2slowcovid.net"; sid:556196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for databasecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"databasecoronavirus.com"; sid:556197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datacorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datacorona.net"; sid:556198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datatoslowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datatoslowcovid19.com"; sid:556199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datatoslowcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datatoslowcovid19.net"; sid:556200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datatoslowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datatoslowcovid.com"; sid:556201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datatoslowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datatoslowcovid.net"; sid:556202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datecorona.com"; sid:556203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingcovid.com"; sid:556204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dawnofthecoronazombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dawnofthecoronazombies.com"; sid:556205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayofcorona.com"; sid:556206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovid-19.com"; sid:556207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovid.net"; sid:556208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleancovid-19.com"; sid:556209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeat-corona.com"; sid:556210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcorona.net"; sid:556211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensalegalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensalegalcovid.com"; sid:556212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delcoronavirus.com"; sid:556213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalpandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalpandemickit.com"; sid:556214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirusattorney.com"; sid:556215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deolhonocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deolhonocorona.com"; sid:556216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descontaminacion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descontaminacion-coronavirus.com"; sid:556217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despidoscoronavirusmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despidoscoronavirusmexico.com"; sid:556218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despidoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despidoscovid19.com"; sid:556219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dev-covidmapportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dev-covidmapportal.com"; sid:556220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for device2curecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"device2curecovid19.com"; sid:556221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for device2treatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"device2treatcovid19.com"; sid:556222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovid.com"; sid:556223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidtest.com"; sid:556224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for did5gcausecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"did5gcausecoronavirus.com"; sid:556225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectants-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectants-coronavirus.com"; sid:556226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectantscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectantscoronavirus.com"; sid:556227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfect-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfect-covid-19.com"; sid:556228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovid19.net"; sid:556229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositivianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositivianticovid.com"; sid:556230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djsforcovid19.com"; sid:556231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmccovid19.com"; sid:556232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmccovid.com"; sid:556233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacovid.com"; sid:556234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dudascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dudascovid.com"; sid:556235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorenlostiemposdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorenlostiemposdecoronavirus.com"; sid:556236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorenlostiemposdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorenlostiemposdelcoronavirus.com"; sid:556237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencyresponsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencyresponsecovid19.com"; sid:556238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirus.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirus.today"; sid:556239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19.today"; sid:556240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endurecorona.com"; sid:556241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicadvisors.com"; sid:556242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsouund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsouund.com"; sid:556243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictraining.com"; sid:556244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicxxx.com"; sid:556245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatecovid.com"; sid:556246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essexcovid.com"; sid:556247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examencoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examencoronavirus.net"; sid:556248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitcorona.com"; sid:556249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastepcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastepcovid19.com"; sid:556250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcoronamask.com"; sid:556251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiftyshadesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiftyshadesofcovid.com"; sid:556252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiftyshadesofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiftyshadesofcovid.net"; sid:556253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid-19.life"; sid:556254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.life"; sid:556255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filtroventilatie-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filtroventilatie-covid19.com"; sid:556256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialplanningaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialplanningaftercovid19.com"; sid:556257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findoutcovid19.com"; sid:556258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaclaim.com"; sid:556259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidlawyer.com"; sid:556260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followthepandemic.com"; sid:556261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthcovid.com"; sid:556262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthcovidtest.com"; sid:556263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxcoronavirus.com"; sid:556264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronacheck.com"; sid:556265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronacheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronacheck.net"; sid:556266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirushelp.com"; sid:556267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19help.com"; sid:556268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fremontwycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fremontwycovid.com"; sid:556269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frenocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frenocoronavirus.com"; sid:556270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frenocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frenocovid19.com"; sid:556271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucoronavirus.club"; sid:556272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundingforcovid19.com"; sid:556273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funds4coronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funds4coronavictims.com"; sid:556274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fyicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fyicoronavirus.com"; sid:556275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamersvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamersvscovid.com"; sid:556276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gastoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gastoncovid.com"; sid:556277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generation-covid19.com"; sid:556278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronahelp.com"; sid:556279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19financialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19financialaid.com"; sid:556280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidgear.com"; sid:556281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidhomerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidhomerelief.com"; sid:556282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsupplies.com"; sid:556283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghanacovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghanacovid19fund.com"; sid:556284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giaitri-online-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giaitri-online-covid19.com"; sid:556285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicfoundation.com"; sid:556286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronagoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronagoo.com"; sid:556287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodnewscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodnewscovid-19.com"; sid:556288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gouv-ca-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gouv-ca-covid19.com"; sid:556289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for growthmindsetforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"growthmindsetforcoronavirus.com"; sid:556290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gsk-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gsk-covid19.com"; sid:556291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gskcovid19.com"; sid:556292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gsscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gsscovid19.com"; sid:556293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hagcorona.com"; sid:556294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveicovid19.com"; sid:556295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcarddcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcarddcovid.com"; sid:556296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for health-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"health-covid19.com"; sid:556297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthdata4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthdata4covid.com"; sid:556298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthdata4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthdata4covid.net"; sid:556299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthdataforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthdataforcovid.com"; sid:556300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthdataforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthdataforcovid.net"; sid:556301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinpandemic.com"; sid:556302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinpandemic.net"; sid:556303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for health-topicscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"health-topicscoronavirus.com"; sid:556304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help4covid19.com"; sid:556305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcenter-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcenter-coronavirus.com"; sid:556306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcoronacrisis.com"; sid:556307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid19.com"; sid:556308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-to-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-to-coronavirus.com"; sid:556309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycovid19.com"; sid:556310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hfhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hfhcovid.com"; sid:556311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hgjcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hgjcovid.com"; sid:556312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highmark-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highmark-covid.com"; sid:556313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiv-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiv-covid19.com"; sid:556314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmrc-govupdate-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmrc-govupdate-covid-19.com"; sid:556315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmrc-refund-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmrc-refund-covid-19.com"; sid:556316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holismandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holismandcovid.com"; sid:556317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeactivitiescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeactivitiescovid19.com"; sid:556318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homelesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homelesscovid.com"; sid:556319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for home-test-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"home-test-covid19.com"; sid:556320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for home-testing-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"home-testing-covid19.com"; sid:556321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horrycountycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horrycountycovidmasks.com"; sid:556322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalitycovid.com"; sid:556323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotworkforce-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotworkforce-covid19.com"; sid:556324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howbadaremycovidsymptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howbadaremycovidsymptom.com"; sid:556325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatthecoronavirus.com"; sid:556326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocopewithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocopewithcovid-19.com"; sid:556327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotestcovid19.com"; sid:556328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovid-19.com"; sid:556329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid.care"; sid:556330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-dont-have-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-dont-have-corona-virus.com"; sid:556331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-dont-have-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-dont-have-covid-19.com"; sid:556332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idrycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idrycorona.com"; sid:556333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idrycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idrycoronavirus.com"; sid:556334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idrycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idrycovid19.com"; sid:556335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idrycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idrycovid.com"; sid:556336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcoronafast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcoronafast.com"; sid:556337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikillcovidfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikillcovidfast.com"; sid:556338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunefromcorona.com"; sid:556339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19sst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19sst.com"; sid:556340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovidsst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovidsst.com"; sid:556341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecorona.net"; sid:556342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumoscovid.com"; sid:556343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancepandemic.com"; sid:556344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcoronaday.com"; sid:556345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationaldayofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationaldayofcorona.com"; sid:556346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthepandemicover.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthepandemicover.net"; sid:556347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istherestillapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istherestillapandemic.com"; sid:556348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus-2020.com"; sid:556349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus-2020.net"; sid:556350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona-virus.net"; sid:556351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19-2020.net"; sid:556352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19pandemic.com"; sid:556353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19pandemic.net"; sid:556354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19usa.com"; sid:556355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedtheworldspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedtheworldspandemic.com"; sid:556356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedwuhanflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedwuhanflu.com"; sid:556357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jailfreepasscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jailfreepasscovid19.com"; sid:556358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jamcovid19.com"; sid:556359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jghcovidappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jghcovidappeal.com"; sid:556360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jnj-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jnj-covid19.com"; sid:556361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jnjcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jnjcovid19.com"; sid:556362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovid19.com"; sid:556363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovidthings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovidthings.com"; sid:556364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kfc-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kfc-covid-19.com"; sid:556365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kfc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kfc-covid19.com"; sid:556366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kfccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kfccovid-19.com"; sid:556367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.net"; sid:556368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickingcovid.net"; sid:556369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill19covid.com"; sid:556370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronav.com"; sid:556371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirus-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirus-nyc.com"; sid:556372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killtimenotpeoplecovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killtimenotpeoplecovid192020.com"; sid:556373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid-19.com"; sid:556374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitprotection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitprotection-covid19.com"; sid:556375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ksacoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ksacoronasurvey.com"; sid:556376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kunstundcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kunstundcorona.com"; sid:556377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidcleaners.com"; sid:556378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagoswillbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagoswillbeatcorona.com"; sid:556379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lahoreagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lahoreagainstcorona.com"; sid:556380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laidoffbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laidoffbycovid.com"; sid:556381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidelcovid19.com"; sid:556382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidellacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidellacovid-19.com"; sid:556383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamorealtempodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamorealtempodelcoronavirus.com"; sid:556384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamorealtempodellacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamorealtempodellacovid-19.com"; sid:556385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestbestclinicalcovidnumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestbestclinicalcovidnumbers.com"; sid:556386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcorona.com"; sid:556387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcoronavirus.com"; sid:556388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnaboutcovid-19.com"; sid:556389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningvscorona.com"; sid:556390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ledlight4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ledlight4covid19.com"; sid:556391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leds4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leds4covid19.com"; sid:556392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightthecovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightthecovid19pandemic.com"; sid:556393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letskickcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letskickcorona.com"; sid:556394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithcovid.com"; sid:556395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for light4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"light4covid19.com"; sid:556396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lightforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lightforcovid19.com"; sid:556397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limitpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limitpandemic.com"; sid:556398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecorona.net"; sid:556399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for live-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"live-covid-19.com"; sid:556400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19map.com"; sid:556401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid.net"; sid:556402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livedthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livedthrucovid.com"; sid:556403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingaftercorona.com"; sid:556404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loancoronavirus.com"; sid:556405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncoronavirusclinic.com"; sid:556406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovid19clinic.com"; sid:556407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovidclinic.com"; sid:556408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losecoronaweight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losecoronaweight.com"; sid:556409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovebeatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovebeatscovid.com"; sid:556410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.coach"; sid:556411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.dating"; sid:556412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronaviruspodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronaviruspodcast.com"; sid:556413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovidpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovidpodcast.com"; sid:556414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofsarscovid2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofsarscovid2.com"; sid:556415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ma3corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ma3corona.com"; sid:556416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mafia-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mafia-corona.net"; sid:556417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makerscovidrota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makerscovidrota.com"; sid:556418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managing-stress-anxiety-thru-covid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managing-stress-anxiety-thru-covid-19.life"; sid:556419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managing-stress-anxiety-thru-covid-19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managing-stress-anxiety-thru-covid-19.solutions"; sid:556420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managing-stress-anxiety-thru-covid-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managing-stress-anxiety-thru-covid-19.today"; sid:556421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-covid19.net"; sid:556422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks4covid.com"; sid:556423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-covid.com"; sid:556424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicai-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicai-covid-19.com"; sid:556425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmasksforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmasksforcoronavirus.com"; sid:556426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidasdeapoiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidasdeapoiocovid19.com"; sid:556427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcoronavirus.com"; sid:556428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for merck-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"merck-covid19.com"; sid:556429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for merckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"merckcovid19.com"; sid:556430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexvscovid19.com"; sid:556431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mhcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mhcovid19.com"; sid:556432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirusattorney.com"; sid:556433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid.com"; sid:556434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidlawyer.com"; sid:556435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovid.com"; sid:556436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for midwestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"midwestcovid.com"; sid:556437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mietwagencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mietwagencorona.com"; sid:556438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronavirusuvdisinfectioncompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronavirusuvdisinfectioncompany.com"; sid:556439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid-19test.com"; sid:556440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid-19testing.com"; sid:556441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtesting.com"; sid:556442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moeblierte-wohnung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moeblierte-wohnung-corona.com"; sid:556443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for murphycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"murphycovid.com"; sid:556444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for murphycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"murphycovidtest.com"; sid:556445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutantcoronavirus.com"; sid:556446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronajourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronajourney.com"; sid:556447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaonline.com"; sid:556448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatrials.com"; sid:556449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusloan.com"; sid:556450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavlog2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavlog2020.com"; sid:556451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19hero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19hero.com"; sid:556452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19heroes.com"; sid:556453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19money.com"; sid:556454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19rights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19rights.com"; sid:556455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19stories.com"; sid:556456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidkits.com"; sid:556457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrx.com"; sid:556458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidshot.com"; sid:556459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidsymptoms.com"; sid:556460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata2slowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata2slowcovid19.com"; sid:556461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata2slowcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata2slowcovid19.net"; sid:556462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata2slowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata2slowcovid.com"; sid:556463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata2slowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata2slowcovid.net"; sid:556464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata4covid19.com"; sid:556465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata4covid19.net"; sid:556466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata4covid.com"; sid:556467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydata4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydata4covid.net"; sid:556468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydataforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydataforcovid19.com"; sid:556469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydataforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydataforcovid19.net"; sid:556470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydataforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydataforcovid.com"; sid:556471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydataforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydataforcovid.net"; sid:556472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myjourneywithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myjourneywithcovid19.com"; sid:556473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmaskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmaskforsale.com"; sid:556474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nahetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nahetcoronavirus.com"; sid:556475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nanocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nanocoronavirus.com"; sid:556476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nanocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nanocovid19.com"; sid:556477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccoronavirusloan.com"; sid:556478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovidloan.com"; sid:556479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovidreliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovidreliefloan.com"; sid:556480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19-supplies.com"; sid:556481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidlive.com"; sid:556482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyage-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyage-covid19.com"; sid:556483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyage-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyage-covid19.net"; sid:556484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyagecovid.com"; sid:556485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevercovid.com"; sid:556486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextactcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextactcovid19.com"; sid:556487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronalawyer.com"; sid:556488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidlawyer.com"; sid:556489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2fightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2fightcovid19.com"; sid:556490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobodylikescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobodylikescovid.com"; sid:556491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavid.com"; sid:556492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaworld.com"; sid:556493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noforcovid19.com"; sid:556494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notgetcoronavirussteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notgetcoronavirussteps.com"; sid:556495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novartis-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novartis-covid19.com"; sid:556496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novartiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novartiscovid19.com"; sid:556497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nricoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nricoronahelp.com"; sid:556498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursecorona.com"; sid:556499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycagainstcorona.com"; sid:556500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidattorney.com"; sid:556501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidcleaners.com"; sid:556502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidlawyers.com"; sid:556503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycwekillcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycwekillcovid-19.com"; sid:556504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nymscovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nymscovidresources.com"; sid:556505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ochsnercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ochsnercovid.com"; sid:556506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid.com"; sid:556507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohscovid.com"; sid:556508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronavirusattorney.com"; sid:556509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronaviruslawyer.com"; sid:556510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidattorney.com"; sid:556511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ok-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ok-covid.com"; sid:556512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidlawyer.com"; sid:556513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omanagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omanagainstcorona.com"; sid:556514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omancoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omancoronasurvey.com"; sid:556515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecovid19.com"; sid:556516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcorona.com"; sid:556517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid.com"; sid:556518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onetypeofcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onetypeofcovidvirus.com"; sid:556519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovid19solutions.com"; sid:556520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecovid.com"; sid:556521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcrushcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcrushcovid19.com"; sid:556522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationx-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationx-covid.com"; sid:556523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationxcovid.com"; sid:556524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oshcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oshcovid.com"; sid:556525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid-19hero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid-19hero.com"; sid:556526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid-19heroes.com"; sid:556527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid-19stories.com"; sid:556528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidstories.com"; sid:556529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outbreakcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outbreakcovid-19.com"; sid:556530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingcovid19.com"; sid:556531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pa-covid19.com"; sid:556532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvising.com"; sid:556533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicarmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicarmor.com"; sid:556534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicasa.com"; sid:556535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicassistance.com"; sid:556536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbreadcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbreadcompany.com"; sid:556537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-chic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-chic.com"; sid:556538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.clinic"; sid:556539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccompassion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccompassion.com"; sid:556540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccookbook.com"; sid:556541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoronavirus.net"; sid:556542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdatacommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdatacommons.com"; sid:556543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdatacommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdatacommons.net"; sid:556544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdomainawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdomainawareness.com"; sid:556545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdomainawareness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdomainawareness.net"; sid:556546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicentertainmentnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicentertainmentnetwork.com"; sid:556547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-express.com"; sid:556548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfight.com"; sid:556549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfit.com"; sid:556550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-fitness.com"; sid:556551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthadvisors.com"; sid:556552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthfoundation.com"; sid:556553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimages.com"; sid:556554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimmunity.com"; sid:556555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicins.com"; sid:556556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancedispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancedispute.com"; sid:556557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancedisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancedisputes.com"; sid:556558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifeadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifeadvisors.com"; sid:556559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifefoundation.com"; sid:556560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclivecam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclivecam.com"; sid:556561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclivecams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclivecams.com"; sid:556562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpantryblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpantryblog.com"; sid:556563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparadox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparadox.com"; sid:556564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpay.com"; sid:556565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicponderings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicponderings.com"; sid:556566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreptime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreptime.com"; sid:556567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproduct.com"; sid:556568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofitz.com"; sid:556569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprospecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprospecting.com"; sid:556570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstressdisorder.com"; sid:556571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvival2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvival2020.com"; sid:556572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalbooks.com"; sid:556573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalprep.com"; sid:556574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteledentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteledentistry.com"; sid:556575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictradecooperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictradecooperation.com"; sid:556576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrainers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrainers.com"; sid:556577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicunemploymenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicunemploymenthelp.com"; sid:556578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirus.net"; sid:556579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvolunteer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvolunteer.net"; sid:556580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvolunteers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvolunteers.net"; sid:556581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-wellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-wellness.com"; sid:556582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworkouts.com"; sid:556583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiecovid-19.com"; sid:556584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingduringcovid19.com"; sid:556585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parkcitiescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parkcitiescovid.com"; sid:556586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parkcitiescovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parkcitiescovidtest.com"; sid:556587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passcorona.com"; sid:556588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovideupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovideupdate.com"; sid:556589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovidupates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovidupates.com"; sid:556590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedulicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedulicovid19.com"; sid:556591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petaviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petaviruscorona.com"; sid:556592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pfizer-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pfizer-covid19.com"; sid:556593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pfizercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pfizercovid19.com"; sid:556594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacoronashield.com"; sid:556595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phonecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phonecovidtest.com"; sid:556596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformadeafectadosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformadeafectadosporcoronavirus.com"; sid:556597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformadeafectadosporcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformadeafectadosporcoronavirus.net"; sid:556598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformalegalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformalegalcoronavirus.com"; sid:556599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusbusiness.com"; sid:556600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.expert"; sid:556601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19lung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19lung.com"; sid:556602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-19.net"; sid:556603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.net"; sid:556604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.solutions"; sid:556605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-covid-19.com"; sid:556606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforhopecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforhopecovid19.com"; sid:556607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforvisioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforvisioncovid19.com"; sid:556608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predict-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predict-corona.com"; sid:556609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepforpandemics.com"; sid:556610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidentpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidentpandemic.com"; sid:556611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaviruslosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaviruslosangeles.com"; sid:556612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proforma-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proforma-covid19.com"; sid:556613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbaselinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbaselinecovid19.com"; sid:556614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectpandemic.com"; sid:556615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectpandemic.net"; sid:556616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid19.com"; sid:556617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivegearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivegearcoronavirus.com"; sid:556618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteggitidalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteggitidalcovid.com"; sid:556619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proyectoproteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proyectoproteccioncoronavirus.com"; sid:556620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proyectoproteccioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proyectoproteccioncoronavirus.net"; sid:556621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qatarcoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qatarcoronasurvey.com"; sid:556622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantaene-unterkunft-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantaene-unterkunft-corona.com"; sid:556623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queridocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queridocoronavirus.com"; sid:556624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktest-corona.com"; sid:556625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronavirustestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronavirustestingkit.com"; sid:556626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidanalytics.com"; sid:556627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rea-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rea-covid.com"; sid:556628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for real-corona-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"real-corona-stats.com"; sid:556629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestateaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestateaftercovid19.com"; sid:556630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestateincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestateincoronavirus.com"; sid:556631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestateincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestateincovid19.com"; sid:556632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecoronavirustest.com"; sid:556633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecovid19test.com"; sid:556634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebootfromcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebootfromcovid19.cloud"; sid:556635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebootfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebootfromcovid19.com"; sid:556636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionadministracioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionadministracioncovid.com"; sid:556637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacioncovid.com"; sid:556638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redapoyoprevenircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redapoyoprevenircovid19.com"; sid:556639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registercorona.com"; sid:556640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4covid19.com"; sid:556641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remedycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remedycovid19.com"; sid:556642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercoronavirusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercoronavirusbill.com"; sid:556643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercoronavirusbill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercoronavirusbill.net"; sid:556644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renfort-covid-paca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renfort-covid-paca.com"; sid:556645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reveal-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reveal-covid-19.com"; sid:556646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for revealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"revealcovid19.com"; sid:556647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rideforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rideforcovid19.com"; sid:556648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridetoconquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridetoconquercovid19.com"; sid:556649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riseofthecoronazombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riseofthecoronazombies.com"; sid:556650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roche-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roche-covid19.com"; sid:556651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ruhlcovidtulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ruhlcovidtulsa.com"; sid:556652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runforcovid19.com"; sid:556653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runtoconquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runtoconquercovid19.com"; sid:556654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saberviewcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saberviewcorona.com"; sid:556655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid.com"; sid:556656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safezonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safezonecovid.com"; sid:556657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocovidcleaners.com"; sid:556658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizeforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizeforcovid19.com"; sid:556659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanmigueldeallendecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanmigueldeallendecovid19.com"; sid:556660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanofi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanofi-covid19.com"; sid:556661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanoficovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanoficovid19.com"; sid:556662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santecovid.com"; sid:556663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santesecuritecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santesecuritecovid.com"; sid:556664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-cov-2-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-cov-2-covid19.com"; sid:556665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacorona.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacorona.loan"; sid:556666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacorona.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacorona.loans"; sid:556667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-covid19.com"; sid:556668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scancovid19.com"; sid:556669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scarsin-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scarsin-covid.com"; sid:556670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcovidcleaners.com"; sid:556671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfemployedcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfemployedcovidmoney.com"; sid:556672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellinginthetimeofcorona.com"; sid:556673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sentenciascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sentenciascovid.com"; sid:556674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serologie-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serologie-covid19.com"; sid:556675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicecovid.com"; sid:556676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicecovidsst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicecovidsst.com"; sid:556677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicescovidsst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicescovidsst.com"; sid:556678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid19healthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid19healthdata.com"; sid:556679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid19healthdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid19healthdata.net"; sid:556680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovidhealthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovidhealthdata.com"; sid:556681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovidhealthdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovidhealthdata.net"; sid:556682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharedata4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharedata4covid.com"; sid:556683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharedata4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharedata4covid.net"; sid:556684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharedataforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharedataforcovid.com"; sid:556685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharedataforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharedataforcovid.net"; sid:556686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcovid19.com"; sid:556687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcorona.net"; sid:556688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidclothes.com"; sid:556689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplepawncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplepawncovid19.com"; sid:556690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid19now.com"; sid:556691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid19now.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid19now.net"; sid:556692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovidnow.com"; sid:556693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovidnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovidnow.net"; sid:556694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid-sharedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid-sharedata.com"; sid:556695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovid-sharedata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovid-sharedata.net"; sid:556696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smacovid19.com"; sid:556697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbizcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbizcovid19relief.com"; sid:556698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovid19relief.com"; sid:556699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smcoronavirusinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smcoronavirusinsights.com"; sid:556700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialerasecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialerasecovid.com"; sid:556701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutioncorona.com"; sid:556702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solveforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solveforcovid-19.com"; sid:556703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscovid19fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscovid19fight.com"; sid:556704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sstcovid.com"; sid:556705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffnewscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffnewscovid.com"; sid:556706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for status-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"status-corona.com"; sid:556707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomeactivities-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomeactivities-covid19.com"; sid:556708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stimuluspackagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stimuluspackagecovid19.com"; sid:556709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19now.com"; sid:556710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.today"; sid:556711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storecovid19.com"; sid:556712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiescoronavirus.com"; sid:556713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesfromhomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesfromhomecovid19.com"; sid:556714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcovid.com"; sid:556715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studyduringcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studyduringcovid-19.net"; sid:556716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sturnewtoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sturnewtoncovid19.com"; sid:556717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for subsidiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"subsidiocovid19.com"; sid:556718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportcovidfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportcovidfrontline.com"; sid:556719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportingcovid-19.com"; sid:556720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona.club"; sid:556721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorof2020pandemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorof2020pandemic.biz"; sid:556722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftcovid.com"; sid:556723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftcovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftcovidtreatment.com"; sid:556724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftcovidtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftcovidtreatments.com"; sid:556725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swisscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swisscovid.com"; sid:556726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcoronaviruses.com"; sid:556727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofhumancoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofhumancoronaviruses.com"; sid:556728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoncovid-19.com"; sid:556729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeoncovid.com"; sid:556730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taklukancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taklukancorona.com"; sid:556731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkcoronatome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkcoronatome.com"; sid:556732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techvscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techvscorona.net"; sid:556733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teddyvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teddyvscoronavirus.com"; sid:556734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testalabamacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testalabamacovid-19.com"; sid:556735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronarisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronarisk.com"; sid:556736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcorona.today"; sid:556737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid-19-a-domicile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid-19-a-domicile.com"; sid:556738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidbol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidbol.com"; sid:556739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidrapido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidrapido.com"; sid:556740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teste-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teste-covid19.com"; sid:556741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-covid19.com"; sid:556742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-priority-one-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-priority-one-covid19.com"; sid:556743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit4covid19.com"; sid:556744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankstothecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankstothecoronavirus.com"; sid:556745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticoronavirusshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticoronavirusshop.com"; sid:556746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycoronavirusclinic.com"; sid:556747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycovid19clinic.com"; sid:556748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycovidclinic.com"; sid:556749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theclassofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theclassofcovid-19.com"; sid:556750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaboomers.com"; sid:556751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacookbook.com"; sid:556752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafixer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafixer.com"; sid:556753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafund.com"; sid:556754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-pandemic.com"; sid:556755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasanction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasanction.com"; sid:556756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasummit.com"; sid:556757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaupdates.com"; sid:556758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscare.com"; sid:556759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscures.net"; sid:556760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnaughtystep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnaughtystep.com"; sid:556761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusninja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusninja.com"; sid:556762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus-pandemic.com"; sid:556763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussucks.com"; sid:556764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawarrior.com"; sid:556765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.club"; sid:556766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19international.com"; sid:556767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19-pandemic.com"; sid:556768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19project.com"; sid:556769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19treatment.com"; sid:556770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbeard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbeard.com"; sid:556771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchronicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchronicals.com"; sid:556772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmemorial.com"; sid:556773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theeffectsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theeffectsofcovid19.com"; sid:556774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theheroesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theheroesofcovid19.com"; sid:556775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncoronavirusclinic.com"; sid:556776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncovid19clinic.com"; sid:556777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncovidclinic.com"; sid:556778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theotherpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theotherpandemic.com"; sid:556779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemichub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemichub.com"; sid:556780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicnews.com"; sid:556781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicparadox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicparadox.com"; sid:556782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicproducts.com"; sid:556783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theracovid.com"; sid:556784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapycovid19.com"; sid:556785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for these-corona-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"these-corona-times.com"; sid:556786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesocialmediaepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesocialmediaepidemic.com"; sid:556787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theuscovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theuscovidtracker.com"; sid:556788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanviruss.com"; sid:556789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thingstodoafterthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thingstodoafterthepandemic.com"; sid:556790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisisapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisisapandemic.com"; sid:556791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for time-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"time-after-corona.com"; sid:556792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncoronaspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncoronaspeak.com"; sid:556793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocorona.com"; sid:556794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocovid19.com"; sid:556795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomcooperthecoronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomcooperthecoronavirusdiaries.com"; sid:556796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovid19now.com"; sid:556797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecovidnow.com"; sid:556798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19spread.com"; sid:556799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackthepandemic.com"; sid:556800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamentocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamentocoronavirus.com"; sid:556801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatment4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatment4covid19.com"; sid:556802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentcovid-19.info"; sid:556803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronadeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronadeaths.com"; sid:556804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronavirusdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronavirusdisaster.com"; sid:556805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-covid-19-disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-covid-19-disaster.com"; sid:556806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-covid-19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-covid-19disaster.com"; sid:556807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-covid19-disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-covid19-disaster.com"; sid:556808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-covid19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-covid19disaster.com"; sid:556809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid-19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid-19disaster.com"; sid:556810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid19disaster.com"; sid:556811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthofcovid-19.com"; sid:556812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthofcovid19.com"; sid:556813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for typesofcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"typesofcovidvirus.com"; sid:556814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for typesofcovidviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"typesofcovidviruses.com"; sid:556815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for typesofhumancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"typesofhumancoronavirus.com"; sid:556816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for typesofhumancoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"typesofhumancoronaviruses.com"; sid:556817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uaecoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uaecoronasurvey.com"; sid:556818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontraocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontraocoronavirus.com"; sid:556819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontraocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontraocovid19.com"; sid:556820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-covid19.com"; sid:556821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcleaners.com"; sid:556822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvandcorona.com"; sid:556823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovidsupplies.com"; sid:556824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimascovid-19.com"; sid:556825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronavolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronavolunteer.com"; sid:556826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusncovid.com"; sid:556827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virustrackercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virustrackercovid19.com"; sid:556828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruswuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruswuhan.net"; sid:556829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerpandemic.com"; sid:556830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerpandemic.net"; sid:556831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerscoronavirus.com"; sid:556832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerscovid19.com"; sid:556833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerspandemic.com"; sid:556834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volunteerspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volunteerspandemic.net"; sid:556835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallmartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallmartcovid19.com"; sid:556836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walmartcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walmartcoronavirus.com"; sid:556837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walmartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walmartcovid19.com"; sid:556838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waynecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waynecovid.com"; sid:556839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearestrongerthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearestrongerthancovid19.com"; sid:556840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovidsulteng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovidsulteng.com"; sid:556841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatthecoronavirus.com"; sid:556842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecucorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecucorona.net"; sid:556843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecucoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecucoronavirus.net"; sid:556844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecucovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecucovid-19.net"; sid:556845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecucovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecucovid19.net"; sid:556846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecucovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecucovid.net"; sid:556847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecurecovid19.com"; sid:556848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcoronavirusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcoronavirusnyc.com"; sid:556849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcoronavirusnyc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcoronavirusnyc.net"; sid:556850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovid-19nyc.com"; sid:556851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wellnessinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wellnessinthetimeofcorona.com"; sid:556852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weremembercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weremembercovid.com"; sid:556853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whathappenscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whathappenscoronavirus.com"; sid:556854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid20.com"; sid:556855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whodiedfromthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whodiedfromthecoronavirus.com"; sid:556856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoisyourcoronahero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoisyourcoronahero.com"; sid:556857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wholesalecoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wholesalecoronaviruskits.com"; sid:556858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wholesalecovid19kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wholesalecovid19kits.com"; sid:556859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid-19.com"; sid:556860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withoutcorona.com"; sid:556861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wokecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wokecovid19.com"; sid:556862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronalive.com"; sid:556863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid-19forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid-19forum.com"; sid:556864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worlddayofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worlddayofcorona.com"; sid:556865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldhelp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldhelp-coronavirus.com"; sid:556866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwar3covid19usvschina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwar3covid19usvschina.com"; sid:556867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarlllcovid19invasion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarlllcovid19invasion.com"; sid:556868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarlllinvasionofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarlllinvasionofcovid19.com"; sid:556869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for writinginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"writinginthetimeofcorona.com"; sid:556870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wsusomcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wsusomcovid.com"; sid:556871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbiologicalweapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbiologicalweapon.com"; sid:556872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbuddybox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbuddybox.com"; sid:556873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanclan.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanclan.life"; sid:556874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansoupkitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansoupkitchen.com"; sid:556875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantaojiankang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantaojiankang.com"; sid:556876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanweapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanweapon.com"; sid:556877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwheeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwheeze.com"; sid:556878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyouka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyouka.com"; sid:556879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronavirusnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronavirusnewsnow.com"; sid:556880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-coronavirus.com"; sid:556881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid.net"; sid:556882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covidoperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covidoperation.com"; sid:556883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mblierte-wohnung-corona-7kc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mblierte-wohnung-corona-7kc.com"; sid:556884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--quarantne-unterkunft-corona-hkc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--quarantne-unterkunft-corona-hkc.com"; sid:556885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronamasks.com"; sid:556886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusloan.com"; sid:556887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19loan.com"; sid:556888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19reliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19reliefloan.com"; sid:556889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidstories.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidstories.net"; sid:556890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zambia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zambia-covid19.com"; sid:556891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcovid-19.com"; sid:556892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeit-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeit-nach-corona.com"; sid:556893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiesandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiesandcoronavirus.com"; sid:556894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1888corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1888corona19.com"; sid:556895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1888covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1888covid19.com"; sid:556896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covids.com"; sid:556897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcovid.com"; sid:556898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020epidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020epidemic.net"; sid:556899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covid19ppe.com"; sid:556900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 501c3covidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"501c3covidaid.com"; sid:556901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7mythsaboutcoronavirus.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7mythsaboutcoronavirus.fail"; sid:556902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ablcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ablcovid19.com"; sid:556903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actu-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actu-corona.com"; sid:556904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.life"; sid:556905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronav.com"; sid:556906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.life"; sid:556907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.life"; sid:556908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajutorcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajutorcovid19.net"; sid:556909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albertafightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albertafightscovid.com"; sid:556910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliviocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliviocovid19.com"; sid:556911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all24info-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all24info-covid19.com"; sid:556912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amendecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amendecovid19.com"; sid:556913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amendecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amendecovid.com"; sid:556914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronasupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronasupply.com"; sid:556915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.pro"; sid:556916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.supplies"; sid:556917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.center"; sid:556918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidgloves.com"; sid:556919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidiot.com"; sid:556920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidiots.com"; sid:556921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.zone"; sid:556922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applysbacoronavirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applysbacoronavirusaid.com"; sid:556923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovid.com"; sid:556924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistesactioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistesactioncovid.com"; sid:556925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciafinancieracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciafinancieracovid19.com"; sid:556926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcovid.com"; sid:556927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atemschutzmasken-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atemschutzmasken-corona.com"; sid:556928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidinfo.com"; sid:556929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovidinfo.com"; sid:556930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austin-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austin-covid19.com"; sid:556931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid19.com"; sid:556932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid19.net"; sid:556933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid.com"; sid:556934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autodenunciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autodenunciacovid.com"; sid:556935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronainfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronainfection.com"; sid:556936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronaviruswithsara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronaviruswithsara.com"; sid:556937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avvocato-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avvocato-coronavirus.com"; sid:556938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awaycorona.com"; sid:556939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaeconomicacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaeconomicacovid19.com"; sid:556940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for az-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"az-covid.com"; sid:556941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcovid-19.com"; sid:556942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcovid19.com"; sid:556943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedandbrakfastcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedandbrakfastcoronavirusfree.com"; sid:556944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedandbreakfastcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedandbreakfastcoronavirusfree.com"; sid:556945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedandbreakfastcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedandbreakfastcovid19free.com"; sid:556946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19memes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19memes.com"; sid:556947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betcorona1399.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betcorona1399.com"; sid:556948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bezcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bezcovid.com"; sid:556949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcoronakebaad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcoronakebaad.com"; sid:556950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bibliografiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bibliografiacovid.com"; sid:556951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bilan-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bilan-coronavirus.com"; sid:556952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgatespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgatespandemic.com"; sid:556953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgatespandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgatespandemics.com"; sid:556954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billionairesagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billionairesagainstcovid19.com"; sid:556955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billionairesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billionairesforcorona.com"; sid:556956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bingcovid19.com"; sid:556957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackswancoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackswancoronavirus.biz"; sid:556958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcoronavirus.cloud"; sid:556959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bnbcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bnbcorona.com"; sid:556960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bnbcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bnbcoronavirusfree.com"; sid:556961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boholcovidportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boholcovidportal.com"; sid:556962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid-19.com"; sid:556963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btccorona.com"; sid:556964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buffalocoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buffalocoronabusters.com"; sid:556965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19masks.net"; sid:556966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19protection.com"; sid:556967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidfacemasks.com"; sid:556968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bylinecovidloanrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bylinecovidloanrelief.com"; sid:556969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bylinesbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bylinesbacovid19.com"; sid:556970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c4corona.com"; sid:556971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidhelp.com"; sid:556972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidlaw.com"; sid:556973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidlawyer.com"; sid:556974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambodia-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambodia-covid.com"; sid:556975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancovid.com"; sid:556976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canwestopcovidyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canwestopcovidyes.com"; sid:556977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardio4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardio4covid.com"; sid:556978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdandcorona.com"; sid:556979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cccovid.com"; sid:556980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19busters.com"; sid:556981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcommons.com"; sid:556982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcommons.net"; sid:556983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovidaid.com"; sid:556984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchescovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchescovidaid.com"; sid:556985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencorona.com"; sid:556986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencoronavirustaskforce.com"; sid:556987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cjcoronawatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cjcoronawatch.com"; sid:556988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimsoncovid19.com"; sid:556989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classcovid19.com"; sid:556990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothesforcorona.com"; sid:556991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronazon.com"; sid:556992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codecovid19.com"; sid:556993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codigocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codigocovid19.com"; sid:556994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collincovidivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collincovidivorce.com"; sid:556995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19.life"; sid:556996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprartestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprartestcoronavirus.com"; sid:556997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecovid-19virus.com"; sid:556998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerthecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerthecovid19virus.com"; sid:556999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controllingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controllingcovid.com"; sid:557000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolincorona.com"; sid:557001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcoronawithnopants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcoronawithnopants.com"; sid:557002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovidwithnopants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovidwithnopants.com"; sid:557003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coraandthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coraandthecorona.com"; sid:557004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1000.com"; sid:557005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19diy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19diy.com"; sid:557006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19india.com"; sid:557007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19liveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19liveupdates.com"; sid:557008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-x.com"; sid:557009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19x.com"; sid:557010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-20.com"; sid:557011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabc.com"; sid:557012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaauthors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaauthors.com"; sid:557013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabakiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabakiye.com"; sid:557014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabarriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabarriers.com"; sid:557015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablogspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablogspot.com"; sid:557016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabold.com"; sid:557017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrev.com"; sid:557018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabucs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabucs.com"; sid:557019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-busters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-busters.net"; sid:557020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabycountry.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabycountry.club"; sid:557021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarev19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarev19.com"; sid:557022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesindia.com"; sid:557023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacastlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacastlive.com"; sid:557024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasualty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasualty.com"; sid:557025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation-usa.com"; sid:557026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationusa.net"; sid:557027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-central.com"; sid:557028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachaintracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachaintracker.com"; sid:557029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachr.com"; sid:557030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide.guru"; sid:557031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacircles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacircles.com"; sid:557032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimflorida.com"; sid:557033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactionla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactionla.com"; sid:557034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanconstruction.com"; sid:557035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningwipes.com"; sid:557036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanwipes.com"; sid:557037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubbing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubbing.com"; sid:557038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoaching.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoaching.co.uk"; sid:557039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoalation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoalation.com"; sid:557040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanions.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanions.world"; sid:557041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompfort.com"; sid:557042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconomy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconomy.net"; sid:557043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontroled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontroled.com"; sid:557044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconversion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconversion.com"; sid:557045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacostumestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacostumestore.com"; sid:557046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19blogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19blogs.com"; sid:557047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacures.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacures.club"; sid:557048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaily.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaily.net"; sid:557049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefeated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefeated.com"; sid:557050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevise.com"; sid:557051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadia.com"; sid:557052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadis.com"; sid:557053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecleaners.com"; sid:557054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectionservice.com"; sid:557055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocumentaryfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocumentaryfilm.com"; sid:557056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrinking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrinking.com"; sid:557057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrive.net"; sid:557058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-driving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-driving.com"; sid:557059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriving.com"; sid:557060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-driving.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-driving.net"; sid:557061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriving.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriving.net"; sid:557062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-enemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-enemy.com"; sid:557063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinish.com"; sid:557064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafordeathuman7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafordeathuman7.com"; sid:557065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoundations.com"; sid:557066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedance.com"; sid:557067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeshirts.com"; sid:557068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrenzy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrenzy.com"; sid:557069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafyi.com"; sid:557070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-glas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-glas.com"; sid:557071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-glasschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-glasschutz.com"; sid:557072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-glasschutzwand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-glasschutzwand.com"; sid:557073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalreport.com"; sid:557074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronago.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronago.net"; sid:557075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagovloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagovloan.com"; sid:557076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagovloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagovloans.com"; sid:557077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-green.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-green.com"; sid:557078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguideforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguideforbusiness.com"; sid:557079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguidefordealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguidefordealers.com"; sid:557080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunlerindeask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunlerindeask.com"; sid:557081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalloween.com"; sid:557082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahcheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahcheros.com"; sid:557083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-wor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-wor.com"; sid:557084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidgov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidgov.com"; sid:557085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidusa.com"; sid:557086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainventions.com"; sid:557087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainwuhan7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainwuhan7.com"; sid:557088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-job.com"; sid:557089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakehero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakehero.com"; sid:557090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakids.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakids.club"; sid:557091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakids.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakids.life"; sid:557092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidstimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidstimes.com"; sid:557093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidtimes.com"; sid:557094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakisachai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakisachai.com"; sid:557095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitsafe.com"; sid:557096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakontoll-mail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakontoll-mail.com"; sid:557097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalavita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalavita.com"; sid:557098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaldtrump.com"; sid:557099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegend.com"; sid:557100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legenden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legenden.com"; sid:557101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-legends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-legends.com"; sid:557102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegends.com"; sid:557103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalift.com"; sid:557104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliterature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliterature.com"; sid:557105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliterature.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliterature.net"; sid:557106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivecase.com"; sid:557107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanapp.com"; sid:557108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loan-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loan-assistance.com"; sid:557109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloangov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloangov.com"; sid:557110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagetan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagetan.com"; sid:557111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaid.com"; sid:557112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamakers-cr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamakers-cr.com"; sid:557113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasken24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasken24.com"; sid:557114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksnow.com"; sid:557115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamastermind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamastermind.com"; sid:557116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamecrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamecrazy.com"; sid:557117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicin.com"; sid:557118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamentalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamentalcare.com"; sid:557119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiami.com"; sid:557120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamomma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamomma.com"; sid:557121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovies.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovies.club"; sid:557122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovies.net"; sid:557123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsca.com"; sid:557124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-newyork.com"; sid:557125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanormality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanormality.com"; sid:557126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverparty.com"; sid:557127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverparty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverparty.net"; sid:557128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapayrollloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapayrollloans.com"; sid:557129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaybookforbusineness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaybookforbusineness.com"; sid:557130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaybookfordealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaybookfordealers.com"; sid:557131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoker.club"; sid:557132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-psychotherapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-psychotherapie.com"; sid:557133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefinance.com"; sid:557134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieffunds.com"; sid:557135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefsupplies.com"; sid:557136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareparations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareparations.com"; sid:557137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-research-group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-research-group.com"; sid:557138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchgroup.com"; sid:557139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresistent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresistent.com"; sid:557140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarockme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarockme.com"; sid:557141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarockwithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarockwithme.com"; sid:557142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasastra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasastra.com"; sid:557143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbagrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbagrant.com"; sid:557144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbagrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbagrants.com"; sid:557145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnell-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnell-test.com"; sid:557146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltestnow.com"; sid:557147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz.pro"; sid:557148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashank.com"; sid:557149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppy.com"; sid:557150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasitrep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasitrep.com"; sid:557151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbusinesshelp.com"; sid:557152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasos.net"; sid:557153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasquad.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasquad.education"; sid:557154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassance.com"; sid:557155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassance.photos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassance.photos"; sid:557156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassistance.com"; sid:557157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastandart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastandart.com"; sid:557158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatustr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatustr.com"; sid:557159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastayhome.com"; sid:557160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulusloans.com"; sid:557161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulusmoney.com"; sid:557162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrophic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrophic.com"; sid:557163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuccess.com"; sid:557164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupport.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupport.biz"; sid:557165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportblog.com"; sid:557166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportcenter.com"; sid:557167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportcenter.net"; sid:557168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportservice.com"; sid:557169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathis.com"; sid:557170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracked.com"; sid:557171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatmentindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatmentindia.com"; sid:557172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatx.net"; sid:557173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatycoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatycoon.com"; sid:557174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav8.com"; sid:557175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcf.com"; sid:557176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversatile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversatile.com"; sid:557177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimsfund.com"; sid:557178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruhelp.com"; sid:557179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirun.com"; sid:557180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus180.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus180.com"; sid:557181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.pro"; sid:557182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaid.club"; sid:557183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidreliefandeconomicsecurityact2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidreliefandeconomicsecurityact2020.com"; sid:557184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbania.com"; sid:557185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalerter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalerter.com"; sid:557186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapex.com"; sid:557187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarmonk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarmonk.com"; sid:557188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbesafekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbesafekit.com"; sid:557189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrand.com"; sid:557190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-brazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-brazil.com"; sid:557191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildingcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildingcleaner.com"; sid:557192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildingcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildingcleaners.com"; sid:557193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscontinuity.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscontinuity.tips"; sid:557194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesssbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesssbaloans.com"; sid:557195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalmness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalmness.com"; sid:557196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarpetcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarpetcleaners.com"; sid:557197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cash.com"; sid:557198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschappaqua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschappaqua.com"; sid:557199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschurchrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschurchrelief.com"; sid:557200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupguide.com"; sid:557201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuphome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuphome.com"; sid:557202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplications.com"; sid:557203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.contractors"; sid:557204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cookbook.com"; sid:557205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsellingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsellingcentre.com"; sid:557206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.club"; sid:557207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.guru"; sid:557208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.life"; sid:557209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.ltd"; sid:557210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.mobi"; sid:557211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.net"; sid:557212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsellingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsellingonline.com"; sid:557213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.pro"; sid:557214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.solutions"; sid:557215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.support"; sid:557216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.today"; sid:557217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.world"; sid:557218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsellor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsellor.com"; sid:557219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsellor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsellor.net"; sid:557220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouplescounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouplescounselling.com"; sid:557221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19disease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19disease.com"; sid:557222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdash19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdash19.com"; sid:557223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-data.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-data.world"; sid:557224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelmondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelmondo.com"; sid:557225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseliminatorshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseliminatorshield.com"; sid:557226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemicfilm.com"; sid:557227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemicmovie.com"; sid:557228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusety.com"; sid:557229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseurope.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseurope.net"; sid:557230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaqchatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaqchatbot.com"; sid:557231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfootprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfootprint.com"; sid:557232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundingrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundingrelief.com"; sid:557233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfund.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfund.money"; sid:557234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunds.net"; sid:557235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundsnow.com"; sid:557236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgage.com"; sid:557237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandshake.com"; sid:557238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheadnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheadnews.com"; sid:557239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpgroup.com"; sid:557240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpuk.com"; sid:557241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomecleaner.com"; sid:557242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomestaychat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomestaychat.com"; sid:557243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalbeds.com"; sid:557244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotstories.com"; sid:557245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotstory.com"; sid:557246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousecleaners.com"; sid:557247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidtheft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidtheft.com"; sid:557248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitytesting.com"; sid:557249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitytesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitytesting.net"; sid:557250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitytests.com"; sid:557251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitytests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitytests.net"; sid:557252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationhub.com"; sid:557253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinittogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinittogether.com"; sid:557254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiswack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiswack.com"; sid:557255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskosovo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskosovo.com"; sid:557256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitnow.com"; sid:557257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalissues.com"; sid:557258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-letsgetchecked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-letsgetchecked.com"; sid:557259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-livemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-livemap.com"; sid:557260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanssba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanssba.com"; sid:557261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockups.com"; sid:557262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarriagecounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarriagecounselling.com"; sid:557263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilan.com"; sid:557264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-money.com"; sid:557265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmorons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmorons.com"; sid:557266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmotionpicture.com"; sid:557267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewrochelle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewrochelle.net"; sid:557268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.pro"; sid:557269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-noticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-noticias.com"; sid:557270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnystate.com"; sid:557271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficecleaner.com"; sid:557272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficecleaners.com"; sid:557273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficecleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficecleaningservices.com"; sid:557274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusonline.com"; sid:557275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetherapy-az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetherapy-az.com"; sid:557276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetherapyaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetherapyaz.com"; sid:557277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-panama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-panama.com"; sid:557278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanama.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanama.life"; sid:557279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicfilm.com"; sid:557280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmovie.com"; sid:557281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanic2020.com"; sid:557282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pay.com"; sid:557283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pharmacies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pharmacies.com"; sid:557284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspharm.com"; sid:557285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoneupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoneupdates.com"; sid:557286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplay.com"; sid:557287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprivateloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprivateloans.com"; sid:557288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspsychotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspsychotherapy.com"; sid:557289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinehelp.com"; sid:557290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryloan.com"; sid:557291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.loans"; sid:557292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remote-work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remote-work.com"; sid:557293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrumor.com"; sid:557294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safe-work-remote-tools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safe-work-remote-tools.com"; sid:557295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscarsdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscarsdale.com"; sid:557296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreens.com"; sid:557297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutions.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutions.guru"; sid:557298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutionsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutionsnyc.com"; sid:557299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutionsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutionsusa.com"; sid:557300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-spain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-spain.com"; sid:557301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-statistiques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-statistiques.com"; sid:557302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstayhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstayhome.com"; sid:557303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstayhomefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstayhomefilm.com"; sid:557304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplies.biz"; sid:557305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-surgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-surgicalmask.com"; sid:557306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sy.com"; sid:557307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.expert"; sid:557308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestmelbourne.com"; sid:557309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustextupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustextupdates.com"; sid:557310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapyonlineaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapyonlineaz.com"; sid:557311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthornwood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthornwood.com"; sid:557312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustipstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustipstoday.com"; sid:557313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustopstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustopstories.com"; sid:557314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustopstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustopstory.com"; sid:557315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-turkiye.com"; sid:557316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvetrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvetrelief.com"; sid:557317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweareinthistogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweareinthistogether.com"; sid:557318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestchestercountycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestchestercountycenter.com"; sid:557319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestchestercounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestchestercounty.com"; sid:557320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestchesterny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestchesterny.com"; sid:557321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhiteplains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhiteplains.com"; sid:557322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhiteplainsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhiteplainsny.com"; sid:557323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-who.com"; sid:557324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkinjury.com"; sid:557325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldwide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldwide.net"; sid:557326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswriting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswriting.com"; sid:557327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyonkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyonkers.com"; sid:557328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyouarenotalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyouarenotalone.com"; sid:557329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyucatan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyucatan.com"; sid:557330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawallets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawallets.com"; sid:557331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweb.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweb.life"; sid:557332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawerun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawerun.com"; sid:557333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wow.com"; sid:557334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxa.com"; sid:557335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxrp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxrp.com"; sid:557336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazombiecelebrity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazombiecelebrity.com"; sid:557337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counter-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counter-covid19.com"; sid:557338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid190.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid190.com"; sid:557339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-191.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-191.com"; sid:557340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adaptiveresponsenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adaptiveresponsenetwork.com"; sid:557341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advisors.com"; sid:557342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aidcenterbd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aidcenterbd.net"; sid:557343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidpalestine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidpalestine.com"; sid:557344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ailment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ailment.com"; sid:557345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19amazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19amazon.com"; sid:557346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhope.com"; sid:557347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andourplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andourplanet.com"; sid:557348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestkits.com"; sid:557349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antiviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antiviral.com"; sid:557350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apex.com"; sid:557351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appeal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appeal.net"; sid:557352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assist.com"; sid:557353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attornies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attornies.com"; sid:557354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19audit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19audit.com"; sid:557355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beardchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beardchallenge.com"; sid:557356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beijing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beijing.com"; sid:557357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19benefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19benefits.com"; sid:557358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bexar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bexar.com"; sid:557359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bilgi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bilgi.com"; sid:557360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blue.com"; sid:557361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blue.com"; sid:557362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bluemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bluemovie.com"; sid:557363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bluemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bluemovie.com"; sid:557364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19borrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19borrow.com"; sid:557365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19br.com"; sid:557366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingcleaner.com"; sid:557367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingcleaners.com"; sid:557368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buildingcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buildingcleaning.com"; sid:557369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-buildingcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-buildingcleaning.com"; sid:557370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingcleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingcleaningsolutions.com"; sid:557371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessfinance.com"; sid:557372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessgrowth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessgrowth.com"; sid:557373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessrelief.com"; sid:557374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessrelief.com"; sid:557375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssbaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssbaloans.com"; sid:557376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cambodia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cambodia.com"; sid:557377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cambodia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cambodia.net"; sid:557378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canon.com"; sid:557379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cash.com"; sid:557380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19charity.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19charity.world"; sid:557381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19charity.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19charity.world"; sid:557382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chatterbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chatterbox.com"; sid:557383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chatterbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chatterbox.com"; sid:557384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checkup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checkup.com"; sid:557385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-checkup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-checkup.com"; sid:557386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-chicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-chicago.com"; sid:557387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.church"; sid:557388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsolutions.com"; sid:557389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanup.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanup.biz"; sid:557390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleared.com"; sid:557391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cloud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cloud.com"; sid:557392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.coffee"; sid:557393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communitysupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communitysupportgroup.com"; sid:557394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compassionproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compassionproject.com"; sid:557395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19complications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19complications.com"; sid:557396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-conspiracy.com"; sid:557397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.construction - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.construction"; sid:557398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus-work-safe-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus-work-safe-life.com"; sid:557399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19corporatecolors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19corporatecolors.com"; sid:557400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cpa.com"; sid:557401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creation.com"; sid:557402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ct.com"; sid:557403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cum.com"; sid:557404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataanalytics.com"; sid:557405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataapp.com"; sid:557406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19data.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19data.cloud"; sid:557407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datavisualizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datavisualizations.com"; sid:557408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deal.com"; sid:557409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diabesity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diabesity.com"; sid:557410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disease.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disease.net"; sid:557411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19docfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19docfilm.com"; sid:557412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19documentaryfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19documentaryfilm.com"; sid:557413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drumcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drumcorp.com"; sid:557414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drumcorp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drumcorp.net"; sid:557415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drumcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drumcorps.com"; sid:557416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19econdatakenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19econdatakenya.com"; sid:557417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-egrt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-egrt.com"; sid:557418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsavador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsavador.com"; sid:557419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epicstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epicstories.com"; sid:557420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemicfilm.com"; sid:557421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemicmovie.com"; sid:557422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialaf.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialaf.biz"; sid:557423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.estate - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.estate"; sid:557424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-europe.com"; sid:557425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eus.net"; sid:557426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evidence.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evidence.net"; sid:557427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fallenheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fallenheroes.com"; sid:557428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19familylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19familylife.com"; sid:557429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familylife.com"; sid:557430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastresult.com"; sid:557431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fastresultnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fastresultnow.com"; sid:557432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastresulttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastresulttest.com"; sid:557433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fedcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fedcash.com"; sid:557434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-festif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-festif.com"; sid:557435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fortheinjured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fortheinjured.com"; sid:557436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forthepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forthepeople.com"; sid:557437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foryourrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foryourrights.com"; sid:557438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fr.net"; sid:557439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.gallery"; sid:557440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19generations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19generations.com"; sid:557441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gis.com"; sid:557442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19govloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19govloan.com"; sid:557443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-govsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-govsupport.com"; sid:557444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19grant.com"; sid:557445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19graphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19graphs.com"; sid:557446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19green.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19green.com"; sid:557447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19groupaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19groupaction.com"; sid:557448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handgels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handgels.com"; sid:557449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthanddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthanddiet.com"; sid:557450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19health.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19health.life"; sid:557451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsupplies.com"; sid:557452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpworld.com"; sid:557453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.holiday"; sid:557454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homey.com"; sid:557455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-horizon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-horizon.com"; sid:557456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitalbeds.com"; sid:557457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalstatus.com"; sid:557458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingslc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingslc.com"; sid:557459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19id.com"; sid:557460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idtheft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idtheft.com"; sid:557461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19imports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19imports.com"; sid:557462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incharts.com"; sid:557463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ind.com"; sid:557464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiacases.com"; sid:557465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19india.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19india.delivery"; sid:557466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inittoether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inittoether.com"; sid:557467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inittogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inittogether.com"; sid:557468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmylife.com"; sid:557469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inourworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inourworld.com"; sid:557470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurance.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurance.agency"; sid:557471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-internet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-internet.com"; sid:557472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intervention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intervention.com"; sid:557473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interventions.com"; sid:557474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inus.com"; sid:557475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iqstikandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iqstikandcure.com"; sid:557476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iqstik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iqstik.com"; sid:557477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isavelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isavelife.com"; sid:557478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kar.com"; sid:557479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kidz.com"; sid:557480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kindness.com"; sid:557481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lateststats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lateststats.com"; sid:557482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawcenter.com"; sid:557483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsny.com"; sid:557484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuitnow.com"; sid:557485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyersny.com"; sid:557486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-letsgetchecked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-letsgetchecked.com"; sid:557487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livemap.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livemap.club"; sid:557488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanpro.com"; sid:557489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-loans.com"; sid:557490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longisland.com"; sid:557491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-madrid.com"; sid:557492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19map.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19map.club"; sid:557493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maryland.com"; sid:557494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskhelp.com"; sid:557495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mass.com"; sid:557496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mass.net"; sid:557497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masterclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masterclass.com"; sid:557498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalbeds.com"; sid:557499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalbeds.com"; sid:557500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalclearancecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalclearancecertificate.com"; sid:557501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalmasks.com"; sid:557502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mhpolice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mhpolice.com"; sid:557503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milan.com"; sid:557504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19minnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19minnesota.com"; sid:557505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mobility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mobility.com"; sid:557506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneynow.com"; sid:557507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19movement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19movement.com"; sid:557508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musicrelief.com"; sid:557509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newjersey.com"; sid:557510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.life"; sid:557511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-odisha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-odisha.com"; sid:557512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oman.com"; sid:557513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ontario.com"; sid:557514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19panama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19panama.com"; sid:557515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-panama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-panama.com"; sid:557516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panama.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panama.life"; sid:557517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panama.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panama.net"; sid:557518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicfilm.com"; sid:557519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.international"; sid:557520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicmovie.com"; sid:557521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19panic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19panic2020.com"; sid:557522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paradox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paradox.com"; sid:557523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pasoapaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pasoapaso.com"; sid:557524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pay.com"; sid:557525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-payout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-payout.com"; sid:557526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19peace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19peace.com"; sid:557527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pharm.com"; sid:557528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plataformaafectados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plataformaafectados.com"; sid:557529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plataformaafectados.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plataformaafectados.net"; sid:557530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19play.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19play.com"; sid:557531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policywatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policywatch.com"; sid:557532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesourcing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesourcing.com"; sid:557533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prediction.com"; sid:557534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prestamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prestamos.com"; sid:557535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19profiteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19profiteers.com"; sid:557536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection.supply"; sid:557537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychologia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychologia.com"; sid:557538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pty.com"; sid:557539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qualified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qualified.com"; sid:557540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarentinefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarentinefilm.com"; sid:557541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktests.com"; sid:557542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantibodytest.com"; sid:557543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidcheck.com"; sid:557544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realestate.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realestate.mobi"; sid:557545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realestate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realestate.world"; sid:557546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestate.world"; sid:557547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtor.com"; sid:557548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoveryloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoveryloans.com"; sid:557549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registery.com"; sid:557550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefdrive.com"; sid:557551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefdrive.com"; sid:557552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieve.com"; sid:557553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.pro"; sid:557554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.repair - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.repair"; sid:557555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.services"; sid:557556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.systems"; sid:557557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.technology"; sid:557558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-remote-tools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-remote-tools.com"; sid:557559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-remote-work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-remote-work.com"; sid:557560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotework.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotework.guru"; sid:557561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.world"; sid:557562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-research-group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-research-group.com"; sid:557563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchstudy.com"; sid:557564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsebot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsebot.com"; sid:557565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseplan.com"; sid:557566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultnow.com"; sid:557567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resulttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resulttest.com"; sid:557568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resulttestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resulttestnow.com"; sid:557569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ride.com"; sid:557570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskscanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskscanner.com"; sid:557571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sa.com"; sid:557572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-salvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-salvador.com"; sid:557573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanctuary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanctuary.com"; sid:557574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sars2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sars2.net"; sid:557575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbaloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbaloan.com"; sid:557576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaloanhelp.com"; sid:557577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sba-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sba-loans.com"; sid:557578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schnelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schnelltest.com"; sid:557579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningnearme.com"; sid:557580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screening.net"; sid:557581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningtool.com"; sid:557582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19search.com"; sid:557583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smartshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smartshield.com"; sid:557584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneezeguard.com"; sid:557585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-solutions.com"; sid:557586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.life"; sid:557587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19song.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19song.com"; sid:557588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialrelief.com"; sid:557589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sst.com"; sid:557590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ssupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ssupplies.com"; sid:557591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19startups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19startups.com"; sid:557592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statestats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statestats.com"; sid:557593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-statistiques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-statistiques.com"; sid:557594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistiques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistiques.com"; sid:557595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stats.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stats.today"; sid:557596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stats.world"; sid:557597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayhomefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayhomefilm.com"; sid:557598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplies.biz"; sid:557599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivornyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivornyc.com"; sid:557600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sy.com"; sid:557601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptoms.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptoms.world"; sid:557602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tales.com"; sid:557603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxplanning.com"; sid:557604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxrelief.com"; sid:557605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testandcure.com"; sid:557606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinginfo.com"; sid:557607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnearme.net"; sid:557608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingri.com"; sid:557609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit4u.com"; sid:557610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkithelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkithelp.com"; sid:557611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testmenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testmenow.com"; sid:557612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testmenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testmenow.com"; sid:557613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnow.net"; sid:557614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsnow.com"; sid:557615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theboardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theboardgame.com"; sid:557616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thepandemic.com"; sid:557617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thequarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thequarantine.com"; sid:557618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapyonline.com"; sid:557619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thinkntalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thinkntalk.com"; sid:557620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thinkntalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thinkntalk.com"; sid:557621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trials.net"; sid:557622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tributes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tributes.com"; sid:557623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatespro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatespro.com"; sid:557624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usdeaths.com"; sid:557625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccino.com"; sid:557626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccino.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccino.net"; sid:557627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccino.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccino.net"; sid:557628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vcf.com"; sid:557629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vetrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vetrelief.com"; sid:557630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.center"; sid:557631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-cleaners.com"; sid:557632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscleanup.com"; sid:557633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusloan.com"; sid:557634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.tips"; sid:557635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustshirt.com"; sid:557636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustshirts.com"; sid:557637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusworld.com"; sid:557638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wall.com"; sid:557639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weareinthistogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weareinthistogether.com"; sid:557640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weekly.com"; sid:557641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wordwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wordwide.com"; sid:557642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workerscomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workerscomp.com"; sid:557643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscomp.com"; sid:557644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-work-from-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-work-from-home.com"; sid:557645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workinjury.com"; sid:557646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-work-safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-work-safe.com"; sid:557647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-worldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-worldwide.com"; sid:557648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldwidelessonslearned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldwidelessonslearned.com"; sid:557649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.pro"; sid:557650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20ready.com"; sid:557651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactivities.com"; sid:557652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaging.com"; sid:557653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid4churches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid4churches.com"; sid:557654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid4u.com"; sid:557655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamawonservices.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamawonservices.club"; sid:557656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandapartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandapartments.com"; sid:557657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandstrata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandstrata.com"; sid:557658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanswers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanswers.net"; sid:557659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaphobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaphobia.com"; sid:557660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatl.com"; sid:557661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawn.com"; sid:557662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaxin.com"; sid:557663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbacktrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbacktrace.com"; sid:557664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarcelona.com"; sid:557665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelly.com"; sid:557666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbitung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbitung.com"; sid:557667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizresources.com"; sid:557668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-box.com"; sid:557669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslawsuit.com"; sid:557670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessloanlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessloanlawyer.com"; sid:557671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardio.com"; sid:557672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecertified.com"; sid:557673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarehub.com"; sid:557674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresact.com"; sid:557675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresclaim.com"; sid:557676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresemployeehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresemployeehelp.com"; sid:557677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresloan.com"; sid:557678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-central.com"; sid:557679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchrishill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchrishill.com"; sid:557680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcitizencoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcitizencoalition.com"; sid:557681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimform.com"; sid:557682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimforms.com"; sid:557683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimorlando.com"; sid:557684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimpro.com"; sid:557685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsla.com"; sid:557686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionla.com"; sid:557687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwipes.com"; sid:557688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleankc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleankc.com"; sid:557689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanwipes.com"; sid:557690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clinical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clinical.com"; sid:557691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clinicaltrial.com"; sid:557692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclose.com"; sid:557693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-club.com"; sid:557694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcme.com"; sid:557695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcochrane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcochrane.com"; sid:557696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coin.com"; sid:557697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcom.com"; sid:557698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomicsjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomicsjournal.com"; sid:557699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcom.net"; sid:557700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompared.com"; sid:557701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcops.com"; sid:557702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouple.com"; sid:557703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverguard.com"; sid:557704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverprotector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverprotector.com"; sid:557705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverprotector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverprotector.net"; sid:557706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovershield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovershield.com"; sid:557707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazyidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazyidea.com"; sid:557708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazyidea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazyidea.net"; sid:557709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddataapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddataapp.com"; sid:557710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.net"; sid:557711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddead.com"; sid:557712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilitylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilitylawyers.com"; sid:557713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterreliefloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterreliefloan.com"; sid:557714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddispatches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddispatches.com"; sid:557715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorce.com"; sid:557716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocumentary.com"; sid:557717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-elsalvador.com"; sid:557718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoinc.com"; sid:557719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilylife.com"; sid:557720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfastpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfastpass.com"; sid:557721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfitnesscabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfitnesscabin.com"; sid:557722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforum.net"; sid:557723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeafrica.com"; sid:557724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeafrica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeafrica.net"; sid:557725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundraise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundraise.com"; sid:557726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgarden.com"; sid:557727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardener.com"; sid:557728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgougers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgougers.com"; sid:557729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgyan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgyan.com"; sid:557730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgyan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgyan.net"; sid:557731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhalloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhalloween.com"; sid:557732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcheros.com"; sid:557733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesunited.com"; sid:557734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherts.com"; sid:557735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianmusings.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianmusings.community"; sid:557736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiantimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiantimes.com"; sid:557737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idea.com"; sid:557738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididea.com"; sid:557739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idea.net"; sid:557740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididea.net"; sid:557741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmune.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmune.net"; sid:557742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindore.com"; sid:557743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindore.net"; sid:557744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.pro"; sid:557745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovate.com"; sid:557746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstrata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstrata.com"; sid:557747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotaward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotaward.com"; sid:557748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotawards.com"; sid:557749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.life"; sid:557750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirect.com"; sid:557751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiv.com"; sid:557752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-jobs.com"; sid:557753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkaraoke2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkaraoke2020.com"; sid:557754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaser.com"; sid:557755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawca.com"; sid:557756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawfl.com"; sid:557757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawpro.com"; sid:557758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitla.com"; sid:557759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitpro.com"; sid:557760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleague.com"; sid:557761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegaldefense.com"; sid:557762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalpro.com"; sid:557763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivecase.com"; sid:557764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanapp.com"; sid:557765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanbot.com"; sid:557766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans19.com"; sid:557767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans2020.com"; sid:557768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansolutions.com"; sid:557769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogger.com"; sid:557770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmakerresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmakerresponse.com"; sid:557771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketwatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketwatch.net"; sid:557772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmat.com"; sid:557773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaterial.com"; sid:557774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsearch.com"; sid:557775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemo.com"; sid:557776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmigrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmigrants.com"; sid:557777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mu.net"; sid:557778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmusic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmusic.club"; sid:557779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutualaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutualaid.com"; sid:557780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutualaiduk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutualaiduk.com"; sid:557781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmx.net"; sid:557782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativo.com"; sid:557783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnigeria.com"; sid:557784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninteencleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninteencleaners.com"; sid:557785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotfunny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotfunny.com"; sid:557786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlysites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlysites.com"; sid:557787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopenwifi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopenwifi.com"; sid:557788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidose.com"; sid:557789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutlook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutlook.com"; sid:557790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverstock.com"; sid:557791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicnews.com"; sid:557792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatient.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatient.net"; sid:557793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayrollfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayrollfunding.com"; sid:557794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayrollgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayrollgrant.com"; sid:557795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasma.com"; sid:557796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmaregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmaregistry.com"; sid:557797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositivo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositivo.com"; sid:557798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppx.com"; sid:557799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprices.com"; sid:557800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofl.com"; sid:557801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromises.com"; sid:557802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprony.com"; sid:557803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectiongear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectiongear.com"; sid:557804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqt.com"; sid:557805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradar.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradar.life"; sid:557806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverylaw.com"; sid:557807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverynews.com"; sid:557808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-registry.com"; sid:557809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefheros.com"; sid:557810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.life"; sid:557811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-relief.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-relief.money"; sid:557812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.money"; sid:557813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefservices.com"; sid:557814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresist.com"; sid:557815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsegear.com"; sid:557816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantfunding.com"; sid:557817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevolution.com"; sid:557818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidril.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidril.com"; sid:557819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrin.com"; sid:557820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrivershield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrivershield.com"; sid:557821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrug.com"; sid:557822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafefirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafefirm.com"; sid:557823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsantarosadecabal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsantarosadecabal.com"; sid:557824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbaloanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbaloanservices.com"; sid:557825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscouts.com"; sid:557826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsessions.com"; sid:557827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsessions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsessions.net"; sid:557828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshaming.com"; sid:557829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheriff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheriff.com"; sid:557830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsim.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsim.team"; sid:557831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsir.com"; sid:557832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsluts.com"; sid:557833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-solution.com"; sid:557834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions2020.com"; sid:557835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsosyalyardim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsosyalyardim.com"; sid:557836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidssi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidssi.com"; sid:557837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstandart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstandart.com"; sid:557838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-status.com"; sid:557839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusmoney.com"; sid:557840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-strong.com"; sid:557841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuitpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuitpro.com"; sid:557842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuits.com"; sid:557843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport.life"; sid:557844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsure.com"; sid:557845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor19.com"; sid:557846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswap.com"; sid:557847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtamins.com"; sid:557848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxguru.com"; sid:557849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteleconultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteleconultant.com"; sid:557850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelemed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelemed.com"; sid:557851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtermlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtermlife.com"; sid:557852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest15.com"; sid:557853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestapp.com"; sid:557854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestathome.com"; sid:557855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdx.com"; sid:557856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.today"; sid:557857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsapp.com"; sid:557858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsnow.com"; sid:557859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsonline.com"; sid:557860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsweb.com"; sid:557861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapists.com"; sid:557862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtroopers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtroopers.com"; sid:557863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinate.com"; sid:557864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveteran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveteran.com"; sid:557865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictorygarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictorygarden.com"; sid:557866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviral.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviral.solutions"; sid:557867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus2020.com"; sid:557868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusaid.com"; sid:557869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.pro"; sid:557870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussucks.com"; sid:557871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworks.com"; sid:557872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixcure.com"; sid:557873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.life"; sid:557874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.pro"; sid:557875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidya.com"; sid:557876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovididea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovididea.com"; sid:557877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovididea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovididea.net"; sid:557878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crewcutsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crewcutsforcovid.com"; sid:557879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdsourcecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdsourcecovid.com"; sid:557880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crush-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crush-coronavirus.com"; sid:557881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crush-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crush-covid19.com"; sid:557882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushnovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushnovelcoronavirus.com"; sid:557883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacoronavirus.cloud"; sid:557884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadelcoronavirus.com"; sid:557885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadoscoronavirus.com"; sid:557886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid-19now.com"; sid:557887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcovid.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcovid.agency"; sid:557888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcovid.com"; sid:557889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcovid.net"; sid:557890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cusecoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cusecoronacare.com"; sid:557891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dadoscoronavirus.com"; sid:557892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidivorce.com"; sid:557893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daruratcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daruratcovid19.com"; sid:557894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daylightroberycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daylightroberycorona.com"; sid:557895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysaftercorona.com"; sid:557896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysofcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysofcorona.life"; sid:557897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcscovid.com"; sid:557898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcorona19.com"; sid:557899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalpandemic.com"; sid:557900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentoncovidivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentoncovidivorce.com"; sid:557901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecovid19.com"; sid:557902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destrijdtegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destrijdtegencorona.com"; sid:557903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariodeconfinamienrocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariodeconfinamienrocovid-19.com"; sid:557904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diecoronavirus.com"; sid:557905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dignosdeunacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dignosdeunacorona.com"; sid:557906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezionecoronaviruspiemonte.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezionecoronaviruspiemonte.cloud"; sid:557907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezionecoronavirustorino.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezionecoronavirustorino.cloud"; sid:557908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcoronavirus.com"; sid:557909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19plasma.com"; sid:557910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drinkingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drinkingcorona.com"; sid:557911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dronesvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dronesvscovid19.com"; sid:557912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drs4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drs4covid.com"; sid:557913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug2curecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug2curecovid19.com"; sid:557914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug2treatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug2treatcovid19.com"; sid:557915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronaviruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronaviruslive.com"; sid:557916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edukasicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edukasicovid19.com"; sid:557917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for efeitocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"efeitocoronavirus.com"; sid:557918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for efeitoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"efeitoscoronavirus.com"; sid:557919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for egyptcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"egyptcovid-19.com"; sid:557920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidfunding.com"; sid:557921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpoderdelcoronamor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpoderdelcoronamor.com"; sid:557922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for embracecoronadays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"embracecoronadays.com"; sid:557923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencia-covid19.com"; sid:557924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronamoney.com"; sid:557925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid-19beds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid-19beds.com"; sid:557926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid19beds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid19beds.com"; sid:557927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid-19hospitalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid-19hospitalbeds.com"; sid:557928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid-19medicalbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid-19medicalbeds.com"; sid:557929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronaparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronaparty.com"; sid:557930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19party.com"; sid:557931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcovid.com"; sid:557932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcorona.com"; sid:557933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eo4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eo4covid-19.com"; sid:557934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiocovid-19.com"; sid:557935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everyonevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everyonevscovid19.com"; sid:557936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evm-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evm-corona.com"; sid:557937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskscovid.com"; sid:557938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fafcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fafcovid19.com"; sid:557939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faitesvosmasques-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faitesvosmasques-covid19.com"; sid:557940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesfirstcoronavirusresponseact2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesfirstcoronavirusresponseact2020.com"; sid:557941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesfirstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesfirstcovid.com"; sid:557942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familyandfriendscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familyandfriendscovid19.com"; sid:557943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouspeoplewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouspeoplewithcorona.com"; sid:557944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fantasycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fantasycovid.com"; sid:557945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19tests.com"; sid:557946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearcovid.com"; sid:557947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fedcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fedcovidclaim.com"; sid:557948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.world"; sid:557949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid-2019.com"; sid:557950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightforcorona.com"; sid:557951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightsagainstcorona.com"; sid:557952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthecovid19.com"; sid:557953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialassistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialassistancecovid19.com"; sid:557954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19lawyer.com"; sid:557955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoviddonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoviddonations.com"; sid:557956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidsupplies.com"; sid:557957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcovid.com"; sid:557958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattencovid-19.com"; sid:557959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidcase.com"; sid:557960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidclaims.com"; sid:557961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidhelp.com"; sid:557962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidpro.com"; sid:557963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronainsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronainsuranceclaims.com"; sid:557964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusbusinessloans.com"; sid:557965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusloans.com"; sid:557966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusrelief.com"; sid:557967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridasbacoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridasbacoronavirusloan.com"; sid:557968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogocovid19.com"; sid:557969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidupdates.com"; sid:557970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeduringcorona.com"; sid:557971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocovidhelp.com"; sid:557972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontlinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontlinecovid19.com"; sid:557973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-covid-19.com"; sid:557974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingcovid-19.com"; sid:557975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingcovid-19.net"; sid:557976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundingforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundingforcorona.com"; sid:557977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovidinfo.com"; sid:557978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gatespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gatespandemic.com"; sid:557979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gelhydrocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gelhydrocovid19.com"; sid:557980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19supplies.com"; sid:557981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtools.com"; sid:557982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettingpastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettingpastcovid.com"; sid:557983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for girardotacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"girardotacovid-19.com"; sid:557984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glas-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glas-corona.com"; sid:557985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glasschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glasschutz-corona.com"; sid:557986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19hq.com"; sid:557987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19hq.com"; sid:557988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19views.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19views.com"; sid:557989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globallovepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globallovepandemic.com"; sid:557990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalteamcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalteamcoronabusters.com"; sid:557991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goawaycovid19.com"; sid:557992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotspacecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotspacecorona.com"; sid:557993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for governmentpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"governmentpandemic.com"; sid:557994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for growingcovid-19pandemicanditsimpact.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"growingcovid-19pandemicanditsimpact.cloud"; sid:557995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycovid19day.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycovid19day.life"; sid:557996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycovid19news.com"; sid:557997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiian-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiian-coronavirus.com"; sid:557998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiiancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiiancoronavirus.com"; sid:557999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovid.com"; sid:558000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for health-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"health-covid.com"; sid:558001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herocovid.com"; sid:558002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescovid.net"; sid:558003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofthepandemic.com"; sid:558004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hgcovid.com"; sid:558005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hitcorona.com"; sid:558006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeboycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeboycovid19.com"; sid:558007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homegirlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homegirlcovid19.com"; sid:558008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitscoronavirus.com"; sid:558009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeycovid19.com"; sid:558010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeaftercovid19.com"; sid:558011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howibeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howibeatcoronavirus.com"; sid:558012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivepandemic.com"; sid:558013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancovid-19.com"; sid:558014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancovid19.com"; sid:558015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanityagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanityagainstcorona.com"; sid:558016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hussaininfocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hussaininfocovid19.com"; sid:558017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamthecovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamthecovid19survivor.com"; sid:558018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icbcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icbcorona.com"; sid:558019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconquercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconquercorona.com"; sid:558020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconquercovid19.com"; sid:558021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideasagainstpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideasagainstpandemics.com"; sid:558022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immune2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immune2covid.com"; sid:558023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiaaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiaaftercorona.com"; sid:558024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiaagainstcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiaagainstcorona.life"; sid:558025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiabattlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiabattlecorona.com"; sid:558026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indonesiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indonesiacovid.com"; sid:558027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info4corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info4corona-virus.com"; sid:558028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info4covid19.com"; sid:558029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infolivecovid49.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infolivecovid49.com"; sid:558030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inittogethercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inittogethercovid19.com"; sid:558031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injectioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injectioncovid-19.com"; sid:558032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insomed-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insomed-covid19.com"; sid:558033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inthetimeofcorona.net"; sid:558034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iran-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iran-covid19.com"; sid:558035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscovidtaxrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscovidtaxrelief.com"; sid:558036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19cured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19cured.com"; sid:558037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidover.com"; sid:558038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidoveryet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidoveryet.com"; sid:558039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurivcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurivcovid19.com"; sid:558040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurivcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurivcovid19virus.com"; sid:558041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedafuckingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedafuckingpandemic.com"; sid:558042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedapandemic.com"; sid:558043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.mobi"; sid:558044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.club"; sid:558045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.mobi"; sid:558046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid.net"; sid:558047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italycovid.com"; sid:558048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivdcovid19.com"; sid:558049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksoncommunitycovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksoncommunitycovidresponse.com"; sid:558050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jualmaskercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jualmaskercorona.com"; sid:558051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccovidclean.com"; sid:558052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronavirusass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronavirusass.com"; sid:558053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickingcorona.com"; sid:558054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickingwithcovid.com"; sid:558055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronapandemic.com"; sid:558056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuliahonlenkarenacorona77.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuliahonlenkarenacorona77.com"; sid:558057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2-coronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2-coronavirus.club"; sid:558058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2-coronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2-coronavirus.life"; sid:558059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcovid19com.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcovid19com.com"; sid:558060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyercovid19.com"; sid:558061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcovid19.com"; sid:558062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learncovid.com"; sid:558063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legal4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legal4covid19.com"; sid:558064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lethalcoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lethalcoronabusters.com"; sid:558065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letmeentertainyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letmeentertainyoucovid19.com"; sid:558066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsavoidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsavoidcoronavirus.com"; sid:558067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid19.net"; sid:558068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringcovid19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringcovid19podcast.com"; sid:558069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for live-corona-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"live-corona-free.com"; sid:558070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidtracker.com"; sid:558071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingcovid19.com"; sid:558072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthrucovid.com"; sid:558073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for llandeilocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"llandeilocovid19.com"; sid:558074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loancovid-19.com"; sid:558075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loans-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loans-corona.com"; sid:558076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loanscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loanscorona.com"; sid:558077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loans-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loans-coronavirus.com"; sid:558078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loanscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loanscovid-19.com"; sid:558079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdownforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdownforcorona.com"; sid:558080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcovid-19.com"; sid:558081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimecorona.com"; sid:558082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimecorona.net"; sid:558083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronahealing.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronahealing.life"; sid:558084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-pandemic.com"; sid:558085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managing-stress-anxiety-thru-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managing-stress-anxiety-thru-covid-19.com"; sid:558086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marcovidale.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marcovidale.net"; sid:558087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for markmontgomerycoronacalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"markmontgomerycoronacalm.com"; sid:558088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovid19emergencyrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovid19emergencyrelieffund.com"; sid:558089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mbhydro-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mbhydro-covid19.com"; sid:558090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for md-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"md-coronavirus.com"; sid:558091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcorona-x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcorona-x.com"; sid:558092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for md-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"md-covid19.com"; sid:558093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid1.com"; sid:558094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicinecovid-19.com"; sid:558095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineinthetimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineinthetimeofcovid-19.com"; sid:558096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicineinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicineinthetimeofcovid19.com"; sid:558097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metacoronavirus.com"; sid:558098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mgmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mgmcovid19.com"; sid:558099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19testing.com"; sid:558100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mucovid.com"; sid:558101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musik-trotz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musik-trotz-corona.com"; sid:558102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacookbook.com"; sid:558103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahero.com"; sid:558104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasurvivalkit.com"; sid:558105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatee.com"; sid:558106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruschatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruschatbot.com"; sid:558107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruslawsuit.com"; sid:558108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.watch"; sid:558109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19chatbot.com"; sid:558110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19money.com"; sid:558111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.net"; sid:558112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidclaims.com"; sid:558113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddashboard.com"; sid:558114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhelper.com"; sid:558115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovididea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovididea.com"; sid:558116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidloan.com"; sid:558117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid.net"; sid:558118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mystimuluspackagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mystimuluspackagecovid19.com"; sid:558119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestkit4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestkit4corona.com"; sid:558120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbcovidsupport.com"; sid:558121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcovid.com"; sid:558122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-covid19.com"; sid:558123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid-19.com"; sid:558124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nitricoxide4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nitricoxide4covid19.com"; sid:558125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no4pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no4pandemics.com"; sid:558126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19here.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19here.com"; sid:558127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-covid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-covid.life"; sid:558128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noepidemic.com"; sid:558129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacovidclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacovidclassaction.com"; sid:558130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecorona.world"; sid:558131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecovid-19.com"; sid:558132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nopandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nopandemics.com"; sid:558133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noriskofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noriskofcovid19.com"; sid:558134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nothankscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nothankscorona.com"; sid:558135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nudes4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nudes4corona.com"; sid:558136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidhelp.com"; sid:558137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidlaw.com"; sid:558138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidlawyer.com"; sid:558139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidpro.com"; sid:558140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofertascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofertascovid.com"; sid:558141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidtracking.com"; sid:558142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oms-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oms-covid19.com"; sid:558143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencoronapledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencoronapledge.com"; sid:558144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcombatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcombatcovid.com"; sid:558145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidcombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidcombat.com"; sid:558146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orientacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orientacioncoronavirus.com"; sid:558147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19stories.com"; sid:558148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourheroesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourheroesofcovid19.com"; sid:558149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakcoronavirus.com"; sid:558150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemia-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemia-covid-19.com"; sid:558151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacovids.com"; sid:558152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020tshirts.com"; sid:558153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicagency.com"; sid:558154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapparel.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapparel.biz"; sid:558155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapps.com"; sid:558156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbread.com"; sid:558157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessadvisors.com"; sid:558158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccertification.com"; sid:558159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccertified.com"; sid:558160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccertified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccertified.net"; sid:558161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-coverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-coverage.com"; sid:558162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-defenderz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-defenderz.com"; sid:558163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdental.com"; sid:558164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdentist.com"; sid:558165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdoc.com"; sid:558166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdocumentary.com"; sid:558167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdrones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdrones.com"; sid:558168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomics.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomics.world"; sid:558169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforce.com"; sid:558170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfounds.com"; sid:558171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgovernment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgovernment.com"; sid:558172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-health.com"; sid:558173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichoneymoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichoneymoon.com"; sid:558174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinnovationstrategist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinnovationstrategist.com"; sid:558175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmapping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmapping.com"; sid:558176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmotionpicture.com"; sid:558177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pantry.com"; sid:558178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplan.net"; sid:558179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplay.com"; sid:558180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolitics.com"; sid:558181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpossibilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpossibilities.com"; sid:558182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpour.com"; sid:558183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepacademy.com"; sid:558184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprices.com"; sid:558185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prints.com"; sid:558186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresupplies.com"; sid:558187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreviews.com"; sid:558188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrules.com"; sid:558189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-safe-work-remote-tools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-safe-work-remote-tools.com"; sid:558190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliesnow.com"; sid:558191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplyline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplyline.com"; sid:558192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestresults.com"; sid:558193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-toolkit.com"; sid:558194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirus2020.com"; sid:558195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingaftercovid19.com"; sid:558196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinscovid19.com"; sid:558197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plandeayudascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plandeayudascoronavirus.com"; sid:558198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plandeayudascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plandeayudascovid19.com"; sid:558199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19party.com"; sid:558200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-19world.com"; sid:558201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbusinesscontinuity.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbusinesscontinuity.tips"; sid:558202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpodcast.com"; sid:558203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe4covid19.com"; sid:558204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovidsupply.com"; sid:558205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppeforcovid.com"; sid:558206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-covid19.com"; sid:558207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid-19.com"; sid:558208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-covid.com"; sid:558209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predicorona.com"; sid:558210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocion-netflix-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocion-netflix-covid19.com"; sid:558211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionforcorona.com"; sid:558212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegetedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegetedelcovid19.com"; sid:558213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestkitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestkitscovid19.com"; sid:558214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratlamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratlamcovid19.com"; sid:558215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readyforcovid19.com"; sid:558216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readyforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readyforcovid.com"; sid:558217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovercovid19.com"; sid:558218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcorona.com"; sid:558219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcovid.com"; sid:558220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for regencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"regencovid19.com"; sid:558221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailpandemic.com"; sid:558222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ride4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ride4covid19.com"; sid:558223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtcovid.com"; sid:558224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for run4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"run4covid19.com"; sid:558225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcorona.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcorona.run"; sid:558226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid19.com"; sid:558227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid.com"; sid:558228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sane-coronavirus-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sane-coronavirus-response.com"; sid:558229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-corona-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-corona-loans.com"; sid:558230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusaid.com"; sid:558231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusmoney.com"; sid:558232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19claim.com"; sid:558233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19loan.com"; sid:558234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19loans.com"; sid:558235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidclaim.com"; sid:558236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidclaims.com"; sid:558237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloancorona.com"; sid:558238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloancovid-19.com"; sid:558239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloanhelpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloanhelpcorona.com"; sid:558240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloanhelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloanhelpcoronavirus.com"; sid:558241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-loans-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-loans-corona.com"; sid:558242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloanscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloanscorona.com"; sid:558243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloanscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloanscovid19.com"; sid:558244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaloansforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaloansforcoronavirus.com"; sid:558245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzglas-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzglas-corona.com"; sid:558246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid.com"; sid:558247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secondinningcoronafights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secondinningcoronafights.com"; sid:558248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secuejoebcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secuejoebcovid.com"; sid:558249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfbaycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfbaycovidtesting.com"; sid:558250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid-19stories.com"; sid:558251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid19stories.com"; sid:558252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid-19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid-19story.com"; sid:558253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid19story.com"; sid:558254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovid19story.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovid19story.net"; sid:558255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shicovideo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shicovideo.net"; sid:558256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcorona19.com"; sid:558257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shilcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shilcovid-19.com"; sid:558258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shilosupply-stopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shilosupply-stopcorona.com"; sid:558259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shingatacoronanoarekore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shingatacoronanoarekore.com"; sid:558260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-anti-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-anti-coronavirus.com"; sid:558261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-anti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-anti-covid19.com"; sid:558262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanti-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanti-covid.com"; sid:558263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanticovid.com"; sid:558264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanti-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanti-covid.net"; sid:558265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopanticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopanticovid.net"; sid:558266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronavirusmasks.com"; sid:558267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shotforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shotforcovid.com"; sid:558268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for silenthelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"silenthelpcovid19.com"; sid:558269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirusaid.com"; sid:558270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscoronavirusrelief.com"; sid:558271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovidact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovidact.com"; sid:558272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovidrelief.com"; sid:558273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smashcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smashcoronavirus.com"; sid:558274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smashcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smashcovid-19.com"; sid:558275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapinhalerkillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapinhalerkillscoronavirus.com"; sid:558276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrecovid19.com"; sid:558277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socomore-desinfection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socomore-desinfection-covid19.com"; sid:558278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solatcovid199.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solatcovid199.com"; sid:558279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucioncovid.com"; sid:558280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soriacoronavirus.com"; sid:558281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sstcovid19.com"; sid:558282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startups4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startups4corona.com"; sid:558283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecovid.com"; sid:558284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statisticscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statisticscovid.com"; sid:558285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayathomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayathomecorona.com"; sid:558286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecoronavirusfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecoronavirusfilm.com"; sid:558287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecoronavirusstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecoronavirusstories.com"; sid:558288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecoronavirusstory.com"; sid:558289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecovid19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecovid19documentary.com"; sid:558290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecovid19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecovid19movie.com"; sid:558291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomecovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomecovid19stories.com"; sid:558292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomepandemic.com"; sid:558293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomepandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomepandemicfilm.com"; sid:558294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomestaysafecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomestaysafecoronavirus.com"; sid:558295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomestaysafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomestaysafecovid19.com"; sid:558296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayingsafeduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayingsafeduringcovid19.com"; sid:558297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcovid19.com"; sid:558298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.pro"; sid:558299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronatn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronatn.com"; sid:558300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronawithelectronics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronawithelectronics.com"; sid:558301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidiot.com"; sid:558302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidiots.com"; sid:558303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidvirus.com"; sid:558304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suecovid19.com"; sid:558305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suecovid.com"; sid:558306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sultenglawancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sultenglawancovid.com"; sid:558307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportfrontlinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportfrontlinecovid-19.com"; sid:558308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportfrontlinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportfrontlinecovid19.com"; sid:558309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportfrontlinecovid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportfrontlinecovid-19nyc.com"; sid:558310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportnycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportnycovid-19.com"; sid:558311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportnycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportnycovid19.com"; sid:558312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surpasscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surpasscovid-19.com"; sid:558313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surthrivethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surthrivethepandemic.com"; sid:558314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19documentary.com"; sid:558315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorofcovid-19.com"; sid:558316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorofcovid19.com"; sid:558317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorofcovid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorofcovid-19nyc.com"; sid:558318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftcovidcure.com"; sid:558319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovidfinancialassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovidfinancialassistance.com"; sid:558320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tech4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tech4covid.com"; sid:558321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthpandemic.com"; sid:558322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telepandemic.com"; sid:558323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaviruscovid-19.com"; sid:558324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusimmunity.com"; sid:558325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusimmunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusimmunity.net"; sid:558326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19barato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19barato.com"; sid:558327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19barcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19barcelona.com"; sid:558328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19clinica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19clinica.com"; sid:558329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19madrid.com"; sid:558330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19rapido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19rapido.com"; sid:558331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidfromhome.com"; sid:558332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdelcovid19.com"; sid:558333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforthecoronavirus.com"; sid:558334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingathomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingathomecovid19.com"; sid:558335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-covid.com"; sid:558336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkits4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkits4corona.com"; sid:558337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmecovid.com"; sid:558338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmycovid.com"; sid:558339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests4covid.com"; sid:558340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests-covid.com"; sid:558341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texas-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texas-corona.com"; sid:558342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoviddivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoviddivorce.com"; sid:558343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidivorce.com"; sid:558344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaepic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaepic.com"; sid:558345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaineed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaineed.com"; sid:558346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronarecovery.com"; sid:558347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaregistry.com"; sid:558348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronasolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronasolution.com"; sid:558349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaspring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaspring.com"; sid:558350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.center"; sid:558351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusepic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusepic.com"; sid:558352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusepidemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusepidemicfilm.com"; sid:558353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusepidemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusepidemicmovie.com"; sid:558354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslockdown.com"; sid:558355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmemorial.com"; sid:558356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmotionpicture.com"; sid:558357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspandemicfilm.com"; sid:558358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspandemicmovie.com"; sid:558359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusplay.com"; sid:558360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusquarentine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusquarentine.com"; sid:558361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustale.com"; sid:558362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19dataapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19dataapp.com"; sid:558363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19documentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19documentary.com"; sid:558364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19documentaryfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19documentaryfilm.com"; sid:558365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19epic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19epic.com"; sid:558366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19epidemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19epidemicfilm.com"; sid:558367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19epidemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19epidemicmovie.com"; sid:558368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19film.com"; sid:558369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19games.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19games.com"; sid:558370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19motionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19motionpicture.com"; sid:558371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19movie.com"; sid:558372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pandemicfilm.com"; sid:558373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pandemicmovie.com"; sid:558374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19play.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19play.com"; sid:558375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19play.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19play.com"; sid:558376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19quarentine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19quarentine.com"; sid:558377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19registry.com"; sid:558378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19show.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19show.com"; sid:558379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19song.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19song.com"; sid:558380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19song.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19song.com"; sid:558381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19stories.com"; sid:558382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19stories.com"; sid:558383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19tale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19tale.com"; sid:558384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19tales.com"; sid:558385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid2019.com"; sid:558386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid69.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid69.com"; sid:558387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidapp.com"; sid:558388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcowboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcowboy.com"; sid:558389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddataapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddataapp.com"; sid:558390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfilm.com"; sid:558391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlockdown.com"; sid:558392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmasks.com"; sid:558393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidregistry.com"; sid:558394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsessions.com"; sid:558395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtrust.com"; sid:558396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themovieaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themovieaboutcovid19.com"; sid:558397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themovieaboutpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themovieaboutpandemic.com"; sid:558398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themovieaboutthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themovieaboutthecoronavirus.com"; sid:558399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronavirus.net"; sid:558400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicdocumentary.com"; sid:558401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicfilm.com"; sid:558402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiclockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiclockdown.com"; sid:558403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicmotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicmotionpicture.com"; sid:558404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicplay.com"; sid:558405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpour.com"; sid:558406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicshow.com"; sid:558407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicstories.com"; sid:558408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemicworld.com"; sid:558409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealhousewivesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealhousewivesofcovid19.com"; sid:558410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldpostcorona.com"; sid:558411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcoronavirus.com"; sid:558412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisiswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisiswuhan.com"; sid:558413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeofcoronavirus.com"; sid:558414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trakmy-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trakmy-covid.com"; sid:558415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trakmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trakmycovid.com"; sid:558416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treat-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treat-covid.com"; sid:558417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcovid.net"; sid:558418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tricountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tricountycovid19.com"; sid:558419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucovid19.com"; sid:558420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandingcovid-19.com"; sid:558421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unemployedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unemployedbycovid.com"; sid:558422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniteagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniteagainstcovid.com"; sid:558423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatespandemic.com"; sid:558424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatespandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatespandemic.net"; sid:558425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19supplies.com"; sid:558426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-covid.com"; sid:558427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusdata.com"; sid:558428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19crash.com"; sid:558429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19crisis.com"; sid:558430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19law.com"; sid:558431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19laws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19laws.com"; sid:558432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19laws.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19laws.net"; sid:558433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19virus.com"; sid:558434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcase.com"; sid:558435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usvscovid19.com"; sid:558436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronavirus.cloud"; sid:558437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccino-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccino-covid19.com"; sid:558438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccino-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccino-covid19.net"; sid:558439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vancovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vancovidlife.com"; sid:558440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaquinhaonlinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaquinhaonlinecoronavirus.com"; sid:558441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcacovid19.com"; sid:558442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verificovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verificovid.com"; sid:558443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercovid19.com"; sid:558444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralcovidmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralcovidmerch.com"; sid:558445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusallworldiscorona7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusallworldiscorona7.com"; sid:558446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona19-20.com"; sid:558447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronacovid-19.com"; sid:558448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19.biz"; sid:558449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtrcovid19.com"; sid:558450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid19stimulus.com"; sid:558451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walkingwithstrengththroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walkingwithstrengththroughcovid19.com"; sid:558452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weareinthistogethercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weareinthistogethercorona.com"; sid:558453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weareinthistogethercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weareinthistogethercoronavirus.com"; sid:558454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weareinthistogethercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weareinthistogethercovid19.com"; sid:558455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webuycovidoverstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webuycovidoverstock.com"; sid:558456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wereinittogethercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wereinittogethercoronavirus.com"; sid:558457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wereinittogethercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wereinittogethercovid19.com"; sid:558458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid-19.life"; sid:558459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid-19.net"; sid:558460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid-19.world"; sid:558461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wetestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wetestcovid-19.com"; sid:558462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wetestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wetestcovid19.com"; sid:558463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsolvecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsolvecovid19.com"; sid:558464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsolvecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsolvecovid.com"; sid:558465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whataftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whataftercorona.com"; sid:558466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencoronaends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencoronaends.com"; sid:558467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitecoronatree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitecoronatree.com"; sid:558468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whopandemic.com"; sid:558469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthecovid.net"; sid:558470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19.life"; sid:558471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19maps.com"; sid:558472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldview-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldview-covid19.com"; sid:558473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfreshmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfreshmarket.com"; sid:558474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjicheng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjicheng.com"; sid:558475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanp.com"; sid:558476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanseo666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanseo666.com"; sid:558477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansolo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansolo.com"; sid:558478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for www67oqueprecisarcontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"www67oqueprecisarcontracorona.com"; sid:558479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19-elsalvador.com"; sid:558480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xrpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xrpcorona.com"; sid:558481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youagainstcovid19.com"; sid:558482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youarenotalonecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youarenotalonecovid19.com"; sid:558483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusstories.com"; sid:558484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirusstory.com"; sid:558485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19heroes.com"; sid:558486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19study.com"; sid:558487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19trial.com"; sid:558488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidheroes.com"; sid:558489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youthjusticecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youthjusticecovid19.com"; sid:558490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zabolevshie-coronavirusom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zabolevshie-coronavirusom.com"; sid:558491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zamcovid19.com"; sid:558492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15-minutecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15-minutecoronavirustest.com"; sid:558493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecoronavirustest.com"; sid:558494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15-minutecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15-minutecovid-19test.com"; sid:558495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovid19test.com"; sid:558496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800corona19.com"; sid:558497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidoperations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidoperations.com"; sid:558498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaviruses.com"; sid:558499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus.net"; sid:558500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2022coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2022coronavirus.com"; sid:558501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2024coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2024coronavirus.com"; sid:558502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2024coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2024coronavirus.net"; sid:558503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800covid.com"; sid:558504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800covidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800covidhelp.com"; sid:558505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a2covid19.com"; sid:558506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronaviruscovid-19.com"; sid:558507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovid-19.com"; sid:558508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for action-groupe-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"action-groupe-covid-19.com"; sid:558509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adcovid19.com"; sid:558510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscoronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscoronaviruscovid-19.com"; sid:558511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona24.com"; sid:558512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronatest.com"; sid:558513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19products.com"; sid:558514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19survival.com"; sid:558515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahcovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahcovid.care"; sid:558516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahcovidcare.com"; sid:558517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ai-ct-covid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ai-ct-covid.team"; sid:558518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aiepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aiepidemics.com"; sid:558519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aimcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aimcovid19vaccine.com"; sid:558520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airehealthcovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airehealthcovid.care"; sid:558521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airehealthcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airehealthcovidcare.com"; sid:558522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertentraidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertentraidecovid19.com"; sid:558523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amawoncovidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amawoncovidservices.com"; sid:558524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid19.com"; sid:558525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid-20.com"; sid:558526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid20.com"; sid:558527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid-21.com"; sid:558528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid21.com"; sid:558529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for animalshelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"animalshelpcovid19.com"; sid:558530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19shop.com"; sid:558531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19-supply.com"; sid:558532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-liquid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-liquid.com"; sid:558533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.team"; sid:558534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotecovid-19.com"; sid:558535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid19.net"; sid:558536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-covid-19.com"; sid:558537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-covid19.com"; sid:558538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescovid19.com"; sid:558539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apreslecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apreslecoronavirus.com"; sid:558540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arsipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arsipcovid19.com"; sid:558541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinthetimeofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinthetimeofthepandemic.com"; sid:558542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackcorona.com"; sid:558543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for augustiner-statt-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"augustiner-statt-corona.net"; sid:558544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacoronawarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacoronawarriors.com"; sid:558545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycovid.com"; sid:558546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barriercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barriercovid.com"; sid:558547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbank-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbank-coronavirus.com"; sid:558548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbankcoronavirus.com"; sid:558549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbankcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbankcoronavirusresponse.com"; sid:558550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbank-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbank-covid-19.com"; sid:558551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbank-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbank-covid19.com"; sid:558552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbankcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbankcovid-19.com"; sid:558553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbankcovid19.com"; sid:558554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbt-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbt-coronavirus.com"; sid:558555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtcoronavirus.com"; sid:558556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtcoronavirusresponse.com"; sid:558557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbt-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbt-covid-19.com"; sid:558558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbt-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbt-covid19.com"; sid:558559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtcovid-19.com"; sid:558560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtcovid19.com"; sid:558561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtrobbinscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtrobbinscovid-19.com"; sid:558562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcpcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcpcovid20.com"; sid:558563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardsofcorona.com"; sid:558564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beds4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beds4corona.com"; sid:558565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronainvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronainvest.com"; sid:558566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusmaskss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusmaskss.com"; sid:558567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bexarcountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bexarcountycovid19.com"; sid:558568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid19.net"; sid:558569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondpandemics.com"; sid:558570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcorona.com"; sid:558571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigeasycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigeasycovidclean.com"; sid:558572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohackcoronavirus.com"; sid:558573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohackcovid19.com"; sid:558574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioresonancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioresonancecoronavirus.com"; sid:558575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioresonancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioresonancecovid19.com"; sid:558576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid-19.com"; sid:558577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blu4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blu4covid.com"; sid:558578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bonnetandcovid-19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bonnetandcovid-19chronicles.com"; sid:558579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookcovid19.com"; sid:558580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncovidresponse.com"; sid:558581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessaftercoronavirus.com"; sid:558582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessagainstcovid.com"; sid:558583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessclaimforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessclaimforcorona.com"; sid:558584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19testkitdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19testkitdirect.com"; sid:558585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyppecovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyppecovid-19virus.com"; sid:558586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calificovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calificovid.com"; sid:558587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canada--covidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canada--covidhelp.com"; sid:558588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerincorona.com"; sid:558589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerinthetimeofcovid.com"; sid:558590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careercorona.com"; sid:558591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscovid19.com"; sid:558592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caughtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caughtcovid.com"; sid:558593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdcworkcovid19.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdcworkcovid19.us"; sid:558594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycovid-19bingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycovid-19bingo.com"; sid:558595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycovid19bingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycovid19bingo.com"; sid:558596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycovidbingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycovidbingo.com"; sid:558597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cellmacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cellmacovid.com"; sid:558598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for central-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"central-covid.com"; sid:558599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centraltexascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centraltexascovid19.com"; sid:558600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for challengecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"challengecovid.net"; sid:558601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartingcovid.com"; sid:558602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkfocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkfocorona.com"; sid:558603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chekforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chekforcorona.com"; sid:558604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19cleaners.com"; sid:558605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidclean.com"; sid:558606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcleaner.com"; sid:558607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcleaners.com"; sid:558608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagolandcovidcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagolandcovidcommons.com"; sid:558609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagolandcovidcommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagolandcovidcommons.net"; sid:558610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovid.com"; sid:558611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquineforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquineforcovid.com"; sid:558612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christovercovid.com"; sid:558613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citestgocoronago12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citestgocoronago12.com"; sid:558614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimforcorona.com"; sid:558615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimforcoronalosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimforcoronalosses.com"; sid:558616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinic-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinic-covid19.com"; sid:558617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmcovid19.com"; sid:558618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachellavalley-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachellavalley-covid.com"; sid:558619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codepacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codepacovid.com"; sid:558620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comingbackfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comingbackfromcovid19.com"; sid:558621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communistchinacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communistchinacovid.com"; sid:558622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concursocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concursocoronavirus.com"; sid:558623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conroecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conroecovid19.com"; sid:558624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1122.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1122.com"; sid:558625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19compensation.com"; sid:558626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19tracker.com"; sid:558627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2019virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2019virus.com"; sid:558628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020survivors.com"; sid:558629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona24shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona24shop.com"; sid:558630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona324.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona324.com"; sid:558631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaakuten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaakuten.com"; sid:558632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-app.net"; sid:558633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy.biz"; sid:558634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababylife.com"; sid:558635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcys.com"; sid:558636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bd.com"; sid:558637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestcare.com"; sid:558638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-block.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-block.net"; sid:558639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathwork.com"; sid:558640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabyarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabyarea.com"; sid:558641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapital.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapital.net"; sid:558642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-care.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-care.digital"; sid:558643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.digital"; sid:558644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.fund"; sid:558645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarekit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarekit.biz"; sid:558646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresfunding.com"; sid:558647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresrelief.com"; sid:558648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaricatures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaricatures.com"; sid:558649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation.club"; sid:558650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachamp.com"; sid:558651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachapter11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachapter11.com"; sid:558652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachapter13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachapter13.com"; sid:558653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachapter7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachapter7.com"; sid:558654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanyclaims.com"; sid:558655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensationclaims.com"; sid:558656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompo.com"; sid:558657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcerns.com"; sid:558658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnect.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnect.life"; sid:558659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19hometesting.com"; sid:558660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19testing.com"; sid:558661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisiscinema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisiscinema.com"; sid:558662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisconsulting.com"; sid:558663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisservices.com"; sid:558664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisuk.com"; sid:558665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacronies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacronies.com"; sid:558666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrony.com"; sid:558667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadados.com"; sid:558668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadergi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadergi.com"; sid:558669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisasterloans.com"; sid:558670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-photography-design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-photography-design.com"; sid:558671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-earth.com"; sid:558672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaestimator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaestimator.com"; sid:558673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-europe.com"; sid:558674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-existenzhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-existenzhilfe.com"; sid:558675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexistenzhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexistenzhilfe.com"; sid:558676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-existenzhilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-existenzhilfe.net"; sid:558677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexistenzhilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexistenzhilfe.net"; sid:558678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaces.com"; sid:558679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafake.net"; sid:558680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-files.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-files.com"; sid:558681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancialcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancialcrisis.com"; sid:558682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflab.com"; sid:558683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflab.net"; sid:558684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafood.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafood.recipes"; sid:558685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecountry.com"; sid:558686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-globe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-globe.com"; sid:558687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronago.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronago.life"; sid:558688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagotmehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagotmehome.com"; sid:558689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaiti.com"; sid:558690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahnuti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahnuti.com"; sid:558691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincanada.com"; sid:558692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo.life"; sid:558693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformation.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformation.club"; sid:558694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfotracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfotracker.com"; sid:558695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainmycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainmycounty.com"; sid:558696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceattorney.com"; sid:558697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairsl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairsl.com"; sid:558698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindess.com"; sid:558699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrush.com"; sid:558700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatestnewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatestnewsupdates.com"; sid:558701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalia.com"; sid:558702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifeassurancefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifeassurancefacts.com"; sid:558703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifeinsurancefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifeinsurancefacts.com"; sid:558704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalimesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalimesmatter.com"; sid:558705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigationattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigationattorney.com"; sid:558706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigationcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigationcase.com"; sid:558707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigationlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigationlawyer.com"; sid:558708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloansupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloansupport.com"; sid:558709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloansupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloansupport.net"; sid:558710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdownsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdownsurvival.com"; sid:558711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloket.com"; sid:558712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-map-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-map-info.com"; sid:558713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaptrackapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaptrackapp.com"; sid:558714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedik.com"; sid:558715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamental.com"; sid:558716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mentalhealth.com"; sid:558717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamental-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamental-health.com"; sid:558718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamentalhealth.com"; sid:558719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerdus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerdus.com"; sid:558720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiracles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiracles.com"; sid:558721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonument.com"; sid:558722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamucadele.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamucadele.com"; sid:558723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-need-to-know.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-need-to-know.com"; sid:558724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsapp.com"; sid:558725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanikatu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanikatu.com"; sid:558726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronann95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronann95mask.com"; sid:558727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlineshop.com"; sid:558728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapilottracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapilottracker.com"; sid:558729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-planet.com"; sid:558730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-poker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-poker.com"; sid:558731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapows.com"; sid:558732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapows.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapows.net"; sid:558733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappcolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappcolombia.com"; sid:558734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappsantarosa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappsantarosa.com"; sid:558735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproblems.com"; sid:558736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmylyft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmylyft.com"; sid:558737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmyrideshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmyrideshare.com"; sid:558738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapublichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapublichealth.com"; sid:558739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-punk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-punk.com"; sid:558740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarabi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarabi.com"; sid:558741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradyo.com"; sid:558742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronardm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronardm.com"; sid:558743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredcap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredcap.com"; sid:558744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredhat.com"; sid:558745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefcheck.com"; sid:558746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchus.com"; sid:558747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareset.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareset.life"; sid:558748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroundus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroundus.com"; sid:558749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroute.com"; sid:558750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.center"; sid:558751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.city"; sid:558752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.club"; sid:558753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.delivery"; sid:558754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.digital"; sid:558755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.directory"; sid:558756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.life"; sid:558757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.world"; sid:558758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sance.com"; sid:558759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasance.com"; sid:558760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasance.net"; sid:558761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasentinel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasentinel.com"; sid:558762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseptic.com"; sid:558763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknessclaims.com"; sid:558764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasleeve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasleeve.com"; sid:558765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolicitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolicitors.com"; sid:558766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspringsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspringsusa.com"; sid:558767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatista.com"; sid:558768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatus.world"; sid:558769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilization.com"; sid:558770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastic.com"; sid:558771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop28.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop28.net"; sid:558772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastore24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastore24.com"; sid:558773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastressedmeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastressedmeout.com"; sid:558774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrike.net"; sid:558775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvie.com"; sid:558776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvival101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvival101.com"; sid:558777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivors.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivors.world"; sid:558778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswiss.com"; sid:558779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymtoms.com"; sid:558780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-technology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-technology.com"; sid:558781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-ig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-ig.com"; sid:558782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinghome.com"; sid:558783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateststrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateststrips.com"; sid:558784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathankyounotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathankyounotes.com"; sid:558785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathankyous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathankyous.com"; sid:558786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathemovie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathemovie.net"; sid:558787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimediary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimediary.com"; sid:558788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerbg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerbg.com"; sid:558789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunternehmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunternehmen.com"; sid:558790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaup.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaup.date"; sid:558791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdates.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdates.club"; sid:558792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine2020.com"; sid:558793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinus.net"; sid:558794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris.net"; sid:558795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.cloud"; sid:558796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.date"; sid:558797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19infection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19infection.com"; sid:558798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.legal"; sid:558799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19usa.com"; sid:558800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19vaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19vaxin.com"; sid:558801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandibuprofenrhsnopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandibuprofenrhsnopes.com"; sid:558802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-archive.com"; sid:558803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautocleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautocleaners.com"; sid:558804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawareness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawareness.net"; sid:558805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbag.com"; sid:558806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbidet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbidet.com"; sid:558807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiz.com"; sid:558808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscleaners.com"; sid:558809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbypost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbypost.com"; sid:558810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarcleaners.com"; sid:558811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarerelief.com"; sid:558812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-case.com"; sid:558813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscensorship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscensorship.com"; sid:558814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningfla.com"; sid:558815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning-florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning-florida.com"; sid:558816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cleanup-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cleanup-now.com"; sid:558817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliant.com"; sid:558818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-costarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-costarica.com"; sid:558819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscostarica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscostarica.net"; sid:558820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscountries.com"; sid:558821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscountrybycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscountrybycountry.com"; sid:558822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscountryreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscountryreports.com"; sid:558823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19.cloud"; sid:558824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19testing.com"; sid:558825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscureindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscureindia.com"; sid:558826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-curriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-curriculum.com"; sid:558827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatahub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatahub.com"; sid:558828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeadcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeadcount.com"; sid:558829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-death.com"; sid:558830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-desinfection-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-desinfection-france.com"; sid:558831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetective.com"; sid:558832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiets.com"; sid:558833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019symptoms.com"; sid:558834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019vaccine.com"; sid:558835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasefree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasefree.com"; sid:558836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasemedicine.com"; sid:558837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenelmundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenelmundo.com"; sid:558838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesdeaths.com"; sid:558839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseshealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseshealing.com"; sid:558840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesprojections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesprojections.com"; sid:558841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighters.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighters.club"; sid:558842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilmfestival.com"; sid:558843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeservice.com"; sid:558844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeservices.com"; sid:558845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobal.net"; sid:558846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguayaquil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguayaquil.com"; sid:558847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-guidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-guidance.com"; sid:558848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hackathons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hackathons.net"; sid:558849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthadvice.com"; sid:558850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthgear.com"; sid:558851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthprofile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthprofile.com"; sid:558852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpfunds.com"; sid:558853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomecleaners.com"; sid:558854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoustonupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoustonupdates.com"; sid:558855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusin.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusin.world"; sid:558856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiqtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiqtest.com"; sid:558857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisascam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisascam.com"; sid:558858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjordan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjordan.com"; sid:558859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuit19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuit19.com"; sid:558860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivee.com"; sid:558861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakers-raspeig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakers-raspeig.com"; sid:558862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedco.com"; sid:558863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmigration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmigration.com"; sid:558864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilano.com"; sid:558865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmitigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmitigations.com"; sid:558866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmke.com"; sid:558867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnerede.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnerede.com"; sid:558868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnicaragua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnicaragua.com"; sid:558869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnicaragua.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnicaragua.net"; sid:558870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-pademic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-pademic.com"; sid:558871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicterminator.com"; sid:558872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspapers.com"; sid:558873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaces.com"; sid:558874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproteccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproteccion.com"; sid:558875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-quarantine.com"; sid:558876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantinetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantinetips.com"; sid:558877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadbook.com"; sid:558878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieffinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieffinancing.com"; sid:558879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.guru"; sid:558880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefmoney.com"; sid:558881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefsupplies.com"; sid:558882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremoval.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremoval.club"; sid:558883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussantarosa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussantarosa.com"; sid:558884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussantarosadecabal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussantarosadecabal.com"; sid:558885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbadisasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbadisasterloans.com"; sid:558886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreening.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreening.mobi"; sid:558887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussense.com"; sid:558888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolicitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolicitors.com"; sid:558889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatebracket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatebracket.com"; sid:558890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustabela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustabela.com"; sid:558891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxquestions.com"; sid:558892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxquestions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxquestions.net"; sid:558893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestandcure.com"; sid:558894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.club"; sid:558895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.network"; sid:558896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test-provider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test-provider.com"; sid:558897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrade.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrade.club"; sid:558898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraders.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraders.club"; sid:558899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrades.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrades.club"; sid:558900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustransactionguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustransactionguard.com"; sid:558901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustriallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustriallaw.com"; sid:558902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustriallawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustriallawyers.com"; sid:558903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustruth.com"; sid:558904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ukdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ukdata.com"; sid:558905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususaupdate.com"; sid:558906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaxin.com"; sid:558907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimfund.com"; sid:558908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvis.com"; sid:558909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-v-rossii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-v-rossii.com"; sid:558910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkcompmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkcompmn.com"; sid:558911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisus.com"; sid:558912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-voucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-voucher.com"; sid:558913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworld2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworld2020.com"; sid:558914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldchanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldchanger.com"; sid:558915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaww111.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaww111.com"; sid:558916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaww3.com"; sid:558917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawww3.com"; sid:558918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayears.com"; sid:558919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayokmusgibi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayokmusgibi.com"; sid:558920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zero.com"; sid:558921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corpuschristicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corpuschristicovid19.com"; sid:558922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov19coronavirus.com"; sid:558923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18-elsalvador.com"; sid:558924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19420.com"; sid:558925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19academy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19academy.com"; sid:558926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-action.com"; sid:558927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adultbeverages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adultbeverages.com"; sid:558928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adventures.com"; sid:558929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advise.com"; sid:558930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19afterthenightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19afterthenightmare.com"; sid:558931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidsupplies.com"; sid:558932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-airlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-airlines.com"; sid:558933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andthechurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andthechurch.com"; sid:558934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andthesymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andthesymptoms.com"; sid:558935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andyou.com"; sid:558936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiesregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiesregister.com"; sid:558937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyregister.com"; sid:558938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appliance.com"; sid:558939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arg.com"; sid:558940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19article.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19article.com"; sid:558941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19at.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19at.com"; sid:558942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atl.com"; sid:558943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attire.com"; sid:558944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aus.com"; sid:558945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19australianbusinessguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19australianbusinessguide.com"; sid:558946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autocleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autocleaners.com"; sid:558947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avoidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avoidsecure.com"; sid:558948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ayudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ayudan.com"; sid:558949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ayudar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ayudar.com"; sid:558950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backtothebasics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backtothebasics.com"; sid:558951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ba.com"; sid:558952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19badges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19badges.com"; sid:558953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bag.com"; sid:558954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bailout.com"; sid:558955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19barristers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19barristers.com"; sid:558956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barristers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barristers.com"; sid:558957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19battle.com"; sid:558958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bestlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bestlawyers.com"; sid:558959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bestlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bestlawyers.com"; sid:558960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bill2china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bill2china.com"; sid:558961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizfund.com"; sid:558962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizfunds.com"; sid:558963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bolivia.com"; sid:558964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boomers.com"; sid:558965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bounce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bounce.com"; sid:558966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bracelet.com"; sid:558967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bracelet.com"; sid:558968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bridge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bridge.com"; sid:558969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brownsville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brownsville.com"; sid:558970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessassistance.com"; sid:558971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessassistance.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessassistance.loan"; sid:558972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessassistance.net"; sid:558973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessbailoutassistance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessbailoutassistance.claims"; sid:558974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessbailoutassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessbailoutassistance.com"; sid:558975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessbailoutassistance.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessbailoutassistance.loans"; sid:558976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessbailoutassistance.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessbailoutassistance.money"; sid:558977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessbailoutassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessbailoutassistance.net"; sid:558978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-business-bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-business-bailout.com"; sid:558979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscleaners.com"; sid:558980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-business.com"; sid:558981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesses.com"; sid:558982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessfunds.com"; sid:558983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessgrantassistance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessgrantassistance.claims"; sid:558984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessgrantassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessgrantassistance.com"; sid:558985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessgrantassistance.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessgrantassistance.loans"; sid:558986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessgrantassistance.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessgrantassistance.money"; sid:558987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessgrantassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessgrantassistance.net"; sid:558988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessgrants.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessgrants.biz"; sid:558989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesskickstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesskickstart.com"; sid:558990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslending.com"; sid:558991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloanassistance.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloanassistance.biz"; sid:558992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloans.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloans.biz"; sid:558993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessnavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessnavigator.com"; sid:558994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefassistance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefassistance.claims"; sid:558995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefassistance.com"; sid:558996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefassistance.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefassistance.loans"; sid:558997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefassistance.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefassistance.money"; sid:558998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefassistance.net"; sid:558999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-business-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-business-relief.com"; sid:559000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessrelief.com"; sid:559001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-asheville.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-asheville.biz"; sid:559002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms.biz"; sid:559003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefprograms.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefprograms.claims"; sid:559004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefprograms.com"; sid:559005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefprograms.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefprograms.loans"; sid:559006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-losangeles.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-losangeles.biz"; sid:559007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefprograms.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefprograms.money"; sid:559008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessreliefprograms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessreliefprograms.net"; sid:559009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-northcarolina.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-northcarolina.biz"; sid:559010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-orangecounty.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-orangecounty.biz"; sid:559011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessreliefprograms-sanfrancisco.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessreliefprograms-sanfrancisco.biz"; sid:559012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buyppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buyppe.com"; sid:559013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carpediem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carpediem.com"; sid:559014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carpediem.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carpediem.email"; sid:559015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carpediem.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carpediem.net"; sid:559016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carpediem.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carpediem.solutions"; sid:559017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casualties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casualties.com"; sid:559018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19censorship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19censorship.com"; sid:559019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chile.com"; sid:559020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningagency.com"; sid:559021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcrew.com"; sid:559022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningessentials.com"; sid:559023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningflorida.com"; sid:559024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninggroup.com"; sid:559025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningsolutions.com"; sid:559026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningstaff.com"; sid:559027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningteam.com"; sid:559028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19comedytour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19comedytour.com"; sid:559029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commercialcleaning.com"; sid:559030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compo.com"; sid:559031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19conspiracy.com"; sid:559032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultantgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultantgroup.com"; sid:559033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultants.com"; sid:559034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contagion.com"; sid:559035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contagionscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contagionscore.com"; sid:559036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contagionscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contagionscore.com"; sid:559037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19convalescentplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19convalescentplasma.com"; sid:559038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19convalescentplasma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19convalescentplasma.net"; sid:559039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus-communityhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus-communityhelp.com"; sid:559040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus-cure.com"; sid:559041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusdata.com"; sid:559042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus-vaccine.com"; sid:559043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-costarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-costarica.com"; sid:559044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cost.com"; sid:559045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counts.com"; sid:559046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crowdfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crowdfund.com"; sid:559047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cruise.com"; sid:559048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cruiselines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cruiselines.com"; sid:559049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cryptoloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cryptoloan.com"; sid:559050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dashboard.com"; sid:559051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtsolutions.com"; sid:559052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deli.com"; sid:559053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-depistage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-depistage.com"; sid:559054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-desinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-desinfection.com"; sid:559055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19destek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19destek.com"; sid:559056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterloans.com"; sid:559057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disease.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disease.cloud"; sid:559058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dossier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dossier.com"; sid:559059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dress.com"; sid:559060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-earth.com"; sid:559061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ecards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ecards.com"; sid:559062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-e.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-e.com"; sid:559063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eidl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eidl.com"; sid:559064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-eksalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-eksalvador.com"; sid:559065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elalvador.com"; sid:559066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsakvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsakvador.com"; sid:559067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalador.com"; sid:559068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalavdor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalavdor.com"; sid:559069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalbador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalbador.com"; sid:559070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalcador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalcador.com"; sid:559071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsallvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsallvador.com"; sid:559072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvado.com"; sid:559073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvadoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvadoe.com"; sid:559074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-elsalvador.com"; sid:559075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvadr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvadr.com"; sid:559076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvaor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvaor.com"; sid:559077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvasor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvasor.com"; sid:559078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvdor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvdor.com"; sid:559079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvedor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvedor.com"; sid:559080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvsdor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvsdor.com"; sid:559081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elsavador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elsavador.com"; sid:559082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elslavador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elslavador.com"; sid:559083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elslvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elslvador.com"; sid:559084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsslvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsslvador.com"; sid:559085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-emirates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-emirates.com"; sid:559086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employment.com"; sid:559087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enterprises.com"; sid:559088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epicenter.com"; sid:559089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-epidemic.com"; sid:559090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-eq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-eq.com"; sid:559091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.estate - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.estate"; sid:559092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-etihad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-etihad.com"; sid:559093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eu.com"; sid:559094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faces.com"; sid:559095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19factsandlinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19factsandlinks.com"; sid:559096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facts.net"; sid:559097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faq.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faq.cloud"; sid:559098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fgl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fgl.com"; sid:559099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialservices.com"; sid:559100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flushot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flushot.com"; sid:559101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foxlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foxlawsuit.com"; sid:559102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fra.com"; sid:559103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19frontlinesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19frontlinesupport.com"; sid:559104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsavailable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsavailable.com"; sid:559105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsimplified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsimplified.com"; sid:559106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsmadeeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsmadeeasy.com"; sid:559107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gb.com"; sid:559108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gofund.com"; sid:559109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19griefsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19griefsupport.com"; sid:559110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gunlukleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gunlukleri.com"; sid:559111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hairdontcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hairdontcare.com"; sid:559112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthgear.com"; sid:559113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpforbusinesses.com"; sid:559114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-heroes.com"; sid:559115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecures.com"; sid:559116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecures.com"; sid:559117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkitset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkitset.com"; sid:559118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestset.com"; sid:559119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homevalue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homevalue.com"; sid:559120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-honduras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-honduras.com"; sid:559121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingimpact.com"; sid:559122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19houston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19houston.com"; sid:559123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-howtobusness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-howtobusness.com"; sid:559124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hustle.com"; sid:559125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19i.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19i.com"; sid:559126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-icu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-icu.com"; sid:559127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idiot.com"; sid:559128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiatracker.com"; sid:559129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-infa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-infa.com"; sid:559130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19in.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19in.life"; sid:559131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspiration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspiration.com"; sid:559132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19intelligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19intelligence.com"; sid:559133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interface.com"; sid:559134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-international.com"; sid:559135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19international.com"; sid:559136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19investigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19investigations.com"; sid:559137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iqcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iqcure.com"; sid:559138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iqtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iqtest.com"; sid:559139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19journey.com"; sid:559140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kindnesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kindnesses.com"; sid:559141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kn95.com"; sid:559142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kn95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kn95mask.com"; sid:559143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19learntobusness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19learntobusness.com"; sid:559144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresource.com"; sid:559145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lender.com"; sid:559146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loan.net"; sid:559147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19local.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19local.com"; sid:559148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lsalvador.com"; sid:559149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19malpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19malpractice.com"; sid:559150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketimpact.com"; sid:559151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketvalue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketvalue.com"; sid:559152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mask.net"; sid:559153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19matching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19matching.com"; sid:559154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medal.com"; sid:559155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalgear.com"; sid:559156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalsuppliers.com"; sid:559157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medmarket.com"; sid:559158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19methodisthospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19methodisthospital.com"; sid:559159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19metrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19metrics.com"; sid:559160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mgt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mgt.com"; sid:559161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19microsimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19microsimulation.com"; sid:559162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19migration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19migration.com"; sid:559163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milano.com"; sid:559164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigations.com"; sid:559165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mostoles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mostoles.com"; sid:559166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myth.com"; sid:559167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19namibia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19namibia.com"; sid:559168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neveragain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neveragain.com"; sid:559169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-newyork.com"; sid:559170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-newzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-newzealand.com"; sid:559171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nicaragua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nicaragua.com"; sid:559172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nigeria.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nigeria.net"; sid:559173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normalcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normalcy.com"; sid:559174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nurseblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nurseblog.com"; sid:559175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nz.com"; sid:559176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemia.com"; sid:559177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19papers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19papers.com"; sid:559178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patientrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patientrecovered.com"; sid:559179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paycheck.com"; sid:559180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paynowstaylater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paynowstaylater.com"; sid:559181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pdhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pdhelp.com"; sid:559182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plus.com"; sid:559183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policestoplawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policestoplawyer.com"; sid:559184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19posguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19posguard.com"; sid:559185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-positivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-positivity.com"; sid:559186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppelocations.com"; sid:559187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppemask.com"; sid:559188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prcsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prcsupply.com"; sid:559189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19president.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19president.com"; sid:559190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19product.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19product.com"; sid:559191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19products.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19products.net"; sid:559192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychological.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychological.com"; sid:559193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-qatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-qatar.com"; sid:559194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinegame.com"; sid:559195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidathometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidathometest.com"; sid:559196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rates.com"; sid:559197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-realestate.com"; sid:559198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realestate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realestate.net"; sid:559199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatenews.com"; sid:559200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realtors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realtors.com"; sid:559201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtors.com"; sid:559202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebuiild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebuiild.com"; sid:559203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19re.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19re.com"; sid:559204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverycalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverycalifornia.com"; sid:559205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverycenter.com"; sid:559206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverycenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverycenters.com"; sid:559207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverycentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverycentral.com"; sid:559208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoveryflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoveryflorida.com"; sid:559209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryflorida.com"; sid:559210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoverylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoverylaw.com"; sid:559211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoverylegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoverylegal.com"; sid:559212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverylouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverylouisiana.com"; sid:559213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoverynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoverynewyork.com"; sid:559214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverynewyork.com"; sid:559215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryny.com"; sid:559216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryonline.com"; sid:559217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverystories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverystories.com"; sid:559218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoverywashingtonstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoverywashingtonstate.com"; sid:559219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverywashingtonstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverywashingtonstate.com"; sid:559220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recovery.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recovery.world"; sid:559221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-relief-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-relief-assistance.com"; sid:559222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-relief-assistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-relief-assistance.net"; sid:559223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffunding.com"; sid:559224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.guru"; sid:559225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relieflending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relieflending.com"; sid:559226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieflending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieflending.com"; sid:559227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.loan"; sid:559228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefs.com"; sid:559229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-remote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-remote.com"; sid:559230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotehelp.com"; sid:559231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotejob.com"; sid:559232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remote.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remote.net"; sid:559233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remoteservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remoteservices.com"; sid:559234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remoteservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remoteservices.com"; sid:559235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotesolutions.com"; sid:559236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remoteworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remoteworker.com"; sid:559237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remoteworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remoteworkers.com"; sid:559238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remoteworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remoteworkshops.com"; sid:559239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19report.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19report.world"; sid:559240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researches.com"; sid:559241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcecenters.com"; sid:559242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsekit.com"; sid:559243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailguard.com"; sid:559244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rgv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rgv.com"; sid:559245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risk.net"; sid:559246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risknumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risknumber.com"; sid:559247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roadmap.com"; sid:559248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ro.com"; sid:559249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeathome.com"; sid:559250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saglik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saglik.com"; sid:559251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitarysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitarysupplies.com"; sid:559252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-score.com"; sid:559253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlementfund.com"; sid:559254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simulation.com"; sid:559255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-singapore.com"; sid:559256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smart.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smart.center"; sid:559257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancing2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancing2020.com"; sid:559258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancing2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancing2021.com"; sid:559259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soldier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soldier.com"; sid:559260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soldiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soldiers.com"; sid:559261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solicitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solicitors.com"; sid:559262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19songs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19songs.net"; sid:559263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-southwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-southwest.com"; sid:559264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-states.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-states.com"; sid:559265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistic.com"; sid:559266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stats.net"; sid:559267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimuluscheck.com"; sid:559268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stimuluscheck.com"; sid:559269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stimuluscheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stimuluscheck.net"; sid:559270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stopthespread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stopthespread.com"; sid:559271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stores.com"; sid:559272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stresssyndrome.com"; sid:559273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19summit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19summit.email"; sid:559274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superheroes.com"; sid:559275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliers.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliers.mobi"; sid:559276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportforbusiness.com"; sid:559277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfund.com"; sid:559278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supports.com"; sid:559279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors.world"; sid:559280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sv.net"; sid:559281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomshelp.com"; sid:559282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symtoms.com"; sid:559283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxplanning.com"; sid:559284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxquestions.com"; sid:559285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxquestions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxquestions.net"; sid:559286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkits.net"; sid:559287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.network"; sid:559288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.today"; sid:559289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test-kit.com"; sid:559290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitsdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitsdirect.com"; sid:559291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tf.com"; sid:559292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19themovie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19themovie.net"; sid:559293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19themusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19themusical.com"; sid:559294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-themusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-themusical.com"; sid:559295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19titties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19titties.com"; sid:559296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19total.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19total.com"; sid:559297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tree.com"; sid:559298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tree.net"; sid:559299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trialattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trialattorney.com"; sid:559300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19triallawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19triallawyer.com"; sid:559301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19u.com"; sid:559302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentbenefits.com"; sid:559303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentflorida.com"; sid:559304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentnyc.com"; sid:559305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unit.com"; sid:559306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19universe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19universe.com"; sid:559307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uruguay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uruguay.com"; sid:559308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usadeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usadeaths.com"; sid:559309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19us.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19us.cloud"; sid:559310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccino.com"; sid:559311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19value.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19value.com"; sid:559312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimfund.com"; sid:559313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vietnam.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vietnam.today"; sid:559314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vip.com"; sid:559315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscorona.com"; sid:559316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusliveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusliveupdates.com"; sid:559317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.mobi"; sid:559318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19voluteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19voluteers.com"; sid:559319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vrc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vrc.com"; sid:559320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wewillrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wewillrecover.com"; sid:559321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whoupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whoupdates.com"; sid:559322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workingcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workingcapital.com"; sid:559323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19world.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19world.net"; sid:559324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wristband.com"; sid:559325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xyz.com"; sid:559326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19zapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19zapper.com"; sid:559327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1st.com"; sid:559328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1stresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1stresponder.com"; sid:559329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1stresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1stresponders.com"; sid:559330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019india.com"; sid:559331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019simulator.com"; sid:559332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020survivors.com"; sid:559333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20game.com"; sid:559334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20mask.com"; sid:559335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-news.com"; sid:559336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20stop.com"; sid:559337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-updates.com"; sid:559338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21-news.com"; sid:559339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21-updates.com"; sid:559340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid312.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid312.com"; sid:559341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9-elsalvador.com"; sid:559342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9filmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9filmfestival.com"; sid:559343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9usa.com"; sid:559344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabc.com"; sid:559345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafrica.com"; sid:559346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaftermathhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaftermathhelp.com"; sid:559347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaftermathsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaftermathsupport.com"; sid:559348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidlive.com"; sid:559349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalert.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalert.network"; sid:559350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalert.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalert.world"; sid:559351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandibuprofenrhsnopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandibuprofenrhsnopes.com"; sid:559352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyreport.com"; sid:559353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarebours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarebours.com"; sid:559354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-art.com"; sid:559355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-arte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-arte.com"; sid:559356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarte.com"; sid:559357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartproject.com"; sid:559358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartsproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartsproject.com"; sid:559359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistancecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistancecheck.com"; sid:559360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyboomer.com"; sid:559361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-badarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-badarf.com"; sid:559362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcysupport.com"; sid:559363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-beat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-beat.com"; sid:559364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeat.com"; sid:559365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedside.com"; sid:559366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizresponse.com"; sid:559367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblooddonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblooddonor.com"; sid:559368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidb.net"; sid:559369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbounceback.com"; sid:559370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbridge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbridge.com"; sid:559371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrooklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrooklyn.com"; sid:559372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrownsville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrownsville.com"; sid:559373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslending.com"; sid:559374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessloanassistance.com"; sid:559375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcal.com"; sid:559376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcallcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcallcenter.com"; sid:559377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcap.com"; sid:559378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalists.com"; sid:559379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecube.com"; sid:559380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareforall.com"; sid:559381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareithaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareithaca.com"; sid:559382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremongering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremongering.com"; sid:559383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasesusa.com"; sid:559384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasesus.com"; sid:559385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcensus.com"; sid:559386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchannel.com"; sid:559387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimscenter.com"; sid:559388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning.biz"; sid:559389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothingline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothingline.com"; sid:559390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombat.net"; sid:559391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedycanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedycanada.com"; sid:559392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compensation.com"; sid:559393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancefoundation.com"; sid:559394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancefoundation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancefoundation.net"; sid:559395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcleaning.com"; sid:559396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianthomeorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianthomeorganization.com"; sid:559397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianthomeorganization.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianthomeorganization.net"; sid:559398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianthomeorganizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianthomeorganizer.com"; sid:559399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianthomeorganizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianthomeorganizer.net"; sid:559400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant.net"; sid:559401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealestate.com"; sid:559402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealestate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealestate.net"; sid:559403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealtor.com"; sid:559404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealtor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealtor.net"; sid:559405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealtors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealtors.com"; sid:559406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealtors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealtors.net"; sid:559407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrealty.com"; sid:559408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconerns.com"; sid:559409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconf.net"; sid:559410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstruction.com"; sid:559411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstructions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstructions.com"; sid:559412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultant.net"; sid:559413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.net"; sid:559414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvalescentplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvalescentplasma.com"; sid:559415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvalescentplasma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvalescentplasma.net"; sid:559416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona.cloud"; sid:559417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisattorneys.com"; sid:559418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisislaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisislaw.com"; sid:559419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisservices.com"; sid:559420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure.life"; sid:559421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurvetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurvetracker.com"; sid:559422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcut.com"; sid:559423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddad.com"; sid:559424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-data-intake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-data-intake.com"; sid:559425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-decontamination.com"; sid:559426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenses.com"; sid:559427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeliver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeliver.com"; sid:559428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevices.com"; sid:559429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddistance.com"; sid:559430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidditance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidditance.com"; sid:559431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorciosyherencias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorciosyherencias.com"; sid:559432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-earth.com"; sid:559433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidearth.com"; sid:559434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-economy.com"; sid:559435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefence.com"; sid:559436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefense.net"; sid:559437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelsalvador.com"; sid:559438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-elsavador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-elsavador.com"; sid:559439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-emergency.com"; sid:559440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemiology.com"; sid:559441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemyawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemyawards.com"; sid:559442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos2020.com"; sid:559443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos2020.net"; sid:559444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-epass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-epass.com"; sid:559445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestimator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestimator.com"; sid:559446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fact.com"; sid:559447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmfest.com"; sid:559448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialplanning.com"; sid:559449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingertest.com"; sid:559450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstresponder.com"; sid:559451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfop.com"; sid:559452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeph.com"; sid:559453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerealty.com"; sid:559454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerealty.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerealty.net"; sid:559455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrustrationofpurpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrustrationofpurpose.com"; sid:559456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-globe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-globe.com"; sid:559457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoodbye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoodbye.com"; sid:559458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrad.com"; sid:559459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrapher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrapher.com"; sid:559460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhairdontcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhairdontcare.com"; sid:559461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-helper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-helper.com"; sid:559462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherograms.com"; sid:559463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomebusiness.com"; sid:559464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoodie.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoodie.biz"; sid:559465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanitarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanitarian.com"; sid:559466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididaho.com"; sid:559467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspector.com"; sid:559468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspirational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspirational.com"; sid:559469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspire.com"; sid:559470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancesettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancesettlement.com"; sid:559471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancesettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancesettlements.com"; sid:559472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterface.com"; sid:559473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-international.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-international.com"; sid:559474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinternational.com"; sid:559475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiqcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiqcure.com"; sid:559476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisdead.com"; sid:559477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid2021.com"; sid:559478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids2020.com"; sid:559479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids20-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids20-21.com"; sid:559480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids2021.com"; sid:559481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids2022.com"; sid:559482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids20.com"; sid:559483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids21.com"; sid:559484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkids.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkids.life"; sid:559485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlab.net"; sid:559486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawflorida.com"; sid:559487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawjax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawjax.com"; sid:559488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawmiami.com"; sid:559489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaworlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaworlando.com"; sid:559490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawtampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawtampa.com"; sid:559491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleaders.com"; sid:559492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lending.com"; sid:559493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlibrary.com"; sid:559494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlineco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlineco.com"; sid:559495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlineco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlineco.net"; sid:559496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmark.com"; sid:559497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingstrategies.com"; sid:559498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingstrategy.com"; sid:559499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascara.com"; sid:559500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksdirect.com"; sid:559501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksnow.com"; sid:559502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedclear.com"; sid:559503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalhelp.com"; sid:559504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalquestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalquestion.com"; sid:559505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalquestions.com"; sid:559506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsupport.com"; sid:559507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmediclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmediclear.com"; sid:559508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mexico.com"; sid:559509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmigration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmigration.com"; sid:559510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmilano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmilano.com"; sid:559511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidminar.com"; sid:559512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmind.com"; sid:559513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmotivation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmotivation.com"; sid:559514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewcareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewcareer.com"; sid:559515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnextcareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnextcareer.com"; sid:559516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnext.com"; sid:559517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteencleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteencleaning.com"; sid:559518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoman.com"; sid:559519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomia.com"; sid:559520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoneniner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoneniner.com"; sid:559521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinepsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinepsychology.com"; sid:559522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonmymind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonmymind.com"; sid:559523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopoly.com"; sid:559524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeace.com"; sid:559525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpettest.com"; sid:559526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpettest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpettest.net"; sid:559527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmasolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmasolution.com"; sid:559528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidph.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidph.net"; sid:559529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphotography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphotography.com"; sid:559530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpictures.com"; sid:559531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-planb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-planb.com"; sid:559532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-planet.com"; sid:559533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprimarycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprimarycare.com"; sid:559534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproclean.com"; sid:559535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprogramassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprogramassistance.com"; sid:559536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprophecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprophecy.com"; sid:559537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublichealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublichealth.com"; sid:559538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqanda.com"; sid:559539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickcheck.com"; sid:559540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquip.com"; sid:559541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebates.com"; sid:559542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistration.com"; sid:559543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefassistance.com"; sid:559544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefassistance.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefassistance.mobi"; sid:559545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefassistance.net"; sid:559546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffinancing.com"; sid:559547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.fund"; sid:559548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.loan"; sid:559549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.mobi"; sid:559550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepo.com"; sid:559551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseindia.com"; sid:559552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultsnow.com"; sid:559553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskindia.com"; sid:559554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rpp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rpp.com"; sid:559555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeathome.com"; sid:559556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentist.com"; sid:559557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe-dentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe-dentistry.com"; sid:559558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.tips"; sid:559559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscandx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscandx.com"; sid:559560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscape.com"; sid:559561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscotland.com"; sid:559562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen.mobi"; sid:559563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserumdonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserumdonor.com"; sid:559564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservingcovid.com"; sid:559565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-settlement.com"; sid:559566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-simulator.com"; sid:559567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsites.com"; sid:559568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sono.com"; sid:559569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsosyalbasvuru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsosyalbasvuru.com"; sid:559570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.network"; sid:559571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategy.com"; sid:559572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stress.com"; sid:559573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesdatabase.com"; sid:559574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesplus.com"; sid:559575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport.business"; sid:559576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupports.net"; sid:559577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalusa.com"; sid:559578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsworld.com"; sid:559579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-talks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-talks.com"; sid:559580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfda.com"; sid:559581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginternational.com"; sid:559582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsmart.com"; sid:559583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthankyounotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthankyounotes.com"; sid:559584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthankyous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthankyous.com"; sid:559585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapy.net"; sid:559586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapynews.com"; sid:559587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-thoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-thoughts.com"; sid:559588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerdz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerdz.com"; sid:559589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtranslate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtranslate.com"; sid:559590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelhelp.com"; sid:559591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelissues.com"; sid:559592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtributes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtributes.com"; sid:559593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduncensored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduncensored.com"; sid:559594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidux.com"; sid:559595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinfo.com"; sid:559596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinenews.com"; sid:559597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineshots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineshots.com"; sid:559598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvc.com"; sid:559599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verify.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verify.net"; sid:559600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverify.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverify.net"; sid:559601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verity.net"; sid:559602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverity.net"; sid:559603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideos.com"; sid:559604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualcare.com"; sid:559605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-2021.com"; sid:559606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus2021.com"; sid:559607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-20.com"; sid:559608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus21.com"; sid:559609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdelivery.com"; sid:559610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruskits.com"; sid:559611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwfh.com"; sid:559612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhere.com"; sid:559613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwho.com"; sid:559614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkerid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkerid.com"; sid:559615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkfromhomesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkfromhomesolutions.com"; sid:559616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldstats.com"; sid:559617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxyz.com"; sid:559618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovidcleaners.com"; sid:559619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidasedecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidasedecoronavirus.com"; sid:559620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutforcorona.com"; sid:559621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-corona.com"; sid:559622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcovid19testing.com"; sid:559623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcovidtesting.com"; sid:559624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezionecoronaviruspiemonte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezionecoronaviruspiemonte.com"; sid:559625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezionecoronavirustorino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezionecoronavirustorino.com"; sid:559626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorsfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorsfightcovid.com"; sid:559627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontfearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontfearcovid.com"; sid:559628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dopocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dopocovid-19.com"; sid:559629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug-for-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug-for-covid.com"; sid:559630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovidtest.com"; sid:559631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid.net"; sid:559632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpasocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpasocovid19.com"; sid:559633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpasocovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpasocovid19tracker.com"; sid:559634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid-19.com"; sid:559635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycovid19.com"; sid:559636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicpandemicdetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicpandemicdetox.com"; sid:559637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicbog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicbog.com"; sid:559638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.group"; sid:559639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmerch.com"; sid:559640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicvein.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicvein.com"; sid:559641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicwear.com"; sid:559642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for especialcoronanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"especialcoronanet.com"; sid:559643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcorona.com"; sid:559644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcovid.com"; sid:559645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eucoronaviruscancermonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eucoronaviruscancermonitoring.com"; sid:559646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europharmaprevencioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europharmaprevencioncovid.com"; sid:559647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for event4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"event4covid19.com"; sid:559648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for events4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"events4covid19.com"; sid:559649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingbutcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingbutcoronavirusnews.com"; sid:559650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eycovidalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eycovidalerts.com"; sid:559651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovidtest.com"; sid:559652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask-covid19.com"; sid:559653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceoffcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceoffcovid.com"; sid:559654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecovid-19.com"; sid:559655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmacovid.com"; sid:559656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-corona.net"; sid:559657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid19.life"; sid:559658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdlcovid19.com"; sid:559659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronanotliberties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronanotliberties.com"; sid:559660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fk-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fk-covid19.com"; sid:559661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortlauderdalecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortlauderdalecovid19.com"; sid:559662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthcovid19.com"; sid:559663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxhoustoncovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxhoustoncovid-19news.com"; sid:559664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronacoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronacoupons.com"; sid:559665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeofcovid19.com"; sid:559666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocovid19talent.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocovid19talent.net"; sid:559667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontlinecovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontlinecovid19.life"; sid:559668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthewuhan.com"; sid:559669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundcorona.com"; sid:559670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundstopcovid19.com"; sid:559671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuqcoronavirus.com"; sid:559672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gainesvillecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gainesvillecovid19.com"; sid:559673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generation-covid.com"; sid:559674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genvirocovid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genvirocovid19screen.com"; sid:559675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genvirocovid19screen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genvirocovid19screen.net"; sid:559676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaloans.com"; sid:559677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettingthroughtimecoronavirusthejournalaspiringauthor.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettingthroughtimecoronavirusthejournalaspiringauthor.life"; sid:559678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givecoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givecoronalove.com"; sid:559679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalshopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalshopcovid19.com"; sid:559680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalshopinccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalshopinccovid19.com"; sid:559681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gnvcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gnvcovidmask.com"; sid:559682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gnvcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gnvcovidmasks.com"; sid:559683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for governorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"governorcovid.com"; sid:559684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graphcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graphcovid19.com"; sid:559685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greenwichcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greenwichcoronavirus.com"; sid:559686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gsf-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gsf-covid-19.com"; sid:559687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid-19.com"; sid:559688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haiticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haiticorona.com"; sid:559689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycovid19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycovid19day.com"; sid:559690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happycovid19days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happycovid19days.com"; sid:559691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happymoments-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happymoments-against-corona.com"; sid:559692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harriscountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harriscountycovid19.com"; sid:559693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovidcharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovidcharts.com"; sid:559694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hayescountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hayescountycovid19.com"; sid:559695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healfromcovid19.com"; sid:559696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-stop-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-stop-coronavirus.com"; sid:559697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-stop-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-stop-coronavirus.net"; sid:559698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesagainstcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesagainstcorona.club"; sid:559699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesagainstcorona.com"; sid:559700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesfightagainstcoronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesfightagainstcoronafestival.com"; sid:559701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hit-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hit-covid.com"; sid:559702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homesellingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homesellingaftercovid19.com"; sid:559703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19.com"; sid:559704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19live.com"; sid:559705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19news.com"; sid:559706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19virus.com"; sid:559707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19virusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19virusnews.com"; sid:559708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobusnessintimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobusnessintimeofcorona.com"; sid:559709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iacovid.com"; sid:559710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcorona.life"; sid:559711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-beat-the-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-beat-the-corona-virus.com"; sid:559712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatthecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatthecovidvirus.com"; sid:559713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronavirusdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronavirusdefense.com"; sid:559714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ididthecovidrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ididthecovidrun.com"; sid:559715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idiotepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idiotepidemic.com"; sid:559716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for if-covid19-keeps-accelerating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"if-covid19-keeps-accelerating.com"; sid:559717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid-19.com"; sid:559718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecorona.net"; sid:559719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovidcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovidcommons.com"; sid:559720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovidcommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovidcommons.net"; sid:559721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidclear.com"; sid:559722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatecovid.com"; sid:559723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatecovid.net"; sid:559724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspirecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspirecovid.com"; sid:559725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtesting.com"; sid:559726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtesting.net"; sid:559727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtestkits.com"; sid:559728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceclaimcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceclaimcorona.com"; sid:559729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuranceclaimscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuranceclaimscorona.com"; sid:559730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona-virus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona-virus.biz"; sid:559731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.biz"; sid:559732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiacovid19.com"; sid:559733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillbeatcorona.com"; sid:559734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksonvillecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksonvillecovid19.com"; sid:559735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacovid.com"; sid:559736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jamcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jamcovid2019.com"; sid:559737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jamcovid.com"; sid:559738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jammufightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jammufightscovid.com"; sid:559739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jessecoronaeas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jessecoronaeas.com"; sid:559740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalingcovid-19.com"; sid:559741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kennettcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kennettcovidinfo.com"; sid:559742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsagainstcoronavirus.com"; sid:559743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kiltedagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kiltedagainstcovid19.com"; sid:559744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticovid19.com"; sid:559745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticovid.com"; sid:559746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitscovid19.com"; sid:559747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for klaarmetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"klaarmetcorona.com"; sid:559748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowathomecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowathomecovid19test.com"; sid:559749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowcovid19.com"; sid:559750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowcovid19hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowcovid19hometesting.com"; sid:559751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowcovid19.net"; sid:559752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knownowcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knownowcovid19testing.com"; sid:559753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid-19.com"; sid:559754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lakewaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lakewaycovid19.com"; sid:559755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirus-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirus-updates.com"; sid:559756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lbhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lbhcovid.com"; sid:559757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learninginthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learninginthetimeofcorona.com"; sid:559758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learninginthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learninginthetimeofcorona.net"; sid:559759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcovid.com"; sid:559760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcoronavirus.com"; sid:559761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcoronavirus.net"; sid:559762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcovid19.com"; sid:559763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcovid19.net"; sid:559764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcovid.com"; sid:559765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcovid.net"; sid:559766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lettersfromapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lettersfromapandemic.com"; sid:559767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lievecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lievecorona.com"; sid:559768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercorona.club"; sid:559769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeyondcovid19.com"; sid:559770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifelovecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifelovecorona.com"; sid:559771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepastcovid19.com"; sid:559772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidstats.com"; sid:559773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveupdatesoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveupdatesoncoronavirus.com"; sid:559774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveupdatesoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveupdatesoncovid-19.com"; sid:559775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveupdatesoncovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveupdatesoncovid-19virus.com"; sid:559776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localpandemic.com"; sid:559777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockcorona.com"; sid:559778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdownforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdownforcovid.com"; sid:559779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locovidiot.com"; sid:559780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loscorona.com"; sid:559781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.wtf"; sid:559782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.wtf"; sid:559783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.wtf"; sid:559784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidrelieffund.net"; sid:559785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makingfunofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makingfunofcovid.com"; sid:559786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maroccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maroccorona.com"; sid:559787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcoronavirusnews.com"; sid:559788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcoronavirusnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcoronavirusnews.net"; sid:559789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcovid19.club"; sid:559790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maske-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maske-covid19.com"; sid:559791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-against-corona.com"; sid:559792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksagainstcorona.com"; sid:559793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.biz"; sid:559794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcoronavirus.net"; sid:559795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicine-for-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicine-for-covid.com"; sid:559796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medsupplycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medsupplycovid19.com"; sid:559797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meketecoronatigray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meketecoronatigray.com"; sid:559798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid-19.com"; sid:559799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid19.life"; sid:559800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid19.world"; sid:559801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid.com"; sid:559802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialmilanocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialmilanocovid19.com"; sid:559803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialnewyorkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialnewyorkcovid19.com"; sid:559804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for merci-le-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"merci-le-corona.com"; sid:559805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocitycovid19.com"; sid:559806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michoacancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michoacancoronavirus.com"; sid:559807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacovid19vaccine.com"; sid:559808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montgomerycountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montgomerycountycovid19.com"; sid:559809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for motivecovidi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"motivecovidi.com"; sid:559810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mu-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mu-corona.com"; sid:559811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumepidemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumepidemic.world"; sid:559812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for music-against-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"music-against-covid.com"; sid:559813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacage.com"; sid:559814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiary2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiary2020.com"; sid:559815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapaycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapaycheck.com"; sid:559816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusstatus.com"; sid:559817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavision.com"; sid:559818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavisions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavisions.com"; sid:559819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaworld.com"; sid:559820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19loan.com"; sid:559821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19loan.com"; sid:559822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19shirts.com"; sid:559823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19tracker.com"; sid:559824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtrials.com"; sid:559825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfreecovid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfreecovid19money.com"; sid:559826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymaskforcoronavirus.com"; sid:559827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid-19mask.com"; sid:559828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid-19virus.com"; sid:559829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid-19virusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid-19virusmask.com"; sid:559830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nahantcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nahantcovid19.com"; sid:559831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigator-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigator-covid19.com"; sid:559832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navsarifightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navsarifightscorona.com"; sid:559833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19stats.com"; sid:559834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netcorona.com"; sid:559835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusreality.com"; sid:559836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsofcovid19.com"; sid:559837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronaviruscleaners.com"; sid:559838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid19cleaners.com"; sid:559839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronatest.com"; sid:559840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacorona.com"; sid:559841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruscleaner.com"; sid:559842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruscleaners.com"; sid:559843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19carcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19carcleaner.com"; sid:559844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19cleaners.com"; sid:559845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nzcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nzcovid19.com"; sid:559846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid19ochealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid19ochealthinfo.com"; sid:559847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for odessacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"odessacovid19.com"; sid:559848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusquicktest.com"; sid:559849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcoronagear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcoronagear.com"; sid:559850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid19.com"; sid:559851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronalife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronalife.com"; sid:559852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronavirusstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronavirusstories.com"; sid:559853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronavirusstory.com"; sid:559854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid2020stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid2020stories.com"; sid:559855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxford-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxford-covid-19.com"; sid:559856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacovid19cleaners.com"; sid:559857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pancovid19.com"; sid:559858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-app.com"; sid:559859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicarchive.com"; sid:559860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbank.com"; sid:559861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbluesband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbluesband.com"; sid:559862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccheck.com"; sid:559863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchinese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchinese.com"; sid:559864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoronavirusoutbreak.com"; sid:559865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-disaster-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-disaster-kits.com"; sid:559866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichomekit.com"; sid:559867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinterface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinterface.com"; sid:559868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickitco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickitco.com"; sid:559869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-kit-company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-kit-company.com"; sid:559870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickitsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickitsupply.com"; sid:559871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclife.net"; sid:559872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedicalsupplies.com"; sid:559873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmonitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmonitor.net"; sid:559874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofdenial.com"; sid:559875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofvalues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofvalues.com"; sid:559876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconesie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconesie.com"; sid:559877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpapers.com"; sid:559878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparked.com"; sid:559879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparked.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparked.net"; sid:559880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpizzacompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpizzacompany.com"; sid:559881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaybooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaybooks.com"; sid:559882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpotholderproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpotholderproject.com"; sid:559883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadyeconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadyeconomics.com"; sid:559884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefkit.com"; sid:559885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefkit.net"; sid:559886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefkits.com"; sid:559887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsecommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsecommons.com"; sid:559888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsecommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsecommons.net"; sid:559889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspotter.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspotter.club"; sid:559890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspotter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspotter.com"; sid:559891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstats.net"; sid:559892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategy.club"; sid:559893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalresources.com"; sid:559894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalsolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalsolutions.net"; sid:559895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictraining.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictraining.net"; sid:559896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarrior.com"; sid:559897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarriors.com"; sid:559898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwearshop.com"; sid:559899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingpandemic.com"; sid:559900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatric-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatric-covid.com"; sid:559901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatric-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatric-covid.net"; sid:559902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pensacolacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pensacolacovid19.com"; sid:559903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for permianbasincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"permianbasincovid19.com"; sid:559904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perte-exploitation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perte-exploitation-covid19.com"; sid:559905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaclinic-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaclinic-covid19.com"; sid:559906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmastore-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmastore-covid19.com"; sid:559907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciansfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciansfightcovid19.com"; sid:559908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciansfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciansfightcovid.com"; sid:559909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planocovid19.com"; sid:559910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poemsfrompandemicisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poemsfrompandemicisolation.com"; sid:559911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positifcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positifcovid19.com"; sid:559912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19products.com"; sid:559913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19survival.com"; sid:559914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19virus.com"; sid:559915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.solutions"; sid:559916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbusinesscontinuity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbusinesscontinuity.com"; sid:559917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbusinesscontinuityconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbusinesscontinuityconsultants.com"; sid:559918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiclife.com"; sid:559919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppcovid19.com"; sid:559920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovid-19virus.com"; sid:559921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppg-covid19-fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppg-covid19-fraud.com"; sid:559922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pranichealingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pranichealingcoronavirus.com"; sid:559923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayerforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayerforcovid-19.com"; sid:559924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencovid19.com"; sid:559925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovid19.com"; sid:559926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncontraelcoronavirus.com"; sid:559927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect4covid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect4covid.life"; sid:559928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect4covid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect4covid.today"; sid:559929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-covid-19.com"; sid:559930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-contre-le-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-contre-le-coronavirus.com"; sid:559931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecttocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecttocovid19.com"; sid:559932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prueba-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prueba-covid19.com"; sid:559933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologiaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologiaycoronavirus.com"; sid:559934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronatest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronatest.net"; sid:559935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtest.net"; sid:559936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quiebracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quiebracoronavirus.com"; sid:559937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitalacoronaalvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitalacoronaalvirus.com"; sid:559938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ran-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ran-covid19.com"; sid:559939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcheckcorona.com"; sid:559940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19.net"; sid:559941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtestkits.com"; sid:559942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveringaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveringaftercovid19.com"; sid:559943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveryaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveryaftercovid-19.com"; sid:559944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcoronavirusfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcoronavirusfraud.com"; sid:559945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportyourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportyourcorona.com"; sid:559946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for richardsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"richardsoncovid19.com"; sid:559947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risknavigator-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risknavigator-covid19.com"; sid:559948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risknavigatorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risknavigatorcovid19.com"; sid:559949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risknavigator-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risknavigator-covid19.net"; sid:559950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roundrockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roundrockcovid19.com"; sid:559951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rsecovidargentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rsecovidargentina.com"; sid:559952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetytestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetytestcovid-19.com"; sid:559953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salesinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salesinthetimeofcorona.com"; sid:559954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sangorgoniopass-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sangorgoniopass-covid.com"; sid:559955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjacintovalley-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjacintovalley-covid.com"; sid:559956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronaconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronaconsulting.com"; sid:559957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronaviruslawyer.com"; sid:559958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19lawyer.com"; sid:559959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19.loan"; sid:559960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19paycheckprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19paycheckprogram.com"; sid:559961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scanforcovid-usv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scanforcovid-usv.net"; sid:559962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmasken-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmasken-corona.com"; sid:559963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmasken-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmasken-covid19.com"; sid:559964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovidrelief.com"; sid:559965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendcoronavirus.com"; sid:559966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serocovid19.com"; sid:559967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serocovid.com"; sid:559968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-impots-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-impots-covid19.com"; sid:559969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfarcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfarcovidupdates.com"; sid:559970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for share-art-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"share-art-covid-19.com"; sid:559971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecoronavirusstory.com"; sid:559972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecoronavirusstory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecoronavirusstory.net"; sid:559973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shareyourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shareyourcorona.com"; sid:559974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcoronav.com"; sid:559975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldcovid.net"; sid:559976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smashcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smashcovid.com"; sid:559977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smf-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smf-covid.com"; sid:559978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smilethrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smilethrucovid.com"; sid:559979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovid.com"; sid:559980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solution-desinfection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solution-desinfection-covid19.com"; sid:559981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscoronafree.com"; sid:559982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southtexascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southtexascovid19.com"; sid:559983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadcovid-19.com"; sid:559984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for squeezeoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"squeezeoutcovid.com"; sid:559985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stategrantscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stategrantscovid19.com"; sid:559986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statistichecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statistichecoronavirus.com"; sid:559987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stats-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stats-coronavirus.com"; sid:559988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscoronavirus.com"; sid:559989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafeofcorona.com"; sid:559990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickitcovid.com"; sid:559991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stimulusbillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stimulusbillcovid19.com"; sid:559992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stimuluscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stimuluscorona.com"; sid:559993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stimuluscoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stimuluscoronamoney.com"; sid:559994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopalcoronavirus.com"; sid:559995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronabox.com"; sid:559996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusnow2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusnow2020.com"; sid:559997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusnow2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusnow2021.com"; sid:559998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid2021.com"; sid:559999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid2022.com"; sid:560000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid20.com"; sid:560001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid21.com"; sid:560002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid22.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid22.com"; sid:560003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid23.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid23.com"; sid:560004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.life"; sid:560005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnow2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnow2020.com"; sid:560006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnow2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnow2021.com"; sid:560007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-my-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-my-covid.com"; sid:560008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcoronavirus2020.com"; sid:560009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcoronavirus2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcoronavirus2021.com"; sid:560010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcoronavirus2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcoronavirus2022.com"; sid:560011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcovid.com"; sid:560012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stpcovid.com"; sid:560013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stpetersburgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stpetersburgcovid19.com"; sid:560014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strategicpandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strategicpandemic.club"; sid:560015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsvscorona.com"; sid:560016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbank-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbank-coronavirus.com"; sid:560017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcoronavirus.com"; sid:560018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcoronavirusresponse.com"; sid:560019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbank-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbank-covid-19.com"; sid:560020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbank-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbank-covid19.com"; sid:560021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcovid-19.com"; sid:560022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcovid19.com"; sid:560023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrust-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrust-coronavirus.com"; sid:560024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustcoronavirus.com"; sid:560025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustcoronavirusresponse.com"; sid:560026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrust-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrust-covid-19.com"; sid:560027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrust-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrust-covid19.com"; sid:560028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustcovid-19.com"; sid:560029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustcovid19.com"; sid:560030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliesforcovid19.com"; sid:560031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplyforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplyforcovid.com"; sid:560032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surveycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surveycovid-19.com"; sid:560033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalaftercovid-19.com"; sid:560034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalaftercovid19.com"; sid:560035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorscorona.com"; sid:560036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorscorona.net"; sid:560037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swfloridacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swfloridacovid.com"; sid:560038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tallahasseecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tallahasseecovid19.com"; sid:560039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid19.com"; sid:560040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcovid-19.com"; sid:560041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techjobscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techjobscorona.com"; sid:560042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tescovid19.com"; sid:560043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-corona.net"; sid:560044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid2020.com"; sid:560045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkit-coronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkit-coronavirus19.com"; sid:560046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for textcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"textcovid.com"; sid:560047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thanks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thanks-covid19.com"; sid:560048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaboomer.com"; sid:560049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacafe.com"; sid:560050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachecker.com"; sid:560051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadance.com"; sid:560052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiploma.com"; sid:560053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiscount.com"; sid:560054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakingdom.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakingdom.life"; sid:560055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus2019.com"; sid:560056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusoffer.com"; sid:560057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusvirus.com"; sid:560058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswar.net"; sid:560059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawarriors.com"; sid:560060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19academy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19academy.com"; sid:560061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19foundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19foundation.com"; sid:560062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19history.com"; sid:560063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19history.com"; sid:560064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19lawyers.com"; sid:560065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lawyers.com"; sid:560066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19map.com"; sid:560067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19roadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19roadmap.com"; sid:560068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19-serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19-serum.com"; sid:560069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19serum.com"; sid:560070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19stopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19stopper.com"; sid:560071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19updates.com"; sid:560072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbusters.com"; sid:560073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcrossing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcrossing.com"; sid:560074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcurve.com"; sid:560075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddad.com"; sid:560076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddefeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddefeat.com"; sid:560077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlawsuit.com"; sid:560078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsurvivors.com"; sid:560079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayafter-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayafter-corona.com"; sid:560080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercovid.com"; sid:560081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelifeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelifeaftercorona.com"; sid:560082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenintendoswitchepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenintendoswitchepidemic.com"; sid:560083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theofficialcoronavirusquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theofficialcoronavirusquicktest.com"; sid:560084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicalert.com"; sid:560085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimesofcorona.com"; sid:560086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewoodlandscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewoodlandscovid19.com"; sid:560087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theybeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theybeatcorona.com"; sid:560088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayincorona.com"; sid:560089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for to-disinfect-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"to-disinfect-coronavirus.com"; sid:560090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for to-disinfect-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"to-disinfect-covid-19.com"; sid:560091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid-19.biz"; sid:560092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousuniscontrecovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousuniscontrecovid19.biz"; sid:560093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracovid19.com"; sid:560094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercovid-19.com"; sid:560095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelinginthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelinginthecorona.com"; sid:560096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traviscountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traviscountycovid19.com"; sid:560097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentforcovid.com"; sid:560098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trialcovid19.com"; sid:560099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trialcovid.com"; sid:560100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trialscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trialscovid19.com"; sid:560101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trialscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trialscovid.com"; sid:560102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribalgrantscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribalgrantscovid19.com"; sid:560103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tricountiescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tricountiescovid19.com"; sid:560104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbank-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbank-coronavirus.com"; sid:560105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbankcoronavirus.com"; sid:560106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbankcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbankcoronavirusresponse.com"; sid:560107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbank-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbank-covid-19.com"; sid:560108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbank-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbank-covid19.com"; sid:560109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbankcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbankcovid-19.com"; sid:560110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistbankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistbankcovid19.com"; sid:560111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truist-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truist-coronavirus.com"; sid:560112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcoronavirus.com"; sid:560113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcoronavirusresponse.com"; sid:560114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truist-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truist-covid-19.com"; sid:560115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truist-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truist-covid19.com"; sid:560116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcovid-19.com"; sid:560117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcovid19.com"; sid:560118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistscovid19.com"; sid:560119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronavirusmask.com"; sid:560120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcoronaclaims.com"; sid:560121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcoronavirusclaims.com"; sid:560122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovid-19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovid-19claims.com"; sid:560123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovid19claims.com"; sid:560124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tueueocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tueueocovid.com"; sid:560125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubersupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubersupport-covid19.com"; sid:560126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uccoronavirus.com"; sid:560127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uccovid19.com"; sid:560128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukrainecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukrainecovid.com"; sid:560129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ulcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ulcovid19.com"; sid:560130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimahoracoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimahoracoronavirus.net"; sid:560131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unemploymentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unemploymentcoronavirus.com"; sid:560132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniticontroilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniticontroilcoronavirus.com"; sid:560133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmencorona.com"; sid:560134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatescovid-19.com"; sid:560135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid21.com"; sid:560136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcases.com"; sid:560137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidguidelines.com"; sid:560138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronademic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronademic.com"; sid:560139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19cases.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19cases.mobi"; sid:560140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19cases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19cases.net"; sid:560141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcases.com"; sid:560142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidguidelines.com"; sid:560143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usgrantscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usgrantscovid19.com"; sid:560144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine4corona.com"; sid:560145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-covid19.net"; sid:560146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vax-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vax-covid19.com"; sid:560147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimasdelcoronavirus.com"; sid:560148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimsofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimsofcoronavirus.com"; sid:560149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus19covid.com"; sid:560150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronatest.com"; sid:560151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19.cloud"; sid:560152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-covid-19.net"; sid:560153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicemailcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicemailcovid19.com"; sid:560154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacoviddata.com"; sid:560155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wa-daily-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wa-daily-covid-19.com"; sid:560156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatscorona.net"; sid:560157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldbeatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldbeatscovid.com"; sid:560158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemickits.com"; sid:560159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidesurvey-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidesurvey-covid.com"; sid:560160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancd.com"; sid:560161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjianjia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjianjia.com"; sid:560162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmeiyan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmeiyan.com"; sid:560163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-midea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-midea.com"; sid:560164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshangrui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshangrui.com"; sid:560165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-showtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-showtime.com"; sid:560166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwcovid-19.com"; sid:560167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwsurvey-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwsurvey-covid.com"; sid:560168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19elsalvador.com"; sid:560169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid-elsalvador.com"; sid:560170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid.biz"; sid:560171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusespaol-txb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusespaol-txb.com"; sid:560172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--knig-corona-rfb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--knig-corona-rfb.com"; sid:560173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosuperealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosuperealcoronavirus.com"; sid:560174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosupereelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosupereelcoronavirus.com"; sid:560175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19score.com"; sid:560176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19score.com"; sid:560177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yuccavalley-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yuccavalley-covid.com"; sid:560178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zero-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zero-covid.com"; sid:560179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovidproject.com"; sid:560180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovid19.com"; sid:560181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0covid19.com"; sid:560182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19viruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19viruscovid.com"; sid:560183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicmemorial.com"; sid:560184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2072covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2072covid.net"; sid:560185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2o2ocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2o2ocovid-19.com"; sid:560186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5minutecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5minutecovid-19test.com"; sid:560187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5minutecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5minutecovid19test.com"; sid:560188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5minutecovidtest.com"; sid:560189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 86coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"86coronavirus.com"; sid:560190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abovecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abovecovid.com"; sid:560191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidconversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidconversation.com"; sid:560192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adcoronavirus.com"; sid:560193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.life"; sid:560194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterwuhan.com"; sid:560195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftkscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftkscoronavirus.com"; sid:560196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afuturepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afuturepandemic.com"; sid:560197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovids19.com"; sid:560198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aipandemic.com"; sid:560199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aiutocovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aiutocovid.club"; sid:560200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertacovid.com"; sid:560201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-corona.com"; sid:560202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecorona.com"; sid:560203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecorona.net"; sid:560204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alianzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alianzacovid19.com"; sid:560205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amende-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amende-covid19.com"; sid:560206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amende-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amende-covid.com"; sid:560207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amisurvivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amisurvivingcovid19.com"; sid:560208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amparocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amparocovid19.com"; sid:560209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelscovid19.com"; sid:560210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronabeschichtung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronabeschichtung.com"; sid:560211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronadoorhandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronadoorhandle.com"; sid:560212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaglass.com"; sid:560213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruscovid19.com"; sid:560214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirusproducts.com"; sid:560215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidrespiration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidrespiration.com"; sid:560216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.world"; sid:560217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apicovid.com"; sid:560218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apothekecontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apothekecontracorona.com"; sid:560219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovid.com"; sid:560220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argentinalibredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argentinalibredecoronavirus.com"; sid:560221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asacovid-19.com"; sid:560222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asacovid19.com"; sid:560223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistance4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistance4corona.com"; sid:560224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aukiwi-covid19-help.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aukiwi-covid19-help.center"; sid:560225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovid19medsuppliescom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovid19medsuppliescom.com"; sid:560226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacovid19.com"; sid:560227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autoevaluacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autoevaluacioncovid19.com"; sid:560228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avislovescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avislovescovid.com"; sid:560229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudadecoronavirus.com"; sid:560230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidproject.com"; sid:560231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycovid-19.com"; sid:560232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baldwincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baldwincovid.com"; sid:560233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayswatercovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayswatercovid19support.com"; sid:560234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcorona.net"; sid:560235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bebecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bebecorona.com"; sid:560236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for begonecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"begonecovid19.com"; sid:560237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepandemic.com"; sid:560238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidfacemask.com"; sid:560239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betterthanbeforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betterthanbeforecorona.com"; sid:560240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betterthanbeforecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betterthanbeforecorona.net"; sid:560241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid19podcast.com"; sid:560242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenoncoronavirus.com"; sid:560243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockthecorona.com"; sid:560244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmycovid19test.com"; sid:560245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmycovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmycovid19testkit.com"; sid:560246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmytestcovid19.com"; sid:560247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bopcovid-19.com"; sid:560248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasilcorona.com"; sid:560249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bravecovidwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bravecovidwarrior.com"; sid:560250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bravecovidwarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bravecovidwarriors.com"; sid:560251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakthroughcovid.com"; sid:560252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brokefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brokefromcorona.com"; sid:560253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brokefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brokefromcovid.com"; sid:560254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessalliancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessalliancecovid19.com"; sid:560255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyacarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyacarcovid.com"; sid:560256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19mask.com"; sid:560257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidtests.com"; sid:560258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bybycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bybycovid.com"; sid:560259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecoronavirus.com"; sid:560260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cameroonhelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cameroonhelpcovid19.com"; sid:560261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadasurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadasurvivedcovid19.com"; sid:560262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cash4coronabiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cash4coronabiz.com"; sid:560263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cash4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cash4corona.com"; sid:560264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cash4coronasurvivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cash4coronasurvivers.com"; sid:560265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cash4coronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cash4coronavictims.com"; sid:560266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.com"; sid:560267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccfcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccfcovid19resources.com"; sid:560268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronacleaners.com"; sid:560269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidcleaners.com"; sid:560270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedfreeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedfreeofcoronavirus.com"; sid:560271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedfreeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedfreeofcovid19.com"; sid:560272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cffcovidspecial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cffcovidspecial.net"; sid:560273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinascorona.com"; sid:560274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovid.com"; sid:560275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cignacovid19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cignacovid19answers.com"; sid:560276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cignacovidanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cignacovidanswers.com"; sid:560277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimback-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimback-covid-19.com"; sid:560278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcovid-19orlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcovid-19orlando.com"; sid:560279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovid19huahin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovid19huahin.com"; sid:560280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeeandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeeandcovid.com"; sid:560281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid.net"; sid:560282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycoronahelp.com"; sid:560283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comocovid.com"; sid:560284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovidkit.com"; sid:560285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectduringcovid.com"; sid:560286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contagiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contagiocoronavirus.com"; sid:560287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contra-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contra-covid19.com"; sid:560288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coopcovid19.net"; sid:560289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19.life"; sid:560290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19pledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19pledge.com"; sid:560291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4cast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4cast.com"; sid:560292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-accomplishments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-accomplishments.com"; sid:560293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-accomplishments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-accomplishments.net"; sid:560294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactnow.com"; sid:560295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ambulanz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ambulanz.com"; sid:560296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandbeyond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandbeyond.com"; sid:560297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atemschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atemschutzmasken.com"; sid:560298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabd.net"; sid:560299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabebe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabebe.com"; sid:560300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabest.net"; sid:560301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioweapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioweapon.com"; sid:560302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizhelp.com"; sid:560303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizopp.com"; sid:560304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizopps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizopps.com"; sid:560305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabona.com"; sid:560306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboss.com"; sid:560307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabroke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabroke.com"; sid:560308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessfunding.com"; sid:560309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacampaign.com"; sid:560310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacant.com"; sid:560311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarekw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarekw.com"; sid:560312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashrefund.com"; sid:560313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashtoday.com"; sid:560314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashusa.com"; sid:560315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation2020.net"; sid:560316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaccomplish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaccomplish.com"; sid:560317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaccomplishment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaccomplishment.com"; sid:560318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaccomplishmentz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaccomplishmentz.com"; sid:560319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacide.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacide.biz"; sid:560320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleanforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleanforce.com"; sid:560321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanforce.com"; sid:560322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanforces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanforces.com"; sid:560323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningforce.com"; sid:560324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoinofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoinofficial.com"; sid:560325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomfy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomfy.com"; sid:560326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommando.com"; sid:560327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommandos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommandos.com"; sid:560328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliancenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliancenews.com"; sid:560329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplianceusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplianceusa.com"; sid:560330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplish.com"; sid:560331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-complishments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-complishments.com"; sid:560332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-complishments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-complishments.net"; sid:560333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreme.com"; sid:560334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisuae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisuae.com"; sid:560335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronact.com"; sid:560336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacup.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacup.amsterdam"; sid:560337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacups.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacups.amsterdam"; sid:560338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacups.com"; sid:560339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureglobal.com"; sid:560340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadamore.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadamore.club"; sid:560341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadarlehn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadarlehn.com"; sid:560342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadataroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadataroom.com"; sid:560343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademographics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademographics.com"; sid:560344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfect.com"; sid:560345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestekol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestekol.com"; sid:560346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfections.com"; sid:560347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorce.net"; sid:560348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoctoruam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoctoruam.com"; sid:560349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadollarsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadollarsnow.com"; sid:560350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosage.com"; sid:560351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-down.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-down.com"; sid:560352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrive-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrive-in.com"; sid:560353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaecon.com"; sid:560354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaegypttours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaegypttours.com"; sid:560355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepiccomicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepiccomicbook.com"; sid:560356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepiccomicbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepiccomicbooks.com"; sid:560357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepiccomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepiccomics.com"; sid:560358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaequipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaequipments.com"; sid:560359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaerotica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaerotica.com"; sid:560360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafastcashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafastcashloans.com"; sid:560361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeats.com"; sid:560362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeats.net"; sid:560363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafederalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafederalaid.com"; sid:560364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaffect.com"; sid:560365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafi.com"; sid:560366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafightteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafightteam.com"; sid:560367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafilmfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafilmfest.com"; sid:560368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirebarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirebarrier.com"; sid:560369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflirt.com"; sid:560370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodpack.com"; sid:560371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forex.com"; sid:560372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemassage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemassage.com"; sid:560373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeplace.com"; sid:560374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesurface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesurface.com"; sid:560375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevirus.net"; sid:560376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundinghelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundinghelpdesk.com"; sid:560377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-geld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-geld.com"; sid:560378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageneration.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageneration.net"; sid:560379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagis.com"; sid:560380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaikus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaikus.com"; sid:560381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandcure.com"; sid:560382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth.center"; sid:560383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immunity.net"; sid:560384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immunity-tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immunity-tests.net"; sid:560385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfluenza.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfluenza.net"; sid:560386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfohub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfohub.com"; sid:560387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info.life"; sid:560388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-informatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-informatie.com"; sid:560389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainues.com"; sid:560390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakahani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakahani.com"; sid:560391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidd.com"; sid:560392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidds.com"; sid:560393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitchens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitchens.com"; sid:560394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitlab.com"; sid:560395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakonnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakonnect.com"; sid:560396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakredit.net"; sid:560397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaser.com"; sid:560398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdate.net"; sid:560399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivingwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivingwill.com"; sid:560400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloyalties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloyalties.com"; sid:560401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-loyalty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-loyalty.com"; sid:560402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloyalty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloyalty.com"; sid:560403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaison.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaison.net"; sid:560404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask-shop.com"; sid:560405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meds.net"; sid:560406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameetsquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameetsquarantine.com"; sid:560407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminer.com"; sid:560408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamug.com"; sid:560409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamugs.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamugs.amsterdam"; sid:560410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorthopedic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorthopedic.com"; sid:560411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalooza2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalooza2020.com"; sid:560412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositives.com"; sid:560413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapparel-collective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapparel-collective.com"; sid:560414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappp.com"; sid:560415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappp.net"; sid:560416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-president.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-president.com"; sid:560417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prophylaxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prophylaxe.com"; sid:560418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protect24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protect24.com"; sid:560419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect24.com"; sid:560420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionshields.com"; sid:560421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantineclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantineclub.com"; sid:560422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradios.com"; sid:560423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reinigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reinigung.com"; sid:560424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefcash.com"; sid:560425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieftigerforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieftigerforce.com"; sid:560426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareset.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareset.net"; sid:560427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresin.com"; sid:560428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-respirator.com"; sid:560429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-respiratory-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-respiratory-protection.com"; sid:560430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarespiratoryprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarespiratoryprotection.com"; sid:560431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarest.com"; sid:560432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarirus.com"; sid:560433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarviruswithalime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarviruswithalime.com"; sid:560434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafebusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafebusinesses.com"; sid:560435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetycenter.com"; sid:560436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-scale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-scale.com"; sid:560437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschoon.com"; sid:560438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzbekleidung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzbekleidung.com"; sid:560439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzfolie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzfolie.com"; sid:560440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzfolie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzfolie.com"; sid:560441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzfuerkinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzfuerkinder.com"; sid:560442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdereinas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdereinas.com"; sid:560443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasepiccomicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasepiccomicbook.com"; sid:560444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasepiccomicbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasepiccomicbooks.com"; sid:560445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasepiccomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasepiccomics.com"; sid:560446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashielding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashielding.com"; sid:560447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shields.com"; sid:560448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sicher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sicher.com"; sid:560449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingoff.com"; sid:560450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslogan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslogan.com"; sid:560451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sound.com"; sid:560452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasplit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasplit.com"; sid:560453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatusnp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatusnp.com"; sid:560454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulusguide.com"; sid:560455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoper.net"; sid:560456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportresource.com"; sid:560457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxadvice.com"; sid:560458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxdollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxdollars.com"; sid:560459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxexpert.com"; sid:560460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxhelpnow.com"; sid:560461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxmoney.com"; sid:560462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxprep.com"; sid:560463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxrefundanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxrefundanswers.com"; sid:560464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxrefundnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxrefundnow.com"; sid:560465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxreliefdollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxreliefdollars.com"; sid:560466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatel.com"; sid:560467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatokyo.com"; sid:560468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatollfreenumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatollfreenumber.com"; sid:560469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatownhallprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatownhallprayer.com"; sid:560470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatuvida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatuvida.com"; sid:560471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatwo.com"; sid:560472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatxk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatxk.com"; sid:560473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinationcenter.com"; sid:560474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcation.com"; sid:560475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavenu.com"; sid:560476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavenue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavenue.com"; sid:560477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavenus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavenus.com"; sid:560478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavi19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavi19.com"; sid:560479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicide.net"; sid:560480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimrelief.com"; sid:560481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida.world"; sid:560482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid.net"; sid:560483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirlab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirlab.net"; sid:560484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousnews.com"; sid:560485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsusa.com"; sid:560486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruenow.com"; sid:560487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19health.com"; sid:560488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19help.com"; sid:560489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19s.com"; sid:560490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.life"; sid:560491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019testing.com"; sid:560492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020pandemic.com"; sid:560493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidassistance.com"; sid:560494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidbill.com"; sid:560495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidconsultants.com"; sid:560496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaidrelief.com"; sid:560497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-analysis.com"; sid:560498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhousingmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhousingmarket.com"; sid:560499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanow.com"; sid:560500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodytest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodytest.net"; sid:560501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyny.com"; sid:560502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutbillions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutbillions.com"; sid:560503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcylawyerca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcylawyerca.com"; sid:560504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcymass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcymass.com"; sid:560505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyny.com"; sid:560506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyri.com"; sid:560507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusiness.net"; sid:560508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareact.com"; sid:560509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasosmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasosmexico.com"; sid:560510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.city"; sid:560511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionattorney.com"; sid:560512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-class.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-class.com"; sid:560513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningexperts.com"; sid:560514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearance.com"; sid:560515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-co19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-co19.com"; sid:560516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoalition.com"; sid:560517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscorp.com"; sid:560518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19prevention.com"; sid:560519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cruise-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cruise-lawsuit.com"; sid:560520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusctrl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusctrl.com"; sid:560521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscy.com"; sid:560522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeaths.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeaths.net"; sid:560523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiaries.net"; sid:560524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019pandemic.com"; sid:560525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctor.net"; sid:560526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdojo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdojo.com"; sid:560527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemployerlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemployerlawsuits.com"; sid:560528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespanol.com"; sid:560529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexperiment.com"; sid:560530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridaattorney.com"; sid:560531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridaattorneys.com"; sid:560532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridalawyers.com"; sid:560533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcemajeurelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcemajeurelaw.com"; sid:560534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfront.com"; sid:560535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusgoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusgoodnews.com"; sid:560536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushalloweencostume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushalloweencostume.com"; sid:560537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusholiday.com"; sid:560538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-holisitic-remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-holisitic-remedies.com"; sid:560539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-homekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-homekit.com"; sid:560540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-il.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-il.com"; sid:560541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitypassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitypassport.com"; sid:560542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpactonmortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpactonmortgages.com"; sid:560543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimusa.com"; sid:560544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindead.com"; sid:560545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfluenza.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfluenza.net"; sid:560546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationcenteroftexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationcenteroftexas.com"; sid:560547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisfinished.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisfinished.com"; sid:560548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisgone.com"; sid:560549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-labtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-labtest.com"; sid:560550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersatlanta.com"; sid:560551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerschicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerschicago.com"; sid:560552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersmiami.com"; sid:560553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifetips.com"; sid:560554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivenow.com"; sid:560555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanassistance.com"; sid:560556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-loans.com"; sid:560557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmag.com"; sid:560558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakers-cr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakers-cr.com"; sid:560559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaps.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaps.world"; sid:560560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.biz"; sid:560561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeditation.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeditation.club"; sid:560562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmillionaire.com"; sid:560563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmnow.com"; sid:560564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnevadaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnevadaattorneys.com"; sid:560565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-news.net"; sid:560566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnowmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnowmap.com"; sid:560567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkattorneys.com"; sid:560568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorklawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorklawsuits.com"; sid:560569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-normality.com"; sid:560570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nursing-home-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nursing-home-lawsuit.com"; sid:560571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-online24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-online24.com"; sid:560572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-openhardware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-openhardware.net"; sid:560573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-pandamic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-pandamic.com"; sid:560574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmarketing.com"; sid:560575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-ppe.com"; sid:560576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreparers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreparers.com"; sid:560577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspropertyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspropertyservices.com"; sid:560578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantine.net"; sid:560579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradio.net"; sid:560580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rapid-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rapid-test-kits.com"; sid:560581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatesolutions.com"; sid:560582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefopportunites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefopportunites.com"; sid:560583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscrubbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscrubbers.com"; sid:560584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessrelief.com"; sid:560585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-smart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-smart.com"; sid:560586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-smartsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-smartsolutions.com"; sid:560587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolicitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolicitor.net"; sid:560588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutions.net"; sid:560589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sound.com"; sid:560590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stimulu-package.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stimulu-package.com"; sid:560591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurivor.com"; sid:560592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.life"; sid:560593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswap.com"; sid:560594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-syria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-syria.com"; sid:560595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestschedule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestschedule.com"; sid:560596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsondemand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsondemand.com"; sid:560597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuas.com"; sid:560598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususanow.com"; sid:560599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccine-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccine-covid19.com"; sid:560600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccine.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccine.guru"; sid:560601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.guru"; sid:560602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vaccine.life"; sid:560603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruzindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruzindia.com"; sid:560604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviusa.com"; sid:560605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaitress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaitress.com"; sid:560606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarfare.com"; sid:560607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawari.com"; sid:560608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wills.com"; sid:560609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayudas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayudas.com"; sid:560610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-z.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-z.net"; sid:560611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corpuscovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corpuscovidsupplies.com"; sid:560612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2021.com"; sid:560613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-af.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-af.com"; sid:560614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afectados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afectados.com"; sid:560615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analyser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analyser.com"; sid:560616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analyzer.com"; sid:560617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antibodies.com"; sid:560618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antibodies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antibodies.net"; sid:560619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-api.com"; sid:560620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apres.com"; sid:560621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-archive.com"; sid:560622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistanceatmortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistanceatmortgagefamily.com"; sid:560623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-atsea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-atsea.com"; sid:560624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19atsea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19atsea.com"; sid:560625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atsea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atsea.com"; sid:560626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorney.net"; sid:560627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailoutloanagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailoutloanagent.com"; sid:560628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailoutloanagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailoutloanagents.com"; sid:560629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailoutloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailoutloans.com"; sid:560630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bakersfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bakersfield.com"; sid:560631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19battle.com"; sid:560632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bc.com"; sid:560633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boardgame.com"; sid:560634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boise.com"; sid:560635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boise.com"; sid:560636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bolivia.com"; sid:560637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brigade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brigade.com"; sid:560638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brigade.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brigade.net"; sid:560639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business.net"; sid:560640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrelieffund.com"; sid:560641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buysupplies.com"; sid:560642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19byday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19byday.com"; sid:560643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californiaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californiaattorney.com"; sid:560644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californiaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californiaattorneys.com"; sid:560645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californiaclassactionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californiaclassactionattorneys.com"; sid:560646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californiaclassactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californiaclassactionlawyers.com"; sid:560647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californialawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californialawsuit.com"; sid:560648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californialawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californialawsuits.com"; sid:560649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californialawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californialawyer.com"; sid:560650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carservice.com"; sid:560651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashflow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashflow.com"; sid:560652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cd.com"; sid:560653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certifiedimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certifiedimmune.com"; sid:560654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cert.net"; sid:560655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chek.com"; sid:560656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimhelp.com"; sid:560657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claim.net"; sid:560658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionattorneys.com"; sid:560659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawyer.com"; sid:560660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcorp.com"; sid:560661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clearinghouse.com"; sid:560662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clinicaltrials.com"; sid:560663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clinicaltrials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clinicaltrials.net"; sid:560664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cm.com"; sid:560665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collapse.com"; sid:560666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comfort.com"; sid:560667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communitycares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communitycares.com"; sid:560668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conclusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conclusion.com"; sid:560669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conscious.com"; sid:560670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conscious.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conscious.net"; sid:560671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consulting.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consulting.today"; sid:560672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-control.com"; sid:560673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus.net"; sid:560674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19costrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19costrecovery.com"; sid:560675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19costume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19costume.com"; sid:560676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19costume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19costume.com"; sid:560677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19count.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19count.life"; sid:560678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19couplescounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19couplescounseling.com"; sid:560679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisishelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisishelp.com"; sid:560680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cruise-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cruise-lawsuit.com"; sid:560681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cuisines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cuisines.com"; sid:560682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cyber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cyber.com"; sid:560683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damageattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damageattorney.com"; sid:560684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damageattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damageattorneys.com"; sid:560685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19debtadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19debtadvice.com"; sid:560686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtadvice.com"; sid:560687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-decals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-decals.com"; sid:560688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deli.com"; sid:560689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deniedclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deniedclaim.com"; sid:560690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectiontest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectiontest.com"; sid:560691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dfwcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dfwcare.com"; sid:560692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterloanassistance.com"; sid:560693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discussion.com"; sid:560694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectingorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectingorlando.com"; sid:560695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doctor.net"; sid:560696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doctors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doctors.net"; sid:560697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donationcenter.com"; sid:560698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dri.com"; sid:560699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drones.com"; sid:560700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfacemask.com"; sid:560701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeelawsuits.com"; sid:560702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeelawsuitscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeelawsuitscom.com"; sid:560703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerlawsuit.com"; sid:560704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerlawsuits.com"; sid:560705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employernegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employernegligence.com"; sid:560706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentlawsuits.com"; sid:560707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enseignements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enseignements.com"; sid:560708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19erc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19erc.com"; sid:560709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19erc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19erc.com"; sid:560710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ethio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ethio.com"; sid:560711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faq.net"; sid:560712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastcashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastcashloans.com"; sid:560713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19f.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19f.com"; sid:560714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fedbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fedbailout.com"; sid:560715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fedbailoutloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fedbailoutloans.com"; sid:560716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19federalfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19federalfunding.com"; sid:560717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19federalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19federalhelp.com"; sid:560718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19femahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19femahelp.com"; sid:560719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19femassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19femassistance.com"; sid:560720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fighters.com"; sid:560721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialresources.com"; sid:560722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firebarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firebarrier.com"; sid:560723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flaechendesinfektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flaechendesinfektion.com"; sid:560724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flaechendesinfektion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flaechendesinfektion.net"; sid:560725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridaatorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridaatorney.com"; sid:560726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridaattorney.com"; sid:560727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridaattorneys.com"; sid:560728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19floridacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19floridacleaning.com"; sid:560729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridalawyers.com"; sid:560730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-flulogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-flulogger.com"; sid:560731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flu-xpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flu-xpress.com"; sid:560732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodkit.com"; sid:560733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forcemajeurelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forcemajeurelaw.com"; sid:560734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebusiness.com"; sid:560735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebusinesses.com"; sid:560736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecompanies.com"; sid:560737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecompany.com"; sid:560738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesigns.com"; sid:560739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freewater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freewater.com"; sid:560740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frequency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frequency.com"; sid:560741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19front.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19front.com"; sid:560742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ftest.com"; sid:560743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19furlough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19furlough.com"; sid:560744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19green.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19green.com"; sid:560745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19green.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19green.net"; sid:560746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hands.com"; sid:560747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harvesthoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harvesthoc.com"; sid:560748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcarelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcarelawyers.com"; sid:560749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpcenter.com"; sid:560750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpnow.com"; sid:560751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helptoday.com"; sid:560752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-history.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-history.com"; sid:560753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoax2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoax2020.com"; sid:560754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebuyerbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebuyerbenefit.com"; sid:560755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homerapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homerapidtesting.com"; sid:560756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesellerbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesellerbenefit.com"; sid:560757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houseclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houseclean.com"; sid:560758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housecleaning.com"; sid:560759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housecleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housecleaning.net"; sid:560760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houseclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houseclean.net"; sid:560761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-immune.com"; sid:560762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immune.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immune.net"; sid:560763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunenotcontagious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunenotcontagious.com"; sid:560764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunetest.com"; sid:560765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitypassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitypassport.com"; sid:560766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informaticsalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informaticsalliance.com"; sid:560767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-infos.com"; sid:560768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insclaims.com"; sid:560769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insuranceclaims.com"; sid:560770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimsservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimsservices.com"; sid:560771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceservices.com"; sid:560772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investment.com"; sid:560773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19is.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19is.com"; sid:560774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isdead.com"; sid:560775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isdead.com"; sid:560776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isfinished.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isfinished.com"; sid:560777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isgone.com"; sid:560778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jc.com"; sid:560779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jobs.com"; sid:560780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killer.biz"; sid:560781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19last.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19last.com"; sid:560782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.biz"; sid:560783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitcenter.com"; sid:560784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyersonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyersonline.com"; sid:560785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyersreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyersreviews.com"; sid:560786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalteam.com"; sid:560787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lending.com"; sid:560788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigationteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigationteam.com"; sid:560789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigationteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigationteams.com"; sid:560790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.today"; sid:560791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livetv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livetv.com"; sid:560792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.world"; sid:560793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanexperts.com"; sid:560794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmessenger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmessenger.com"; sid:560795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmessengers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmessengers.com"; sid:560796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loansupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loansupport.com"; sid:560797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lookup.com"; sid:560798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19marriagecounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19marriagecounseling.com"; sid:560799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks.biz"; sid:560800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-masks.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-masks.life"; sid:560801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-md.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-md.com"; sid:560802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-media.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-media.com"; sid:560803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicines.com"; sid:560804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medshop.com"; sid:560805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorialday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorialday.com"; sid:560806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorials.com"; sid:560807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memory.com"; sid:560808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memory.com"; sid:560809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mentions-db.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mentions-db.com"; sid:560810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19michigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19michigan.com"; sid:560811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19millionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19millionaire.com"; sid:560812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19millionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19millionaire.com"; sid:560813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mindset.com"; sid:560814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19necessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19necessities.com"; sid:560815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nevadaattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nevadaattorneys.com"; sid:560816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.network"; sid:560817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorklawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorklawyers.com"; sid:560818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19njjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19njjobs.com"; sid:560819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notifications.com"; sid:560820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nursing-home-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nursing-home-lawsuit.com"; sid:560821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-onboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-onboard.com"; sid:560822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onboard.com"; sid:560823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onboard.com"; sid:560824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onestop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onestop.com"; sid:560825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinestore.com"; sid:560826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19openforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19openforbusiness.com"; sid:560827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oregon.com"; sid:560828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-out.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-out.com"; sid:560829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pass.com"; sid:560830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pass.net"; sid:560831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pdxdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pdxdata.com"; sid:560832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19percapita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19percapita.com"; sid:560833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19personalfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19personalfacemask.com"; sid:560834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phsychologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phsychologist.com"; sid:560835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19physdis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19physdis.com"; sid:560836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pins.com"; sid:560837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-plano-contingencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-plano-contingencia.com"; sid:560838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pneumonia-ai-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pneumonia-ai-dx.com"; sid:560839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pointofcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pointofcare.com"; sid:560840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pointofcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pointofcare.net"; sid:560841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pro.com"; sid:560842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19psicosivirale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19psicosivirale.com"; sid:560843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychologist.com"; sid:560844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radio.net"; sid:560845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestingnow.com"; sid:560846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkit.today"; sid:560847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestsydney.com"; sid:560848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestateresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestateresources.com"; sid:560849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realtor.com"; sid:560850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtorhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtorhelp.com"; sid:560851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtorresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtorresources.com"; sid:560852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebates.com"; sid:560853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebuild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebuild.com"; sid:560854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19releaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19releaf.com"; sid:560855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefadvisor.com"; sid:560856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefcash.com"; sid:560857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefcoffee.com"; sid:560858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffinance.com"; sid:560859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relieffunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relieffunding.com"; sid:560860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffund.net"; sid:560861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefregistry.com"; sid:560862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefregistry.com"; sid:560863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repair.com"; sid:560864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescue.net"; sid:560865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsfund.com"; sid:560866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restart.com"; sid:560867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19review.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19review.com"; sid:560868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rt.com"; sid:560869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizers.com"; sid:560870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbahelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbahelpnow.com"; sid:560871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbahelptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbahelptoday.com"; sid:560872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbasupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbasupport.com"; sid:560873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-schutz.com"; sid:560874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sci.com"; sid:560875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19secrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19secrets.com"; sid:560876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serum.net"; sid:560877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19s.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19s.life"; sid:560878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbiz.com"; sid:560879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-smartsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-smartsolutions.com"; sid:560880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smbsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smbsurvey.com"; sid:560881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stories.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stories.life"; sid:560882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19summary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19summary.com"; sid:560883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliers.com"; sid:560884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliers.net"; sid:560885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplies1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplies1.com"; sid:560886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplys.com"; sid:560887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-support.com"; sid:560888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survey.net"; sid:560889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivers.com"; sid:560890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor2020.com"; sid:560891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sxm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sxm.com"; sid:560892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxadvice.com"; sid:560893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tax.com"; sid:560894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxhelpnow.com"; sid:560895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxprep.com"; sid:560896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxreliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxreliefnow.com"; sid:560897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teachersupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teachersupply.com"; sid:560898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-temoignages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-temoignages.com"; sid:560899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.biz"; sid:560900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testkit.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testkit.club"; sid:560901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testprevention.com"; sid:560902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testri.com"; sid:560903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsondemand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsondemand.com"; sid:560904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststudy.com"; sid:560905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theteachings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theteachings.com"; sid:560906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-today.com"; sid:560907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tokyo.com"; sid:560908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.today"; sid:560909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trap.com"; sid:560910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19txcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19txcare.com"; sid:560911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-unemployment.com"; sid:560912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unionrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unionrights.com"; sid:560913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-updated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-updated.com"; sid:560914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.guru"; sid:560915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.life"; sid:560916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vancouver.com"; sid:560917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualcare.com"; sid:560918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusattorneys.com"; sid:560919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-virusdellapaura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-virusdellapaura.com"; sid:560920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusdellapaura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusdellapaura.com"; sid:560921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslawsuit.com"; sid:560922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslawsuits.com"; sid:560923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslawyers.com"; sid:560924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslegalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslegalteam.com"; sid:560925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslegalteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslegalteams.com"; sid:560926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruslitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruslitigation.com"; sid:560927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussaftey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussaftey.com"; sid:560928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vitals.com"; sid:560929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vitals.com"; sid:560930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vizualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vizualizer.com"; sid:560931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vrij.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vrij.com"; sid:560932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19watch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19watch.net"; sid:560933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wearable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wearable.com"; sid:560934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wearables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wearables.com"; sid:560935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-who.com"; sid:560936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-who.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-who.net"; sid:560937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19widow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19widow.com"; sid:560938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wisdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wisdom.com"; sid:560939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerslawsuits.com"; sid:560940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplace.com"; sid:560941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplace.net"; sid:560942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplace-vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplace-vaccinations.com"; sid:560943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldwar.com"; sid:560944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldwar.com"; sid:560945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrapparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrapparty.com"; sid:560946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yahoraque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yahoraque.com"; sid:560947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zapp.com"; sid:560948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1nine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1nine.com"; sid:560949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1ninevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1ninevaccine.com"; sid:560950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019wiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019wiki.com"; sid:560951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020relief.com"; sid:560952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20drones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20drones.com"; sid:560953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20plus.com"; sid:560954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21drones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21drones.com"; sid:560955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4d.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4d.club"; sid:560956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4d.com"; sid:560957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4d.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4d.net"; sid:560958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4dummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4dummies.com"; sid:560959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid939.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid939.com"; sid:560960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid95mask.com"; sid:560961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19america.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19america.com"; sid:560962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19us.com"; sid:560963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccountable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccountable.com"; sid:560964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalaska.com"; sid:560965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcoffee.com"; sid:560966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyproject.com"; sid:560967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyproject.net"; sid:560968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappeal.com"; sid:560969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapply.com"; sid:560970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmour.com"; sid:560971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistancenow.com"; sid:560972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatgims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatgims.com"; sid:560973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-a-thon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-a-thon.com"; sid:560974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaxtnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaxtnow.com"; sid:560975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabiesboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabiesboom.com"; sid:560976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bedarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bedarf.com"; sid:560977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbestdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbestdeals.com"; sid:560978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbits.com"; sid:560979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblock.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblock.biz"; sid:560980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboise.com"; sid:560981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbroke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbroke.com"; sid:560982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bubbles.com"; sid:560983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessprograms.com"; sid:560984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuzz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuzz.com"; sid:560985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbycountry.com"; sid:560986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancerchic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancerchic.com"; sid:560987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregroup.com"; sid:560988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarelending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarelending.com"; sid:560989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashcalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashcalc.com"; sid:560990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashnow.com"; sid:560991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashrefund.com"; sid:560992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashtoday.com"; sid:560993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcause.com"; sid:560994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenterbarby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenterbarby.com"; sid:560995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchange.com"; sid:560996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchek.com"; sid:560997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsa.com"; sid:560998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoalition.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoalition.net"; sid:560999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktailclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktailclub.com"; sid:561000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcohab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcohab.com"; sid:561001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcohabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcohabs.com"; sid:561002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollars.com"; sid:561003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnecticut.com"; sid:561004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnedticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnedticut.com"; sid:561005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsole.com"; sid:561006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcount.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcount.club"; sid:561007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrusader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrusader.com"; sid:561008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidct.com"; sid:561009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupcakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupcakes.com"; sid:561010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcyphers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcyphers.com"; sid:561011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddelaware.com"; sid:561012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentistry.com"; sid:561013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctor.net"; sid:561014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddollars.com"; sid:561015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19symtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19symtoms.com"; sid:561016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideco.com"; sid:561017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenespanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenespanol.com"; sid:561018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenmexico.com"; sid:561019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenroll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenroll.com"; sid:561020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo.chat"; sid:561021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexitstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexitstrategy.com"; sid:561022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidex.net"; sid:561023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactory.com"; sid:561024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-factsheet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-factsheet.com"; sid:561025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilykit.com"; sid:561026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyusa.com"; sid:561027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfine.com"; sid:561028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirebarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirebarrier.com"; sid:561029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfive.com"; sid:561030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fix.com"; sid:561031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflukiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflukiller.com"; sid:561032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfog.com"; sid:561033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeafrica.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeafrica.biz"; sid:561034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebelgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebelgium.com"; sid:561035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecheck.com"; sid:561036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelove.com"; sid:561037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesurface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesurface.com"; sid:561038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesurfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesurfaces.com"; sid:561039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreewater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreewater.com"; sid:561040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreewithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreewithme.com"; sid:561041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-funding.com"; sid:561042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamers.net"; sid:561043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gear.com"; sid:561044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeneration.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeneration.net"; sid:561045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgilance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgilance.com"; sid:561046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalstats.com"; sid:561047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgradesanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgradesanitizer.com"; sid:561048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgr.com"; sid:561049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreen.net"; sid:561050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgym.com"; sid:561051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhands.com"; sid:561052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthkit.com"; sid:561053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheatmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheatmaps.com"; sid:561054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelptoday.com"; sid:561055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhge.com"; sid:561056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hla.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hla.net"; sid:561057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hunter.com"; sid:561058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiane-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiane-20.com"; sid:561059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiane20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiane20.com"; sid:561060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiane-20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiane-20.net"; sid:561061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiane20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiane20.net"; sid:561062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiciannove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiciannove.com"; sid:561063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidill.com"; sid:561064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunity.com"; sid:561065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunity.net"; sid:561066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitypassportonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitypassportonline.com"; sid:561067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunity-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunity-tests.com"; sid:561068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunity-tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunity-tests.net"; sid:561069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiana.com"; sid:561070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.center"; sid:561071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ing.com"; sid:561072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviding.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviding.life"; sid:561073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinmemoriam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinmemoriam.com"; sid:561074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioke.com"; sid:561075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot-count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot-count.com"; sid:561076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotsthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotsthemovie.com"; sid:561077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisualizer.com"; sid:561078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivisualizer.com"; sid:561079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkentucky.com"; sid:561080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkey.com"; sid:561081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kids.net"; sid:561082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitchens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitchens.com"; sid:561083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkn95.com"; sid:561084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkonnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkonnect.com"; sid:561085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkw.com"; sid:561086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearningcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearningcurve.com"; sid:561087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalinfo.com"; sid:561088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifesurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifesurvey.com"; sid:561089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifesurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifesurvey.net"; sid:561090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifetips.com"; sid:561091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-line.com"; sid:561092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliquors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliquors.com"; sid:561093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanexpress.com"; sid:561094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans-now.com"; sid:561095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlog.net"; sid:561096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmademedoit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmademedoit.com"; sid:561097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaine.com"; sid:561098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalls.com"; sid:561099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaryland.com"; sid:561100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmassachusetts.com"; sid:561101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedbot.com"; sid:561102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedcheck.com"; sid:561103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeeting.com"; sid:561104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetin2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetin2.com"; sid:561105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetric.com"; sid:561106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmin.com"; sid:561107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidminnesota.com"; sid:561108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmississippi.com"; sid:561109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoney.net"; sid:561110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmontana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmontana.com"; sid:561111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnailcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnailcare.com"; sid:561112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearus.com"; sid:561113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearus.net"; sid:561114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnebraska.com"; sid:561115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnevada.com"; sid:561116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewhampshire.com"; sid:561117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewmexico.com"; sid:561118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.media"; sid:561119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewswire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewswire.com"; sid:561120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ninteenini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ninteenini.com"; sid:561121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorthcarolina.com"; sid:561122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorth.com"; sid:561123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorthdakota.com"; sid:561124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnyl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnyl.com"; sid:561125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol-3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol-3.com"; sid:561126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-one9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-one9.com"; sid:561127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorg.com"; sid:561128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidosed.com"; sid:561129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-out.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-out.com"; sid:561130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.partners"; sid:561131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassport.net"; sid:561132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaycheckprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaycheckprotection.com"; sid:561133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaypayrollprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaypayrollprotection.com"; sid:561134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayrollrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayrollrelief.com"; sid:561135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpennsylvania.com"; sid:561136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoct.com"; sid:561137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpointofcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpointofcare.com"; sid:561138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpointofcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpointofcare.net"; sid:561139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpresident.com"; sid:561140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproject894.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproject894.com"; sid:561141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproject965.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproject965.com"; sid:561142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofed.com"; sid:561143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofme.com"; sid:561144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectme.com"; sid:561145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidracking.com"; sid:561146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreacking.com"; sid:561147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebel.com"; sid:561148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefnow.com"; sid:561149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefopportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefopportunities.com"; sid:561150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefsupport.com"; sid:561151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresp.com"; sid:561152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.team"; sid:561153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresporator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresporator.com"; sid:561154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrhodeisland.com"; sid:561155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids-19.com"; sid:561156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsakidthai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsakidthai.com"; sid:561157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbaapplication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbaapplication.com"; sid:561158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbacash.com"; sid:561159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbafunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbafunding.com"; sid:561160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbahelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbahelpnow.com"; sid:561161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbahelptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbahelptoday.com"; sid:561162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbalending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbalending.com"; sid:561163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbarelief.com"; sid:561164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbarelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbarelief.net"; sid:561165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-self-assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-self-assessment.com"; sid:561166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilver.com"; sid:561167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimpact.com"; sid:561168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.life"; sid:561169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslogan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslogan.com"; sid:561170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthcarolina.com"; sid:561171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthdakota.com"; sid:561172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsro.com"; sid:561173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidss.com"; sid:561174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.solutions"; sid:561175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsstudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsstudio.com"; sid:561176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatsus.com"; sid:561177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimuluscalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimuluscalc.com"; sid:561178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.today"; sid:561179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstriketeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstriketeam.com"; sid:561180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuministrosmedicos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuministrosmedicos.com"; sid:561181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survey.com"; sid:561182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalpack.com"; sid:561183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survivor.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survivor.club"; sid:561184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survivor.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survivor.world"; sid:561185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.world"; sid:561186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.sydney"; sid:561187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsystem.com"; sid:561188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtask.com"; sid:561189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-taskforce.com"; sid:561190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtasks.com"; sid:561191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxcredit.com"; sid:561192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxdollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxdollars.com"; sid:561193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxhelpnow.com"; sid:561194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tee.com"; sid:561195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteens.com"; sid:561196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelecare.com"; sid:561197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteleconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteleconsultant.com"; sid:561198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtennessee.com"; sid:561199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbrasil.com"; sid:561200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlocator.com"; sid:561201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlocator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlocator.net"; sid:561202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresults.com"; sid:561203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestri.com"; sid:561204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsondemand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsondemand.com"; sid:561205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-th.com"; sid:561206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthriver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthriver.com"; sid:561207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackig.com"; sid:561208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravking.com"; sid:561209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrqcking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrqcking.com"; sid:561210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrscking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrscking.com"; sid:561211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trump.com"; sid:561212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtude.com"; sid:561213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtxt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtxt.com"; sid:561214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidum.com"; sid:561215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemployed.com"; sid:561216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-unicredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-unicredit.com"; sid:561217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunicredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunicredit.com"; sid:561218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-unicredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-unicredit.net"; sid:561219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunicredit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunicredit.net"; sid:561220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvallescolabora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvallescolabora.com"; sid:561221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvermont.com"; sid:561222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimadvisor.com"; sid:561223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvidualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvidualizer.com"; sid:561224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19test.com"; sid:561225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusppe.com"; sid:561226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualer.com"; sid:561227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualise.com"; sid:561228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvital.com"; sid:561229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvitals.com"; sid:561230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvs.com"; sid:561231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwearables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwearables.com"; sid:561232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwestvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwestvirginia.com"; sid:561233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-widget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-widget.com"; sid:561234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwidget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwidget.com"; sid:561235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiki.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiki.net"; sid:561236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwisconsin.com"; sid:561237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwisdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwisdom.com"; sid:561238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.works - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.works"; sid:561239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwuhan.com"; sid:561240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwuhansurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwuhansurvivor.com"; sid:561241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwyoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwyoming.com"; sid:561242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzapp.com"; sid:561243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidz.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidz.life"; sid:561244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidz.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidz.today"; sid:561245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidz.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidz.world"; sid:561246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cowlitzcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cowlitzcovid19.com"; sid:561247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cowlitzcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cowlitzcovid19.net"; sid:561248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpapforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpapforcovid.com"; sid:561249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craftnotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craftnotcorona.com"; sid:561250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativecoronacoliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativecoronacoliving.com"; sid:561251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushitinrecovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushitinrecovidresources.com"; sid:561252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubrebocascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubrebocascovid.com"; sid:561253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacaocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacaocovid19.com"; sid:561254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curemycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curemycovid.com"; sid:561255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid.com"; sid:561256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuts4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuts4covid.com"; sid:561257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutsforcovid.com"; sid:561258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daikuanwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daikuanwuhan.com"; sid:561259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dannicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dannicoronavirus.com"; sid:561260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dannicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dannicovid19.com"; sid:561261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datacovid-19.com"; sid:561262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datapandemic.com"; sid:561263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid.com"; sid:561264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathsbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathsbycovid19.com"; sid:561265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decalscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decalscovid-19.com"; sid:561266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronameron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronameron.com"; sid:561267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despidocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despidocovid.com"; sid:561268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didcovidstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didcovidstop.com"; sid:561269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difesamedicicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difesamedicicovid19.com"; sid:561270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digital-durch-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digital-durch-corona.com"; sid:561271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcoronakiller.com"; sid:561272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronas.com"; sid:561273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronafacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronafacemasks.com"; sid:561274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronavirusfacemasks.com"; sid:561275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid19.com"; sid:561276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid19facemasks.com"; sid:561277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid19mask.com"; sid:561278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diyfacemasks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diyfacemasks-covid19.com"; sid:561279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diyfacemaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diyfacemaskscovid19.com"; sid:561280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djibouti-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djibouti-coronavirus.com"; sid:561281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogsagainstcorona.com"; sid:561282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dollars4covidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dollars4covidvictims.com"; sid:561283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcoronavirus.com"; sid:561284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcoronavirus.net"; sid:561285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcccovid19.com"; sid:561286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug4coronavirus.com"; sid:561287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugs4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugs4corona.com"; sid:561288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugscoronavirus.com"; sid:561289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dubistcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dubistcorona.com"; sid:561290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcovid19.com"; sid:561291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectsofcovid19.com"; sid:561292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ejecucionhipotecariacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ejecucionhipotecariacovid.com"; sid:561293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencycoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencycoronacash.com"; sid:561294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-covid-19.com"; sid:561295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccorona.com"; sid:561296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.ltd"; sid:561297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpack.com"; sid:561298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpak.com"; sid:561299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipoanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipoanticovid.com"; sid:561300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for euro2020-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"euro2020-covid19.com"; sid:561301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitcovid.com"; sid:561302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19.com"; sid:561303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks-covid19.com"; sid:561304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasksforcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasksforcoronavirus.net"; sid:561305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastestcoronavirus.com"; sid:561306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for femometercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"femometercovid19.com"; sid:561307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fifa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fifa-covid19.com"; sid:561308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fifacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fifacovid19.com"; sid:561309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19pandemic.com"; sid:561310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidnepal.com"; sid:561311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fileacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fileacovid19claim.com"; sid:561312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronarelief.com"; sid:561313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidrelief.com"; sid:561314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstpandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstpandemickit.com"; sid:561315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiveminutecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiveminutecovid-19test.com"; sid:561316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiveminutecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiveminutecovid19test.com"; sid:561317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiveminutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiveminutecovidtest.com"; sid:561318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcoronaco.com"; sid:561319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkucorona.com"; sid:561320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flatcorona.com"; sid:561321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidupdates.com"; sid:561322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19.com"; sid:561323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formacioncoronavirus.com"; sid:561324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formula1-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formula1-covid19.com"; sid:561325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formula1covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formula1covid19.com"; sid:561326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foro-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foro-covid19.com"; sid:561327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forocovid19.com"; sid:561328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxnewscoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxnewscoronaviruslawsuit.com"; sid:561329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusloans.com"; sid:561330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fryingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fryingpandemic.com"; sid:561331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureaftercovid.com"; sid:561332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurepandemic.com"; sid:561333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gainesvillecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gainesvillecovidmasks.com"; sid:561334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for galvestoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"galvestoncovid19.com"; sid:561335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gear4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gear4covid.com"; sid:561336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsam-durch-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsam-durch-corona.com"; sid:561337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gemeinsamdurchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gemeinsamdurchcorona.com"; sid:561338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcovid19.net"; sid:561339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19aid.com"; sid:561340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19kit.com"; sid:561341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19relief.com"; sid:561342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidloans.com"; sid:561343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gethelpcovidoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gethelpcovidoregon.com"; sid:561344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19clean.com"; sid:561345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19memorial.com"; sid:561346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidclean.com"; sid:561347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.run"; sid:561348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gouvcanada-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gouvcanada-covid19.com"; sid:561349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gpscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gpscoronavirus.com"; sid:561350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gratitudecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gratitudecovid.com"; sid:561351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gripecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gripecoronavirus.com"; sid:561352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gripecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gripecoronavirus.net"; sid:561353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heartofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heartofcovid.com"; sid:561354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hechoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hechoscoronavirus.com"; sid:561355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help4coronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help4coronavictims.com"; sid:561356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpendcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpendcovid19.com"; sid:561357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpinghand4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpinghand4covid19.com"; sid:561358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcoronavirus.net"; sid:561359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcovid19.life"; sid:561360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid19depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid19depression.com"; sid:561361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithmycoronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithmycoronavirusloan.com"; sid:561362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbalcovid19.com"; sid:561363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hidingfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hidingfromcovid19.com"; sid:561364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hkcovid-19.com"; sid:561365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hlbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hlbcovid19.com"; sid:561366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for home-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"home-covid19.com"; sid:561367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for home-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"home-covid19.net"; sid:561368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestforcovid19.com"; sid:561369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotline-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotline-covid-19.net"; sid:561370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houseofcorona.com"; sid:561371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housingmarketandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housingmarketandcovid19.com"; sid:561372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hugsusacovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hugsusacovidfund.com"; sid:561373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hugsusacovidfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hugsusacovidfund.net"; sid:561374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcoronaed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcoronaed.com"; sid:561375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igscovid19.com"; sid:561376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecovids19.com"; sid:561377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatepandemics.com"; sid:561378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikilledcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikilledcorona.com"; sid:561379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illovocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illovocovid19.com"; sid:561380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactcovid.com"; sid:561381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incentivicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incentivicovid19.com"; sid:561382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionesafectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionesafectadoscoronavirus.com"; sid:561383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionesafectadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionesafectadoscovid19.com"; sid:561384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indizen-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indizen-covid19.com"; sid:561385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocoronavirusindustriamusical.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocoronavirusindustriamusical.net"; sid:561386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informationcorona.com"; sid:561387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infraredthermometercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infraredthermometercoronavirus.com"; sid:561388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiativecoronavirusisolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiativecoronavirusisolation.com"; sid:561389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovationforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovationforcovid.com"; sid:561390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalpandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalpandemicday.com"; sid:561391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irshelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irshelpcovid19.com"; sid:561392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for is-coronavirus-still-spreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"is-coronavirus-still-spreading.com"; sid:561393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.life"; sid:561394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.pro"; sid:561395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiacovid-19.com"; sid:561396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancovid-19.com"; sid:561397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itcamefromwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itcamefromwuhan.com"; sid:561398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-trackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-trackcovid19.com"; sid:561399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itrackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itrackcovid19.com"; sid:561400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronatime.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronatime.wtf"; sid:561401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivonacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivonacorona.com"; sid:561402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksoncovid19.com"; sid:561403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeparalawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeparalawancorona.com"; sid:561404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcoronajobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcoronajobs.com"; sid:561405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kanbancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kanbancovid.com"; sid:561406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kevzara-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kevzara-covid19.com"; sid:561407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kevzara-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kevzara-covid19.net"; sid:561408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kevzaracovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kevzaracovid19treatment.com"; sid:561409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kevzaracovid19treatment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kevzaracovid19treatment.net"; sid:561410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronaass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronaass.com"; sid:561411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasstache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasstache.com"; sid:561412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronastache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronastache.com"; sid:561413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid-19ass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid-19ass.com"; sid:561414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovidass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovidass.com"; sid:561415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickoffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickoffcorona.com"; sid:561416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickthecoronavirusring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickthecoronavirusring.com"; sid:561417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidqaltek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidqaltek.com"; sid:561418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kits-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kits-coronavirus.com"; sid:561419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kittestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kittestcovid19.com"; sid:561420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockdowncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockdowncoronavirus.com"; sid:561421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockdowncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockdowncovid-19.com"; sid:561422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockdowncovid19.com"; sid:561423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kwcoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kwcoronachallenge.com"; sid:561424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kwcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kwcovid19resources.com"; sid:561425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-covid.com"; sid:561426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagunawoodsvillagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagunawoodsvillagecovid19.com"; sid:561427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laidoffcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laidoffcoronahelp.com"; sid:561428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamacchiacovidresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamacchiacovidresource.com"; sid:561429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamacchiarealtycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamacchiarealtycoronavirus.com"; sid:561430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laprescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laprescovid19.com"; sid:561431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legaladvicerelatedtocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legaladvicerelatedtocorona.com"; sid:561432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterthecovid19.com"; sid:561433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeincoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeincoronatime.com"; sid:561434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeincovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeincovidtimes.com"; sid:561435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ligacontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ligacontraelcovid.com"; sid:561436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveupdatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveupdatecovid19.com"; sid:561437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncoronavirus.com"; sid:561438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-in-the-time-of-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-in-the-time-of-covid19.com"; sid:561439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimesofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimesofcorona.net"; sid:561440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimesofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimesofcovid.net"; sid:561441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetmesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetmesofcovid.com"; sid:561442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lubbockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lubbockcovid19.com"; sid:561443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ma-covid-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ma-covid-data.com"; sid:561444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for majlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"majlcovid.com"; sid:561445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maparealdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maparealdelcoronavirus.com"; sid:561446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherineanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherineanticovid19.com"; sid:561447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherineanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherineanticovid.com"; sid:561448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscovidtracker.com"; sid:561449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mastercovidactualizacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mastercovidactualizacion.com"; sid:561450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mc-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mc-corona.com"; sid:561451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mc-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mc-covid-19.com"; sid:561452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mc-covid.com"; sid:561453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcoviddefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcoviddefense.com"; sid:561454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediadorescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediadorescovid19.com"; sid:561455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcovidsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcovidsupplier.com"; sid:561456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicovid19.com"; sid:561457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meds4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meds4corona.com"; sid:561458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetcovid.com"; sid:561459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menacovidrelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menacovidrelief.fund"; sid:561460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mistercovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mistercovid.club"; sid:561461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mistercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mistercovid.com"; sid:561462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitzvotagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitzvotagainstcorona.com"; sid:561463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mlb-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mlb-covid19.com"; sid:561464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mlbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mlbcovid19.com"; sid:561465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moicovid.com"; sid:561466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitorcovid.com"; sid:561467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monroecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monroecovid.com"; sid:561468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moveagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moveagainstcorona.com"; sid:561469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mu-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mu-covid.com"; sid:561470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundschutz-corona.com"; sid:561471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for murrietacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"murrietacovid19.com"; sid:561472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatrades.com"; sid:561473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19alert.com"; sid:561474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19risk.com"; sid:561475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbaby.com"; sid:561476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcheck.com"; sid:561477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidid.com"; sid:561478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmonitor.com"; sid:561479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidodds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidodds.com"; sid:561480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidskill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidskill.com"; sid:561481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicsupply.com"; sid:561482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myworldwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myworldwithcovid.com"; sid:561483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95mask-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95mask-covid.com"; sid:561484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nadal-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nadal-covid.com"; sid:561485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nba-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nba-covid19.com"; sid:561486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincoronavirus.com"; sid:561487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincovid19.com"; sid:561488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforgetcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforgetcoronavirus.net"; sid:561489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverlovecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverlovecovid19.com"; sid:561490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newtestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newtestcoronavirus.com"; sid:561491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newtestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newtestcovid-19.com"; sid:561492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyork-20covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyork-20covid-19.com"; sid:561493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorksurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorksurvivedcovid19.com"; sid:561494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nfl-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nfl-covid19.com"; sid:561495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nflcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nflcovid19.com"; sid:561496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtest-covid19-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtest-covid19-info.com"; sid:561497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidvirus.com"; sid:561498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcoronarelief.com"; sid:561499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcovid19relief.com"; sid:561500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowfindcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowfindcoronarelief.com"; sid:561501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyc-covid19.com"; sid:561502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidrelief.com"; sid:561503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyckickcoronavirusass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyckickcoronavirusass.com"; sid:561504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyckickcovidass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyckickcovidass.com"; sid:561505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycwecleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycwecleancovid-19.com"; sid:561506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycwecleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycwecleancovid19.com"; sid:561507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycwilllkickcoronavirusass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycwilllkickcoronavirusass.com"; sid:561508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okccovid.com"; sid:561509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olympics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olympics-covid19.com"; sid:561510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olympicscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olympicscovid19.com"; sid:561511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oneforfreevscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oneforfreevscorona.com"; sid:561512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcoronavirus.com"; sid:561513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcoronavirusinfo.com"; sid:561514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid19.com"; sid:561515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid19.net"; sid:561516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirushelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirushelpline.com"; sid:561517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronavirusmap.com"; sid:561518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opensourcecovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opensourcecovid19.world"; sid:561519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ophthalmology-coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ophthalmology-coronado.com"; sid:561520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourprojectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourprojectcovid.com"; sid:561521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcomeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcomeofcovid19.com"; sid:561522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paintforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paintforcoronavirus.com"; sid:561523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakcorona.com"; sid:561524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic123.com"; sid:561525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-2.com"; sid:561526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicassurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicassurance.com"; sid:561527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccorona2020.com"; sid:561528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid-19.net"; sid:561529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdepression.com"; sid:561530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiscussion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiscussion.com"; sid:561531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdocs.com"; sid:561532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflame.com"; sid:561533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfraud.com"; sid:561534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfraud.net"; sid:561535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglobalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglobalsupply.com"; sid:561536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichauntproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichauntproduction.com"; sid:561537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinformationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinformationcenter.com"; sid:561538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsuranceclaimcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsuranceclaimcenter.com"; sid:561539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsuranceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsuranceprotection.com"; sid:561540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawsuitcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawsuitcenter.com"; sid:561541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawsuits.com"; sid:561542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-lawyer.com"; sid:561543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicman.com"; sid:561544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicman.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicman.net"; sid:561545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmarkets.com"; sid:561546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedbag.com"; sid:561547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.money"; sid:561548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmustache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmustache.com"; sid:561549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoflive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoflive.com"; sid:561550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpianolessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpianolessons.com"; sid:561551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplacestovisitthisweekend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplacestovisitthisweekend.com"; sid:561552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanningforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanningforbusiness.com"; sid:561553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepusa.com"; sid:561554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.productions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.productions"; sid:561555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofit.com"; sid:561556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofstrategies.com"; sid:561557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-re.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-re.com"; sid:561558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicre.com"; sid:561559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafety.net"; sid:561560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicslasher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicslasher.com"; sid:561561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrading.com"; sid:561562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicusa.net"; sid:561563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-virus.com"; sid:561564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingthroughthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingthroughthepandemic.com"; sid:561565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasifikacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasifikacovid19.com"; sid:561566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccoviduodate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccoviduodate.com"; sid:561567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedulicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedulicovid19.net"; sid:561568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perdidasinversioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perdidasinversioncovid.com"; sid:561569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for periksacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"periksacorona.com"; sid:561570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pgatour-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pgatour-covid19.com"; sid:561571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pgatourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pgatourcovid19.com"; sid:561572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phlcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phlcovid19.com"; sid:561573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phongdichcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phongdichcovid.com"; sid:561574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phtcccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phtcccovid19.com"; sid:561575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pimpmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pimpmycorona.com"; sid:561576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetcoronavirus.com"; sid:561577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for podsavewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"podsavewuhan.com"; sid:561578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poker-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poker-corona.com"; sid:561579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portal3dcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portal3dcovid19.com"; sid:561580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona.life"; sid:561581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusparty.com"; sid:561582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirussyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirussyndrome.com"; sid:561583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19ocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19ocs.com"; sid:561584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfest.com"; sid:561585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovid.com"; sid:561586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronakit.com"; sid:561587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19australia.com"; sid:561588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisonology-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisonology-covid19.com"; sid:561589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisonology-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisonology-covid19.net"; sid:561590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profitfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profitfromthepandemic.com"; sid:561591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-against-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-against-covid19.com"; sid:561592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-against-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-against-covid.com"; sid:561593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purecoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purecoronarelief.com"; sid:561594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qualify4coronadollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qualify4coronadollars.com"; sid:561595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarentenacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarentenacovid-19.com"; sid:561596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quit4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quit4covid.com"; sid:561597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitforcovid.com"; sid:561598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestcovid19sydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestcovid19sydney.com"; sid:561599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestingcovid19.com"; sid:561600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rassdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rassdcorona.com"; sid:561601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatecovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatecovid19resources.com"; sid:561602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatemarketandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatemarketandcoronavirus.com"; sid:561603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realpandemicviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realpandemicviruses.com"; sid:561604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatung-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatung-covid19.com"; sid:561605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacioncoronavirus.net"; sid:561606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionescoronavirus.net"; sid:561607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcovid19.com"; sid:561608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registercovid19.com"; sid:561609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rehabcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rehabcoronavirus.com"; sid:561610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4covid.com"; sid:561611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relief4covidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relief4covidvictims.com"; sid:561612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remedioscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remedioscoronavirus.com"; sid:561613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resultsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resultsofcovid19.com"; sid:561614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for revealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"revealcovid.com"; sid:561615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reversepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reversepandemic.com"; sid:561616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reversepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reversepandemic.net"; sid:561617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reversepandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reversepandemic.world"; sid:561618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricovidarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricovidarchive.com"; sid:561619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimentodannicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimentodannicovid19.com"; sid:561620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochestercoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochestercoronavirusinfo.com"; sid:561621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rolandgarros-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rolandgarros-covid19.com"; sid:561622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rolandgarroscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rolandgarroscovid19.com"; sid:561623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rollycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rollycovid19.com"; sid:561624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saas4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saas4covid.com"; sid:561625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saasforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saasforcovid.com"; sid:561626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetytestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetytestcoronavirus.com"; sid:561627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyvaccinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyvaccinecoronavirus.com"; sid:561628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salvoconductocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salvoconductocoronavirus.com"; sid:561629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salvoconductocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salvoconductocovid19.com"; sid:561630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocovid19.com"; sid:561631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscov2-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscov2-covid.com"; sid:561632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemyhomefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemyhomefromcoronavirus.com"; sid:561633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemyhomefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemyhomefromcovid19.com"; sid:561634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemyrealestatefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemyrealestatefromcovid19.com"; sid:561635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacash4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacash4covid.com"; sid:561636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronadollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronadollars.com"; sid:561637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronadvice.com"; sid:561638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronahelp.com"; sid:561639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronamoney.com"; sid:561640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronarelief.com"; sid:561641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidadvice.com"; sid:561642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidadvisor.com"; sid:561643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidadvisors.com"; sid:561644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidcash.com"; sid:561645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoviddisasterrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoviddisasterrelief.com"; sid:561646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidhelp.com"; sid:561647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbarelief4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbarelief4covid.com"; sid:561648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutz-corona.com"; sid:561649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutz-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutz-gegen-corona.com"; sid:561650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmittel-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmittel-corona.com"; sid:561651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningcovid.com"; sid:561652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securevaccinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securevaccinecoronavirus.com"; sid:561653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selectcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selectcoronarelief.com"; sid:561654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shcovid.com"; sid:561655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signscovid-19.com"; sid:561656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sinaiimmunologycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sinaiimmunologycovid19.com"; sid:561657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincasacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincasacovid19.com"; sid:561658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siparadigm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siparadigm-covid19.com"; sid:561659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sjmocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sjmocovid.com"; sid:561660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinesscovid19disasterrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinesscovid19disasterrelief.com"; sid:561661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcorona.com"; sid:561662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcovid19.com"; sid:561663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialvisacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialvisacovid.com"; sid:561664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionsforcovid-19.com"; sid:561665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscorona.net"; sid:561666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statcovid.com"; sid:561667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steamcovid.com"; sid:561668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19-ci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19-ci.com"; sid:561669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppandemicsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppandemicsnow.com"; sid:561670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopviruscovid19.com"; sid:561671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storecovid.com"; sid:561672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesfromcorona.com"; sid:561673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strategicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strategicpandemic.com"; sid:561674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strikedowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strikedowncovid19.com"; sid:561675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentagainstcovid19.com"; sid:561676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suckitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suckitcovid19.com"; sid:561677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suisse-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suisse-corona.com"; sid:561678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suite401-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suite401-covid19.com"; sid:561679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplycovid-19.com"; sid:561680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplyforcovid19.com"; sid:561681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronatime.com"; sid:561682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid2020.com"; sid:561683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swabscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swabscovid-19.com"; sid:561684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swabscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swabscovid19.com"; sid:561685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swdenanticorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swdenanticorona.net"; sid:561686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovidlaw.com"; sid:561687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxcreditcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxcreditcovid-19.com"; sid:561688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxcreditcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxcreditcovid19.com"; sid:561689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxcreditscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxcreditscovid-19.com"; sid:561690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxcreditscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxcreditscovid19.com"; sid:561691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxhelp4coronasurvivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxhelp4coronasurvivers.com"; sid:561692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxhelp4coronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxhelp4coronavictims.com"; sid:561693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxprep4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxprep4corona.com"; sid:561694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxprep4coronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxprep4coronavictims.com"; sid:561695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxrelief4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxrelief4corona.com"; sid:561696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tccovid.com"; sid:561697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachingscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachingscovid19.com"; sid:561698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terapicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terapicovid19.com"; sid:561699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronaviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronaviruscovid.com"; sid:561700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid19.net"; sid:561701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidencasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidencasa.com"; sid:561702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testerapidocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testerapidocorona.com"; sid:561703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19now.com"; sid:561704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovidimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovidimmunity.com"; sid:561705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingkits-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingkits-covid19.com"; sid:561706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsforcovid19.com"; sid:561707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theantidotecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theantidotecovid-19.com"; sid:561708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-busters.com"; sid:561709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacalculator.com"; sid:561710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacats.com"; sid:561711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadata.com"; sid:561712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaoptimist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaoptimist.com"; sid:561713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfurlough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfurlough.com"; sid:561714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusinsider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusinsider.com"; sid:561715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusrecovery.com"; sid:561716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswellness.com"; sid:561717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.world"; sid:561718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19aftercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19aftercare.com"; sid:561719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19blog.com"; sid:561720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19brigade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19brigade.com"; sid:561721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19brigade.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19brigade.net"; sid:561722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19coronavirus.com"; sid:561723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19essentials.com"; sid:561724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19forum.com"; sid:561725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19info.com"; sid:561726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lawgroup.com"; sid:561727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19meetingplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19meetingplace.com"; sid:561728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19opportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19opportunity.com"; sid:561729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19recovery.com"; sid:561730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19survivors.com"; sid:561731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19symptoms.com"; sid:561732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.today"; sid:561733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclaimer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclaimer.com"; sid:561734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddashboard.com"; sid:561735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnineteen.com"; sid:561736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepeoplescoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepeoplescoronadiary.com"; sid:561737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thermometer-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thermometer-coronavirus.com"; sid:561738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theteachingscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theteachingscovid19.com"; sid:561739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tobyspreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tobyspreadcovid19.com"; sid:561740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwefightcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwefightcovid-19.com"; sid:561741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwefightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwefightcovid19.com"; sid:561742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherwefightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherwefightcovid.com"; sid:561743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomorrowland-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomorrowland-covid19.com"; sid:561744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomorrowlandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomorrowlandcovid19.com"; sid:561745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19ph.com"; sid:561746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelinthetimesofcorona.com"; sid:561747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trendsincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trendsincoronavirus.com"; sid:561748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuckercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuckercovid19.com"; sid:561749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovid.com"; sid:561750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uefa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uefa-covid19.com"; sid:561751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uefacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uefacovid19.com"; sid:561752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19help.com"; sid:561753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19support.com"; sid:561754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uksurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uksurvivedcovid19.com"; sid:561755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultimatecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultimatecovidkit.com"; sid:561756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for un-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"un-corona.com"; sid:561757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicredit-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicredit-covid.com"; sid:561758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicreditcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicreditcovid.com"; sid:561759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicredit-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicredit-covid.net"; sid:561760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicreditcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicreditcovid.net"; sid:561761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontracovid.com"; sid:561762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unite-against-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unite-against-covid.com"; sid:561763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united-against-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united-against-covid.com"; sid:561764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universalpandemic.com"; sid:561765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidtest.com"; sid:561766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usasurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usasurvivedcovid19.com"; sid:561767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronamask.com"; sid:561768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusptsd.com"; sid:561769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19clean.com"; sid:561770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19memorial.com"; sid:561771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ushealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ushealthcovid.com"; sid:561772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccination4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccination4covid-19.com"; sid:561773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronaviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronaviruscovid.com"; sid:561774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid.com"; sid:561775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacoronaviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacoronaviruscovid.com"; sid:561776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vasculitiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vasculitiscovid.com"; sid:561777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vasculitiscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vasculitiscovid.net"; sid:561778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viajandoenlostiempodelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viajandoenlostiempodelcorona.com"; sid:561779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimscovid19memorial.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimscovid19memorial.cloud"; sid:561780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19news.com"; sid:561781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualizecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualizecovid19.com"; sid:561782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waw-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waw-covid19.com"; sid:561783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wawcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wawcovid19.com"; sid:561784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waycovid.com"; sid:561785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-after-corona.com"; sid:561786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleancovid-19.com"; sid:561787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleannyccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleannyccovid-19.com"; sid:561788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleannyccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleannyccovid19.com"; sid:561789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsmycoronarisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsmycoronarisk.com"; sid:561790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherescovid19.com"; sid:561791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherescovid.com"; sid:561792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherewascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherewascovid.com"; sid:561793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whosgotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whosgotcorona.com"; sid:561794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wildcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wildcorona.com"; sid:561795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipecoronavirus.com"; sid:561796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withoutcoronavirus.com"; sid:561797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wmasscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wmasscovid.com"; sid:561798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercovid.com"; sid:561799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercovid.net"; sid:561800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwildecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwildecovid19.com"; sid:561801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcovid-19.com"; sid:561802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-feixiang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-feixiang.com"; sid:561803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanguns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanguns.com"; sid:561804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrunzeweiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrunzeweiye.com"; sid:561805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansnacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansnacks.com"; sid:561806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusmillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusmillionaire.com"; sid:561807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xocoronavirus.com"; sid:561808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcovid.com"; sid:561809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zipcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zipcovid.com"; sid:561810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1099covidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1099covidloans.com"; sid:561811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18waystogetbeyondyourcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18waystogetbeyondyourcoronacrisis.com"; sid:561812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18waystogetbeyondyourcoronacrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18waystogetbeyondyourcoronacrisis.net"; sid:561813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19anticovid.com"; sid:561814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus.biz"; sid:561815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicfacts.com"; sid:561816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicvirus.com"; sid:561817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20corona.com"; sid:561818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2corona.com"; sid:561819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcoronavirus19.com"; sid:561820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcovid19.com"; sid:561821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5mincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5mincovid19.com"; sid:561822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5mincovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5mincovid19test.com"; sid:561823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 720wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"720wuhan.com"; sid:561824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 757covid19strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"757covid19strong.com"; sid:561825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 757covid19strong.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"757covid19strong.net"; sid:561826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adcovid.com"; sid:561827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adultcovidsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adultcovidsite.com"; sid:561828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advantagecovidconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advantagecovidconsulting.com"; sid:561829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aev-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aev-covid19.com"; sid:561830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid.com"; sid:561831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovidresponse.com"; sid:561832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronausa.com"; sid:561833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterpandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterpandemic.club"; sid:561834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aiutocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aiutocovid.com"; sid:561835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid.com"; sid:561836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amende-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amende-covid19.net"; sid:561837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amende-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amende-covid.net"; sid:561838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid.com"; sid:561839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapandemic.com"; sid:561840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anthologiesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anthologiesofcovid-19.com"; sid:561841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anthrocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anthrocovid.com"; sid:561842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.center"; sid:561843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.club"; sid:561844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-certified.com"; sid:561845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-certified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-certified.net"; sid:561846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtees.com"; sid:561847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid19tests.com"; sid:561848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidoutreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidoutreach.com"; sid:561849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asdacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asdacoronavirus.com"; sid:561850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asdacovid19.com"; sid:561851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionafectadoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionafectadoscovid-19.com"; sid:561852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistenzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistenzacovid.com"; sid:561853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-coronavirus.com"; sid:561854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-covid19.com"; sid:561855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avta-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avta-corona.com"; sid:561856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avtacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avtacorona.com"; sid:561857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aycorona.works - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aycorona.works"; sid:561858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascanariascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascanariascoronavirus.com"; sid:561859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankofamericacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankofamericacovid-19.com"; sid:561860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcnvscovid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcnvscovid19.cat"; sid:561861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcovid19free.com"; sid:561862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatitcorona.com"; sid:561863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19free.com"; sid:561864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bekercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bekercovid.com"; sid:561865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beritacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beritacovid19.com"; sid:561866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusattorney.com"; sid:561867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruskiller.com"; sid:561868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestofcovid19.com"; sid:561869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestofcovid19.net"; sid:561870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhccovid19.com"; sid:561871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birthduringcovidwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birthduringcovidwa.com"; sid:561872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcorona-virus.com"; sid:561873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockscorona.com"; sid:561874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodforcovid.com"; sid:561875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloquercovid19.com"; sid:561876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for book-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"book-coronavirus.com"; sid:561877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botiquincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botiquincovid19.com"; sid:561878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botoquinbasicocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botoquinbasicocovid.com"; sid:561879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for browardcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"browardcovidlaw.com"; sid:561880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btdlabcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btdlabcovid19.com"; sid:561881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btdlabscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btdlabscovid19.com"; sid:561882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusmaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusmaskonline.com"; sid:561883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19ppe.com"; sid:561884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecoronabye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecoronabye.com"; sid:561885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecorona.club"; sid:561886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-covid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-covid-19.life"; sid:561887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambridgecovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambridgecovidcleaning.com"; sid:561888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casescovid.com"; sid:561889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchfeelingnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchfeelingnotcovid.com"; sid:561890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeforcorona.com"; sid:561891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeforcovid.com"; sid:561892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causesforcorona.com"; sid:561893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificazionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificazionicovid.com"; sid:561894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronaviruscleaner.com"; sid:561895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronaviruscleaners.com"; sid:561896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirushousecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirushousecleaner.com"; sid:561897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19cleaner.com"; sid:561898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19cleaners.com"; sid:561899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidfree.com"; sid:561900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cffcovidspecial2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cffcovidspecial2.net"; sid:561901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovidmasks.com"; sid:561902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check-covid.com"; sid:561903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidnow.com"; sid:561904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinascovid19.com"; sid:561905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinasfaultcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinasfaultcovid19.com"; sid:561906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chronicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chronicpandemic.com"; sid:561907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chronicpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chronicpandemic.net"; sid:561908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim4covid.com"; sid:561909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimsforcovid.com"; sid:561910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classaction-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classaction-coronavirus.com"; sid:561911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classaction-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classaction-covid19.com"; sid:561912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean-covid19.net"; sid:561913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanscorona.com"; sid:561914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanyourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanyourcovid.com"; sid:561915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickcoronavirus.com"; sid:561916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colcorona.com"; sid:561917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprasemcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprasemcorona.com"; sid:561918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confirmedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confirmedcovid19.com"; sid:561919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confirmedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confirmedcovid.com"; sid:561920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conversazionipandemiche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conversazionipandemiche.com"; sid:561921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona15diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona15diet.com"; sid:561922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19app.com"; sid:561923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19baby.com"; sid:561924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19hometestkit.com"; sid:561925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19hometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19hometestkits.com"; sid:561926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19vaccine.com"; sid:561927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020tracking.com"; sid:561928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020tshirts.com"; sid:561929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020tv.com"; sid:561930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivairus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivairus.com"; sid:561931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanwaelte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanwaelte.com"; sid:561932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasupportgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasupportgh.com"; sid:561933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcypro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcypro.com"; sid:561934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bbs.com"; sid:561935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabezos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabezos.com"; sid:561936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabhagao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabhagao.com"; sid:561937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabic.com"; sid:561938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiodesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiodesign.com"; sid:561939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizloanhelp.com"; sid:561940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonanza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonanza.com"; sid:561941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuyback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuyback.com"; sid:561942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabyebyebye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabyebyebye.com"; sid:561943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaptain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaptain.com"; sid:561944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresact.com"; sid:561945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresupplies.com"; sid:561946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaretest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaretest.com"; sid:561947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarry.com"; sid:561948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashback.com"; sid:561949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachacochips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachacochips.com"; sid:561950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachles.com"; sid:561951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaciderx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaciderx.com"; sid:561952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsnyc.com"; sid:561953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsnys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsnys.com"; sid:561954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanfitness.com"; sid:561955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleangym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleangym.com"; sid:561956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaning.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaning.services"; sid:561957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanlife.com"; sid:561958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommemoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommemoration.com"; sid:561959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommemorationday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommemorationday.com"; sid:561960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunitys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunitys.com"; sid:561961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19bilgi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19bilgi.com"; sid:561962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19pill.com"; sid:561963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19pill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19pill.net"; sid:561964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19serum.com"; sid:561965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19treatment.com"; sid:561966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid-19vaccine.com"; sid:561967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid.net"; sid:561968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidtedavi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidtedavi.com"; sid:561969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidvaccine.com"; sid:561970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraftmc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraftmc.net"; sid:561971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisguide.com"; sid:561972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisplan.com"; sid:561973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisplaybook.com"; sid:561974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacry.com"; sid:561975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaption.com"; sid:561976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadata.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadata.today"; sid:561977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dell-arte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dell-arte.com"; sid:561978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevjobs.com"; sid:561979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisabiltylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisabiltylawyer.com"; sid:561980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisabiltylawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisabiltylawyer.net"; sid:561981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogardensindio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogardensindio.com"; sid:561982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomination.com"; sid:561983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonator.com"; sid:561984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoscleaning.com"; sid:561985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadruglaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadruglaw.com"; sid:561986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevidence.com"; sid:561987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafails.com"; sid:561988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiling.com"; sid:561989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirws.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirws.cymru"; sid:561990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirws.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirws.wales"; sid:561991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerderung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerderung.net"; sid:561992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafog.com"; sid:561993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafortuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafortuna.com"; sid:561994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafred.com"; sid:561995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-facemask.com"; sid:561996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefitness.com"; sid:561997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesurgery.com"; sid:561998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-freezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-freezone.com"; sid:561999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagazi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagazi.com"; sid:562000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagesichtsmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagesichtsmaske.com"; sid:562001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguideforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguideforbusinesses.com"; sid:562002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-has-taken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-has-taken.com"; sid:562003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahastaken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahastaken.com"; sid:562004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcareworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcareworkers.com"; sid:562005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthwebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthwebinar.com"; sid:562006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthwebinars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthwebinars.com"; sid:562007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.biz"; sid:562008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfocg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfocg.com"; sid:562009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-intel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-intel.com"; sid:562010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisntjustbeer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisntjustbeer.com"; sid:562011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajang.com"; sid:562012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajeton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajeton.com"; sid:562013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajung.com"; sid:562014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-karte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-karte.com"; sid:562015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakater.com"; sid:562016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillercenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillercenter.com"; sid:562017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersanitizer.com"; sid:562018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersanitizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersanitizer.net"; sid:562019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitshop.com"; sid:562020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitweb.com"; sid:562021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifegear.com"; sid:562022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifegear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifegear.net"; sid:562023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloan.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloan.biz"; sid:562024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloans.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloans.biz"; sid:562025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalpha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalpha.com"; sid:562026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalust.com"; sid:562027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanga.com"; sid:562028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaman-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaman-game.com"; sid:562029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-maps.com"; sid:562030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaps.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaps.world"; sid:562031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-map.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-map.world"; sid:562032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketingbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketingbook.com"; sid:562033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketsea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketsea.com"; sid:562034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaske24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaske24.com"; sid:562035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaski.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaski.com"; sid:562036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamastery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamastery.com"; sid:562037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-matome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-matome.net"; sid:562038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalvictims.com"; sid:562039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameters.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameters.today"; sid:562040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamichigan.com"; sid:562041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionaires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionaires.com"; sid:562042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundschutz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundschutz.net"; sid:562043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsupdate.net"; sid:562044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronangels.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronangels.net"; sid:562045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobias.com"; sid:562046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapi.com"; sid:562047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapill.net"; sid:562048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolitics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolitics.net"; sid:562049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-presse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-presse.com"; sid:562050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect.club"; sid:562051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect.world"; sid:562052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarack.com"; sid:562053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareclaim.com"; sid:562054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryclaim.com"; sid:562055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryloss.com"; sid:562056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoverytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoverytracker.com"; sid:562057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieflenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieflenders.com"; sid:562058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieflending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieflending.com"; sid:562059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremembrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremembrance.com"; sid:562060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremembranceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremembranceday.com"; sid:562061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareport.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareport.club"; sid:562062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rezept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rezept.com"; sid:562063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarezept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarezept.com"; sid:562064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rezept.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rezept.net"; sid:562065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarezept.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarezept.net"; sid:562066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarisco.com"; sid:562067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroots.com"; sid:562068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafety.club"; sid:562069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetymasks.com"; sid:562070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasance.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasance.biz"; sid:562071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaw.com"; sid:562072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascab.com"; sid:562073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningform.com"; sid:562074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasearch.net"; sid:562075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskincare.com"; sid:562076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasrilanka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasrilanka.com"; sid:562077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassance.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassance.biz"; sid:562078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastateupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastateupdate.com"; sid:562079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastats.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastats.pro"; sid:562080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimbill.com"; sid:562081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastime.com"; sid:562082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastimulus2020.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastimulus2020.biz"; sid:562083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportghana.com"; sid:562084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalshop.com"; sid:562085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvive2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvive2020.com"; sid:562086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorfoundation.com"; sid:562087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tax-grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tax-grant.com"; sid:562088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tax-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tax-grants.com"; sid:562089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tax-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tax-loan.com"; sid:562090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatechbuyback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatechbuyback.com"; sid:562091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcyprus.com"; sid:562092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesty.com"; sid:562093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathepandemic.com"; sid:562094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipsoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipsoz.com"; sid:562095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatour2020.com"; sid:562096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracetest.com"; sid:562097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracker.net"; sid:562098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrakr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrakr.com"; sid:562099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-unterstuetzung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-unterstuetzung.com"; sid:562100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinelaw.com"; sid:562101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigate.com"; sid:562102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavipcars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavipcars.com"; sid:562103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.club"; sid:562104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19lawyer.com"; sid:562105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19medicalsupplies.com"; sid:562106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19updates.com"; sid:562107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaffect.com"; sid:562108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusam.net"; sid:562109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-ar.com"; sid:562110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasda.com"; sid:562111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatwork.com"; sid:562112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbycountry.com"; sid:562113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasacleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasacleaner.com"; sid:562114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinocovid19.com"; sid:562115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsco.com"; sid:562116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupstar.com"; sid:562117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupstar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupstar.net"; sid:562118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommission.com"; sid:562119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-confinement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-confinement.com"; sid:562120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconstants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconstants.com"; sid:562121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconstructionjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconstructionjobs.com"; sid:562122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontacttracing.com"; sid:562123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselling.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselling.biz"; sid:562124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19.life"; sid:562125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.training"; sid:562126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19.world"; sid:562127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdata.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdata.today"; sid:562128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-derfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-derfilm.com"; sid:562129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesignmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesignmasks.com"; sid:562130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectioncameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectioncameras.com"; sid:562131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectionsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectionsystems.com"; sid:562132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetroit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetroit-covid19.com"; sid:562133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease-19vaccine.com"; sid:562134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease19vaccine.com"; sid:562135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasevaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasevaccination.com"; sid:562136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectant-forever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectant-forever.com"; sid:562137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantforever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantforever.com"; sid:562138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectant-permanent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectant-permanent.com"; sid:562139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantpermanent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantpermanent.com"; sid:562140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinformation.com"; sid:562141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiy.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiy.tips"; sid:562142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdollar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdollar.com"; sid:562143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseviction.com"; sid:562144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexecutivejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexecutivejobs.com"; sid:562145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfindajob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfindajob.com"; sid:562146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeday.com"; sid:562147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfromwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfromwuhan.com"; sid:562148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobaltracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobaltracker.com"; sid:562149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrant.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrant.biz"; sid:562150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirush24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirush24.com"; sid:562151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virushealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virushealth.com"; sid:562152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusilfilm.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusilfilm.cloud"; sid:562153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusilfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusilfilm.com"; sid:562154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusillinoiscaringcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusillinoiscaringcorps.com"; sid:562155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-in-the-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-in-the-usa.com"; sid:562156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskerala.com"; sid:562157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskrise.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskrise.net"; sid:562158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawline.com"; sid:562159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawri.com"; sid:562160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer19.com"; sid:562161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.legal"; sid:562162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-liabilitylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-liabilitylawsuit.com"; sid:562163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.lighting - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.lighting"; sid:562164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslung.com"; sid:562165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslunghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslunghelp.com"; sid:562166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.ltd"; sid:562167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskonlinebuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskonlinebuy.com"; sid:562168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedforce.com"; sid:562169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedikit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedikit.com"; sid:562170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedikits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedikits.com"; sid:562171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemoriam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemoriam.com"; sid:562172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichigan-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichigan-covid19.com"; sid:562173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmystory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmystory.com"; sid:562174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsamerica.com"; sid:562175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsitalia.com"; sid:562176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomes.com"; sid:562177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusongs.com"; sid:562178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-online-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-online-statistics.com"; sid:562179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreakebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreakebook.com"; sid:562180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparodies.com"; sid:562181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparody.com"; sid:562182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatient.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatient.net"; sid:562183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruspatients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruspatients.com"; sid:562184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-patients.com"; sid:562185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-permanent-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-permanent-disinfectant.com"; sid:562186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppekit.com"; sid:562187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayersetc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayersetc.com"; sid:562188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspropertycleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspropertycleaner.com"; sid:562189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectivekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectivekit.com"; sid:562190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectivekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectivekits.com"; sid:562191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreceipts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreceipts.com"; sid:562192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreclamaciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreclamaciones.com"; sid:562193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreportage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreportage.com"; sid:562194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrunning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrunning.com"; sid:562195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbafunds.com"; sid:562196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserviceindustryjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserviceindustryjob.com"; sid:562197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserviceindustryjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserviceindustryjobs.com"; sid:562198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuggestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuggestions.com"; sid:562199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-surplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-surplus.com"; sid:562200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustailoredmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustailoredmasks.com"; sid:562201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteamshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteamshelp.com"; sid:562202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustenantrights.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustenantrights.legal"; sid:562203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.biz"; sid:562204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.care"; sid:562205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcentres.com"; sid:562206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.life"; sid:562207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.world"; sid:562208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthinking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthinking.com"; sid:562209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-tips.com"; sid:562210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackeruk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackeruk.com"; sid:562211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunionjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunionjobs.com"; sid:562212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.support"; sid:562213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ventures.com"; sid:562214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisualization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisualization.com"; sid:562215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswal-mart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswal-mart.com"; sid:562216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhistleblowerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhistleblowerlawyer.com"; sid:562217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhistleblowerlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhistleblowerlawyers.com"; sid:562218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhitecollarjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhitecollarjobs.com"; sid:562219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkingfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkingfromhome.com"; sid:562220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisualized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisualized.com"; sid:562221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivor.com"; sid:562222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivors.com"; sid:562223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavojna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavojna.com"; sid:562224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavs.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavs.life"; sid:562225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavue.com"; sid:562226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarz.com"; sid:562227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawellnesswebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawellnesswebinar.com"; sid:562228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawellnesswebinars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawellnesswebinars.com"; sid:562229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wire-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wire-us.com"; sid:562230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkerscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkerscompensation.com"; sid:562231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawristband.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawristband.net"; sid:562232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxtraclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxtraclean.com"; sid:562233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaya.com"; sid:562234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveredforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveredforcovid.com"; sid:562235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveringcoronavirus.com"; sid:562236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020survivor.com"; sid:562237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abatementpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abatementpro.com"; sid:562238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountant.com"; sid:562239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountants.com"; sid:562240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-africa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-africa.net"; sid:562241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alaska.com"; sid:562242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alive.com"; sid:562243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19americanheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19americanheros.com"; sid:562244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anewsnow.com"; sid:562245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-anthologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-anthologies.com"; sid:562246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antibody.com"; sid:562247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytest.com"; sid:562248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestlab.com"; sid:562249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19app.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19app.mobi"; sid:562250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19app.net"; sid:562251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arena.com"; sid:562252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19arkansas.com"; sid:562253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19asda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19asda.com"; sid:562254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-back2work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-back2work.com"; sid:562255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beerchuggin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beerchuggin.com"; sid:562256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19belirtileri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19belirtileri.com"; sid:562257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bett.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bett.com"; sid:562258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bonus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bonus.com"; sid:562259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boston.com"; sid:562260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boxes.com"; sid:562261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19broker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19broker.com"; sid:562262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buisnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buisnesscenter.com"; sid:562263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busanhelp.com"; sid:562264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busanhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busanhelp.net"; sid:562265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businescenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businescenter.com"; sid:562266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesscenter.com"; sid:562267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscentre.com"; sid:562268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessceter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessceter.com"; sid:562269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptionclaim.com"; sid:562270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessresourecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessresourecenter.com"; sid:562271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessscenter.com"; sid:562272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busnesscenter.com"; sid:562273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bussinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bussinesscenter.com"; sid:562274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cab.com"; sid:562275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19califorina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19califorina.com"; sid:562276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canli.com"; sid:562277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.legal"; sid:562278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casetracker.com"; sid:562279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casetracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casetracker.net"; sid:562280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashback.com"; sid:562281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashflowforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashflowforecast.com"; sid:562282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashflowtemplate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashflowtemplate.com"; sid:562283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centraltexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centraltexas.com"; sid:562284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chatline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chatline.com"; sid:562285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chips.com"; sid:562286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanusa.com"; sid:562287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clear.net"; sid:562288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinicaltrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinicaltrial.com"; sid:562289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coins.com"; sid:562290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communicationspallet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communicationspallet.com"; sid:562291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceguide.com"; sid:562292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliancesop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliancesop.com"; sid:562293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceupdates.com"; sid:562294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19connecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19connecticut.com"; sid:562295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19constructionjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19constructionjobs.com"; sid:562296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracing.com"; sid:562297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contractlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contractlaw.com"; sid:562298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19criminals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19criminals.com"; sid:562299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crises.com"; sid:562300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureforce.com"; sid:562301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cv.com"; sid:562302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19data.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19data.guru"; sid:562303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datahub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datahub.com"; sid:562304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathcount.com"; sid:562305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenders.com"; sid:562306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19delaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19delaware.com"; sid:562307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19demo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19demo.com"; sid:562308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destek.com"; sid:562309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectioncameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectioncameras.com"; sid:562310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detection.net"; sid:562311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectionsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectionsystems.com"; sid:562312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfections.com"; sid:562313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinformation.com"; sid:562314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diyppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diyppe.com"; sid:562315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19don.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19don.com"; sid:562316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19downsized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19downsized.com"; sid:562317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edtechguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edtechguidance.com"; sid:562318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emergencysupplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emergencysupplychain.com"; sid:562319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyusa.com"; sid:562320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19essential.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19essential.net"; sid:562321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eviction.com"; sid:562322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19evictiondefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19evictiondefense.com"; sid:562323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictiondefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictiondefense.com"; sid:562324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19executivejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19executivejobs.com"; sid:562325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expogr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expogr.com"; sid:562326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-exposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-exposure.com"; sid:562327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposurelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposurelawsuit.com"; sid:562328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facewear.com"; sid:562329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19findajob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19findajob.com"; sid:562330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fiveminutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fiveminutetest.com"; sid:562331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floordecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floordecals.com"; sid:562332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forcefield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forcefield.com"; sid:562333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedom.com"; sid:562334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinesupport.com"; sid:562335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funders.com"; sid:562336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsnow.com"; sid:562337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19georgia.com"; sid:562338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-global.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-global.net"; sid:562339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaltracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaltracker.com"; sid:562340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19govfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19govfunds.com"; sid:562341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19greetings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19greetings.com"; sid:562342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grocery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grocery.com"; sid:562343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19guard.com"; sid:562344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19h24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19h24.com"; sid:562345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haber.com"; sid:562346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hair.com"; sid:562347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.guide"; sid:562348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helphouseforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helphouseforsale.com"; sid:562349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homesforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homesforsale.com"; sid:562350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotel.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotel.info"; sid:562351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19housesforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19housesforsale.com"; sid:562352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housing.net"; sid:562353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hungary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hungary.com"; sid:562354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icanwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icanwork.com"; sid:562355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icanwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icanwork.net"; sid:562356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icebathchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icebathchallenge.com"; sid:562357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ilfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ilfilm.com"; sid:562358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19illinois.com"; sid:562359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immuneverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immuneverified.com"; sid:562360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuneverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuneverified.com"; sid:562361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuneworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuneworkers.com"; sid:562362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitytestkit.com"; sid:562363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiacase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiacase.com"; sid:562364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19indiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19indiana.com"; sid:562365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infohq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infohq.com"; sid:562366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19innj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19innj.com"; sid:562367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19instanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19instanttest.com"; sid:562368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internationalclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internationalclub.com"; sid:562369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internationalonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internationalonline.com"; sid:562370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19interruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19interruptionclaim.com"; sid:562371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19interruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19interruptionclaims.com"; sid:562372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iotalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iotalliance.com"; sid:562373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19iowa.com"; sid:562374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19italiandentalprofessionalsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19italiandentalprofessionalsurvey.com"; sid:562375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kansas.com"; sid:562376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kentucky.com"; sid:562377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kid.com"; sid:562378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liability.com"; sid:562379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liabilitylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liabilitylawsuit.com"; sid:562380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liabilitylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liabilitylawyer.com"; sid:562381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanadvisors.com"; sid:562382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanattorney.com"; sid:562383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lost.com"; sid:562384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19louisiana.com"; sid:562385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lung.com"; sid:562386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lunghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lunghelp.com"; sid:562387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19magic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19magic.com"; sid:562388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maine.com"; sid:562389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-manager.com"; sid:562390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maps.net"; sid:562391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maryland.com"; sid:562392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maschere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maschere.com"; sid:562393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskmakers.com"; sid:562394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskspray.com"; sid:562395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19massachusette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19massachusette.com"; sid:562396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mechanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mechanic.com"; sid:562397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medforce.com"; sid:562398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mediations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mediations.com"; sid:562399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mediator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mediator.com"; sid:562400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mediators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mediators.com"; sid:562401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalquestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalquestion.com"; sid:562402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalquestions.com"; sid:562403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medpro.com"; sid:562404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memoriam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memoriam.com"; sid:562405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mhi.com"; sid:562406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19minnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19minnesota.com"; sid:562407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19misinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19misinformation.com"; sid:562408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mississippi.com"; sid:562409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19missouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19missouri.com"; sid:562410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigationguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigationguide.com"; sid:562411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgageassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgageassistance.com"; sid:562412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moving.com"; sid:562413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-museum.com"; sid:562414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-museum.com"; sid:562415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19musiciansupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19musiciansupport.com"; sid:562416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musiciansupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musiciansupport.com"; sid:562417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myanmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myanmar.com"; sid:562418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19n95facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19n95facemask.com"; sid:562419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19needscalculator.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19needscalculator.healthcare"; sid:562420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newnormal.com"; sid:562421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newnormal.com"; sid:562422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19neworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19neworleans.com"; sid:562423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsinfo.com"; sid:562424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normalidad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normalidad.com"; sid:562425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ntt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ntt.com"; sid:562426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nurses.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nurses.net"; sid:562427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomes.com"; sid:562428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19orlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19orlando.com"; sid:562429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19panacea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19panacea.com"; sid:562430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parodies.com"; sid:562431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parody.com"; sid:562432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paycheckloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paycheckloans.com"; sid:562433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharmacies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharmacies.com"; sid:562434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pill.net"; sid:562435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19potion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19potion.com"; sid:562436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pregnancyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pregnancyproject.com"; sid:562437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pregnancyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pregnancyproject.com"; sid:562438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preparation.com"; sid:562439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proprete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proprete.com"; sid:562440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectivekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectivekit.com"; sid:562441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectivekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectivekits.com"; sid:562442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectkit.com"; sid:562443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectkits.com"; sid:562444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protezione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protezione.com"; sid:562445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-puntland.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-puntland.net"; sid:562446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidhometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidhometests.com"; sid:562447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19readytowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19readytowork.com"; sid:562448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19readytowork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19readytowork.net"; sid:562449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realty.com"; sid:562450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19receipts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19receipts.com"; sid:562451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryconsultants.com"; sid:562452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryconsulting.com"; sid:562453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19refief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19refief.com"; sid:562454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19releif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19releif.com"; sid:562455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief101.com"; sid:562456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefcenter.com"; sid:562457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefgrant.com"; sid:562458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.legal"; sid:562459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefsba.com"; sid:562460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefuvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefuvc.com"; sid:562461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19research.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19research.study"; sid:562462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-respirator.com"; sid:562463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratormask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratormask.com"; sid:562464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-respirators.com"; sid:562465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19responsenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19responsenetwork.com"; sid:562466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19responsenetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19responsenetwork.net"; sid:562467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-responses-climate.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-responses-climate.solutions"; sid:562468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19retail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19retail.com"; sid:562469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retro.com"; sid:562470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retrospective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retrospective.com"; sid:562471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskscan.com"; sid:562472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rumor.com"; sid:562473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rus.com"; sid:562474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rx.net"; sid:562475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safeguard.com"; sid:562476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19samsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19samsclub.com"; sid:562477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sancristobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sancristobal.com"; sid:562478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanfrancisco.com"; sid:562479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saved.com"; sid:562480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbafunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbafunding.com"; sid:562481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaloans.net"; sid:562482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s-compensation.com"; sid:562483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19score.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19score.life"; sid:562484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19score.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19score.net"; sid:562485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfie.com"; sid:562486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfswabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfswabs.com"; sid:562487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seniorshoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seniorshoppers.com"; sid:562488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19serum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19serum.net"; sid:562489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serviceindustryjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serviceindustryjobs.com"; sid:562490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19servicing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19servicing.com"; sid:562491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shipping.com"; sid:562492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-somaliland.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-somaliland.net"; sid:562493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southsound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southsound.com"; sid:562494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southsound.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southsound.net"; sid:562495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimbill.com"; sid:562496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studentsforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studentsforum.com"; sid:562497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stylemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stylemask.com"; sid:562498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stylemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stylemasks.com"; sid:562499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19summit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19summit.email"; sid:562500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taskgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taskgroup.com"; sid:562501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taskgroup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taskgroup.net"; sid:562502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tax-grant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tax-grant.com"; sid:562503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tax-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tax-grants.com"; sid:562504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxlaw.com"; sid:562505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tax-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tax-loan.com"; sid:562506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tax-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tax-loans.com"; sid:562507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tedavi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tedavi.com"; sid:562508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testanywhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testanywhere.com"; sid:562509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testaz.com"; sid:562510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testbrevard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testbrevard.com"; sid:562511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testerkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testerkits.com"; sid:562512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testhub.com"; sid:562513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testhub.com"; sid:562514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testil.com"; sid:562515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcentersofnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcentersofnyc.com"; sid:562516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testing.net"; sid:562517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingnyc.com"; sid:562518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingstl.com"; sid:562519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.international"; sid:562520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test.life"; sid:562521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.life"; sid:562522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testnm.com"; sid:562523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testnv.com"; sid:562524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testresultsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testresultsus.com"; sid:562525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testshop.com"; sid:562526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tests.net"; sid:562527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19teststl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19teststl.com"; sid:562528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testtoday.com"; sid:562529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testusa.com"; sid:562530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test.world"; sid:562531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.world"; sid:562532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19texas.com"; sid:562533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19texas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19texas.net"; sid:562534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-thai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-thai.com"; sid:562535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thedocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thedocumentary.com"; sid:562536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timeline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timeline.net"; sid:562537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trak.com"; sid:562538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tv.com"; sid:562539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ug.com"; sid:562540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentfacts.com"; sid:562541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentfacts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentfacts.net"; sid:562542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemploymentlawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemploymentlawyers.net"; sid:562543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unionjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unionjobs.com"; sid:562544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unitelight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unitelight.com"; sid:562545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19urgentcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19urgentcare.com"; sid:562546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvchelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvchelp.com"; sid:562547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvcrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvcrelief.com"; sid:562548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.today"; sid:562549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19va.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19va.net"; sid:562550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-verified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-verified.com"; sid:562551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimclaims.com"; sid:562552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusescleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusescleanup.com"; sid:562553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitamin.com"; sid:562554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitamini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitamini.com"; sid:562555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vulnerability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vulnerability.com"; sid:562556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wal-mart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wal-mart.com"; sid:562557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warriors.com"; sid:562558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warriors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warriors.net"; sid:562559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19washington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19washington.com"; sid:562560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19washingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19washingtondc.com"; sid:562561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whitecollarjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whitecollarjobs.com"; sid:562562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wiz.com"; sid:562563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wristband.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wristband.net"; sid:562564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wv.com"; sid:562565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wv.com"; sid:562566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wv.com"; sid:562567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zw.com"; sid:562568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019.cloud"; sid:562569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.cloud"; sid:562570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019stats.com"; sid:562571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019test.net"; sid:562572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020survivor.com"; sid:562573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20vaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20vaccine.life"; sid:562574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20vaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20vaccine.world"; sid:562575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.wtf"; sid:562576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid35.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid35.com"; sid:562577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid500.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid500.com"; sid:562578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5minutetest.com"; sid:562579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9topia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9topia.com"; sid:562580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvance.com"; sid:562581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaf.com"; sid:562582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalert19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalert19.com"; sid:562583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertmap.com"; sid:562584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alerts.com"; sid:562585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalpha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalpha.com"; sid:562586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-analysis.com"; sid:562587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibodies-certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibodies-certified.com"; sid:562588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibodies-certified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibodies-certified.net"; sid:562589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodiescertified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodiescertified.net"; sid:562590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibodies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibodies.net"; sid:562591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antigen.com"; sid:562592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antigen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antigen.net"; sid:562593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaquine.com"; sid:562594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneycalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneycalifornia.com"; sid:562595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneyflorida.com"; sid:562596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneynewyork.com"; sid:562597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaventura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaventura.com"; sid:562598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessprint.com"; sid:562599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyhelp.com"; sid:562600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcypro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcypro.com"; sid:562601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarriers.com"; sid:562602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbay.com"; sid:562603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbe.net"; sid:562604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblast.com"; sid:562605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblast.net"; sid:562606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtesting.com"; sid:562607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloopers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloopers.com"; sid:562608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbro.com"; sid:562609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesshelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesshelpline.com"; sid:562610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareact.com"; sid:562611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregraphics.com"; sid:562612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareproject.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareproject.community"; sid:562613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareproject.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareproject.healthcare"; sid:562614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareproject.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareproject.international"; sid:562615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresupplies.com"; sid:562616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresupplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresupplies.net"; sid:562617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarry.com"; sid:562618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcautiousnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcautiousnow.com"; sid:562619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertify.com"; sid:562620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-check.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-check.net"; sid:562621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck.net"; sid:562622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimadjuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimadjuster.com"; sid:562623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-claim-denial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-claim-denial.com"; sid:562624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimdenial.com"; sid:562625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimlawyers.com"; sid:562626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimslaw.com"; sid:562627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsnyc.com"; sid:562628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclcsistem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclcsistem.com"; sid:562629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcompanies.com"; sid:562630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcling.com"; sid:562631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclings.com"; sid:562632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclown.com"; sid:562633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoda.com"; sid:562634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compliance.com"; sid:562635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectni.com"; sid:562636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consciousness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consciousness.com"; sid:562637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorner.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorner.co.uk"; sid:562638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostarica.com"; sid:562639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountry.com"; sid:562640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coverage-denial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coverage-denial.com"; sid:562641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveragedenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveragedenial.com"; sid:562642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrashcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrashcourse.com"; sid:562643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupidsandcriminals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupidsandcriminals.com"; sid:562644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddash.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddash.digital"; sid:562645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.today"; sid:562646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-db.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-db.net"; sid:562647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathrate.com"; sid:562648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtnegotiators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtnegotiators.com"; sid:562649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecathlon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecathlon.com"; sid:562650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddomination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddomination.com"; sid:562651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddominator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddominator.com"; sid:562652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-drive-through-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-drive-through-tests.com"; sid:562653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddruglaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddruglaw.com"; sid:562654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddy.com"; sid:562655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddz.com"; sid:562656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideasybreath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideasybreath.com"; sid:562657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideating.com"; sid:562658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ec.com"; sid:562659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidec.com"; sid:562660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemain.com"; sid:562661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencies.com"; sid:562662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentiallyyours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentiallyyours.com"; sid:562663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoinitiative.com"; sid:562664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideolive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideolive.com"; sid:562665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos.net"; sid:562666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepidemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepidemic2020.com"; sid:562667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexample.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexample.com"; sid:562668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-exposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-exposure.com"; sid:562669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshieldproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshieldproject.com"; sid:562670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashionista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashionista.com"; sid:562671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfearless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfearless.com"; sid:562672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfieldhospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfieldhospitals.com"; sid:562673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfielhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfielhospital.com"; sid:562674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmarchive.com"; sid:562675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfind.com"; sid:562676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirelab.com"; sid:562677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflights.com"; sid:562678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fogger.com"; sid:562679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfogging.com"; sid:562680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeindia.com"; sid:562681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreespinesurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreespinesurgery.com"; sid:562682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunders.com"; sid:562683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeo.com"; sid:562684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeo.net"; sid:562685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgohome.com"; sid:562686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrief.com"; sid:562687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidh24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidh24.com"; sid:562688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaber.com"; sid:562689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-healthcare.com"; sid:562690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthjob.com"; sid:562691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-health.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-health.net"; sid:562692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpcanada.com"; sid:562693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.guide"; sid:562694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnewjersey.com"; sid:562695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnewyork.com"; sid:562696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnj.com"; sid:562697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpnyc.com"; sid:562698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpny.com"; sid:562699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomescreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomescreening.com"; sid:562700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hometests.com"; sid:562701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousingmatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousingmatters.com"; sid:562702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhvac.com"; sid:562703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiab.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiab.care"; sid:562704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiab.net"; sid:562705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicebathchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicebathchallenge.com"; sid:562706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunebracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunebracelets.com"; sid:562707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunebracelets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunebracelets.net"; sid:562708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitycertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitycertificate.com"; sid:562709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitypassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitypassport.com"; sid:562710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitytests.com"; sid:562711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfohq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfohq.com"; sid:562712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfonj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfonj.com"; sid:562713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfonyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfonyc.com"; sid:562714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfony.com"; sid:562715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformationusa.com"; sid:562716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstanthometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstanthometest.com"; sid:562717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-intel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-intel.com"; sid:562718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintelligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintelligence.com"; sid:562719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionclaim.com"; sid:562720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionclaims.com"; sid:562721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionlawsuit.com"; sid:562722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionlawsuits.com"; sid:562723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistress.com"; sid:562724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistressglobalsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistressglobalsurvey.com"; sid:562725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-italia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-italia.com"; sid:562726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidizer.net"; sid:562727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs.today"; sid:562728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-journal-club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-journal-club.com"; sid:562729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjs.com"; sid:562730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiddo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiddo.com"; sid:562731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknowledge.com"; sid:562732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawhelp.com"; sid:562733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliabilitylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliabilitylawsuit.com"; sid:562734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlibrary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlibrary.net"; sid:562735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-loan.com"; sid:562736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloangiant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloangiant.com"; sid:562737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanguru.com"; sid:562738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloan.net"; sid:562739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanpro.com"; sid:562740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanpros.com"; sid:562741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanresources.com"; sid:562742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-maghreb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-maghreb.com"; sid:562743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaghreb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaghreb.com"; sid:562744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmails.com"; sid:562745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascaras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascaras.com"; sid:562746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masken.com"; sid:562747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskspray.com"; sid:562748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmastery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmastery.com"; sid:562749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmediators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmediators.com"; sid:562750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilehospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilehospitals.com"; sid:562751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoda.com"; sid:562752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneynewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneynewjersey.com"; sid:562753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneynewyork.com"; sid:562754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneynj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneynj.com"; sid:562755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneyny.com"; sid:562756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nation.com"; sid:562757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnest.com"; sid:562758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursechronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursechronicles.com"; sid:562759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghomelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghomelawsuit.com"; sid:562760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidolypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidolypse.com"; sid:562761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopportunity.com"; sid:562762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopportunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopportunity.net"; sid:562763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidops.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidops.net"; sid:562764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparty.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparty.co.uk"; sid:562765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidperspective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidperspective.com"; sid:562766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphilippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphilippines.com"; sid:562767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.pictures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.pictures"; sid:562768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppploans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppploans.com"; sid:562769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnancyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnancyproject.com"; sid:562770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnancyproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnancyproject.net"; sid:562771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnant.com"; sid:562772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescree.com"; sid:562773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescren.com"; sid:562774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprints.com"; sid:562775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protec.com"; sid:562776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectiongroup.com"; sid:562777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionplan.com"; sid:562778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionsystems.com"; sid:562779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectivemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectivemask.com"; sid:562780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquaranteam.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquaranteam.club"; sid:562781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquaranteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquaranteam.net"; sid:562782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestatereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestatereport.com"; sid:562783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recover.com"; sid:562784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryplan.com"; sid:562785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehelp.com"; sid:562786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefuvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefuvc.com"; sid:562787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.rentals - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.rentals"; sid:562788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespira.com"; sid:562789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrooms.com"; sid:562790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19abatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19abatement.com"; sid:562791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-certified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-certified.net"; sid:562792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertified.net"; sid:562793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-check.com"; sid:562794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecheck.com"; sid:562795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-check.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-check.net"; sid:562796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecheck.net"; sid:562797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbafunds.com"; sid:562798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscab.com"; sid:562799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscarf.com"; sid:562800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschutz.com"; sid:562801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreening.net"; sid:562802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfswabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfswabs.com"; sid:562803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorshopers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorshopers.com"; sid:562804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorshopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorshopper.com"; sid:562805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorsshoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorsshoppers.com"; sid:562806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshirts.net"; sid:562807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsite.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsite.net"; sid:562808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspu.com"; sid:562809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimbill.com"; sid:562810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusloan.com"; sid:562811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrong.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrong.world"; sid:562812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.study"; sid:562813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummit.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummit.email"; sid:562814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesfund.com"; sid:562815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyusa.com"; sid:562816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurathelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurathelp.com"; sid:562817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvior.com"; sid:562818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurviors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurviors.com"; sid:562819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivaltest.com"; sid:562820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcompany.com"; sid:562821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitnow.com"; sid:562822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpdx.com"; sid:562823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteszt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteszt.com"; sid:562824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheaftermath.com"; sid:562825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeline.net"; sid:562826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracker.world"; sid:562827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-travelfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-travelfree.com"; sid:562828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelfree.com"; sid:562829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.cloud"; sid:562830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelawyers.com"; sid:562831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.life"; sid:562832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.today"; sid:562833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveils.com"; sid:562834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verified.com"; sid:562835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verified.net"; sid:562836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19testkit.com"; sid:562837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusattorney.com"; sid:562838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusattorney.net"; sid:562839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusmap.com"; sid:562840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebs.com"; sid:562841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkercomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkercomp.com"; sid:562842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkershelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkershelpline.com"; sid:562843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrongfuldeathva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrongfuldeathva.com"; sid:562844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwsop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwsop.com"; sid:562845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crappycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crappycorona.com"; sid:562846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatorsvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatorsvscovid.com"; sid:562847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisis-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisis-covid.com"; sid:562848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscovid.com"; sid:562849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptokillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptokillscovid.com"; sid:562850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadosenelhogarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadosenelhogarcovid19.com"; sid:562851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cupidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cupidcovid.com"; sid:562852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadecoronavirus.com"; sid:562853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcovid.biz"; sid:562854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curiouscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curiouscorona.com"; sid:562855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cybersecuritypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cybersecuritypandemic.com"; sid:562856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dascoronavirus.com"; sid:562857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deaoucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deaoucovid-19.com"; sid:562858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deaoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deaoucovid19.com"; sid:562859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deaoucovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deaoucovid19testkit.com"; sid:562860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearestcovid.com"; sid:562861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19.net"; sid:562862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistage-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistage-corona.com"; sid:562863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroycovid-19.com"; sid:562864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detection-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detection-corona.com"; sid:562865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronahelp.com"; sid:562866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deudascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deudascoronavirus.com"; sid:562867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dez-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dez-covid.com"; sid:562868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetescovid19.com"; sid:562869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecovid.com"; sid:562870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diaryofapandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diaryofapandemicapp.com"; sid:562871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diecoronavirusstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diecoronavirusstory.com"; sid:562872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discordcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discordcovid19.com"; sid:562873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disscovid-19.com"; sid:562874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disscovid19.com"; sid:562875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorceduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorceduringcoronavirus.com"; sid:562876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dominatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dominatecovid.com"; sid:562877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for downcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"downcovid.com"; sid:562878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19loans.com"; sid:562879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elmapacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elmapacovid.com"; sid:562880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingthecovid19.com"; sid:562881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemblecontrelecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemblecontrelecovid.com"; sid:562882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epiccovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epiccovidresponse.com"; sid:562883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicpandemiccomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicpandemiccomedy.com"; sid:562884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceconomics.com"; sid:562885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceconomy.com"; sid:562886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicgames.com"; sid:562887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpleasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpleasures.com"; sid:562888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicre.com"; sid:562889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eriecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eriecovidrelief.com"; sid:562890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europeanpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europeanpandemic.com"; sid:562891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europepandemic.com"; sid:562892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for events4covid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"events4covid19.co.uk"; sid:562893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everyonevscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everyonevscoronavirus.com"; sid:562894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exposedtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exposedtocovid.com"; sid:562895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fabricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fabricovid.com"; sid:562896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus.com"; sid:562897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-info.com"; sid:562898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirusinfo.com"; sid:562899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-info.com"; sid:562900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirusinfo.com"; sid:562901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-info.net"; sid:562902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirusinfo.net"; sid:562903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-info.net"; sid:562904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirusinfo.net"; sid:562905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-information.com"; sid:562906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirusinformation.com"; sid:562907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-information.com"; sid:562908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirusinformation.com"; sid:562909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-information.net"; sid:562910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirusinformation.net"; sid:562911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-information.net"; sid:562912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirusinformation.net"; sid:562913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus.net"; sid:562914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-support.com"; sid:562915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirussupport.com"; sid:562916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-support.com"; sid:562917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirussupport.com"; sid:562918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirus-support.net"; sid:562919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-coronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-coronavirussupport.net"; sid:562920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirus-support.net"; sid:562921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcoronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcoronavirussupport.net"; sid:562922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19.com"; sid:562923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19.com"; sid:562924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19.com"; sid:562925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19-information.com"; sid:562926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19information.com"; sid:562927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19-information.com"; sid:562928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19-information.com"; sid:562929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19information.com"; sid:562930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19-information.com"; sid:562931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19information.com"; sid:562932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19-information.net"; sid:562933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19information.net"; sid:562934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19-information.net"; sid:562935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19-information.net"; sid:562936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19information.net"; sid:562937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19-information.net"; sid:562938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19information.net"; sid:562939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19.net"; sid:562940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19.net"; sid:562941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19.net"; sid:562942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19.net"; sid:562943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19-support.com"; sid:562944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19support.com"; sid:562945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19-support.com"; sid:562946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19support.com"; sid:562947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19-support.com"; sid:562948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19support.com"; sid:562949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19-support.com"; sid:562950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19support.com"; sid:562951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19-support.net"; sid:562952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-19support.net"; sid:562953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19-support.net"; sid:562954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid19support.net"; sid:562955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19-support.net"; sid:562956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-19support.net"; sid:562957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19-support.net"; sid:562958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid19support.net"; sid:562959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid.com"; sid:562960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid.com"; sid:562961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-information.com"; sid:562962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covidinformation.com"; sid:562963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-information.com"; sid:562964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovidinformation.com"; sid:562965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-information.net"; sid:562966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covidinformation.net"; sid:562967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-information.net"; sid:562968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovidinformation.net"; sid:562969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid.net"; sid:562970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid.net"; sid:562971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-support.com"; sid:562972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covidsupport.com"; sid:562973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-support.com"; sid:562974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovidsupport.com"; sid:562975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covid-support.net"; sid:562976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-covidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-covidsupport.net"; sid:562977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovid-support.net"; sid:562978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookcovidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookcovidsupport.net"; sid:562979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-info-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-info-coronavirus.com"; sid:562980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-infocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-infocoronavirus.com"; sid:562981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinfo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinfo-coronavirus.com"; sid:562982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinfocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinfocoronavirus.com"; sid:562983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-info-coronavirus.net"; sid:562984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-infocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-infocoronavirus.net"; sid:562985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinfo-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinfo-coronavirus.net"; sid:562986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinfocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinfocoronavirus.net"; sid:562987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-coronavirus.com"; sid:562988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcoronavirus.com"; sid:562989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-coronavirus.com"; sid:562990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcoronavirus.com"; sid:562991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-coronavirus.net"; sid:562992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcoronavirus.net"; sid:562993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-coronavirus.net"; sid:562994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcoronavirus.net"; sid:562995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid-19.com"; sid:562996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid19.com"; sid:562997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid-19.com"; sid:562998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid19.com"; sid:562999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid-19.com"; sid:563000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid19.com"; sid:563001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid-19.com"; sid:563002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid19.com"; sid:563003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid-19.net"; sid:563004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid19.net"; sid:563005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid-19.net"; sid:563006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid19.net"; sid:563007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid-19.net"; sid:563008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid19.net"; sid:563009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid-19.net"; sid:563010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid19.net"; sid:563011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid.com"; sid:563012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid.com"; sid:563013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid.com"; sid:563014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid.com"; sid:563015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-information-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-information-covid.net"; sid:563016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-informationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-informationcovid.net"; sid:563017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformation-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformation-covid.net"; sid:563018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebookinformationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebookinformationcovid.net"; sid:563019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-coronavirus.com"; sid:563020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcoronavirus.com"; sid:563021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-coronavirus.com"; sid:563022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcoronavirus.com"; sid:563023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-coronavirus.net"; sid:563024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcoronavirus.net"; sid:563025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-coronavirus.net"; sid:563026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcoronavirus.net"; sid:563027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid-19.com"; sid:563028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid19.com"; sid:563029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid-19.com"; sid:563030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid19.com"; sid:563031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid-19.com"; sid:563032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid19.com"; sid:563033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid-19.com"; sid:563034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid19.com"; sid:563035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid-19.net"; sid:563036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid19.net"; sid:563037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid-19.net"; sid:563038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid19.net"; sid:563039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid-19.net"; sid:563040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid19.net"; sid:563041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid-19.net"; sid:563042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid19.net"; sid:563043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid.com"; sid:563044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid.com"; sid:563045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid.com"; sid:563046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid.com"; sid:563047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-support-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-support-covid.net"; sid:563048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebook-supportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebook-supportcovid.net"; sid:563049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupport-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupport-covid.net"; sid:563050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facebooksupportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facebooksupportcovid.net"; sid:563051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faithbeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faithbeyondcovid19.com"; sid:563052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmacovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmacovid.club"; sid:563053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastestcovidtest.com"; sid:563054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-ads6456u65e43455covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-ads6456u65e43455covid19.com"; sid:563055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbafricacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbafricacovid19.com"; sid:563056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus.com"; sid:563057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus.com"; sid:563058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-info.com"; sid:563059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirusinfo.com"; sid:563060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-info.com"; sid:563061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirusinfo.com"; sid:563062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-info.net"; sid:563063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirusinfo.net"; sid:563064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-info.net"; sid:563065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirusinfo.net"; sid:563066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-information.com"; sid:563067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirusinformation.com"; sid:563068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-information.com"; sid:563069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirusinformation.com"; sid:563070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-information.net"; sid:563071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirusinformation.net"; sid:563072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-information.net"; sid:563073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirusinformation.net"; sid:563074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus.net"; sid:563075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus.net"; sid:563076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-support.com"; sid:563077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirussupport.com"; sid:563078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-support.com"; sid:563079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirussupport.com"; sid:563080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirus-support.net"; sid:563081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-coronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-coronavirussupport.net"; sid:563082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirus-support.net"; sid:563083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcoronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcoronavirussupport.net"; sid:563084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19.com"; sid:563085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19.com"; sid:563086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19.com"; sid:563087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19.com"; sid:563088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19-information.com"; sid:563089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19information.com"; sid:563090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19-information.com"; sid:563091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19information.com"; sid:563092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19-information.com"; sid:563093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19information.com"; sid:563094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19-information.com"; sid:563095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19information.com"; sid:563096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19-information.net"; sid:563097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19information.net"; sid:563098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19-information.net"; sid:563099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19information.net"; sid:563100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19-information.net"; sid:563101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19information.net"; sid:563102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19-information.net"; sid:563103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19information.net"; sid:563104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19.net"; sid:563105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19.net"; sid:563106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19.net"; sid:563107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19.net"; sid:563108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19-support.com"; sid:563109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19support.com"; sid:563110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19-support.com"; sid:563111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19support.com"; sid:563112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19-support.com"; sid:563113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19support.com"; sid:563114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19-support.com"; sid:563115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19support.com"; sid:563116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19-support.net"; sid:563117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-19support.net"; sid:563118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19-support.net"; sid:563119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid19support.net"; sid:563120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19-support.net"; sid:563121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19support.net"; sid:563122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19-support.net"; sid:563123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid19support.net"; sid:563124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid.com"; sid:563125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid.com"; sid:563126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-information.com"; sid:563127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covidinformation.com"; sid:563128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-information.com"; sid:563129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovidinformation.com"; sid:563130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-information.net"; sid:563131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covidinformation.net"; sid:563132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-information.net"; sid:563133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovidinformation.net"; sid:563134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid.net"; sid:563135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid.net"; sid:563136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-support.com"; sid:563137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covidsupport.com"; sid:563138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-support.com"; sid:563139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovidsupport.com"; sid:563140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-support.net"; sid:563141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covidsupport.net"; sid:563142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-support.net"; sid:563143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovidsupport.net"; sid:563144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-info-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-info-coronavirus.com"; sid:563145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-infocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-infocoronavirus.com"; sid:563146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinfo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinfo-coronavirus.com"; sid:563147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinfocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinfocoronavirus.com"; sid:563148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-info-coronavirus.net"; sid:563149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-infocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-infocoronavirus.net"; sid:563150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinfo-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinfo-coronavirus.net"; sid:563151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinfocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinfocoronavirus.net"; sid:563152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-coronavirus.com"; sid:563153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcoronavirus.com"; sid:563154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-coronavirus.com"; sid:563155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcoronavirus.com"; sid:563156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-coronavirus.net"; sid:563157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcoronavirus.net"; sid:563158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-coronavirus.net"; sid:563159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcoronavirus.net"; sid:563160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid-19.com"; sid:563161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid19.com"; sid:563162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid-19.com"; sid:563163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid19.com"; sid:563164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid-19.com"; sid:563165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid19.com"; sid:563166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid-19.com"; sid:563167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid19.com"; sid:563168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid-19.net"; sid:563169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid19.net"; sid:563170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid-19.net"; sid:563171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid19.net"; sid:563172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid-19.net"; sid:563173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid19.net"; sid:563174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid-19.net"; sid:563175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid19.net"; sid:563176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid.com"; sid:563177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid.com"; sid:563178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid.com"; sid:563179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid.com"; sid:563180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-information-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-information-covid.net"; sid:563181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-informationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-informationcovid.net"; sid:563182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformation-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformation-covid.net"; sid:563183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbinformationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbinformationcovid.net"; sid:563184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-coronavirus.com"; sid:563185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcoronavirus.com"; sid:563186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-coronavirus.com"; sid:563187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcoronavirus.com"; sid:563188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-coronavirus.net"; sid:563189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcoronavirus.net"; sid:563190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-coronavirus.net"; sid:563191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcoronavirus.net"; sid:563192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid-19.com"; sid:563193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid19.com"; sid:563194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid-19.com"; sid:563195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid19.com"; sid:563196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid-19.com"; sid:563197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid19.com"; sid:563198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid-19.com"; sid:563199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid19.com"; sid:563200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid-19.net"; sid:563201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid19.net"; sid:563202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid-19.net"; sid:563203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid19.net"; sid:563204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid-19.net"; sid:563205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid19.net"; sid:563206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid-19.net"; sid:563207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid19.net"; sid:563208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid.com"; sid:563209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid.com"; sid:563210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid.com"; sid:563211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid.com"; sid:563212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-support-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-support-covid.net"; sid:563213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-supportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-supportcovid.net"; sid:563214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupport-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupport-covid.net"; sid:563215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbsupportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbsupportcovid.net"; sid:563216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearlesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearlesscovid.com"; sid:563217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feelingcoviddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feelingcoviddy.com"; sid:563218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffcovid19.com"; sid:563219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fieldguidetocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fieldguidetocoronavirus.com"; sid:563220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19-flyersgiveaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19-flyersgiveaway.com"; sid:563221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19jobs.com"; sid:563222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidfromhome.com"; sid:563223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincoronavirus.com"; sid:563224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincovid19.com"; sid:563225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincovid.com"; sid:563226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattencovid.com"; sid:563227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronalawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronalawyers.com"; sid:563228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidlawyers.com"; sid:563229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidlegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidlegal.com"; sid:563230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronalaw.com"; sid:563231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidlawyers.com"; sid:563232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forniturecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forniturecovid.com"; sid:563233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortunacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortunacorona.com"; sid:563234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecovid-19.com"; sid:563235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronacash.com"; sid:563236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19loans.com"; sid:563237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidloan.com"; sid:563238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid.loans"; sid:563239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freedomfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freedomfromcovid19.com"; sid:563240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucorona19.com"; sid:563241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funaftercoronavirus.com"; sid:563242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gelcovid19.com"; sid:563243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germanycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germanycovid-19.com"; sid:563244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19masks.com"; sid:563245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19ppe.com"; sid:563246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gigworkercovid19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gigworkercovid19loans.com"; sid:563247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gigworkercovidloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gigworkercovidloans.com"; sid:563248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glarcovid19.com"; sid:563249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidmap.com"; sid:563250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.cloud"; sid:563251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicobservatory.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicobservatory.cloud"; sid:563252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicoflove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicoflove.com"; sid:563253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicppe.com"; sid:563254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for golfcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"golfcovid.com"; sid:563255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcovid19receipts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcovid19receipts.com"; sid:563256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gooddaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gooddaycorona.com"; sid:563257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graphcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graphcovid.com"; sid:563258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greececovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greececovid-19.com"; sid:563259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiacovid.com"; sid:563260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcq4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcq4covid.com"; sid:563261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthandhealinginthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthandhealinginthetimeofcovid19.com"; sid:563262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthandhealinginthetimeofcovidthebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthandhealinginthetimeofcovidthebook.com"; sid:563263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthandhealinginthetimeofcovidthebook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthandhealinginthetimeofcovidthebook.net"; sid:563264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinthetimeofcovid.com"; sid:563265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthinthetimeofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthinthetimeofcovid.net"; sid:563266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helfendehaendegegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helfendehaendegegencorona.com"; sid:563267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoviddoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoviddoctors.com"; sid:563268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidpatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidpatient.com"; sid:563269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpdefeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpdefeatcovid-19.com"; sid:563270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highspeedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highspeedcovid19test.com"; sid:563271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hispabot-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hispabot-covid19.net"; sid:563272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hispabotcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hispabotcovid19.net"; sid:563273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid.care"; sid:563274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidcare.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidcare.healthcare"; sid:563275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopebeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopebeyondcovid19.com"; sid:563276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horridcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horridcovid.com"; sid:563277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houseofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houseofcoronavirus.com"; sid:563278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcoronaisahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcoronaisahoax.com"; sid:563279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howigotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howigotcovid19.com"; sid:563280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocovid.com"; sid:563281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howwillcoronaviruschange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howwillcoronaviruschange.com"; sid:563282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcorona.com"; sid:563283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcoronatest.com"; sid:563284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcovid19.com"; sid:563285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcovid19test.com"; sid:563286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcovid.com"; sid:563287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrcovidtest.com"; sid:563288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntingtoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntingtoncoronavirus.com"; sid:563289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iampositive-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iampositive-covid19.com"; sid:563290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcovid19fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcovid19fraud.com"; sid:563291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus.com"; sid:563292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-info.com"; sid:563293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirusinfo.com"; sid:563294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-info.com"; sid:563295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirusinfo.com"; sid:563296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-info.net"; sid:563297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirusinfo.net"; sid:563298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-info.net"; sid:563299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirusinfo.net"; sid:563300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-information.com"; sid:563301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirusinformation.com"; sid:563302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-information.com"; sid:563303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirusinformation.com"; sid:563304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-information.net"; sid:563305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirusinformation.net"; sid:563306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-information.net"; sid:563307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirusinformation.net"; sid:563308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus.net"; sid:563309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-support.com"; sid:563310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirussupport.com"; sid:563311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-support.com"; sid:563312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirussupport.com"; sid:563313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirus-support.net"; sid:563314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-coronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-coronavirussupport.net"; sid:563315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirus-support.net"; sid:563316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcoronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcoronavirussupport.net"; sid:563317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19.com"; sid:563318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19.com"; sid:563319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19-information.com"; sid:563320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19information.com"; sid:563321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19-information.com"; sid:563322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19information.com"; sid:563323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19-information.net"; sid:563324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19information.net"; sid:563325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19-information.net"; sid:563326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19information.net"; sid:563327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19.net"; sid:563328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19.net"; sid:563329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19-support.com"; sid:563330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19support.com"; sid:563331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19-support.com"; sid:563332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19support.com"; sid:563333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19-support.net"; sid:563334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-19support.net"; sid:563335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19-support.net"; sid:563336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid19support.net"; sid:563337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid.com"; sid:563338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-information.com"; sid:563339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovidinformation.com"; sid:563340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-information.net"; sid:563341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovidinformation.net"; sid:563342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid.net"; sid:563343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-support.com"; sid:563344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovidsupport.com"; sid:563345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovid-support.net"; sid:563346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igcovidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igcovidsupport.net"; sid:563347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-info-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-info-coronavirus.com"; sid:563348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-infocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-infocoronavirus.com"; sid:563349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginfo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginfo-coronavirus.com"; sid:563350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginfocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginfocoronavirus.com"; sid:563351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-info-coronavirus.net"; sid:563352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-infocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-infocoronavirus.net"; sid:563353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginfo-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginfo-coronavirus.net"; sid:563354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginfocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginfocoronavirus.net"; sid:563355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-coronavirus.com"; sid:563356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcoronavirus.com"; sid:563357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-coronavirus.com"; sid:563358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcoronavirus.com"; sid:563359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-coronavirus.net"; sid:563360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcoronavirus.net"; sid:563361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-coronavirus.net"; sid:563362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcoronavirus.net"; sid:563363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid-19.com"; sid:563364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid19.com"; sid:563365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid-19.com"; sid:563366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid19.com"; sid:563367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid-19.com"; sid:563368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid19.com"; sid:563369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid-19.com"; sid:563370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid19.com"; sid:563371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid-19.net"; sid:563372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid19.net"; sid:563373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid-19.net"; sid:563374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid19.net"; sid:563375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid-19.net"; sid:563376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid19.net"; sid:563377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid-19.net"; sid:563378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid19.net"; sid:563379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid.com"; sid:563380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid.com"; sid:563381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid.com"; sid:563382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid.com"; sid:563383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-information-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-information-covid.net"; sid:563384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-informationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-informationcovid.net"; sid:563385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformation-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformation-covid.net"; sid:563386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iginformationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iginformationcovid.net"; sid:563387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-coronavirus.com"; sid:563388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-supportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-supportcoronavirus.com"; sid:563389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-coronavirus.com"; sid:563390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcoronavirus.com"; sid:563391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-coronavirus.net"; sid:563392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-supportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-supportcoronavirus.net"; sid:563393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-coronavirus.net"; sid:563394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcoronavirus.net"; sid:563395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid-19.com"; sid:563396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid19.com"; sid:563397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid-19.com"; sid:563398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid19.com"; sid:563399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid-19.com"; sid:563400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid19.com"; sid:563401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid-19.net"; sid:563402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid19.net"; sid:563403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid-19.net"; sid:563404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid19.net"; sid:563405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid-19.net"; sid:563406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid19.net"; sid:563407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid.com"; sid:563408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-supportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-supportcovid.com"; sid:563409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid.com"; sid:563410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid.com"; sid:563411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-support-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-support-covid.net"; sid:563412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ig-supportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ig-supportcovid.net"; sid:563413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupport-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupport-covid.net"; sid:563414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igsupportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igsupportcovid.net"; sid:563415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indennizzicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indennizzicoronavirus.com"; sid:563416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid19.life"; sid:563417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inentingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inentingcorona.com"; sid:563418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infermieripercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infermieripercovid.com"; sid:563419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus.com"; sid:563420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-info.com"; sid:563421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirusinfo.com"; sid:563422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-info.com"; sid:563423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirusinfo.com"; sid:563424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-info.net"; sid:563425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirusinfo.net"; sid:563426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-info.net"; sid:563427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirusinfo.net"; sid:563428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-information.com"; sid:563429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirusinformation.com"; sid:563430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-information.com"; sid:563431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirusinformation.com"; sid:563432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-information.net"; sid:563433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirusinformation.net"; sid:563434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-information.net"; sid:563435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirusinformation.net"; sid:563436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus.net"; sid:563437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-support.com"; sid:563438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirussupport.com"; sid:563439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-support.com"; sid:563440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirussupport.com"; sid:563441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirus-support.net"; sid:563442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-coronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-coronavirussupport.net"; sid:563443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirus-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirus-support.net"; sid:563444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcoronavirussupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcoronavirussupport.net"; sid:563445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19.com"; sid:563446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19.com"; sid:563447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19-information.com"; sid:563448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19information.com"; sid:563449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19-information.com"; sid:563450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19information.com"; sid:563451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19-information.net"; sid:563452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19information.net"; sid:563453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19-information.net"; sid:563454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19information.net"; sid:563455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19.net"; sid:563456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19.net"; sid:563457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19-support.com"; sid:563458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19support.com"; sid:563459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19-support.com"; sid:563460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19support.com"; sid:563461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19-support.net"; sid:563462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-19support.net"; sid:563463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19-support.net"; sid:563464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid19support.net"; sid:563465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid.com"; sid:563466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-information.com"; sid:563467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovidinformation.com"; sid:563468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-information.net"; sid:563469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovidinformation.net"; sid:563470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid.net"; sid:563471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-support.com"; sid:563472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovidsupport.com"; sid:563473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovid-support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovid-support.net"; sid:563474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramcovidsupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramcovidsupport.net"; sid:563475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-info-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-info-coronavirus.com"; sid:563476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-infocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-infocoronavirus.com"; sid:563477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminfo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminfo-coronavirus.com"; sid:563478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminfocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminfocoronavirus.com"; sid:563479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-info-coronavirus.net"; sid:563480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-infocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-infocoronavirus.net"; sid:563481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminfo-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminfo-coronavirus.net"; sid:563482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminfocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminfocoronavirus.net"; sid:563483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-coronavirus.com"; sid:563484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcoronavirus.com"; sid:563485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-coronavirus.com"; sid:563486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcoronavirus.com"; sid:563487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-coronavirus.net"; sid:563488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcoronavirus.net"; sid:563489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-coronavirus.net"; sid:563490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcoronavirus.net"; sid:563491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid-19.com"; sid:563492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid19.com"; sid:563493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid-19.com"; sid:563494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid19.com"; sid:563495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid-19.com"; sid:563496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid19.com"; sid:563497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid-19.com"; sid:563498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid19.com"; sid:563499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid-19.net"; sid:563500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid19.net"; sid:563501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid-19.net"; sid:563502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid19.net"; sid:563503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid-19.net"; sid:563504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid19.net"; sid:563505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid-19.net"; sid:563506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid19.net"; sid:563507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid.com"; sid:563508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid.com"; sid:563509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid.com"; sid:563510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid.com"; sid:563511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-information-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-information-covid.net"; sid:563512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-informationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-informationcovid.net"; sid:563513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformation-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformation-covid.net"; sid:563514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagraminformationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagraminformationcovid.net"; sid:563515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-coronavirus.com"; sid:563516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-supportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-supportcoronavirus.com"; sid:563517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-coronavirus.com"; sid:563518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcoronavirus.com"; sid:563519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-coronavirus.net"; sid:563520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-supportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-supportcoronavirus.net"; sid:563521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-coronavirus.net"; sid:563522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcoronavirus.net"; sid:563523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid-19.com"; sid:563524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid19.com"; sid:563525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid-19.com"; sid:563526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid19.com"; sid:563527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid-19.com"; sid:563528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid19.com"; sid:563529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid-19.net"; sid:563530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid19.net"; sid:563531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid-19.net"; sid:563532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid19.net"; sid:563533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid-19.net"; sid:563534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid19.net"; sid:563535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid.com"; sid:563536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-supportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-supportcovid.com"; sid:563537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid.com"; sid:563538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid.com"; sid:563539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-support-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-support-covid.net"; sid:563540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagram-supportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagram-supportcovid.net"; sid:563541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupport-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupport-covid.net"; sid:563542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instagramsupportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instagramsupportcovid.net"; sid:563543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronavirustester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronavirustester.com"; sid:563544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19tester.com"; sid:563545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtester.com"; sid:563546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insuredforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insuredforcovid.com"; sid:563547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for interferoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"interferoncovid19.com"; sid:563548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcovid.com"; sid:563549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irsassistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irsassistancecovid19.com"; sid:563550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irsassistancecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irsassistancecovid19.net"; sid:563551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.biz"; sid:563552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived-covid19.com"; sid:563553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19live.com"; sid:563554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19pandemic.com"; sid:563555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaboncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaboncovid19.com"; sid:563556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaboncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaboncovid.com"; sid:563557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksontncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksontncovid19.com"; sid:563558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for job-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"job-covid19.com"; sid:563559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovid.com"; sid:563560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justicecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justicecovid19.com"; sid:563561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kauaicoronamusicvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kauaicoronamusicvideos.com"; sid:563562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid19ass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid19ass.com"; sid:563563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovidsass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovidsass.com"; sid:563564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcovid.com"; sid:563565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsupervivenciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsupervivenciacovid19.com"; sid:563566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kocovid19.com"; sid:563567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawfirmpandemicgrowthresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawfirmpandemicgrowthresources.com"; sid:563568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyers-4-covid-reliefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyers-4-covid-reliefunds.com"; sid:563569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstopcovid.com"; sid:563570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercorona19.com"; sid:563571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid.net"; sid:563572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinlockdowncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinlockdowncovid-19.com"; sid:563573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingaftercoronavirus.com"; sid:563574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingaftercovid19.com"; sid:563575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveamidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveamidcovid.com"; sid:563576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimesofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimesofpandemic.com"; sid:563577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luchacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luchacovid19.com"; sid:563578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lwcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lwcovid-19.com"; sid:563579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maakdzair-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maakdzair-covid19.com"; sid:563580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maakdzair-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maakdzair-covid19.net"; sid:563581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovid-19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovid-19relieffund.com"; sid:563582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovid19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovid19relieffund.com"; sid:563583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for magazinecontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"magazinecontracovid19.com"; sid:563584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malawicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malawicovid19.com"; sid:563585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malaysiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malaysiacovid-19.com"; sid:563586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid.net"; sid:563587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcovid.com"; sid:563588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcorona2020.com"; sid:563589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcicovidatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcicovidatl.com"; sid:563590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialecoronavirus.com"; sid:563591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menacovidrelief.com"; sid:563592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menacovidrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menacovidrelieffund.com"; sid:563593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalcovid19.com"; sid:563594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidlaw.com"; sid:563595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovid19news.com"; sid:563596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for millioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"millioncovid19.com"; sid:563597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19.com"; sid:563598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19docs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19docs.com"; sid:563599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid.com"; sid:563600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoviddocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoviddocs.com"; sid:563601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monteriacordobacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monteriacordobacorona.com"; sid:563602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mother-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mother-covid.com"; sid:563603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for motorcitycovidkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"motorcitycovidkillers.com"; sid:563604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundocoronas.com"; sid:563605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadrone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadrone.com"; sid:563606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaevents.com"; sid:563607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafashions.com"; sid:563608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.guru"; sid:563609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaimpact.com"; sid:563610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusclassactionlawsuit.com"; sid:563611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covid19.com"; sid:563612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19kits.com"; sid:563613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcpa.com"; sid:563614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhomekit.com"; sid:563615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidindia.com"; sid:563616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidinformationnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidinformationnow.com"; sid:563617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidloss.com"; sid:563618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidplan.com"; sid:563619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtestkit.com"; sid:563620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeaftercovid.com"; sid:563621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicstory.com"; sid:563622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nach-corona.com"; sid:563623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19test.com"; sid:563624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19test.net"; sid:563625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid.com"; sid:563626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflix-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflix-covid-19.com"; sid:563627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidlife.com"; sid:563628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidapp.com"; sid:563629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecovid19.world"; sid:563630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncovid19.com"; sid:563631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notacovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notacovidrisk.com"; sid:563632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notacovidrisk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notacovidrisk.net"; sid:563633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obxcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obxcovid19test.com"; sid:563634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obxcovid19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obxcovid19test.net"; sid:563635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obxcovidtest.com"; sid:563636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid19.com"; sid:563637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offcorona.com"; sid:563638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orbiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orbiscovid19.com"; sid:563639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacovid19.net"; sid:563640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaccountability.com"; sid:563641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactionnetwork.com"; sid:563642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactionnetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactionnetwork.net"; sid:563643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapproved.com"; sid:563644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicartgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicartgallery.com"; sid:563645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicasaservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicasaservice.com"; sid:563646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbaking.com"; sid:563647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuddy.com"; sid:563648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccam.com"; sid:563649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccasetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccasetracker.com"; sid:563650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccasetracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccasetracker.net"; sid:563651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclothingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclothingcompany.com"; sid:563652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccomedy.com"; sid:563653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccommunicationsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccommunicationsolutions.com"; sid:563654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconvenience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconvenience.com"; sid:563655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicearlywarning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicearlywarning.com"; sid:563656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconometrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconometrics.com"; sid:563657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomies.com"; sid:563658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicepic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicepic.com"; sid:563659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfallout.com"; sid:563660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgeneration.com"; sid:563661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-industrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-industrial.com"; sid:563662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicindustrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicindustrial.com"; sid:563663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-kit-supply.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-kit-supply.biz"; sid:563664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawnyc.com"; sid:563665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifecoach.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifecoach.net"; sid:563666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-lifeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-lifeline.com"; sid:563667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifeline.com"; sid:563668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-lifeline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-lifeline.net"; sid:563669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclifeline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclifeline.net"; sid:563670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedicals.com"; sid:563671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmu.com"; sid:563672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoflovesacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoflovesacramento.com"; sid:563673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoronavirus19.com"; sid:563674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoronavirus.com"; sid:563675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpack.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpack.biz"; sid:563676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpants.com"; sid:563677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparentingcoach.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparentingcoach.tips"; sid:563678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpax.com"; sid:563679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperformances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperformances.com"; sid:563680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolitics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolitics.net"; sid:563681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpredators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpredators.com"; sid:563682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofabusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofabusiness.com"; sid:563683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofevent.com"; sid:563684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofmybusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofmybusiness.com"; sid:563685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofmyevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofmyevent.com"; sid:563686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofmyevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofmyevents.com"; sid:563687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofourbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofourbusiness.com"; sid:563688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofurbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofurbusiness.com"; sid:563689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofyourbusiness.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofyourbusiness.business"; sid:563690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofyourbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofyourbusinesses.com"; sid:563691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofyourevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofyourevent.com"; sid:563692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefcenter.com"; sid:563693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsanitation.com"; sid:563694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsanitationcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsanitationcompany.com"; sid:563695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-theater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-theater.com"; sid:563696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthefilm.com"; sid:563697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscovid19.com"; sid:563698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusgear.com"; sid:563699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallacoronavirus.com"; sid:563700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for payforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"payforcorona.com"; sid:563701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paymycoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paymycoronaclaim.com"; sid:563702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paymycoronaloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paymycoronaloss.com"; sid:563703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paymycovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paymycovid19claim.com"; sid:563704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paymycovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paymycovidclaim.com"; sid:563705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovidhelp.com"; sid:563706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pencepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pencepandemic.com"; sid:563707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perjudicadoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perjudicadoscovid19.com"; sid:563708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perjudicadoscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perjudicadoscovid19.net"; sid:563709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetcoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetcoronablog.com"; sid:563710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformacovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformacovida.com"; sid:563711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivecovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivecovidupdates.com"; sid:563712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronacare.com"; sid:563713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadiet.com"; sid:563714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafest.com"; sid:563715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronahealth.com"; sid:563716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronajobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronajobs.com"; sid:563717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronarecovery.com"; sid:563718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postepidemicera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postepidemicera.com"; sid:563719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbaseball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbaseball.com"; sid:563720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicparties.com"; sid:563721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicproductions.com"; sid:563722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayagainstcovid.com"; sid:563723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precisionforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precisionforcovid.com"; sid:563724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepare4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepare4covid19.com"; sid:563725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestamocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestamocovid19.com"; sid:563726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestamoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestamoscovid19.com"; sid:563727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid.com"; sid:563728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecciondelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecciondelcoronavirus.com"; sid:563729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-covid-19.com"; sid:563730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmyselffromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmyselffromcovid19.com"; sid:563731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegersedelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegersedelcoronavirus.com"; sid:563732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prtc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prtc-covid19.com"; sid:563733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for putnamcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"putnamcovidresponse.com"; sid:563734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qatarcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qatarcovid-19.com"; sid:563735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronatesting.com"; sid:563736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for racetobeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"racetobeatcovid19.com"; sid:563737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapid-test-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapid-test-corona.com"; sid:563738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest-corona.com"; sid:563739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rastreocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rastreocovid.com"; sid:563740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rc-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rc-corona.com"; sid:563741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdcoronavirus.com"; sid:563742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtorideascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtorideascovid19.com"; sid:563743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realwuhanclan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realwuhanclan.com"; sid:563744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamaporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamaporcoronavirus.com"; sid:563745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamaporcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamaporcovid.com"; sid:563746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respuestacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respuestacovid19.com"; sid:563747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retrocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retrocovid19.com"; sid:563748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rgvcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rgvcovid19info.com"; sid:563749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riskscovid.com"; sid:563750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rks-covid19.com"; sid:563751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romanceintheeraofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romanceintheeraofcovid.com"; sid:563752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for russiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"russiacovid-19.com"; sid:563753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ryl2covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ryl2covid19.net"; sid:563754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeair-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeair-covid19.com"; sid:563755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samsclubcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samsclubcoronavirus.com"; sid:563756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samsclubcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samsclubcovid19.com"; sid:563757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitize-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitize-covid19.com"; sid:563758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaassistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaassistancecovid19.com"; sid:563759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbaassistancecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbaassistancecovid19.net"; sid:563760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19funding.com"; sid:563761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19relief.com"; sid:563762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbahelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbahelpcovid19.com"; sid:563763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbahelpcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbahelpcovid19.net"; sid:563764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltest-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltest-corona.net"; sid:563765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schutzmaskencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schutzmaskencorona.com"; sid:563766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screen-corona.com"; sid:563767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguridadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguridadcoronavirus.com"; sid:563768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segurocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segurocovid19.com"; sid:563769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestkitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestkitscovid19.com"; sid:563770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingrealestateduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingrealestateduringpandemic.com"; sid:563771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shootcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shootcovid.com"; sid:563772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shortsalecovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shortsalecovid19.today"; sid:563773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shortsalescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shortsalescovid19.com"; sid:563774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shortsalescovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shortsalescovid19.today"; sid:563775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shushcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shushcovid19.com"; sid:563776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signupforthecovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signupforthecovid19update.com"; sid:563777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singaporecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singaporecovid-19.com"; sid:563778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sitsi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sitsi-covid19.com"; sid:563779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slcoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slcoronatimes.com"; sid:563780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessloancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessloancoronavirus.com"; sid:563781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sm-covid19.com"; sid:563782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smcovid19.com"; sid:563783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smellcovid.com"; sid:563784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sniffoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sniffoutcovid.com"; sid:563785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soccorsocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soccorsocovid.com"; sid:563786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for societyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"societyaftercorona.com"; sid:563787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sognipandemici.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sognipandemici.com"; sid:563788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sourcewellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sourcewellcovid19.com"; sid:563789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southfloridacoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southfloridacoronalaw.com"; sid:563790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southfloridacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southfloridacovidlaw.com"; sid:563791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedycovid19test.com"; sid:563792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spermidinelife-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spermidinelife-corona.com"; sid:563793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spuckschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spuckschutz-corona.com"; sid:563794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standupagainstcovid19.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standupagainstcovid19.team"; sid:563795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupvscovid.com"; sid:563796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecovidtesting.com"; sid:563797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayaheadofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayaheadofcovid19.com"; sid:563798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawaycovid19.com"; sid:563799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirususa.com"; sid:563800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19worldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19worldwide.com"; sid:563801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidapp.com"; sid:563802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcovid-19.com"; sid:563803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthiscovid.com"; sid:563804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suckitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suckitcovid.com"; sid:563805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suecovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suecovidnow.com"; sid:563806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportlocalduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportlocalduringcovid.com"; sid:563807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tangkalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tangkalcorona.com"; sid:563808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taoscovid19mutualaidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taoscovid19mutualaidhub.com"; sid:563809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachcovid.com"; sid:563810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachcovid.net"; sid:563811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-for-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-for-corona.com"; sid:563812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaifightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaifightcovid19.com"; sid:563813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankgodforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankgodforcoronavirus.com"; sid:563814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankucorona.com"; sid:563815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucovid.com"; sid:563816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theboringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theboringcorona.com"; sid:563817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecityaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecityaftercoronavirus.com"; sid:563818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecityaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecityaftercovid19.com"; sid:563819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaafterparty.com"; sid:563820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachannel.com"; sid:563821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadoctors.com"; sid:563822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafoundation.com"; sid:563823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapandemicmovie.com"; sid:563824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronascandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronascandal.com"; sid:563825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.international"; sid:563826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.media"; sid:563827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19now.com"; sid:563828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidate.com"; sid:563829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovideos.com"; sid:563830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidguard.com"; sid:563831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiary.com"; sid:563832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmail.com"; sid:563833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidopportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidopportunities.com"; sid:563834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidprotection.com"; sid:563835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidremoval.com"; sid:563836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicgeneration.com"; sid:563837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepeoplevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepeoplevscovid19.com"; sid:563838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostepidemicera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostepidemicera.com"; sid:563839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewalkingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewalkingcoronavirus.com"; sid:563840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewalkingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewalkingcovid-19.com"; sid:563841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewaroncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewaroncovid.com"; sid:563842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tidforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tidforcovid.com"; sid:563843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tittiesforcovidies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tittiesforcovidies.com"; sid:563844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tmwccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tmwccovid19.com"; sid:563845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncovid.com"; sid:563846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todayscoronadate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todayscoronadate.com"; sid:563847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19.services"; sid:563848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid.net"; sid:563849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingpandemics.com"; sid:563850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingpandemics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingpandemics.net"; sid:563851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trailcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trailcovid.com"; sid:563852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trinitycybercovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trinitycybercovidresponse.com"; sid:563853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcoronachain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcoronachain.com"; sid:563854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovid19chain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovid19chain.com"; sid:563855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t-shirts4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t-shirts4coronavirus.com"; sid:563856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuabogadocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuabogadocovid19.com"; sid:563857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tucorona.com"; sid:563858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tutecoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tutecoronas.com"; sid:563859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twittercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twittercoronavirus.com"; sid:563860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twocovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twocovids.com"; sid:563861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uaecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uaecovid-19.com"; sid:563862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ujicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ujicorona.com"; sid:563863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultravioletcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultravioletcovidrelief.com"; sid:563864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidnineteen.com"; sid:563865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidnineteen.com"; sid:563866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-covid-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-covid-tracker.com"; sid:563867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemicmovie.com"; sid:563868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcoronavirus.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcoronavirus.cleaning"; sid:563869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid19help.com"; sid:563870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid19relief.com"; sid:563871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid.com"; sid:563872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovidhelp.com"; sid:563873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovidhelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovidhelpers.com"; sid:563874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid19coronavirus.com"; sid:563875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vamosacabcomocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vamosacabcomocorona.com"; sid:563876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-check-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-check-covid.com"; sid:563877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcheckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcheckcovid.com"; sid:563878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-check-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-check-covid.net"; sid:563879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcheckcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcheckcovid.net"; sid:563880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verified-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verified-covid.com"; sid:563881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verity-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verity-covid.com"; sid:563882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verity-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verity-covid.net"; sid:563883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona-19.com"; sid:563884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicemailcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicemailcovid-19.com"; sid:563885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vtrtvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vtrtvcovid19.com"; sid:563886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wafromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wafromcovid19.com"; sid:563887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walkawayfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walkawayfromcovid19.com"; sid:563888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wal-martcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wal-martcoronavirus.com"; sid:563889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wal-martcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wal-martcovid19.com"; sid:563890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washyourwuhands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washyourwuhands.com"; sid:563891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washyourwuhans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washyourwuhans.com"; sid:563892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whathappenedaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whathappenedaftercovid19.com"; sid:563893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whathappenedaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whathappenedaftercovid19.net"; sid:563894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whospreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whospreadcovid19.com"; sid:563895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willisurvivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willisurvivecovid.com"; sid:563896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcarecovidprescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcarecovidprescreen.com"; sid:563897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicday.com"; sid:563898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanh.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanh.club"; sid:563899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhs.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhs.club"; sid:563900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanming998.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanming998.com"; sid:563901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruslawsuits.com"; sid:563902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzmd.com"; sid:563903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wx-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wx-corona.com"; sid:563904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wxcorona.com"; sid:563905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-sterreich-swb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-sterreich-swb.com"; sid:563906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavrus-7sb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavrus-7sb.com"; sid:563907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19yardm-c5b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19yardm-c5b.com"; sid:563908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yocorona.com"; sid:563909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yopalcasanarecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yopalcasanarecorona.com"; sid:563910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronaclaim.com"; sid:563911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19claim.com"; sid:563912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourworldaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourworldaftercovid-19.com"; sid:563913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yousurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yousurvivedcorona.com"; sid:563914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocoronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocoronasanitizer.com"; sid:563915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zicorona.com"; sid:563916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidhelpcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidhelpcenter.com"; sid:563917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidlawsuits.com"; sid:563918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidmasks.com"; sid:563919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirusstimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirusstimuluscheck.com"; sid:563920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24forcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24forcovid.com"; sid:563921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2bcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2bcovidfree.com"; sid:563922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2covid-19.com"; sid:563923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dcovid19.net"; sid:563924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411-covid19.com"; sid:563925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4cornercovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4cornercovidhelp.com"; sid:563926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5covid19.com"; sid:563927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5wipeoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5wipeoutcovid19.com"; sid:563928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-covid19.com"; sid:563929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acesespinhogaiacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acesespinhogaiacovid19.net"; sid:563930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronacure.com"; sid:563931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidcure.com"; sid:563932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidstory.com"; sid:563933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actions-fondations-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actions-fondations-covid19.com"; sid:563934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adlabscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adlabscovidtest.com"; sid:563935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adlcovid.com"; sid:563936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adlcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adlcovidtest.com"; sid:563937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacorona.com"; sid:563938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovidscreen.com"; sid:563939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.business"; sid:563940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.world"; sid:563941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19banking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19banking.com"; sid:563942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19businesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19businesshelp.com"; sid:563943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19businesssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19businesssupport.com"; sid:563944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19healthcare.com"; sid:563945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19healthclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19healthclaims.com"; sid:563946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19health.com"; sid:563947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19help.com"; sid:563948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19support.com"; sid:563949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19.world"; sid:563950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.world"; sid:563951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahefcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahefcovid19test.com"; sid:563952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allagainstcoronavirus.com"; sid:563953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ansiadacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ansiadacoronavirus.com"; sid:563954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibacterialescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibacterialescoronavirus.com"; sid:563955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19-tunnel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19-tunnel.com"; sid:563956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidwarfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidwarfare.com"; sid:563957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicoflies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicoflies.com"; sid:563958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apeopleshistoryofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apeopleshistoryofcorona.com"; sid:563959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apeopleshistoryofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apeopleshistoryofcovid.com"; sid:563960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-covid.com"; sid:563961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidhelp.com"; sid:563962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkcovid.com"; sid:563963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asg-covid19-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asg-covid19-cleaning.com"; sid:563964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askoptumcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askoptumcovid19.com"; sid:563965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtesting.com"; sid:563966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for augustacoronasonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"augustacoronasonline.com"; sid:563967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotest-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotest-coronavirus.com"; sid:563968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotest-covid.com"; sid:563969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotestcovid.com"; sid:563970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotests-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotests-covid19.com"; sid:563971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahascovid19.com"; sid:563972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbtbankcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbtbankcovidinfo.com"; sid:563973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbttreasurycovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbttreasurycovidinfo.com"; sid:563974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beautypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beautypandemic.com"; sid:563975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidcompliant.com"; sid:563976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforeaftercorona.com"; sid:563977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhandcovid.com"; sid:563978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biharcoronasahayata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biharcoronasahayata.com"; sid:563979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackstockcoronasonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackstockcoronasonline.com"; sid:563980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootycorona.com"; sid:563981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncoronavirussanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncoronavirussanitizing.com"; sid:563982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business2pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business2pandemic.com"; sid:563983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessloancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessloancoronavirus.com"; sid:563984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronamedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronamedicine.com"; sid:563985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidchildcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidchildcare.com"; sid:563986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirustest.com"; sid:563987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidchildcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidchildcare.com"; sid:563988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for care-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"care-covid19.com"; sid:563989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecreditcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecreditcoronavirus.com"; sid:563990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecreditcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecreditcovid-19.com"; sid:563991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecreditcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecreditcovid19.com"; sid:563992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpecorona.com"; sid:563993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpecorona.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpecorona.international"; sid:563994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpecorona.net"; sid:563995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpecorona.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpecorona.watch"; sid:563996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casualtiesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casualtiesofcovid19.com"; sid:563997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchfeelingsnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchfeelingsnotcovid.com"; sid:563998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebratecovid-19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebratecovid-19survival.com"; sid:563999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebratecovid19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebratecovid19survival.com"; sid:564000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebswithcovid.com"; sid:564001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid.com"; sid:564002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcarecovidca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcarecovidca.com"; sid:564003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacausedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacausedcovid.com"; sid:564004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chineseamericansfightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chineseamericansfightcovid19.com"; sid:564005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovidnineteen.com"; sid:564006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean2combatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean2combatcorona.com"; sid:564007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaning2killcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaning2killcorona.com"; sid:564008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningkillscorona.com"; sid:564009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleartogocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleartogocovid-19.com"; sid:564010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleartogocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleartogocovid19.net"; sid:564011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleartoworkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleartoworkcovid-19.com"; sid:564012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleartoworkcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleartoworkcovid-19.net"; sid:564013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedbycovid.com"; sid:564014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmoncorona.com"; sid:564015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cohassetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cohassetcovid19.com"; sid:564016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colonycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colonycovid.com"; sid:564017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comacorona.com"; sid:564018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communicatingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communicatingduringcovid19.com"; sid:564019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontcorona.com"; sid:564020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontingcorona.com"; sid:564021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conspiracyofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conspiracyofcovid19.com"; sid:564022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraelcoronaviruscondios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraelcoronaviruscondios.com"; sid:564023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingwhilecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingwhilecovid.com"; sid:564024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolcovidmask.com"; sid:564025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolcovidmasks.com"; sid:564026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coordination-spectacle-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coordination-spectacle-covid19.com"; sid:564027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcoronajournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcoronajournal.com"; sid:564028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornwallcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornwallcovidresponse.com"; sid:564029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19claimants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19claimants.com"; sid:564030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19guru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19guru.com"; sid:564031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lawblog.com"; sid:564032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19loan.com"; sid:564033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19loans.com"; sid:564034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19masks.com"; sid:564035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19online.com"; sid:564036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19plaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19plaintiffs.com"; sid:564037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19victims.com"; sid:564038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19virusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19virusmasks.com"; sid:564039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abstrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abstrich.com"; sid:564040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaidservices.com"; sid:564041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaircleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaircleaner.com"; sid:564042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairpurifiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairpurifiers.com"; sid:564043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aktien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aktien.com"; sid:564044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-analytics.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-analytics.report"; sid:564045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodypositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodypositive.com"; sid:564046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaass.com"; sid:564047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-assistance.com"; sid:564048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-assist.com"; sid:564049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaastrazeneca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaastrazeneca.com"; sid:564050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatx.com"; sid:564051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaustin.com"; sid:564052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-a-z.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-a-z.com"; sid:564053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyworld.com"; sid:564054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabefarsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabefarsi.com"; sid:564055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizbill.com"; sid:564056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizguide.com"; sid:564057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabond.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabond.biz"; sid:564058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonus.net"; sid:564059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-book.com"; sid:564060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-book.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-book.net"; sid:564061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabook.net"; sid:564062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-aid.com"; sid:564063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessclaims.net"; sid:564064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslawsuit.com"; sid:564065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslawsuits.com"; sid:564066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslawsuits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslawsuits.net"; sid:564067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.services"; sid:564068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalls.com"; sid:564069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.center"; sid:564070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-camera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-camera.com"; sid:564071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarehawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarehawaii.com"; sid:564072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareloans.com"; sid:564073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresforlives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresforlives.com"; sid:564074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarezone.com"; sid:564075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarezone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarezone.net"; sid:564076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachanges.com"; sid:564077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimants.com"; sid:564078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactions.com"; sid:564079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningaustin.com"; sid:564080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningny.com"; sid:564081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningvirus.com"; sid:564082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearair.com"; sid:564083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloseouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloseouts.com"; sid:564084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollect.com"; sid:564085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollectors.com"; sid:564086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcertlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcertlive.com"; sid:564087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourting.com"; sid:564088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourtship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourtship.com"; sid:564089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverage.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverage.agency"; sid:564090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19ppe.com"; sid:564091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidppe.com"; sid:564092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafting.com"; sid:564093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisbet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisbet.com"; sid:564094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruisecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruisecase.com"; sid:564095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseclaim.com"; sid:564096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiselawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiselawsuit.com"; sid:564097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruisevictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruisevictim.com"; sid:564098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrushes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrushes.com"; sid:564099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-curve.com"; sid:564100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarbelize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarbelize.com"; sid:564101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadfw.com"; sid:564102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadialogue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadialogue.com"; sid:564103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoiscalling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoiscalling.com"; sid:564104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaduniya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaduniya.com"; sid:564105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaecommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaecommerce.com"; sid:564106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacecover.com"; sid:564107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fashiondesignschule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fashiondesignschule.com"; sid:564108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashionista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashionista.com"; sid:564109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaux.com"; sid:564110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-feed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-feed.com"; sid:564111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinger.com"; sid:564112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflood.com"; sid:564113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflood.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflood.net"; sid:564114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafuckingvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafuckingvirus.com"; sid:564115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagens.com"; sid:564116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalworld.com"; sid:564117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguideline.com"; sid:564118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-haftung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-haftung.com"; sid:564119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahantavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahantavirus.com"; sid:564120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahastanesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahastanesi.com"; sid:564121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahawaii.com"; sid:564122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthplans.com"; sid:564123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpers.world"; sid:564124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroclothing.com"; sid:564125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfspaket.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfspaket.net"; sid:564126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronailacibulundu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronailacibulundu.com"; sid:564127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info-4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info-4u.com"; sid:564128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info.pro"; sid:564129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfostats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfostats.com"; sid:564130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaistakingover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaistakingover.com"; sid:564131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajackass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajackass.com"; sid:564132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakafasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakafasi.com"; sid:564133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeys.com"; sid:564134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakickrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakickrent.com"; sid:564135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilledmybiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilledmybiz.com"; sid:564136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalamba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalamba.com"; sid:564137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuits.net"; sid:564138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaletters.com"; sid:564139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalistingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalistingservice.com"; sid:564140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloancalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloancalculator.com"; sid:564141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask.pro"; sid:564142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksnyc.com"; sid:564143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksrus.com"; sid:564144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksrus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksrus.net"; sid:564145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask.world"; sid:564146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masques.com"; sid:564147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamater.com"; sid:564148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillionaire.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillionaire.club"; sid:564149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-modefachschule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-modefachschule.com"; sid:564150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-modeschule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-modeschule.com"; sid:564151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamon.com"; sid:564152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoneyback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoneyback.com"; sid:564153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamugz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamugz.com"; sid:564154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusicgram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusicgram.com"; sid:564155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-n95mask.com"; sid:564156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanaliz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanaliz.com"; sid:564157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneg.com"; sid:564158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanetusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanetusa.com"; sid:564159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanetworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanetworking.com"; sid:564160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nurse.com"; sid:564161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalembang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalembang.com"; sid:564162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemictreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemictreatment.com"; sid:564163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemictreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemictreatments.com"; sid:564164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonalive.com"; sid:564165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pharma.com"; sid:564166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaintiffs.com"; sid:564167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoet.com"; sid:564168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolicyanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolicyanalysis.com"; sid:564169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprestamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprestamo.com"; sid:564170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproductsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproductsonline.com"; sid:564171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofbiz.com"; sid:564172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofincome.com"; sid:564173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofyourrideshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofyourrideshare.com"; sid:564174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kids.com"; sid:564175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kids.net"; sid:564176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kidsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kidsuk.com"; sid:564177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kidsuk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kidsuk.net"; sid:564178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kidsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kidsusa.com"; sid:564179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect4kidsusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect4kidsusa.net"; sid:564180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarainbows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarainbows.com"; sid:564181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefus.com"; sid:564182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestaurantclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestaurantclaim.com"; sid:564183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestaurantclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestaurantclaims.com"; sid:564184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rivm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rivm.com"; sid:564185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sampler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sampler.com"; sid:564186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schadensersatzanspruch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schadensersatzanspruch.com"; sid:564187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schadensersatz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schadensersatz.net"; sid:564188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schild.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schild.net"; sid:564189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseal.net"; sid:564190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasheba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasheba.com"; sid:564191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashields.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashields.life"; sid:564192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmells.com"; sid:564193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnafu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnafu.com"; sid:564194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnafus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnafus.com"; sid:564195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe-nuernberg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe-nuernberg.com"; sid:564196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe.tips"; sid:564197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeaks.com"; sid:564198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spendenhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spendenhilfe.com"; sid:564199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspendenhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspendenhilfe.com"; sid:564200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastaysafe.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastaysafe.today"; sid:564201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stress.com"; sid:564202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stress.net"; sid:564203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurgicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurgicalmasks.com"; sid:564204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalbook.com"; sid:564205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivors.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivors.club"; sid:564206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatamil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatamil.com"; sid:564207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatasks.com"; sid:564208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelemedicine.com"; sid:564209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test.biz"; sid:564210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestuk.com"; sid:564211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.center"; sid:564212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracers.com"; sid:564213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrialsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrialsnearme.com"; sid:564214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineguide.com"; sid:564215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavbaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavbaby.com"; sid:564216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideoss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideoss.com"; sid:564217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaville.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaville.life"; sid:564218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19bankruptcy.com"; sid:564219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19survivors.com"; sid:564220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1hrwarmcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1hrwarmcure.com"; sid:564221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus24.com"; sid:564222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-24.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-24.life"; sid:564223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccessories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccessories.com"; sid:564224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccident.com"; sid:564225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccreditationscheme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccreditationscheme.com"; sid:564226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusair.com"; sid:564227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-altona-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-altona-dx.com"; sid:564228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandlaw.com"; sid:564229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandwork.com"; sid:564230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodypositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodypositive.com"; sid:564231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusastrazeneca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusastrazeneca.com"; sid:564232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusavoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusavoid.com"; sid:564233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbailoutfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbailoutfund.com"; sid:564234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbibliography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbibliography.com"; sid:564235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bracelets.com"; sid:564236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloanhelp.com"; sid:564237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusc19testcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusc19testcenter.com"; sid:564238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalculus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalculus.com"; sid:564239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscard.com"; sid:564240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifications.com"; sid:564241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschecked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschecked.com"; sid:564242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionsettlement.com"; sid:564243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningaustin.com"; sid:564244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdenver.com"; sid:564245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninginbrevard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninginbrevard.com"; sid:564246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cosa-posso-fare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cosa-posso-fare.com"; sid:564247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscraft.com"; sid:564248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseclaims.com"; sid:564249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathclaim.com"; sid:564250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathlawsuit.com"; sid:564251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathlawsuits.com"; sid:564252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathregistry.com"; sid:564253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathsusa.com"; sid:564254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebt.net"; sid:564255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-desinfectante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-desinfectante.com"; sid:564256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectiondenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectiondenver.com"; sid:564257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomains.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomains.net"; sid:564258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-donation.com"; sid:564259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrugtrial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrugtrial.net"; sid:564260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dx.com"; sid:564261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectionplan.com"; sid:564262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfans.com"; sid:564263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfind.com"; sid:564264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloormarking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloormarking.com"; sid:564265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloorsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloorsigns.com"; sid:564266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloortape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloortape.com"; sid:564267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfogcan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfogcan.com"; sid:564268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoger.com"; sid:564269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoger.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoger.net"; sid:564270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggercan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggercan.com"; sid:564271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggercans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggercans.com"; sid:564272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggers.com"; sid:564273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggers.net"; sid:564274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfogspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfogspray.com"; sid:564275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreebd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreebd.com"; sid:564276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushere.com"; sid:564277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomecleaning.com"; sid:564278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalitycoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalitycoverage.com"; sid:564279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusids.com"; sid:564280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpairment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpairment.com"; sid:564281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusineuropa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusineuropa.com"; sid:564282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryatwork.com"; sid:564283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisrael2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisrael2020.com"; sid:564284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjewels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjewels.com"; sid:564285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerky.com"; sid:564286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyernj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyernj.com"; sid:564287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslength.com"; sid:564288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslistingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslistingservice.com"; sid:564289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-liveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-liveupdate.com"; sid:564290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedkits.com"; sid:564291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmess.com"; sid:564292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmisterspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmisterspray.com"; sid:564293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmistspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmistspray.com"; sid:564294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgageassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgageassist.com"; sid:564295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsindia.com"; sid:564296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.support"; sid:564297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.tips"; sid:564298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnonprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnonprofit.com"; sid:564299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnopetleftalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnopetleftalone.com"; sid:564300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnopetleftbehind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnopetleftbehind.com"; sid:564301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinecoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinecoaching.com"; sid:564302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetraining.com"; sid:564303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartition.com"; sid:564304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartiton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartiton.com"; sid:564305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspassed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspassed.com"; sid:564306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspi.com"; sid:564307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoems.com"; sid:564308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreparednessandresponsesupplementalappropriationsact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreparednessandresponsesupplementalappropriationsact.com"; sid:564309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprint.com"; sid:564310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionbox.com"; sid:564311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-que-puedo-hacer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-que-puedo-hacer.com"; sid:564312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverycommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverycommission.com"; sid:564313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-remedy.com"; sid:564314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresiliency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresiliency.com"; sid:564315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcelibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcelibrary.com"; sid:564316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestaurantjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestaurantjobs.com"; sid:564317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrevolution.com"; sid:564318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessfunding.com"; sid:564319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussnafu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussnafu.com"; sid:564320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussnafus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussnafus.com"; sid:564321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sprayer.com"; sid:564322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussprayer.com"; sid:564323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupport.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupport.legal"; sid:564324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvived.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvived.com"; sid:564325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivor-bracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivor-bracelets.com"; sid:564326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorbracelets.com"; sid:564327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomstreatmentclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomstreatmentclinic.com"; sid:564328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestimonies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestimonies.com"; sid:564329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthegame.com"; sid:564330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-time.com"; sid:564331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-today.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-today.net"; sid:564332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuministros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuministros.com"; sid:564333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatess.com"; sid:564334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-what-can-i-do.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-what-can-i-do.com"; sid:564335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhatcanido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhatcanido.com"; sid:564336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruswipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruswipes.com"; sid:564337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldsurvivor.com"; sid:564338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldsurvivors.com"; sid:564339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawineus.com"; sid:564340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counselingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counselingcovid19.com"; sid:564341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov19pandemic.com"; sid:564342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cover-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cover-covid.com"; sid:564343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15fatburn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15fatburn.com"; sid:564344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid195g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid195g.com"; sid:564345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accessory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accessory.com"; sid:564346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accident.com"; sid:564347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accident.com"; sid:564348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accidents.com"; sid:564349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accidents.com"; sid:564350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actioncrm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actioncrm.com"; sid:564351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actiongroup.com"; sid:564352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adoptahospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adoptahospital.com"; sid:564353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afghanistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afghanistan.com"; sid:564354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19analysis.com"; sid:564355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andwork.com"; sid:564356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andwork.com"; sid:564357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestkit.com"; sid:564358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anxietycounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anxietycounseling.com"; sid:564359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-arab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-arab.com"; sid:564360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arkansas.com"; sid:564361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-assist.com"; sid:564362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19astrazeneca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19astrazeneca.com"; sid:564363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneynj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneynj.com"; sid:564364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenesspin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenesspin.com"; sid:564365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenesspin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenesspin.net"; sid:564366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenesspins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenesspins.com"; sid:564367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenesspins.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenesspins.net"; sid:564368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenessribbon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenessribbon.net"; sid:564369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenessribbons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenessribbons.com"; sid:564370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenessribbons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenessribbons.net"; sid:564371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banking.com"; sid:564372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankingsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankingsupport.com"; sid:564373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bibleprofecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bibleprofecy.com"; sid:564374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biologics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biologics.com"; sid:564375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19booking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19booking.com"; sid:564376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boom.com"; sid:564377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boomer.com"; sid:564378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busters.net"; sid:564379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.net"; sid:564380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cellatlas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cellatlas.com"; sid:564381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ceo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ceo.com"; sid:564382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certifications.com"; sid:564383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chance.com"; sid:564384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checked.com"; sid:564385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cinema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cinema.com"; sid:564386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimants.com"; sid:564387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsinfo.com"; sid:564388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanup.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanup.world"; sid:564389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19colony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19colony.com"; sid:564390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compiler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compiler.com"; sid:564391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-compliant.com"; sid:564392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conceptionstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conceptionstudy.com"; sid:564393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19connect.com"; sid:564394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus.biz"; sid:564395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruslivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruslivenews.com"; sid:564396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corporate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corporate.com"; sid:564397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19costarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19costarica.com"; sid:564398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cre.com"; sid:564399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19czsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19czsolution.com"; sid:564400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailyroutine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailyroutine.com"; sid:564401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dasboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dasboards.com"; sid:564402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dashboads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dashboads.com"; sid:564403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19d.com"; sid:564404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deaseases.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deaseases.club"; sid:564405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrelief.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrelief.loan"; sid:564406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrelief.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrelief.loans"; sid:564407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-demande-avoir-univairmer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-demande-avoir-univairmer.com"; sid:564408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-desinfectantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-desinfectantes.com"; sid:564409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagram.com"; sid:564410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagram.com"; sid:564411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfecting.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfecting.today"; sid:564412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectiondenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectiondenver.com"; sid:564413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dronecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dronecleaning.com"; sid:564414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtrial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtrial.net"; sid:564415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dvlegalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dvlegalcenter.com"; sid:564416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dxhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dxhub.com"; sid:564417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19egrfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19egrfacemask.com"; sid:564418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvador.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvador.club"; sid:564419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentadvisor.com"; sid:564420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19engr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19engr.com"; sid:564421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.life"; sid:564422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fans.com"; sid:564423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialtherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialtherapist.com"; sid:564424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialtherapy.com"; sid:564425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19floormarking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19floormarking.com"; sid:564426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19floorsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19floorsigns.com"; sid:564427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floorsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floorsigns.com"; sid:564428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19floortape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19floortape.com"; sid:564429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floortape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floortape.com"; sid:564430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fluidmechanics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fluidmechanics.com"; sid:564431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forecast.com"; sid:564432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosure.com"; sid:564433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecertified.com"; sid:564434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freedentalclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freedentalclinic.com"; sid:564435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fromwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fromwork.com"; sid:564436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundraiser.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundraiser.agency"; sid:564437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19furniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19furniture.com"; sid:564438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gate.com"; sid:564439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gate.com"; sid:564440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19germs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19germs.com"; sid:564441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19get-paid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19get-paid.com"; sid:564442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalactionplan.com"; sid:564443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalactionplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalactionplan.net"; sid:564444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaltaxtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaltaxtracker.com"; sid:564445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graduation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graduation.com"; sid:564446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gratitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gratitude.com"; sid:564447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19griefcounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19griefcounseling.com"; sid:564448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hcwregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hcwregistry.com"; sid:564449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hd.com"; sid:564450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthclaims.com"; sid:564451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthconcern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthconcern.com"; sid:564452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthconcerns.com"; sid:564453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthgear.com"; sid:564454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthproblem.com"; sid:564455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heat.com"; sid:564456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-help.net"; sid:564457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hero.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hero.support"; sid:564458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19honesty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19honesty.com"; sid:564459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hours.com"; sid:564460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoy.net"; sid:564461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hustleformuscle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hustleformuscle.com"; sid:564462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idlabel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idlabel.com"; sid:564463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ids.com"; sid:564464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19images.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19images.com"; sid:564465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitycertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitycertificate.com"; sid:564466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunitytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunitytesting.com"; sid:564467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-impact.com"; sid:564468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19impairment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19impairment.com"; sid:564469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impairment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impairment.com"; sid:564470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiacure.com"; sid:564471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiaorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiaorg.com"; sid:564472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-indonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-indonesia.com"; sid:564473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injuries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injuries.com"; sid:564474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insweden.com"; sid:564475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-interventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-interventions.com"; sid:564476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19israel.com"; sid:564477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jewelrysale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jewelrysale.com"; sid:564478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kerobokan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kerobokan.com"; sid:564479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19knights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19knights.com"; sid:564480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kratom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kratom.com"; sid:564481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalquestions.com"; sid:564482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalservice.com"; sid:564483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19listingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19listingservice.com"; sid:564484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingstudy.com"; sid:564485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maskn95.com"; sid:564486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maskn95.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maskn95.net"; sid:564487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksale.com"; sid:564488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksforsale.com"; sid:564489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskz.com"; sid:564490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masr.com"; sid:564491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalclaim.com"; sid:564492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalclaims.com"; sid:564493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medical-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medical-guide.com"; sid:564494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-monde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-monde.com"; sid:564495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-monitor.com"; sid:564496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19morelos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19morelos.com"; sid:564497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19musicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19musicrelief.com"; sid:564498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19narratives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19narratives.com"; sid:564499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news360.com"; sid:564500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newshub.com"; sid:564501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nextsteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nextsteps.com"; sid:564502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nicaragua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nicaragua.com"; sid:564503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nmbbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nmbbc.com"; sid:564504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19normalcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19normalcy.com"; sid:564505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19now.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19now.net"; sid:564506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partition.com"; sid:564507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passed.com"; sid:564508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-payments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-payments.com"; sid:564509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ph.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ph.life"; sid:564510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plaintiffs.com"; sid:564511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plot.com"; sid:564512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppp.com"; sid:564513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19productsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19productsolutions.com"; sid:564514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pro.net"; sid:564515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionbox.com"; sid:564516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiondevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiondevices.com"; sid:564517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19punjab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19punjab.com"; sid:564518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19question.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19question.com"; sid:564519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quick-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quick-test.com"; sid:564520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-radar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-radar.com"; sid:564521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestaterelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestaterelief.com"; sid:564522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebellion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebellion.com"; sid:564523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rehab.com"; sid:564524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehber.com"; sid:564525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.agency"; sid:564526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieflawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieflawyers.com"; sid:564527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefprogram.com"; sid:564528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.team"; sid:564529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19renting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19renting.com"; sid:564530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renting.com"; sid:564531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19report.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19report.today"; sid:564532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resourcecenter.com"; sid:564533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resourcecentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resourcecentre.com"; sid:564534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-resource-page.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-resource-page.com"; sid:564535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantjobs.com"; sid:564536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailpulselive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailpulselive.com"; sid:564537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rois.com"; sid:564538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rsa.com"; sid:564539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rx.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rx.care"; sid:564540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rx.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rx.care"; sid:564541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rx.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rx.care"; sid:564542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rx.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rx.care"; sid:564543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rx.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rx.clinic"; sid:564544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rx.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rx.clinic"; sid:564545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rx.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rx.clinic"; sid:564546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rx.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rx.clinic"; sid:564547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rx.com"; sid:564548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rx.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rx.healthcare"; sid:564549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rx.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rx.healthcare"; sid:564550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rx.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rx.healthcare"; sid:564551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rx.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rx.healthcare"; sid:564552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rx.net"; sid:564553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rx.net"; sid:564554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rx.net"; sid:564555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safetykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safetykits.com"; sid:564556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety-kits.com"; sid:564557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitazer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitazer.com"; sid:564558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaconsultant.com"; sid:564559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningtrack.com"; sid:564560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfcheck.com"; sid:564561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfcheck.com"; sid:564562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfscreen.com"; sid:564563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-settlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-settlements.com"; sid:564564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-settlements.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-settlements.net"; sid:564565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sixfeetaway.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sixfeetaway.life"; sid:564566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19snafu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19snafu.com"; sid:564567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19snafus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19snafus.com"; sid:564568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19squad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19squad.com"; sid:564569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.world"; sid:564570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steriliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steriliser.com"; sid:564571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steriliserpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steriliserpro.com"; sid:564572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilizer.com"; sid:564573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilizer.com"; sid:564574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilizerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilizerpro.com"; sid:564575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimulusbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimulusbill.com"; sid:564576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stories.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stories.world"; sid:564577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19straya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19straya.com"; sid:564578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliers.biz"; sid:564579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesctmade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesctmade.com"; sid:564580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyshop.com"; sid:564581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survived.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survived.com"; sid:564582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swifttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swifttest.com"; sid:564583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19switchboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19switchboard.net"; sid:564584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19switchboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19switchboard.net"; sid:564585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sydney.com"; sid:564586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19telehealthpsychologyandcounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19telehealthpsychologyandcounseling.com"; sid:564587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedics.com"; sid:564588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telugu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telugu.com"; sid:564589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tenantrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tenantrights.com"; sid:564590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tepuke.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tepuke.fyi"; sid:564591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tested.com"; sid:564592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tested.com"; sid:564593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnigeria.com"; sid:564594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tests.net"; sid:564595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtrack.com"; sid:564596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thebattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thebattle.com"; sid:564597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-times.com"; sid:564598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackers.com"; sid:564599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treats.com"; sid:564600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trusts.com"; sid:564601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tur.com"; sid:564602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uber.com"; sid:564603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19understand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19understand.com"; sid:564604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usasettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usasettlement.com"; sid:564605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.biz"; sid:564606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vault.com"; sid:564607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vax.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vax.biz"; sid:564608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verify.com"; sid:564609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19violators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19violators.com"; sid:564610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdonations.com"; sid:564611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virustest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virustest.net"; sid:564612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19v.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19v.world"; sid:564613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washo.com"; sid:564614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weight.com"; sid:564615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wipes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wipes.net"; sid:564616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplaceadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplaceadvisor.com"; sid:564617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacelawjl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacelawjl.com"; sid:564618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldsurvivor.com"; sid:564619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldsurvivor.com"; sid:564620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldsurvivors.com"; sid:564621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldsurvivors.com"; sid:564622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-worldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-worldtour.com"; sid:564623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wwc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wwc.com"; sid:564624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19www.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19www.com"; sid:564625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xtest.com"; sid:564626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yearbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yearbook.com"; sid:564627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yearbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yearbooks.com"; sid:564628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zelftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zelftest.com"; sid:564629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1dashboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1dashboards.com"; sid:564630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019stat.com"; sid:564631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20solutions.com"; sid:564632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.today"; sid:564633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-45.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-45.net"; sid:564634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid45.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid45.net"; sid:564635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5g.com"; sid:564636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-7.com"; sid:564637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid911.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid911.net"; sid:564638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid95masks.com"; sid:564639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactsofkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactsofkindness.com"; sid:564640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaho.com"; sid:564641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidmap.com"; sid:564642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaircleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaircleaner.com"; sid:564643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairpurifier.com"; sid:564644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalcoholclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalcoholclearinghouse.com"; sid:564645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamasks.com"; sid:564646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandbh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandbh.com"; sid:564647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapex.com"; sid:564648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-assist.com"; sid:564649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassurance.com"; sid:564650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidastrazeneca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidastrazeneca.com"; sid:564651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessribbon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessribbon.net"; sid:564652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessribbons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessribbons.net"; sid:564653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidayacancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidayacancer.com"; sid:564654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyworld.com"; sid:564655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbadfaith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbadfaith.com"; sid:564656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbility.com"; sid:564657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbriefing.com"; sid:564658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbriefing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbriefing.net"; sid:564659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessmoney.com"; sid:564660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessmoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessmoney.net"; sid:564661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamo.com"; sid:564662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanidoit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanidoit.com"; sid:564663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanidoit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanidoit.net"; sid:564664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.cloud"; sid:564665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareforce.net"; sid:564666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareproject.net"; sid:564667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.support"; sid:564668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashcomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashcomeback.com"; sid:564669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-casino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-casino.com"; sid:564670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasinos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasinos.com"; sid:564671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasualties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasualties.com"; sid:564672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasualty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasualty.com"; sid:564673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckapp.com"; sid:564674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecked.com"; sid:564675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchef.com"; sid:564676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcarecalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcarecalifornia.com"; sid:564677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcareohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcareohio.com"; sid:564678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcareusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcareusa.com"; sid:564679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclesbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclesbook.com"; sid:564680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcinteli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcinteli.com"; sid:564681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsinfo.com"; sid:564682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsonline.com"; sid:564683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionsettlement.com"; sid:564684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean2020.com"; sid:564685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningaustin.com"; sid:564686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnyc.com"; sid:564687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanme.com"; sid:564688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearair.com"; sid:564689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclever.com"; sid:564690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicaldata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicaldata.com"; sid:564691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosed.com"; sid:564692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clothing.com"; sid:564693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollaborative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollaborative.net"; sid:564694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollectors.com"; sid:564695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompassion2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompassion2020.com"; sid:564696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompassion2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompassion2020.net"; sid:564697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomply.com"; sid:564698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconceptionstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconceptionstudy.com"; sid:564699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcove.com"; sid:564700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crash.com"; sid:564701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrowdfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrowdfunding.com"; sid:564702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiseclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiseclaim.com"; sid:564703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiseclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiseclaims.com"; sid:564704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruseclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruseclaim.com"; sid:564705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuff.com"; sid:564706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurve19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurve19.com"; sid:564707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurve19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurve19.net"; sid:564708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcymru.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcymru.wales"; sid:564709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailyroutine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailyroutine.com"; sid:564710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebrief.com"; sid:564711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtreliefservices.com"; sid:564712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-desk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-desk.com"; sid:564713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiaper.com"; sid:564714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiaper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiaper.net"; sid:564715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiapers.com"; sid:564716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiapers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiapers.net"; sid:564717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorce.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorce.solutions"; sid:564718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.domains - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.domains"; sid:564719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideapper.com"; sid:564720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidebtrelief.com"; sid:564721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentifiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentifiers.com"; sid:564722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentifies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentifies.com"; sid:564723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepidemia.com"; sid:564724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderm.com"; sid:564725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexlabs.com"; sid:564726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextesting.com"; sid:564727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacecover.com"; sid:564728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemaskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemaskforsale.com"; sid:564729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemasksale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemasksale.com"; sid:564730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.fan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.fan"; sid:564731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiction.com"; sid:564732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightclub.com"; sid:564733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinders.net"; sid:564734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflashfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflashfiction.com"; sid:564735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforbh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforbh.com"; sid:564736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforce.com"; sid:564737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeholidays.com"; sid:564738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeneration.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeneration.life"; sid:564739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgifts.com"; sid:564740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoodnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoodnews.net"; sid:564741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrantsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrantsoftware.com"; sid:564742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.gripe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.gripe"; sid:564743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardtr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardtr.com"; sid:564744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-healthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-healthplans.com"; sid:564745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthplans.com"; sid:564746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheartstogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheartstogether.com"; sid:564747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp19.com"; sid:564748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroclothing.com"; sid:564749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.fund"; sid:564750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheros2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheros2020.com"; sid:564751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.support"; sid:564752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeessentials.com"; sid:564753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomefit.com"; sid:564754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesupplies.com"; sid:564755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhouseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhouseparty.com"; sid:564756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhukuku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhukuku.com"; sid:564757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiapers.com"; sid:564758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityli.com"; sid:564759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityny.com"; sid:564760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotnm.com"; sid:564761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidishop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidishop.com"; sid:564762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisland.com"; sid:564763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisnojoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisnojoke.com"; sid:564764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkare.com"; sid:564765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidz.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidz.club"; sid:564766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.kitchen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.kitchen"; sid:564767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkorea.com"; sid:564768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kush.com"; sid:564769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlateral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlateral.com"; sid:564770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlauren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlauren.com"; sid:564771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawatlanta.com"; sid:564772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawlibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawlibrary.com"; sid:564773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawnyc.com"; sid:564774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawrelief.com"; sid:564775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsc.com"; sid:564776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalissues.com"; sid:564777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidletternyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidletternyc.com"; sid:564778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidli.com"; sid:564779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigationonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigationonline.com"; sid:564780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliveupdates.com"; sid:564781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanapplications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanapplications.com"; sid:564782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansoftware.com"; sid:564783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasker.com"; sid:564784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeals.com"; sid:564785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoment.com"; sid:564786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoments.com"; sid:564787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagehelp.com"; sid:564788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn95mask.com"; sid:564789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewshub.com"; sid:564790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ny.com"; sid:564791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofy.com"; sid:564792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoing.com"; sid:564793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidon8.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidon8.cloud"; sid:564794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonwax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonwax.com"; sid:564795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassed.com"; sid:564796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonecase.com"; sid:564797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpinatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpinatas.com"; sid:564798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpong.com"; sid:564799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppp.com"; sid:564800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prediction.com"; sid:564801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproof.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproof.net"; sid:564802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofyouragencybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofyouragencybook.com"; sid:564803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofyouragencybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofyouragencybook.net"; sid:564804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofyouragency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofyouragency.com"; sid:564805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofyouragency.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofyouragency.net"; sid:564806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionbox.com"; sid:564807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protectiveproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protectiveproducts.com"; sid:564808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqrcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqrcode.com"; sid:564809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresponse.net"; sid:564810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrate.com"; sid:564811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrates.com"; sid:564812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealite.com"; sid:564813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief19.com"; sid:564814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefaustin.com"; sid:564815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.biz"; sid:564816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefdfw.com"; sid:564817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefs.com"; sid:564818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremoved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremoved.com"; sid:564819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresolutionsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresolutionsolutions.com"; sid:564820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsejob.com"; sid:564821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsenow.com"; sid:564822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrules.com"; sid:564823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertifiedonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertifiedonline.com"; sid:564824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeshop.com"; sid:564825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetynetwork.com"; sid:564826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsandstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsandstorm.com"; sid:564827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscarf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscarf.net"; sid:564828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschedule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschedule.com"; sid:564829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningtrack.com"; sid:564830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsenior.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsenior.care"; sid:564831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserumdonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserumdonors.com"; sid:564832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserumtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserumtesting.com"; sid:564833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserve.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserve.net"; sid:564834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidset.com"; sid:564835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsets.com"; sid:564836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlements.com"; sid:564837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-share.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-share.com"; sid:564838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-share.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-share.net"; sid:564839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshope.com"; sid:564840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsinai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsinai.com"; sid:564841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnafu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnafu.com"; sid:564842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnafus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnafus.com"; sid:564843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoldiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoldiers.com"; sid:564844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ssd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ssd.com"; sid:564845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ssd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ssd.net"; sid:564846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatepolicy.com"; sid:564847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.world"; sid:564848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stop-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stop-france.com"; sid:564849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupport19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupport19.com"; sid:564850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportmft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportmft.com"; sid:564851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalgear.com"; sid:564852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvived.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvived.com"; sid:564853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuvivor.com"; sid:564854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuvivors.com"; sid:564855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtar.com"; sid:564856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteefund.com"; sid:564857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenantrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenantrights.com"; sid:564858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestandtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestandtrack.com"; sid:564859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestchicago.com"; sid:564860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmap.com"; sid:564861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnow.com"; sid:564862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingonline.com"; sid:564863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsupplies.com"; sid:564864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnewyork.com"; sid:564865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestseattle.com"; sid:564866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststudy.com"; sid:564867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttrack.com"; sid:564868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttrack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttrack.net"; sid:564869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthevirus.com"; sid:564870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker.world"; sid:564871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracking.net"; sid:564872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinela.com"; sid:564873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelondon.com"; sid:564874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinenyc.com"; sid:564875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetrials.com"; sid:564876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacine.com"; sid:564877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveil.com"; sid:564878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19.net"; sid:564879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusclaim.com"; sid:564880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusclaims.com"; sid:564881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus-cure.com"; sid:564882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushelp.com"; sid:564883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus-remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus-remedy.com"; sid:564884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusresearch.com"; sid:564885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvstockmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvstockmarket.com"; sid:564886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarfare.com"; sid:564887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashoe.com"; sid:564888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwisconsinconnect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwisconsinconnect.net"; sid:564889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxlabs.com"; sid:564890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxtest.com"; sid:564891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackcovid.com"; sid:564892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cracovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cracovid19.net"; sid:564893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for criticalcovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"criticalcovid19ppe.com"; sid:564894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryovscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryovscovid19.com"; sid:564895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronacrazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronacrazies.com"; sid:564896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvecorona.com"; sid:564897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovid19cure.com"; sid:564898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovid.com"; sid:564899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovidcure.com"; sid:564900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damnpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damnpandemic.com"; sid:564901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daruratcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daruratcorona.com"; sid:564902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dedhamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dedhamcovid19.com"; sid:564903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19ga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19ga.com"; sid:564904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deletecovid19tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deletecovid19tshirts.com"; sid:564905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deniedcoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deniedcoronavirusclaim.com"; sid:564906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistryaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistryaftercovid.com"; sid:564907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for der-corona-schnelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"der-corona-schnelltest.com"; sid:564908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designercovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designercovidmasks.com"; sid:564909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus-bordeaux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus-bordeaux.com"; sid:564910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus-gironde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus-gironde.com"; sid:564911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid19-bordeaux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid19-bordeaux.com"; sid:564912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncovid19bordeaux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncovid19bordeaux.com"; sid:564913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for devqrcovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"devqrcovidpass.com"; sid:564914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfmedicacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfmedicacovid19.com"; sid:564915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabatescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabatescovid-19.com"; sid:564916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitaldurchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitaldurchcorona.com"; sid:564917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorceduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorceduringcovid.com"; sid:564918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donate4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donate4coronavirus.com"; sid:564919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donate4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donate4covid19.com"; sid:564920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donate-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donate-covid19.com"; sid:564921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovidhealthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovidhealthdata.com"; sid:564922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovidhealthdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovidhealthdata.net"; sid:564923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatedata-slowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatedata-slowcovid.com"; sid:564924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatedata-slowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatedata-slowcovid.net"; sid:564925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydata4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydata4covid.com"; sid:564926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydata4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydata4covid.net"; sid:564927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydataforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydataforcovid.com"; sid:564928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydataforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydataforcovid.net"; sid:564929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydata-slowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydata-slowcovid.com"; sid:564930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatemydata-slowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatemydata-slowcovid.net"; sid:564931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donotgetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donotgetcovid19.com"; sid:564932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dopocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dopocovid.com"; sid:564933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dsindiavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dsindiavscovid.com"; sid:564934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthspandemic.com"; sid:564935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthspandemic.net"; sid:564936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovid.biz"; sid:564937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emocionalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emocionalcovid19.com"; sid:564938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmentlawcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmentlawcovid19.com"; sid:564939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcovid-19.com"; sid:564940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endpandemicndc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endpandemicndc.com"; sid:564941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enugucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enugucovid19.com"; sid:564942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccharity.com"; sid:564943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicgiving.com"; sid:564944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsports.com"; sid:564945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsports.net"; sid:564946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicworkshop2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicworkshop2020.com"; sid:564947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esquelascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esquelascoronavirus.com"; sid:564948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essenciasanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essenciasanticoronavirus.com"; sid:564949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estateplancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estateplancovid19.com"; sid:564950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurocovid.com"; sid:564951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingcovid.com"; sid:564952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for experiencingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"experiencingcovid19.com"; sid:564953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyeoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyeoncorona.com"; sid:564954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskscovid19.com"; sid:564955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facingcorona.com"; sid:564956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faeccadizcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faeccadizcovid19.com"; sid:564957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmacopercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmacopercoronavirus.com"; sid:564958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fck-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fck-covid-19.com"; sid:564959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-corona19.com"; sid:564960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for figlidelcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"figlidelcorona.net"; sid:564961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialsupportcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialsupportcovid-19.com"; sid:564962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronacure.com"; sid:564963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finducovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finducovid19.com"; sid:564964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattenthepandemiccurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattenthepandemiccurve.com"; sid:564965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaforeclosure.com"; sid:564966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronarelief.com"; sid:564967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaupdates.com"; sid:564968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foffcovid19.com"; sid:564969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freakycoronamerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freakycoronamerch.com"; sid:564970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidmask.com"; sid:564971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freshstartpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freshstartpostcorona.com"; sid:564972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendscare-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendscare-covid-19.com"; sid:564973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendshelp-corona-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendshelp-corona-app.com"; sid:564974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gefacovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gefacovid.cloud"; sid:564975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gefacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gefacovid.com"; sid:564976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gewerbemiete-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gewerbemiete-corona.com"; sid:564977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giftnowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giftnowcoronavirus.com"; sid:564978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giftnowcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giftnowcovid-19.com"; sid:564979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giftnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giftnowcovid19.com"; sid:564980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicobservatory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicobservatory.com"; sid:564981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goldenalliance-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goldenalliance-covid19.com"; sid:564982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotthecovid.com"; sid:564983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gplcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gplcovidtest.com"; sid:564984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gratitudecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gratitudecovid19.com"; sid:564985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemicof2020.com"; sid:564986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guidetocopingwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guidetocopingwithcovid-19.com"; sid:564987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiltyofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiltyofpandemic.com"; sid:564988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haemokinesis-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haemokinesis-coronavirus.com"; sid:564989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hahnrmgcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hahnrmgcovid-19.com"; sid:564990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthpersonnelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthpersonnelcovid19.com"; sid:564991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid-19now.com"; sid:564992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecoronavirus.com"; sid:564993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcovid19.com"; sid:564994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmefilemycoronaaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmefilemycoronaaid.com"; sid:564995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoclcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoclcovid19.com"; sid:564996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopewithcovid.com"; sid:564997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronavirus.net"; sid:564998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how2aftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how2aftercorona.com"; sid:564999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how2combatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how2combatcorona.com"; sid:565000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how2killcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how2killcorona.com"; sid:565001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how2surviveapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how2surviveapandemic.com"; sid:565002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcoronavirus.com"; sid:565003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howimetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howimetcorona.com"; sid:565004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovids.com"; sid:565005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid-19hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid-19hotline.com"; sid:565006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideascoronavirus.com"; sid:565007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcoronavirus.net"; sid:565008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunetocovid.com"; sid:565009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imrcovid.com"; sid:565010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiaagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiaagainstcovid.com"; sid:565011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocurecoronavirus.com"; sid:565012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocurecovid19.com"; sid:565013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informate-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informate-covid19.com"; sid:565014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informatecovid19.com"; sid:565015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injuredfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injuredfromcoronavirus.com"; sid:565016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcorona.com"; sid:565017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcorona.net"; sid:565018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirus.com"; sid:565019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirus.net"; sid:565020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid-19.com"; sid:565021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid19.com"; sid:565022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid-19.net"; sid:565023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid19.net"; sid:565024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for invidiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"invidiacovid19.com"; sid:565025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancorona.net"; sid:565026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isolationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isolationcovid.com"; sid:565027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istopcovid.com"; sid:565028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istoppedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istoppedcovid.com"; sid:565029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthe2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthe2020pandemic.net"; sid:565030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itestcovid19.com"; sid:565031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeffersoncountycoronavirusrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeffersoncountycoronavirusrecovery.com"; sid:565032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeffersoncountycoronavirusrecoveryteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeffersoncountycoronavirusrecoveryteam.com"; sid:565033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeffersoncountycovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeffersoncountycovidrecovery.com"; sid:565034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewishcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewishcoronarelief.com"; sid:565035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalcovid19.com"; sid:565036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justiciapoliticacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justiciapoliticacovid.com"; sid:565037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickrentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickrentcorona.com"; sid:565038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killacorona.com"; sid:565039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidnow.com"; sid:565040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labqrcovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labqrcovidpass.com"; sid:565041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labtestcovid19.com"; sid:565042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lateralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lateralcovid.com"; sid:565043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latest-corona-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latest-corona-news.com"; sid:565044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscrackcovid.com"; sid:565045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstalkcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstalkcovid19live.com"; sid:565046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringnovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringnovelcoronavirus.com"; sid:565047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronapersona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronapersona.com"; sid:565048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livelifenowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livelifenowcovid19.com"; sid:565049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loans4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loans4covid.com"; sid:565050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lonelyplanet-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lonelyplanet-covid19.com"; sid:565051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lonelyplanetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lonelyplanetcovid19.com"; sid:565052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loopcommercecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loopcommercecoronavirus.com"; sid:565053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loopcommercecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loopcommercecovid-19.com"; sid:565054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loopcommercecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loopcommercecovid19.com"; sid:565055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthenameofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthenameofcorona.com"; sid:565056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimecoronavirus.com"; sid:565057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona-chi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona-chi.com"; sid:565058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.gallery"; sid:565059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronapodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronapodcast.com"; sid:565060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19-chi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19-chi.com"; sid:565061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovelessinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovelessinthetimeofcorona.com"; sid:565062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovid.com"; sid:565063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidresponse.com"; sid:565064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makersagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makersagainstcorona.net"; sid:565065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makersvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makersvscovid.com"; sid:565066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingcoronavirus.com"; sid:565067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingthepandemic.com"; sid:565068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manajemencovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manajemencovid.net"; sid:565069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovid19.net"; sid:565070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcovid19sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcovid19sale.com"; sid:565071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for md-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"md-covid-19.com"; sid:565072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-coronavirus.com"; sid:565073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercoronavirus.com"; sid:565074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-coronavirus.net"; sid:565075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercoronavirus.net"; sid:565076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid-19.com"; sid:565077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid19.com"; sid:565078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid-19.com"; sid:565079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid19.com"; sid:565080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid-19.net"; sid:565081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid19.net"; sid:565082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid-19.net"; sid:565083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid19.net"; sid:565084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid19partnerprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid19partnerprogram.com"; sid:565085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid19partnerprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid19partnerprogram.com"; sid:565086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid19partnerprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid19partnerprogram.net"; sid:565087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid19partnerprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid19partnerprogram.net"; sid:565088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid.com"; sid:565089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid.com"; sid:565090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covid.net"; sid:565091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovid.net"; sid:565092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covidpartnerprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covidpartnerprogram.com"; sid:565093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovidpartnerprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovidpartnerprogram.com"; sid:565094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messenger-covidpartnerprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messenger-covidpartnerprogram.net"; sid:565095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for messengercovidpartnerprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"messengercovidpartnerprogram.net"; sid:565096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metacovid19.com"; sid:565097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancovid19relief.com"; sid:565098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelingcovid.com"; sid:565099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monjournalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monjournalcovid19.com"; sid:565100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for msbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"msbacovid19.com"; sid:565101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muertosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muertosporcoronavirus.com"; sid:565102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronascarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronascarf.com"; sid:565103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19mask.com"; sid:565104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19store.com"; sid:565105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfiction.com"; sid:565106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhometest.com"; sid:565107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidpin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidpin.com"; sid:565108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidshield.com"; sid:565109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtest.net"; sid:565110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynameiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynameiscorona.com"; sid:565111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19masks.com"; sid:565112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19sale.com"; sid:565113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covidmask.com"; sid:565114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covidmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covidmask.net"; sid:565115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95forcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95forcovid.com"; sid:565116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95maskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95maskcovid19.com"; sid:565117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95maskforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95maskforcovid19.com"; sid:565118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusrecoverycommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusrecoverycommission.com"; sid:565119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingbeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingbeyondcovid19.com"; sid:565120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncorona19.com"; sid:565121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverforget-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverforget-covid19.com"; sid:565122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neverinfectedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neverinfectedcovid19.com"; sid:565123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nflcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nflcovidmasks.com"; sid:565124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronaviruslaw.com"; sid:565125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid19tracker.com"; sid:565126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidtracker.com"; sid:565127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nnbuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nnbuscovid.com"; sid:565128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid-19scarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid-19scarf.com"; sid:565129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19scarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19scarf.com"; sid:565130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19symptoms.com"; sid:565131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidmask.com"; sid:565132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidscarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidscarf.com"; sid:565133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidsymptoms.com"; sid:565134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascovidfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascovidfitness.com"; sid:565135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmycorona.com"; sid:565136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirus.net"; sid:565137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycletterforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycletterforcovid.com"; sid:565138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronatest.com"; sid:565139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocovid.com"; sid:565140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidchildcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidchildcare.com"; sid:565141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidresponse.com"; sid:565142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidresponse.net"; sid:565143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omancovid19.com"; sid:565144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondetemcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondetemcoronavirus.com"; sid:565145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondetemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondetemcovid.com"; sid:565146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovidtesting.com"; sid:565147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19test.com"; sid:565148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourpandemic.com"; sid:565149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oycorona.com"; sid:565150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronacoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronacoverage.com"; sid:565151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicacademics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicacademics.com"; sid:565152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaccident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaccident.com"; sid:565153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaccidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaccidents.com"; sid:565154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandwork.com"; sid:565155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbeauty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbeauty.com"; sid:565156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-box.com"; sid:565157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbranding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbranding.com"; sid:565158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinesssurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinesssurvivalguide.com"; sid:565159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccam.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccam.club"; sid:565160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccollaborative.com"; sid:565161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccollaborative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccollaborative.net"; sid:565162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.community"; sid:565163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoutureco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoutureco.com"; sid:565164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cover.com"; sid:565165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid19news.com"; sid:565166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdivorcelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdivorcelawyers.com"; sid:565167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdonations.com"; sid:565168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfest.com"; sid:565169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfighter.com"; sid:565170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-forum.com"; sid:565171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgarden.com"; sid:565172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgiving.com"; sid:565173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgreed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgreed.com"; sid:565174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgreed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgreed.net"; sid:565175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinjuries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinjuries.com"; sid:565176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclending.com"; sid:565177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmarriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmarriage.com"; sid:565178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemorial.com"; sid:565179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.movie"; sid:565180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofcreation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofcreation.com"; sid:565181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconlinecoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconlinecoaching.com"; sid:565182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparadise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparadise.com"; sid:565183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpics.com"; sid:565184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpics.net"; sid:565185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpinatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpinatas.com"; sid:565186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpix.com"; sid:565187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpods.com"; sid:565188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoet.com"; sid:565189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesspod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesspod.com"; sid:565190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesspods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesspods.com"; sid:565191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofessors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofessors.com"; sid:565192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofretirement.com"; sid:565193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectors.com"; sid:565194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsnafu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsnafu.com"; sid:565195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsnafus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsnafus.com"; sid:565196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspa.com"; sid:565197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicuniversity.com"; sid:565198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-world-tour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-world-tour.com"; sid:565199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworldtour.com"; sid:565200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicinthepandemic.com"; sid:565201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantau-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantau-covid19.com"; sid:565202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parafarmaciacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parafarmaciacoronavirus.com"; sid:565203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partycovid19.com"; sid:565204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partycovid.com"; sid:565205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peduli-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peduli-covid19.com"; sid:565206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pelhamcoronasonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pelhamcoronasonline.com"; sid:565207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penangkal-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penangkal-corona.com"; sid:565208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penncovid19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penncovid19hub.com"; sid:565209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleshistorycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleshistorycorona.com"; sid:565210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleshistorycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleshistorycovid.com"; sid:565211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleshistoryofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleshistoryofcorona.com"; sid:565212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleshistoryofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleshistoryofcovid.com"; sid:565213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petersburgerscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petersburgerscorona.com"; sid:565214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsbestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsbestcoronavirus.com"; sid:565215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsbestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsbestcovid-19.com"; sid:565216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsbestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsbestcovid19.com"; sid:565217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaboom.com"; sid:565218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafreshstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafreshstart.com"; sid:565219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalistingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalistingservice.com"; sid:565220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronarealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronarealestate.com"; sid:565221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaselfhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaselfhelp.com"; sid:565222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusboom.com"; sid:565223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusfuture.com"; sid:565224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19boom.com"; sid:565225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidboom.com"; sid:565226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.world"; sid:565227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiccovid19.com"; sid:565228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpalooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpalooza.com"; sid:565229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicrelief.com"; sid:565230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsolutions.com"; sid:565231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postspandemic.com"; sid:565232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayawaycovid19.com"; sid:565233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayawaycovid.com"; sid:565234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidentcoronavirus.com"; sid:565235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidentcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidentcovid.com"; sid:565236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestamocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestamocorona.com"; sid:565237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevent-covid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevent-covid19now.com"; sid:565238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19now.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19now.life"; sid:565239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovidnow.com"; sid:565240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for priimo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"priimo-covid19.com"; sid:565241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proformula-coronavirus-dk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proformula-coronavirus-dk.com"; sid:565242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocion-netflix-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocion-netflix-covid-19.com"; sid:565243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccion-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccion-covid-19.com"; sid:565244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolloanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolloanticovid19.com"; sid:565245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punchcoronaintheface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punchcoronaintheface.com"; sid:565246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qacovid19.com"; sid:565247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qrcovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qrcovidpass.com"; sid:565248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantastoriepercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantastoriepercoronavirus.com"; sid:565249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantunescovidcabaret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantunescovidcabaret.com"; sid:565250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rakacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rakacorona.com"; sid:565251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raoultvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raoultvscoronavirus.com"; sid:565252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rarewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rarewithcovid.com"; sid:565253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reacovid19.com"; sid:565254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronavirusdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronavirusdefense.com"; sid:565255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid-19.com"; sid:565256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidtest.com"; sid:565257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamoscovid19elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamoscovid19elsalvador.com"; sid:565258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidnowcoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidnowcoaching.com"; sid:565259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidnowcoaching.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidnowcoaching.net"; sid:565260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reference-sem-covid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reference-sem-covid19.cat"; sid:565261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinventaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinventaftercovid19.com"; sid:565262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinventaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinventaftercovid.com"; sid:565263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovidfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovidfraud.com"; sid:565264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcovid19together.com"; sid:565265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resolutioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resolutioncovid19.com"; sid:565266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rewirecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rewirecovid.com"; sid:565267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runagainstcovid-19.com"; sid:565268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runagainstcovid19.com"; sid:565269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saltlakecitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saltlakecitycoronavirus.com"; sid:565270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanicleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanicleancovid.com"; sid:565271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19test.com"; sid:565272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirushelp.com"; sid:565273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanguide.com"; sid:565274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanguide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanguide.net"; sid:565275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanprogram.com"; sid:565276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanprogram.net"; sid:565277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19loanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19loanprograms.com"; sid:565278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccovidlaw.com"; sid:565279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semcovid.com"; sid:565280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19gateway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19gateway.com"; sid:565281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincecovid19.com"; sid:565282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sklep-testcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sklep-testcovid19.com"; sid:565283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slap-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slap-corona.com"; sid:565284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartcloudcpa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartcloudcpa-covid19.com"; sid:565285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smellcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smellcovid-19.com"; sid:565286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snafupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snafupandemic.com"; sid:565287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sniffcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sniffcovid.com"; sid:565288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soforthilfe-corona-kmu-koeln.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soforthilfe-corona-kmu-koeln.com"; sid:565289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soforthilfe-corona-ziel3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soforthilfe-corona-ziel3.com"; sid:565290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for songuoinhiemcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"songuoinhiemcorona.com"; sid:565291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-corona.net"; sid:565292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid19.net"; sid:565293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparkscovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparkscovidmasks.com"; sid:565294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spermidin-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spermidin-corona.com"; sid:565295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staerkeralscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staerkeralscorona.com"; sid:565296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuptocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuptocovid.com"; sid:565297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standuptocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standuptocovid.net"; sid:565298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafecovid.com"; sid:565299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafetobeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafetobeatcoronavirus.com"; sid:565300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.life"; sid:565301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19mx.com"; sid:565302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnyc.com"; sid:565303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppandemicapp.com"; sid:565304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopping-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopping-covid19.com"; sid:565305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopspreadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopspreadcoronavirus.com"; sid:565306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronacrisis.com"; sid:565307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronacrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronacrisis.net"; sid:565308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirusspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirusspread.com"; sid:565309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadcorona.com"; sid:565310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespread-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespread-coronavirus.com"; sid:565311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadcoronavirus.com"; sid:565312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadcoronaviruses.com"; sid:565313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stress-duringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stress-duringcorona.com"; sid:565314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressduringcorona.com"; sid:565315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressduringcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressduringcorona.net"; sid:565316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stressmanagementduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stressmanagementduringcoronavirus.com"; sid:565317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcovidinfo.com"; sid:565318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrustbankcovidinfosystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrustbankcovidinfosystems.com"; sid:565319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suntrusttreasurycovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suntrusttreasurycovidinfo.com"; sid:565320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19virus.com"; sid:565321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecovid-19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecovid-19epidemic.com"; sid:565322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syfcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syfcoronavirus.com"; sid:565323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syfcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syfcovid-19.com"; sid:565324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syfcovid19.com"; sid:565325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronybankcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronybankcovid-19.com"; sid:565326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronybankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronybankcovid19.com"; sid:565327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronycoronavirus.com"; sid:565328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronycovid-19.com"; sid:565329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronycovid19.com"; sid:565330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronyfinancialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronyfinancialcoronavirus.com"; sid:565331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronyfinancialcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronyfinancialcovid-19.com"; sid:565332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for synchronyfinancialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"synchronyfinancialcovid19.com"; sid:565333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syncovid.com"; sid:565334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamsportscovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamsportscovid19mask.com"; sid:565335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamsportscovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamsportscovid19masks.com"; sid:565336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techvscovid.com"; sid:565337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telcorona.com"; sid:565338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tescovid-19.com"; sid:565339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.biz"; sid:565340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tesztcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tesztcovid19.com"; sid:565341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaescape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaescape.com"; sid:565342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronagate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronagate.com"; sid:565343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatimescollectivejournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatimescollectivejournal.com"; sid:565344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivalguide.com"; sid:565345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustheory.com"; sid:565346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronazone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronazone.com"; sid:565347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19faces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19faces.com"; sid:565348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19theory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19theory.com"; sid:565349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19vaccination.com"; sid:565350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19year.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19year.com"; sid:565351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbattle.com"; sid:565352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid.life"; sid:565353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid.net"; sid:565354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedepartedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedepartedcovid19.com"; sid:565355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatpandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatpandemicof2020.com"; sid:565356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelostcovid19.com"; sid:565357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoneswelostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoneswelostcovid19.com"; sid:565358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicbusinesssurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicbusinesssurvivalguide.com"; sid:565359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpledge.com"; sid:565360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therespiratoryuniversalmasspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therespiratoryuniversalmasspandemic.com"; sid:565361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesilentpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesilentpandemic.com"; sid:565362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldagainstcovid19.com"; sid:565363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewwcovid19.com"; sid:565364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeofcovid.com"; sid:565365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetherbeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetherbeatcoronavirus.com"; sid:565366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismaftercovid-19.com"; sid:565367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toysforcovid19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toysforcovid19lockdown.com"; sid:565368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid-19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid-19app.com"; sid:565369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trancepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trancepandemic.com"; sid:565370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatingcovid.com"; sid:565371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribute2covid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribute2covid19victims.com"; sid:565372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tributetocovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tributetocovid19victims.com"; sid:565373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tripadvisor-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tripadvisor-covid19.com"; sid:565374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tripadvisorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tripadvisorcovid19.com"; sid:565375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcovidinfofun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcovidinfofun.com"; sid:565376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcovidinfofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcovidinfofund.com"; sid:565377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistcovidinfolaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistcovidinfolaw.com"; sid:565378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistemployeecovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistemployeecovidinfo.com"; sid:565379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truistemployeecovidinfonet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truistemployeecovidinfonet.com"; sid:565380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truisthelpcovidmaterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truisthelpcovidmaterial.com"; sid:565381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronawithstocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronawithstocks.com"; sid:565382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpspandemic.net"; sid:565383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpvscovid19.com"; sid:565384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustscovid19.com"; sid:565385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tsccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tsccovid19.com"; sid:565386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tscoronahelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tscoronahelpdesk.com"; sid:565387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcoronatest.com"; sid:565388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovidrevascregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovidrevascregistry.com"; sid:565389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronable.com"; sid:565390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatesofcorona.com"; sid:565391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatesofcovid.com"; sid:565392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskedcovid19.com"; sid:565393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronamasks.com"; sid:565394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavaccine.com"; sid:565395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidmasks.com"; sid:565396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19cases.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19cases.biz"; sid:565397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19support.com"; sid:565398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidassistance.com"; sid:565399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidchildcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidchildcare.com"; sid:565400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcleaning.com"; sid:565401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidrelief.com"; sid:565402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcoronaviruscleaning.com"; sid:565403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcoronaviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcoronaviruscleanup.com"; sid:565404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvlightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvlightcoronavirus.com"; sid:565405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinopercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinopercoronavirus.com"; sid:565406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinacovid19.com"; sid:565407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcovidfree.com"; sid:565408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vi-covid19.com"; sid:565409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronaayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronaayuda.com"; sid:565410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19-protection.com"; sid:565411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidfree.com"; sid:565412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusmascherinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusmascherinecovid19.com"; sid:565413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicesofcovid.com"; sid:565414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w-covid19.com"; sid:565415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcorona2020.com"; sid:565416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehatecovid.com"; sid:565417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westandforyoucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westandforyoucovid-19.com"; sid:565418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westcoastcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westcoastcovid19help.com"; sid:565419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus.com"; sid:565420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus.com"; sid:565421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus-info.com"; sid:565422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinfo.com"; sid:565423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus-info.com"; sid:565424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinfo.com"; sid:565425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus-information.com"; sid:565426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinformation.com"; sid:565427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus-information.com"; sid:565428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinformation.com"; sid:565429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinformationhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinformationhub.com"; sid:565430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinformationhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinformationhub.com"; sid:565431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinformationhub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinformationhub.net"; sid:565432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinformationhub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinformationhub.net"; sid:565433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19.com"; sid:565434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19.com"; sid:565435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19.com"; sid:565436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19.com"; sid:565437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19-information.com"; sid:565438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19information.com"; sid:565439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19-information.com"; sid:565440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19information.com"; sid:565441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19-information.com"; sid:565442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19information.com"; sid:565443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19-information.com"; sid:565444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19information.com"; sid:565445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid.com"; sid:565446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid.com"; sid:565447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-information.com"; sid:565448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covidinformation.com"; sid:565449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-information.com"; sid:565450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovidinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovidinformation.com"; sid:565451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-info-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-info-coronavirus.com"; sid:565452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-infocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-infocoronavirus.com"; sid:565453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinfo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinfo-coronavirus.com"; sid:565454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinfocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinfocoronavirus.com"; sid:565455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-coronavirus.com"; sid:565456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcoronavirus.com"; sid:565457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-coronavirus.com"; sid:565458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcoronavirus.com"; sid:565459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid-19.com"; sid:565460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid19.com"; sid:565461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid-19.com"; sid:565462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid19.com"; sid:565463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid-19.com"; sid:565464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid19.com"; sid:565465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid-19.com"; sid:565466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid19.com"; sid:565467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid.com"; sid:565468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid.com"; sid:565469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid.com"; sid:565470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid.com"; sid:565471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whogotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whogotcoronavirus.com"; sid:565472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whogotcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whogotcovid-19.com"; sid:565473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willscovid19.com"; sid:565474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winnowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winnowcovid.com"; sid:565475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingfromhomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingfromhomecoronavirus.com"; sid:565476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workplacelawcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workplacelawcovid19.com"; sid:565477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidcases.com"; sid:565478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldvscovid19.com"; sid:565479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-war-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-war-covid19.com"; sid:565480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbi.com"; sid:565481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoronaviruslawsuit.com"; sid:565482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoronaviruslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoronaviruslawsuits.com"; sid:565483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoronavirustreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoronavirustreatments.com"; sid:565484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangeneration.com"; sid:565485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyhfkyy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyhfkyy.com"; sid:565486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronax.com"; sid:565487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xoutcorona.com"; sid:565488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youhavecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youhavecoronavirus.net"; sid:565489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronapersona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronapersona.com"; sid:565490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zodiaccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zodiaccovid19.com"; sid:565491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 101covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"101covid-19.com"; sid:565492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800corona1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800corona1.com"; sid:565493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidnews.com"; sid:565494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1billioncoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1billioncoronasafe.com"; sid:565495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaface.com"; sid:565496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19news.com"; sid:565497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidlife.com"; sid:565498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020uncovided.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020uncovided.com"; sid:565499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2flycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2flycorona.com"; sid:565500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2flysurvivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2flysurvivedcorona.com"; sid:565501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2flysurvivescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2flysurvivescorona.com"; sid:565502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 407etr-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"407etr-covid-19.com"; sid:565503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcorona.com"; sid:565504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcorona.net"; sid:565505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5mincovidtest.com"; sid:565506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5stepsaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5stepsaftercoronavirus.com"; sid:565507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800corona1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800corona1.com"; sid:565508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800covid19.com"; sid:565509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acadianacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acadianacovid.com"; sid:565510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affectedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affectedbycovid.com"; sid:565511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaclub.com"; sid:565512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaiwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaiwill.com"; sid:565513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid9.com"; sid:565514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidiwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidiwill.com"; sid:565515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcoronavirusnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcoronavirusnineteen.com"; sid:565516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageof-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageof-covid-19.com"; sid:565517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageof-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageof-covid19.com"; sid:565518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovid-19.com"; sid:565519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovid19socialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovid19socialdistancing.com"; sid:565520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageof-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageof-covid.com"; sid:565521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovidsocialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovidsocialdistancing.com"; sid:565522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agevolazionicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agevolazionicovid19.com"; sid:565523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allagainstcovid19.com"; sid:565524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allegegencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allegegencorona.com"; sid:565525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronavirus-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronavirus-19cases.com"; sid:565526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronavirus19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronavirus19cases.com"; sid:565527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronaviruscases.com"; sid:565528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronavirusnineteencases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronavirusnineteencases.com"; sid:565529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid-19cases.com"; sid:565530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid19cases.com"; sid:565531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapandemicprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapandemicprevention.com"; sid:565532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americascovid19.com"; sid:565533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorenlostiemposdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorenlostiemposdelcorona.com"; sid:565534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorycoronavirus.com"; sid:565535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycorona.com"; sid:565536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycoronavirus.com"; sid:565537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid19test.com"; sid:565538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcovid-19.com"; sid:565539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcovid19.com"; sid:565540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcovid-19.net"; sid:565541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcovid19.net"; sid:565542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona-eg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona-eg.com"; sid:565543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronal.com"; sid:565544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.mobi"; sid:565545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirus.world"; sid:565546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfacemask.com"; sid:565547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfacemasks.com"; sid:565548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apollocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apollocovid.com"; sid:565549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appacorona.com"; sid:565550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for app-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"app-corona.com"; sid:565551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprendecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprendecovid19.com"; sid:565552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askmeaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askmeaboutcovid19.com"; sid:565553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistcovid.com"; sid:565554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atomizecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atomizecoronavirus.com"; sid:565555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscovid.com"; sid:565556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotest-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotest-covid-19.com"; sid:565557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19corona.club"; sid:565558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awarecovid.com"; sid:565559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovid19.net"; sid:565560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backaftercovidpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backaftercovidpr.com"; sid:565561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banterracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banterracovid19.com"; sid:565562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for behindthesecretofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"behindthesecretofthecovid19.com"; sid:565563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for behindthesecretofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"behindthesecretofthecovid19.net"; sid:565564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthecullofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthecullofcovid19.com"; sid:565565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthecullofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthecullofcovid19.net"; sid:565566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigalspizzacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigalspizzacorona.com"; sid:565567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billscoronavirus.com"; sid:565568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blog-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blog-coronavirus.com"; sid:565569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncorona.com"; sid:565570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncoronalegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncoronalegal.com"; sid:565571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bot-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bot-covid.com"; sid:565572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bouldercoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bouldercoronaviruscleaning.com"; sid:565573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bouldercovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bouldercovid19cleaning.com"; sid:565574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for braccialicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"braccialicorona.com"; sid:565575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brianandchantlespostpandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brianandchantlespostpandemicparty.com"; sid:565576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinthetimeofcovid.com"; sid:565577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bwcovid.com"; sid:565578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bycovid19.com"; sid:565579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinacoronavirus.com"; sid:565580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinacovid19.com"; sid:565581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calendarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calendarcorona.com"; sid:565582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirusattorneys.com"; sid:565583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canihelpduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canihelpduringcovid19.com"; sid:565584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpay-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpay-coronavirus.com"; sid:565585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpaycoronavirus.com"; sid:565586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpay-coronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpay-coronavirus.life"; sid:565587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpaycoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpaycoronavirus.life"; sid:565588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpay-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpay-coronavirus.net"; sid:565589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpaycoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpaycoronavirus.net"; sid:565590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstcorona.net"; sid:565591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcorona.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcorona.support"; sid:565592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascovid.com"; sid:565593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribbeancoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribbeancoronavirusupdate.com"; sid:565594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribcovid.com"; sid:565595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashpandemic.com"; sid:565596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccoronaclean.com"; sid:565597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccoronaclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccoronaclean.net"; sid:565598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovidclean.com"; sid:565599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovidcleaners.com"; sid:565600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificationcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificationcovid19free.com"; sid:565601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidsafe.com"; sid:565602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeforcorona.com"; sid:565603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chaocovid.com"; sid:565604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check-covid19.com"; sid:565605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chefsbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chefsbeatcorona.com"; sid:565606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chefsbeatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chefsbeatcorona.net"; sid:565607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid20.com"; sid:565608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid.com"; sid:565609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiefcovidofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiefcovidofficer.com"; sid:565610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiefcovidofficer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiefcovidofficer.net"; sid:565611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chpcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chpcovid19response.com"; sid:565612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizensagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizensagainstcoronavirus.com"; sid:565613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycoronaviruscentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycoronaviruscentre.com"; sid:565614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovid19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovid19centre.com"; sid:565615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovidcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovidcentre.com"; sid:565616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid19az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid19az.com"; sid:565617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid19virus.com"; sid:565618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidaz.com"; sid:565619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidbuildingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidbuildingservices.com"; sid:565620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codigoubercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codigoubercovid19.com"; sid:565621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collectif-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collectif-covid19.com"; sid:565622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloringforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloringforcovid.com"; sid:565623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcovidtogetherapart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcovidtogetherapart.com"; sid:565624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comet-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comet-corona.com"; sid:565625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cometcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cometcorona.com"; sid:565626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comet-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comet-covid.com"; sid:565627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cometcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cometcovid.com"; sid:565628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consecuenciascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consecuenciascovid19.com"; sid:565629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consequencescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consequencescovid19.com"; sid:565630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingcorona.com"; sid:565631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscoronavirus.com"; sid:565632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscovid19.com"; sid:565633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscovid.com"; sid:565634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona10k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona10k.com"; sid:565635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-check.com"; sid:565636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19checks.com"; sid:565637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cleaning.com"; sid:565638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-cure.com"; sid:565639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19financing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19financing.com"; sid:565640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19online.com"; sid:565641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19relief.com"; sid:565642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-relief.com"; sid:565643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19relief.com"; sid:565644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19relief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19relief.fund"; sid:565645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19relief.net"; sid:565646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19relief.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19relief.tax"; sid:565647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19screen.com"; sid:565648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.solutions"; sid:565649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19solutions.com"; sid:565650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19spread.com"; sid:565651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19tshirt.com"; sid:565652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19tshirts.com"; sid:565653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020claims.com"; sid:565654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020money.com"; sid:565655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4children.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4children.com"; sid:565656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-accomplishments.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-accomplishments.biz"; sid:565657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-africa.com"; sid:565658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-analyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-analyse.com"; sid:565659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandchillmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandchillmerch.com"; sid:565660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodyscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodyscreening.com"; sid:565661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodyscreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodyscreenings.com"; sid:565662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytesting.com"; sid:565663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantikor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantikor.com"; sid:565664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarzneimittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarzneimittel.com"; sid:565665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaautomotiveplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaautomotiveplaybook.com"; sid:565666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawarness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawarness.com"; sid:565667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaayuda.com"; sid:565668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeatdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeatdown.com"; sid:565669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeschermers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeschermers.com"; sid:565670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabilities.com"; sid:565671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabites.com"; sid:565672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablabla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablabla.com"; sid:565673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabob.com"; sid:565674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabodyguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabodyguard.com"; sid:565675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboomer2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboomer2020.com"; sid:565676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabritain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabritain.com"; sid:565677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrth.com"; sid:565678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesshelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesshelpers.com"; sid:565679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacansuckit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacansuckit.com"; sid:565680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cap.com"; sid:565681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare4u.com"; sid:565682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareguide.com"; sid:565683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaresguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaresguide.com"; sid:565684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashcow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashcow.com"; sid:565685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashflo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashflo.com"; sid:565686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacert.com"; sid:565687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachamps.com"; sid:565688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckapp.com"; sid:565689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-check-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-check-in.com"; sid:565690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck.science"; sid:565691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-check-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-check-up.com"; sid:565692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachugchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachugchallenge.com"; sid:565693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaciller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaciller.com"; sid:565694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaims.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaims.solutions"; sid:565695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningsolutions.com"; sid:565696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanlight.com"; sid:565697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothmask.com"; sid:565698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubhouse.com"; sid:565699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comet.com"; sid:565700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomforts.com"; sid:565701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconscious.com"; sid:565702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consulting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consulting.net"; sid:565703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacottage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacottage.com"; sid:565704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacottage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacottage.net"; sid:565705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverages.com"; sid:565706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19law.com"; sid:565707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19lawyer.com"; sid:565708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19lawyers.com"; sid:565709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19lawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19lawyers.net"; sid:565710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovids.com"; sid:565711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaction.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaction.biz"; sid:565712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuremission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuremission.com"; sid:565713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cuties.com"; sid:565714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacviruscleanup.com"; sid:565715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadadah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadadah.com"; sid:565716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadartsleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadartsleague.com"; sid:565717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadater.com"; sid:565718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaters.com"; sid:565719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealershiplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealershiplaybook.com"; sid:565720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealershipplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealershipplaybook.com"; sid:565721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathtolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathtolls.com"; sid:565722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestroyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestroyer.net"; sid:565723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoctorsnote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoctorsnote.com"; sid:565724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadroga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadroga.com"; sid:565725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrogue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrogue.com"; sid:565726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemploymentattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemploymentattorneys.com"; sid:565727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemploymentlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemploymentlaws.com"; sid:565728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-employment-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-employment-lawyer.com"; sid:565729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaengland.com"; sid:565730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaespana.com"; sid:565731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashiongear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashiongear.com"; sid:565732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeirws.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeirws.cymru"; sid:565733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeirws.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeirws.wales"; sid:565734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafication.com"; sid:565735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.world"; sid:565736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafigure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafigure.com"; sid:565737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree-campaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree-campaign.com"; sid:565738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreenews.com"; sid:565739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.pro"; sid:565740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetee.com"; sid:565741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagearsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagearsupply.com"; sid:565742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageartogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageartogo.com"; sid:565743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gedichte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gedichte.com"; sid:565744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirlz.com"; sid:565745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreatcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreatcleaning.com"; sid:565746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreece.com"; sid:565747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardshield.com"; sid:565748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardshields.com"; sid:565749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guide.net"; sid:565750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guys.com"; sid:565751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hat.com"; sid:565752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealingsong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealingsong.com"; sid:565753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthie.com"; sid:565754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheatmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheatmap.com"; sid:565755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelden.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelden.world"; sid:565756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelfer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelfer.net"; sid:565757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp.world"; sid:565758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheros.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheros.international"; sid:565759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheros.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheros.net"; sid:565760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-fuer-unternehmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-fuer-unternehmen.com"; sid:565761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholland.com"; sid:565762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecoverage.com"; sid:565763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiku.com"; sid:565764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunityscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunityscreening.com"; sid:565765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunityscreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunityscreenings.com"; sid:565766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionreport.com"; sid:565767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancegroup.com"; sid:565768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisblind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisblind.com"; sid:565769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaissance.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaissance.life"; sid:565770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajihad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajihad.com"; sid:565771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaborlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaborlaw.com"; sid:565772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaborlaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaborlaw.net"; sid:565773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalady.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalady.com"; sid:565774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawms.com"; sid:565775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalaidms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalaidms.com"; sid:565776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalaidnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalaidnola.com"; sid:565777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegallcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegallcase.com"; sid:565778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalms.com"; sid:565779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalnola.com"; sid:565780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalquestions.com"; sid:565781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalrelief.com"; sid:565782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivenow.com"; sid:565783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalives.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalives.net"; sid:565784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocums.com"; sid:565785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaltdelete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaltdelete.com"; sid:565786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamediq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamediq.com"; sid:565787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamelongtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamelongtime.com"; sid:565788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamelongtime.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamelongtime.net"; sid:565789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-msb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-msb.com"; sid:565790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamsb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamsb.com"; sid:565791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-msb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-msb.net"; sid:565792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamsb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamsb.net"; sid:565793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamulligan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamulligan.com"; sid:565794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamw.com"; sid:565795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewschannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewschannel.com"; sid:565796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nights.com"; sid:565797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nola.com"; sid:565798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nola.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nola.net"; sid:565799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanola.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanola.net"; sid:565800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanumber.com"; sid:565801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanumber.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanumber.net"; sid:565802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-offensive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-offensive.com"; sid:565803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoffensive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoffensive.com"; sid:565804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapalooza.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapalooza.club"; sid:565805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicaftermath.com"; sid:565806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemiccure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemiccure.com"; sid:565807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemiceffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemiceffects.com"; sid:565808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicimpact.com"; sid:565809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapants.com"; sid:565810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapants.net"; sid:565811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyplan.com"; sid:565812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyplanning.com"; sid:565813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapeakshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapeakshirt.com"; sid:565814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapelis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapelis.com"; sid:565815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapilots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapilots.com"; sid:565816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapluse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapluse.com"; sid:565817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectivedevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectivedevices.com"; sid:565818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapunchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapunchers.com"; sid:565819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapvp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapvp.com"; sid:565820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapvp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapvp.net"; sid:565821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapymes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapymes.com"; sid:565822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinelife.com"; sid:565823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarchia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarchia.com"; sid:565824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareach.com"; sid:565825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefboda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefboda.com"; sid:565826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefsupport.com"; sid:565827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-resistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-resistance.com"; sid:565828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rikon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rikon.com"; sid:565829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarmour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarmour.com"; sid:565830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaro.net"; sid:565831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarooms.com"; sid:565832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safe.net"; sid:565833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbond.com"; sid:565834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-scan.com"; sid:565835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschleier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschleier.com"; sid:565836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz.zone"; sid:565837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-science.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-science.net"; sid:565838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascience.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascience.net"; sid:565839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascotland.com"; sid:565840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashirtshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashirtshop.com"; sid:565841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashotusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashotusa.com"; sid:565842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslayers.com"; sid:565843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sleevemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sleevemask.com"; sid:565844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmask.com"; sid:565845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmasks.com"; sid:565846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltest.com"; sid:565847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolidaritaets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolidaritaets.net"; sid:565848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolo.com"; sid:565849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasourcing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasourcing.com"; sid:565850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspro.com"; sid:565851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastage.com"; sid:565852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastemcell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastemcell.com"; sid:565853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.team"; sid:565854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportservices.com"; sid:565855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorsolutions.com"; sid:565856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomsmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomsmap.com"; sid:565857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatax-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatax-relief.com"; sid:565858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test.center"; sid:565859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-center.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-center.net"; sid:565860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-centrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-centrum.com"; sid:565861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkopen.com"; sid:565862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-zuhause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-zuhause.com"; sid:565863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tipps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tipps.com"; sid:565864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatko.com"; sid:565865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunitedkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunitedkingdom.com"; sid:565866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunitedstates.com"; sid:565867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineco.com"; sid:565868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineworld.com"; sid:565869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccino.com"; sid:565870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacina.com"; sid:565871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaktsina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaktsina.com"; sid:565872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveepilepsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveepilepsi.com"; sid:565873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveepilepsi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveepilepsi.net"; sid:565874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ventures.com"; sid:565875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-victims.com"; sid:565876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirat.com"; sid:565877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirnews.com"; sid:565878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir.today"; sid:565879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19-20.com"; sid:565880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19facemask.com"; sid:565881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19facemasks.com"; sid:565882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.solutions"; sid:565883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2day.com"; sid:565884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus3dprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus3dprinting.com"; sid:565885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvogado.com"; sid:565886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalumni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalumni.com"; sid:565887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalumninetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalumninetwork.com"; sid:565888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamericalatina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamericalatina.com"; sid:565889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandtheeconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandtheeconomy.com"; sid:565890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodyscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodyscreening.com"; sid:565891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodyscreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodyscreenings.com"; sid:565892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietytherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietytherapy.com"; sid:565893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautomotiveplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautomotiveplaybook.com"; sid:565894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautoplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautoplaybook.com"; sid:565895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusautosplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusautosplaybook.com"; sid:565896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusbabies.com"; sid:565897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bankruptcy-california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bankruptcy-california.com"; sid:565898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bk.com"; sid:565899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblackbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblackbook.com"; sid:565900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessclaimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessclaimdenial.com"; sid:565901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionclaim.com"; sid:565902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslossclaim.com"; sid:565903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslossclaims.com"; sid:565904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessloss.com"; sid:565905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslossdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslossdenial.com"; sid:565906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashapp.com"; sid:565907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashguide.com"; sid:565908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashtoolkit.com"; sid:565909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashworkbook.com"; sid:565910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-centers.com"; sid:565911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschangechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschangechallenge.com"; sid:565912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschangechallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschangechallenge.net"; sid:565913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharityarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharityarts.com"; sid:565914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharter.com"; sid:565915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschickensoupforthesoul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschickensoupforthesoul.com"; sid:565916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschild.com"; sid:565917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschildrensbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschildrensbook.com"; sid:565918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaenup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaenup.com"; sid:565919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionclaims.com"; sid:565920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassclaims.com"; sid:565921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningboulder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningboulder.com"; sid:565922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsteamboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsteamboat.com"; sid:565923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommittee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommittee.com"; sid:565924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsequences.com"; sid:565925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoping.com"; sid:565926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-counter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-counter.com"; sid:565927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscovid19.com"; sid:565928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruisedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruisedeath.com"; sid:565929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdealerplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdealerplaybook.com"; sid:565930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathnursinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathnursinghome.com"; sid:565931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-debt-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-debt-relief.com"; sid:565932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasesurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasesurvivor.com"; sid:565933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasesurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasesurvivor.net"; sid:565934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingnewyork.com"; sid:565935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionnewyork.com"; sid:565936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorce911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorce911.com"; sid:565937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorce911.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorce911.net"; sid:565938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrogue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrogue.com"; sid:565939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdroplet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdroplet.com"; sid:565940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdroplets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdroplets.com"; sid:565941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessay.com"; sid:565942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfieldguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfieldguide.com"; sid:565943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialapp.com"; sid:565944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialguide.com"; sid:565945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialtoolkit.com"; sid:565946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialworkbook.com"; sid:565947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforbearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforbearance.com"; sid:565948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforo.com"; sid:565949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-forthepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-forthepeople.com"; sid:565950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfromunitedstatesofamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfromunitedstatesofamerica.com"; sid:565951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundingus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundingus.com"; sid:565952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguardshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguardshield.com"; sid:565953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguardshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguardshields.com"; sid:565954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazardousmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazardousmitigation.com"; sid:565955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazardousremediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazardousremediation.com"; sid:565956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebuyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebuyer.com"; sid:565957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebuyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebuyers.com"; sid:565958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hygiene.com"; sid:565959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpfstoff.com"; sid:565960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinterruption.com"; sid:565961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinterruptioninsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinterruptioninsuranceclaims.com"; sid:565962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiop.com"; sid:565963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-last.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-last.com"; sid:565964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitco.com"; sid:565965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitfl.com"; sid:565966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitflorida.com"; sid:565967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitinfo.com"; sid:565968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersdallas.com"; sid:565969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyershouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyershouston.com"; sid:565970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersla.com"; sid:565971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersphiladelphia.com"; sid:565972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersphoenix.com"; sid:565973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lifeinsurance.com"; sid:565974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslife-insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslife-insurance.com"; sid:565975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivinglife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivinglife.com"; sid:565976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloansonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloansonline.com"; sid:565977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocums.com"; sid:565978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadeinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadeinusa.com"; sid:565979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-malpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-malpractice.com"; sid:565980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksforall.com"; sid:565981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.tips"; sid:565982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalsuppliers.com"; sid:565983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorialgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorialgardens.com"; sid:565984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorialquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorialquilt.com"; sid:565985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmisting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmisting.com"; sid:565986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mitigation.com"; sid:565987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmitigationflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmitigationflorida.com"; sid:565988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusml.com"; sid:565989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyadvice.com"; sid:565990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyapp.com"; sid:565991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyguide.com"; sid:565992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyhelp.com"; sid:565993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneytoolkit.com"; sid:565994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyworkbook.com"; sid:565995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmosquitoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmosquitoes.com"; sid:565996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewday.com"; sid:565997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsstory.com"; sid:565998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnineteenfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnineteenfacemask.com"; sid:565999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnineteenfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnineteenfacemasks.com"; sid:566000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusobits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusobits.com"; sid:566001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoptin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoptin.com"; sid:566002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoptout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoptout.com"; sid:566003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeptides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeptides.com"; sid:566004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaster.com"; sid:566005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquilt.com"; sid:566006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreclamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreclamo.com"; sid:566007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreclamodeseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreclamodeseguro.com"; sid:566008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreclamoseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreclamoseguro.com"; sid:566009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverycoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverycoach.com"; sid:566010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-relief.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-relief.center"; sid:566011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.center"; sid:566012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.tax"; sid:566013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrents.com"; sid:566014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretailproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretailproducts.com"; sid:566015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretailsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretailsafety.com"; sid:566016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyglasses.com"; sid:566017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussf.net"; sid:566018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopinglist.com"; sid:566019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulus.net"; sid:566020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-suit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-suit.com"; sid:566021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurgery.com"; sid:566022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.fund"; sid:566023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorfund.com"; sid:566024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivors.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivors.fund"; sid:566025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorsfund.com"; sid:566026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustax.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustax.center"; sid:566027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tax.com"; sid:566028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustax.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustax.expert"; sid:566029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxlawyer.com"; sid:566030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustax.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustax.solutions"; sid:566031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.center"; sid:566032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting-nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting-nearme.com"; sid:566033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.solutions"; sid:566034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.support"; sid:566035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustr.net"; sid:566036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacina.com"; sid:566037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaksin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaksin.com"; sid:566038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaktsina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaktsina.com"; sid:566039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.voyage"; sid:566040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswakuchin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswakuchin.com"; sid:566041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswidows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswidows.com"; sid:566042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldometer.com"; sid:566043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworries.com"; sid:566044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworry.com"; sid:566045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlive.com"; sid:566046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorce.com"; sid:566047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawakuchin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawakuchin.com"; sid:566048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashingmachinerepairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashingmachinerepairs.com"; sid:566049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawefight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawefight.com"; sid:566050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkclaims.com"; sid:566051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawrap.com"; sid:566052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawraps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawraps.com"; sid:566053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zeit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zeit.com"; sid:566054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazeit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazeit.com"; sid:566055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikalaw.com"; sid:566056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazikalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazikalawyer.com"; sid:566057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coughagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coughagainstcovid.com"; sid:566058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coughagainstcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coughagainstcovid.net"; sid:566059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counter-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counter-corona.com"; sid:566060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counterpandemic.com"; sid:566061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covenicovidicovici.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covenicovidicovici.com"; sid:566062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covercovid.com"; sid:566063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-01.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-01.com"; sid:566064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-0.com"; sid:566065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1000.com"; sid:566066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-100.com"; sid:566067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-10cashapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-10cashapp.com"; sid:566068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-11.com"; sid:566069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-12.com"; sid:566070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-14.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-14.com"; sid:566071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-15.com"; sid:566072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-16.com"; sid:566073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-190.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-190.com"; sid:566074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-20.com"; sid:566075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192.com"; sid:566076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid193dprintingefforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid193dprintingefforts.com"; sid:566077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-199.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-199.com"; sid:566078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aas.com"; sid:566079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19abogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19abogado.com"; sid:566080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advocate.com"; sid:566081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andibuprofenrhsnopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andibuprofenrhsnopes.com"; sid:566082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19announcements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19announcements.com"; sid:566083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestingonline.com"; sid:566084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytest.net"; sid:566085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anxietyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anxietyrelief.com"; sid:566086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assistance.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assistance.care"; sid:566087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assistance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assistance.claims"; sid:566088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistanceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistanceprogram.com"; sid:566089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19audit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19audit.net"; sid:566090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19authority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19authority.com"; sid:566091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19automotive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19automotive.com"; sid:566092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19automotiveplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19automotiveplaybook.com"; sid:566093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19awerenessnewssite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19awerenessnewssite.com"; sid:566094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bandana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bandana.com"; sid:566095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyla.com"; sid:566096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcynyc.com"; sid:566097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banners.com"; sid:566098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19b-business-stimulusloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19b-business-stimulusloanassistance.com"; sid:566099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19b-business-stimulusloanassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19b-business-stimulusloanassistance.net"; sid:566100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19beatdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19beatdown.com"; sid:566101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beatdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beatdown.com"; sid:566102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boomers.com"; sid:566103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brain.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brain.cloud"; sid:566104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brain.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brain.guru"; sid:566105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brain.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brain.services"; sid:566106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brain.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brain.world"; sid:566107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breakdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breakdown.com"; sid:566108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessclaimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessclaimdenial.com"; sid:566109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessclaimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessclaimdenial.com"; sid:566110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionclaim.com"; sid:566111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessloanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessloanhelp.com"; sid:566112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslossclaim.com"; sid:566113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslossclaim.com"; sid:566114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslossclaims.com"; sid:566115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslossclaims.com"; sid:566116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslossdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslossdenial.com"; sid:566117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslossdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslossdenial.com"; sid:566118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessnews.com"; sid:566119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessresponse.com"; sid:566120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cameras.com"; sid:566121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capitalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capitalcleaning.com"; sid:566122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careguide.com"; sid:566123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caresguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caresguide.com"; sid:566124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cases.net"; sid:566125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashapp.com"; sid:566126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cashguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cashguide.com"; sid:566127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashguide.com"; sid:566128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cashtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cashtoolkit.com"; sid:566129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashtoolkit.com"; sid:566130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cashworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cashworkbook.com"; sid:566131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashworkbook.com"; sid:566132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19channel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19channel.com"; sid:566133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ci.com"; sid:566134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionclaims.com"; sid:566135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classclaims.com"; sid:566136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsteamboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsteamboat.com"; sid:566137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanny.com"; sid:566138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanny.com"; sid:566139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19closures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19closures.com"; sid:566140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothmask.com"; sid:566141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothmask.net"; sid:566142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleaners.com"; sid:566143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialtesting.com"; sid:566144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19committee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19committee.com"; sid:566145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19company.com"; sid:566146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantrestaurants.com"; sid:566147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19confirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19confirm.com"; sid:566148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consequences.com"; sid:566149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conspiracycon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conspiracycon.com"; sid:566150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.construction - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.construction"; sid:566151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contractors.com"; sid:566152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirusmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirusmitigation.com"; sid:566153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusmitigation.com"; sid:566154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusstatus.com"; sid:566155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirustesting.com"; sid:566156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counselors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counselors.com"; sid:566157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-course.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-course.com"; sid:566158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19courses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19courses.com"; sid:566159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19courses.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19courses.net"; sid:566160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covers.com"; sid:566161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cruise.com"; sid:566162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cruisedeathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cruisedeathattorney.com"; sid:566163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datamap.com"; sid:566164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataredenderer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataredenderer.com"; sid:566165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datas.com"; sid:566166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dating.com"; sid:566167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathnursinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathnursinghome.com"; sid:566168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19defender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19defender.com"; sid:566169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19designerfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19designerfacemask.com"; sid:566170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19designerfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19designerfacemasks.com"; sid:566171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19designermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19designermask.com"; sid:566172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19designermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19designermasks.com"; sid:566173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19device.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19device.com"; sid:566174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19die.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19die.com"; sid:566175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disasterhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disasterhelp.com"; sid:566176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionservices.net"; sid:566177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doctorlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doctorlawsuit.com"; sid:566178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doctorsnote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doctorsnote.com"; sid:566179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drc.com"; sid:566180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19droplet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19droplet.com"; sid:566181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19droplet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19droplet.com"; sid:566182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19education.com"; sid:566183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-education.com"; sid:566184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentfacts.com"; sid:566185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentlaws.com"; sid:566186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ensemble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ensemble.com"; sid:566187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ensemble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ensemble.com"; sid:566188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ensemble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ensemble.com"; sid:566189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ensemble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ensemble.com"; sid:566190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19estatesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19estatesale.com"; sid:566191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19evaluations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19evaluations.com"; sid:566192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exclusivepromotionetflix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exclusivepromotionetflix.com"; sid:566193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facecover.com"; sid:566194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facecovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facecovers.com"; sid:566195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facemasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facemasksforsale.com"; sid:566196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-face-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-face-shield.com"; sid:566197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fashionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fashionmask.com"; sid:566198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fieldguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fieldguide.com"; sid:566199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fieldguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fieldguide.com"; sid:566200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialapp.com"; sid:566201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialapp.com"; sid:566202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialguide.com"; sid:566203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialguide.com"; sid:566204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialtoolkit.com"; sid:566205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialtoolkit.com"; sid:566206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialworkbook.com"; sid:566207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialworkbook.com"; sid:566208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-food.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-food.com"; sid:566209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foro.com"; sid:566210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-forthepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-forthepeople.com"; sid:566211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foxnewslawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foxnewslawsuits.com"; sid:566212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foxnewssettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foxnewssettlements.com"; sid:566213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecertification.com"; sid:566214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeshowings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeshowings.com"; sid:566215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19furlong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19furlong.com"; sid:566216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalcure.com"; sid:566217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalstop.com"; sid:566218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graphics.com"; sid:566219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-guard.com"; sid:566220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guards.com"; sid:566221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guru.net"; sid:566222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guyana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guyana.com"; sid:566223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handwash.com"; sid:566224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazardousmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazardousmitigation.com"; sid:566225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazardousremediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazardousremediation.com"; sid:566226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazardtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazardtesting.com"; sid:566227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpandinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpandinformation.com"; sid:566228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpinformation.com"; sid:566229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.life"; sid:566230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homebuyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homebuyer.com"; sid:566231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebuyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebuyer.com"; sid:566232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homebuyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homebuyers.com"; sid:566233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebuyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebuyers.com"; sid:566234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19home.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19home.loan"; sid:566235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalbox.com"; sid:566236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inamerica.com"; sid:566237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innigeria.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innigeria.net"; sid:566238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insights.net"; sid:566239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ins.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ins.net"; sid:566240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insuranceclaim.com"; sid:566241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurance.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurance.expert"; sid:566242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurance.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurance.expert"; sid:566243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurance.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurance.guru"; sid:566244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelcaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelcaim.com"; sid:566245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceloss.com"; sid:566246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interruptioninsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interruptioninsuranceclaims.com"; sid:566247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iop.com"; sid:566248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isurvived.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isurvived.com"; sid:566249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepsafe.com"; sid:566250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepsafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepsafe.net"; sid:566251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kindness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kindness.net"; sid:566252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kingdom.com"; sid:566253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborlawyers.com"; sid:566254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-latest.com"; sid:566255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawfirms.com"; sid:566256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirms.com"; sid:566257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.legal"; sid:566258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laws.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laws.legal"; sid:566259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuitflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuitflorida.com"; sid:566260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitflorida.com"; sid:566261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuitinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuitinfo.com"; sid:566262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerflorida.com"; sid:566263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerorlando.com"; sid:566264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19leaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19leaders.com"; sid:566265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lefilm.com"; sid:566266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lefilm.com"; sid:566267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaldefense.com"; sid:566268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresourcecenter.com"; sid:566269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresourcecenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresourcecenter.net"; sid:566270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalservice.com"; sid:566271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalservices.com"; sid:566272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19localresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19localresources.com"; sid:566273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19location.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19location.com"; sid:566274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19locums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19locums.com"; sid:566275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lossclaims.com"; sid:566276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19madeinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19madeinusa.com"; sid:566277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskarade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskarade.com"; sid:566278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maskprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maskprovider.com"; sid:566279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masksurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masksurplus.com"; sid:566280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmasks.com"; sid:566281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorialpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorialpage.com"; sid:566282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorialwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorialwall.com"; sid:566283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19messages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19messages.com"; sid:566284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19misr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19misr.com"; sid:566285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mitigation.com"; sid:566286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mitigation.com"; sid:566287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigationflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigationflorida.com"; sid:566288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mix.com"; sid:566289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobility.com"; sid:566290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19moneyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19moneyapp.com"; sid:566291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneyapp.com"; sid:566292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19moneyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19moneyguide.com"; sid:566293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneyguide.com"; sid:566294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19moneytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19moneytoolkit.com"; sid:566295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneytoolkit.com"; sid:566296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19moneyworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19moneyworkbook.com"; sid:566297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneyworkbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneyworkbook.com"; sid:566298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19msb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19msb.com"; sid:566299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-msb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-msb.com"; sid:566300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msb.com"; sid:566301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19msb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19msb.net"; sid:566302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-msb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-msb.net"; sid:566303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msb.net"; sid:566304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newslink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newslink.com"; sid:566305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-news.net"; sid:566306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsonline.net"; sid:566307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsstory.com"; sid:566308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news-updates.com"; sid:566309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomeinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomeinjurylawyer.com"; sid:566310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19of2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19of2019.com"; sid:566311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinememorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinememorial.com"; sid:566312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinetraining.com"; sid:566313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opoly.com"; sid:566314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19optin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19optin.com"; sid:566315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19optout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19optout.com"; sid:566316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outlaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outlaster.com"; sid:566317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemiccure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemiccure.com"; sid:566318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ph.com"; sid:566319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-plan-b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-plan-b.com"; sid:566320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plaster.com"; sid:566321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pledge.com"; sid:566322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pledge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pledge.net"; sid:566323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pledge.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pledge.world"; sid:566324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pndmic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pndmic.com"; sid:566325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poc.com"; sid:566326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poct.com"; sid:566327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policywatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policywatch.net"; sid:566328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppekit.com"; sid:566329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppekit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppekit.net"; sid:566330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prayerrequests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prayerrequests.com"; sid:566331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19presents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19presents.com"; sid:566332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19professionalcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19professionalcleaners.com"; sid:566333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantined.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantined.life"; sid:566334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19r1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19r1.com"; sid:566335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rainbows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rainbows.com"; sid:566336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidresults.com"; sid:566337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapids.com"; sid:566338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapids.net"; sid:566339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reach.com"; sid:566340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehberi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehberi.com"; sid:566341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relief.credit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relief.credit"; sid:566342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relief.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relief.tax"; sid:566343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remember.com"; sid:566344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentalfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentalfree.com"; sid:566345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentalrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentalrestrictions.com"; sid:566346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentalsteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentalsteps.com"; sid:566347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescuecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescuecenter.com"; sid:566348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19residentialcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19residentialcleaners.com"; sid:566349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-resources.com"; sid:566350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourceteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourceteam.com"; sid:566351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourceteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourceteam.net"; sid:566352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratorydezinfekcia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratorydezinfekcia.com"; sid:566353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response-native.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response-native.com"; sid:566354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response.team"; sid:566355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19responseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19responseteam.com"; sid:566356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantcompliant.com"; sid:566357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restaurants.com"; sid:566358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reviewsguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reviewsguide.com"; sid:566359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roundup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roundup.com"; sid:566360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rx.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rx.biz"; sid:566361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecertification.com"; sid:566362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecertified.com"; sid:566363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safer.com"; sid:566364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycertification.com"; sid:566365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetygear.com"; sid:566366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyglasses.com"; sid:566367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetytraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetytraining.com"; sid:566368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salesacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salesacademy.com"; sid:566369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanatizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanatizing.com"; sid:566370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanatizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanatizing.com"; sid:566371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanitizers.com"; sid:566372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaclassaction.com"; sid:566373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sba.com"; sid:566374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scars.com"; sid:566375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scarves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scarves.com"; sid:566376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-schutz.com"; sid:566377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scompensation.com"; sid:566378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screwballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screwballs.com"; sid:566379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scrubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scrubs.com"; sid:566380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-security-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-security-shield.com"; sid:566381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfchecker.com"; sid:566382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19servpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19servpro.com"; sid:566383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signs.net"; sid:566384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-singles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-singles.com"; sid:566385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sixfeetaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sixfeetaway.com"; sid:566386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sixfeetaway.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sixfeetaway.net"; sid:566387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneltest.com"; sid:566388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancingfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancingfacts.com"; sid:566389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancingnow.com"; sid:566390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solved.com"; sid:566391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19speed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19speed.com"; sid:566392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srilanka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srilanka.com"; sid:566393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stemcell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stemcell.com"; sid:566394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulasprogramassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulasprogramassistance.com"; sid:566395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulasprogramassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulasprogramassistance.net"; sid:566396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimuluschecks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimuluschecks.net"; sid:566397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusloanassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusloanassistance.com"; sid:566398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusloanassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusloanassistance.net"; sid:566399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulus.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulus.loans"; sid:566400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusloans.com"; sid:566401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusloans.net"; sid:566402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockfootage.com"; sid:566403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockvideo.com"; sid:566404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-strong.com"; sid:566405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-summit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-summit.net"; sid:566406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplylink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplylink.com"; sid:566407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.legal"; sid:566408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19support.net"; sid:566409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-taxconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-taxconsulting.com"; sid:566410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testflorida.com"; sid:566411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingorlando.com"; sid:566412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testings.com"; sid:566413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testkitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testkitnow.com"; sid:566414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testn5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testn5.com"; sid:566415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-themovie.com"; sid:566416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thesecret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thesecret.com"; sid:566417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thesecret.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thesecret.net"; sid:566418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracers.com"; sid:566419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackersoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackersoftware.com"; sid:566420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trainer.com"; sid:566421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trainers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trainers.com"; sid:566422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traker.com"; sid:566423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tribute.com"; sid:566424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustedadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustedadvisors.com"; sid:566425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ts.com"; sid:566426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unitelight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unitelight.com"; sid:566427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unmasked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unmasked.com"; sid:566428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19updates2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19updates2020.com"; sid:566429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvpro.com"; sid:566430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veepilepsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veepilepsi.com"; sid:566431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veepilepsi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veepilepsi.net"; sid:566432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viral.com"; sid:566433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusjobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusjobloss.com"; sid:566434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslawsuite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslawsuite.com"; sid:566435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusppe.com"; sid:566436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusvaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusvaccine.net"; sid:566437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visitor.com"; sid:566438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.voyage"; sid:566439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wefight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wefight.com"; sid:566440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-who.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-who.biz"; sid:566441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workforce.com"; sid:566442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldstats.com"; sid:566443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worries.com"; sid:566444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worries.com"; sid:566445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worry.com"; sid:566446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wristband.com"; sid:566447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wuhantonewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wuhantonewyork.com"; sid:566448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-yemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-yemen.com"; sid:566449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019-info.com"; sid:566450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019live.com"; sid:566451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019mask.com"; sid:566452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.club"; sid:566453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020shields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020shields.com"; sid:566454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-38.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-38.com"; sid:566455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-39.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-39.com"; sid:566456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-3.com"; sid:566457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-4.com"; sid:566458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-5.com"; sid:566459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5gplandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5gplandemic.com"; sid:566460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid--69.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid--69.com"; sid:566461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-6.com"; sid:566462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-8.com"; sid:566463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabuse.com"; sid:566464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactiondz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactiondz.com"; sid:566465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafghanistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafghanistan.com"; sid:566466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaga.com"; sid:566467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida.life"; sid:566468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappolo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappolo.com"; sid:566469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchitect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchitect.com"; sid:566470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-architecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-architecture.com"; sid:566471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchitecture.com"; sid:566472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchitecture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchitecture.net"; sid:566473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmoured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmoured.com"; sid:566474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartla.com"; sid:566475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartmuseum.com"; sid:566476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassholes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassholes.com"; sid:566477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-assistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-assistance.com"; sid:566478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistnow.com"; sid:566479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidator.com"; sid:566480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautomotive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautomotive.com"; sid:566481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautomotiveplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautomotiveplaybook.com"; sid:566482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautoplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautoplaybook.com"; sid:566483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautosplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautosplaybook.com"; sid:566484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-baiak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-baiak.com"; sid:566485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidballs.com"; sid:566486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandana.com"; sid:566487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyattorneys.com"; sid:566488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcylawyer.com"; sid:566489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcy.net"; sid:566490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackbook.com"; sid:566491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblockers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblockers.com"; sid:566492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbox19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbox19.com"; sid:566493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboxes.com"; sid:566494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessadaptationprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessadaptationprogram.com"; sid:566495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessclaimdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessclaimdenial.com"; sid:566496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessclaim.net"; sid:566497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruption.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruption.net"; sid:566498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslossclaim.com"; sid:566499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslossclaims.com"; sid:566500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslossdenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslossdenial.com"; sid:566501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcakes.com"; sid:566502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-california.com"; sid:566503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamnorte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamnorte.com"; sid:566504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalcleaning.com"; sid:566505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardgame.com"; sid:566506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregivers.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregivers.support"; sid:566507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashrelief.com"; sid:566508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcat.net"; sid:566509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcert.net"; sid:566510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchances.com"; sid:566511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchat.net"; sid:566512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chic.com"; sid:566513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchic.net"; sid:566514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchugchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchugchallenge.com"; sid:566515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimla.com"; sid:566516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.dog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.dog"; sid:566517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.engineering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.engineering"; sid:566518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaner.net"; sid:566519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.expert"; sid:566520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanny.com"; sid:566521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansb.com"; sid:566522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansb.net"; sid:566523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothingco.com"; sid:566524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothmask.com"; sid:566525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothmask.net"; sid:566526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolab.com"; sid:566527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolab.net"; sid:566528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-comeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-comeback.com"; sid:566529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-comet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-comet.com"; sid:566530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfort.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfort.net"; sid:566531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfidence.com"; sid:566532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfirm.com"; sid:566533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.biz"; sid:566534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coverguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coverguard.com"; sid:566535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcream.com"; sid:566536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcred.com"; sid:566537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisconsulting.com"; sid:566538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisismarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisismarketing.com"; sid:566539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcron.com"; sid:566540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushed.com"; sid:566541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrusher.com"; sid:566542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcsal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcsal.com"; sid:566543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cupid.com"; sid:566544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcups.com"; sid:566545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailylife.com"; sid:566546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dater.com"; sid:566547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dating.com"; sid:566548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeception.com"; sid:566549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-design.com"; sid:566550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesigners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesigners.com"; sid:566551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddestroyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddestroyers.com"; sid:566552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-detectiondog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-detectiondog.com"; sid:566553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-direct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-direct.com"; sid:566554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisasterfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisasterfunds.com"; sid:566555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-divorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-divorce.com"; sid:566556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcehelp.com"; sid:566557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctorcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctorcare.com"; sid:566558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctorexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctorexam.com"; sid:566559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide-20.com"; sid:566560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomicloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomicloss.com"; sid:566561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-em.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-em.com"; sid:566562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyresources.com"; sid:566563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-em.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-em.net"; sid:566564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemon.com"; sid:566565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosandphotography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosandphotography.com"; sid:566566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosandphotography.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosandphotography.net"; sid:566567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidependent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidependent.com"; sid:566568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-europrotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-europrotection.com"; sid:566569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevil.com"; sid:566570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemasks.net"; sid:566571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfastfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfastfacts.com"; sid:566572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforbusinessbingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforbusinessbingo.com"; sid:566573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforo.com"; sid:566574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedates.com"; sid:566575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreematch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreematch.com"; sid:566576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfront.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfront.com"; sid:566577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfurlough.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfurlough.club"; sid:566578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfurlough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfurlough.com"; sid:566579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamenight.com"; sid:566580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgearsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgearsupply.com"; sid:566581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeartogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeartogo.com"; sid:566582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgendered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgendered.com"; sid:566583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenius.com"; sid:566584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgil.com"; sid:566585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgirls.com"; sid:566586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgiveback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgiveback.com"; sid:566587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgratitude.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgratitude.today"; sid:566588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgriefgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgriefgroups.com"; sid:566589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardfund.com"; sid:566590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsanitizers.com"; sid:566591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthsupplies.com"; sid:566592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-here.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-here.com"; sid:566593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhint.com"; sid:566594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhints.com"; sid:566595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-homecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-homecare.com"; sid:566596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalbox.com"; sid:566597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidi19italia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidi19italia.com"; sid:566598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidi19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidi19world.com"; sid:566599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianwalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianwalks.com"; sid:566600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunepass.com"; sid:566601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnova.com"; sid:566602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaim.net"; sid:566603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancehelp.com"; sid:566604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceloss.com"; sid:566605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptioninsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptioninsuranceclaims.com"; sid:566606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruption.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruption.net"; sid:566607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinusa.com"; sid:566608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.investments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.investments"; sid:566609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiop.com"; sid:566610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.world"; sid:566611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditalia19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditalia19.com"; sid:566612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditis.com"; sid:566613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditrack.com"; sid:566614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditrak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditrak.com"; sid:566615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjewelrycleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjewelrycleanse.com"; sid:566616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs.net"; sid:566617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjuridique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjuridique.com"; sid:566618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkenyafund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkenyafund.com"; sid:566619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillersanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillersanitizer.com"; sid:566620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkindness.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkindness.life"; sid:566621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyershawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyershawaii.com"; sid:566622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersmassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersmassachusetts.com"; sid:566623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalassistance.com"; sid:566624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlenderlink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlenderlink.com"; sid:566625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleverage.com"; sid:566626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlossclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlossclaims.com"; sid:566627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpracticeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpracticeattorney.com"; sid:566628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskmaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskmaker.com"; sid:566629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmba.com"; sid:566630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalgear.com"; sid:566631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalkit.com"; sid:566632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalkits.com"; sid:566633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsupply.com"; sid:566634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialquilt.com"; sid:566635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessages.com"; sid:566636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeterkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeterkit.com"; sid:566637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-msb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-msb.com"; sid:566638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmsb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmsb.com"; sid:566639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-msb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-msb.net"; sid:566640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmsb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmsb.net"; sid:566641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmt2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmt2.com"; sid:566642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-museum.com"; sid:566643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-near-me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-near-me.com"; sid:566644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsdaily.com"; sid:566645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsstory.com"; sid:566646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsupdate.com"; sid:566647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenmedicine.com"; sid:566648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenselfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenselfquarantine.com"; sid:566649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnonsurgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnonsurgicalmask.com"; sid:566650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidograph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidograph.com"; sid:566651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinetherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinetherapy.com"; sid:566652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverview.com"; sid:566653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemia.com"; sid:566654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicaftermath.com"; sid:566655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparty2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparty2020.com"; sid:566656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparty2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparty2020.net"; sid:566657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpediabd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpediabd.com"; sid:566658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidposzkodowani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidposzkodowani.com"; sid:566659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreps.com"; sid:566660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsa.com"; sid:566661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquilt.com"; sid:566662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrads.com"; sid:566663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrain.com"; sid:566664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidraise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidraise.com"; sid:566665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestatesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestatesales.com"; sid:566666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefproject.net"; sid:566667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescuecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescuecheck.com"; sid:566668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescuemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescuemoney.com"; sid:566669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchcompany.com"; sid:566670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreturn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreturn.com"; sid:566671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevenueloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevenueloss.com"; sid:566672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrone.com"; sid:566673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeofficespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeofficespace.com"; sid:566674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafespace.com"; sid:566675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeworkspace.com"; sid:566676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaver.com"; sid:566677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbappp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbappp.com"; sid:566678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.biz"; sid:566679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-schutz.com"; sid:566680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsd.com"; sid:566681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsearcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsearcher.com"; sid:566682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecondline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecondline.com"; sid:566683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfquarantine.com"; sid:566684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-serology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-serology.com"; sid:566685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserology.com"; sid:566686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-serology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-serology.net"; sid:566687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserology.net"; sid:566688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sessions.com"; sid:566689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshero.com"; sid:566690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheros.com"; sid:566691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-simulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-simulation.com"; sid:566692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-simulation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-simulation.net"; sid:566693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsingle.com"; sid:566694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.singles"; sid:566695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-singles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-singles.com"; sid:566696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialdistancingfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialdistancingfacts.com"; sid:566697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-spreader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-spreader.com"; sid:566698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstimulusloans.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstimulusloans.net"; sid:566699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore365.com"; sid:566700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudentresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudentresources.com"; sid:566701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-support-inc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-support-inc.net"; sid:566702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsolutions.com"; sid:566703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtav.com"; sid:566704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtech.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtech.digital"; sid:566705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tested.com"; sid:566706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtested.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtested.net"; sid:566707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelcheck.com"; sid:566708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtribute.com"; sid:566709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidts.com"; sid:566710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdatesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdatesnow.com"; sid:566711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusaftermath.com"; sid:566712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirususa.com"; sid:566713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteer.net"; sid:566714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarrior.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarrior.net"; sid:566715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashnetwork.com"; sid:566716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashservices.com"; sid:566717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwastetracking.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwastetracking.world"; sid:566718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebdesign.com"; sid:566719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwipedown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwipedown.com"; sid:566720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwithmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwithmylife.com"; sid:566721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkfromhomeparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkfromhomeparent.com"; sid:566722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworksafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworksafe.com"; sid:566723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixart.com"; sid:566724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixcleaners.com"; sid:566725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxraydetector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxraydetector.com"; sid:566726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createworkyoulove-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createworkyoulove-covid19.com"; sid:566727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createworkyoulove-postcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createworkyoulove-postcovid19.com"; sid:566728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidphx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidphx.com"; sid:566729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cullofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cullofthecovid19.com"; sid:566730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cullofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cullofthecovid19.net"; sid:566731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cullofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cullofthecovid.com"; sid:566732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cullofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cullofthecovid.net"; sid:566733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultofthecovid.com"; sid:566734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultofthecovid.net"; sid:566735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcoronavirusmask.com"; sid:566736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cypruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cypruscovid19.com"; sid:566737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dashboardcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dashboardcoronavirus.com"; sid:566738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for databasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"databasecovid19.com"; sid:566739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datacovid.net"; sid:566740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringcovid.com"; sid:566741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcoronavirus.com"; sid:566742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtscoronavirus.com"; sid:566743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovider.com"; sid:566744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcleancovid.com"; sid:566745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcovid2020.com"; sid:566746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronaviruscleaning.com"; sid:566747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescovid-19.com"; sid:566748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescovid19.com"; sid:566749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus-covid19.com"; sid:566750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcoviddrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcoviddrive.com"; sid:566751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difesacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difesacoronavirus.com"; sid:566752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcorona19.com"; sid:566753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovid.net"; sid:566754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidvirus.com"; sid:566755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divertcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divertcovid.com"; sid:566756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorceduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorceduringcorona.com"; sid:566757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donationcovid19.com"; sid:566758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dossier-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dossier-covid-19.com"; sid:566759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpinocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpinocovid.com"; sid:566760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drdcovidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drdcovidbook.com"; sid:566761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drogacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drogacorona.com"; sid:566762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drogacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drogacoronavirus.com"; sid:566763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dudesovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dudesovercovid.com"; sid:566764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthpandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthpandemicday.com"; sid:566765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatadickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatadickcovid.com"; sid:566766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecuadorcoronavirusbodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecuadorcoronavirusbodies.com"; sid:566767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorentiemposdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorentiemposdelcorona.com"; sid:566768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenciacovid19-elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenciacovid19-elsalvador.com"; sid:566769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenzacovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenzacovid.cloud"; sid:566770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidplatform.com"; sid:566771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidplatform.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidplatform.net"; sid:566772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidtrial.com"; sid:566773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidtrial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidtrial.net"; sid:566774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ending-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ending-covid19.com"; sid:566775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endurecovid19.com"; sid:566776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemble-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemble-covid-19.com"; sid:566777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemble-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemble-covid19.com"; sid:566778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemblecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemblecovid-19.com"; sid:566779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemblecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemblecovid19.com"; sid:566780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicapparelco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicapparelco.com"; sid:566781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicaprl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicaprl.com"; sid:566782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicexperts.com"; sid:566783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epilepsivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epilepsivecorona.com"; sid:566784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epilepsivecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epilepsivecorona.net"; sid:566785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epilepsivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epilepsivecovid19.com"; sid:566786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epilepsivecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epilepsivecovid19.net"; sid:566787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiodiasporacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiodiasporacovid.com"; sid:566788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for euro-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"euro-corona.com"; sid:566789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exit-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exit-corona.com"; sid:566790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exit-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exit-corona.net"; sid:566791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitcorona.net"; sid:566792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskforcorona.com"; sid:566793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceoffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceoffcorona.com"; sid:566794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceoffcovid19.com"; sid:566795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facescovid19.com"; sid:566796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshieldcovid19.com"; sid:566797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallecidoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallecidoscovid19.com"; sid:566798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fb-covid-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fb-covid-resources.com"; sid:566799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid-19mke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid-19mke.com"; sid:566800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearpandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearpandemicbook.com"; sid:566801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusppe.com"; sid:566802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid-19mask.com"; sid:566803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid-19virus.com"; sid:566804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid2020.com"; sid:566805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fimdocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fimdocovid19.com"; sid:566806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidhelp.com"; sid:566807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findelcovid19.com"; sid:566808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finedelcovid19.com"; sid:566809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponderscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponderscovid19.com"; sid:566810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitness-vs-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitness-vs-pandemic.com"; sid:566811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19loanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19loanhelp.com"; sid:566812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidclaims.com"; sid:566813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flyaftercorona.com"; sid:566814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondoscovid.com"; sid:566815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foreningenforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foreningenforcovid-19.com"; sid:566816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fourniturecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fourniturecovid.com"; sid:566817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusfacemask.com"; sid:566818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusstockfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusstockfootage.com"; sid:566819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusstockvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusstockvideo.com"; sid:566820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusvideo.com"; sid:566821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19stockfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19stockfootage.com"; sid:566822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19stockfootage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19stockfootage.com"; sid:566823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19stockvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19stockvideo.com"; sid:566824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freedomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freedomcovid19.com"; sid:566825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freepandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freepandemicbook.com"; sid:566826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronas.com"; sid:566827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovideo.com"; sid:566828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fullyprotectedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fullyprotectedcovid19.com"; sid:566829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxxxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxxxcorona.com"; sid:566830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fycovid19.com"; sid:566831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getawaycovid.com"; sid:566832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19mask.com"; sid:566833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testnow.com"; sid:566834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfunding.com"; sid:566835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestnow.com"; sid:566836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcovid19test.com"; sid:566837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalinstituteofpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalinstituteofpandemics.com"; sid:566838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicday.com"; sid:566839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemiclife.com"; sid:566840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicnetwork.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicnetwork.cloud"; sid:566841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicsgroup.com"; sid:566842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemics.net"; sid:566843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goawaycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goawaycovid-19.com"; sid:566844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for go-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"go-corona.net"; sid:566845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gopandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gopandemiclife.com"; sid:566846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for governmentcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"governmentcovidcheck.com"; sid:566847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for governmentcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"governmentcovidmoney.com"; sid:566848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcorona.com"; sid:566849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatnewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatnewscovid19.com"; sid:566850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hamptonscovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hamptonscovidmasks.com"; sid:566851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbo4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbo4covid.com"; sid:566852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbo4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbo4covid.net"; sid:566853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbot4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbot4covid19.com"; sid:566854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbot4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbot4covid19.net"; sid:566855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbot4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbot4covid.com"; sid:566856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbot4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbot4covid.net"; sid:566857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcacovid19form.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcacovid19form.com"; sid:566858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthworkercovidrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthworkercovidrecovered.com"; sid:566859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpaftercovid19.com"; sid:566860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidvictims.com"; sid:566861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpflcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpflcoronavirus.com"; sid:566862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid19.cloud"; sid:566863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroscovid.com"; sid:566864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycoronausa.com"; sid:566865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for how2care4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"how2care4covid19.com"; sid:566866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcovid19changedme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcovid19changedme.com"; sid:566867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocare4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocare4covid19.com"; sid:566868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocareforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocareforcovid19.com"; sid:566869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanityvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanityvscovid19.com"; sid:566870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibmcoronavirus.com"; sid:566871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibmcovid19.com"; sid:566872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibmwatsoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibmwatsoncoronavirus.com"; sid:566873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibmwatsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibmwatsoncovid19.com"; sid:566874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icleancovid.com"; sid:566875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifuckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifuckcovid19.com"; sid:566876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcoronadate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcoronadate.com"; sid:566877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcoronadating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcoronadating.com"; sid:566878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihealedfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihealedfromcorona.com"; sid:566879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidfree.com"; sid:566880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imighthavehadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imighthavehadcovid19.com"; sid:566881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impfung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impfung-corona.com"; sid:566882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid19.today"; sid:566883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscovids.com"; sid:566884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectadoscoronavirus.com"; sid:566885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informationcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informationcovid-19.com"; sid:566886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informationcovid19.com"; sid:566887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infovivocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infovivocovid-19.com"; sid:566888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inlandcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inlandcovidresponse.com"; sid:566889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmemoriam-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmemoriam-covid19.com"; sid:566890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronavirustestkit.com"; sid:566891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19testkits.com"; sid:566892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instituteofglobalpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instituteofglobalpandemics.com"; sid:566893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intheageofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intheageofcorona.com"; sid:566894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investcovid19.com"; sid:566895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investcovid.com"; sid:566896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for invinciblecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"invinciblecovid-19.com"; sid:566897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for invinciblecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"invinciblecovid19.com"; sid:566898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscoronavirus.com"; sid:566899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvdcovid.com"; sid:566900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survivedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survivedcovid-19.com"; sid:566901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19mke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19mke.com"; sid:566902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itepcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itepcovid.com"; sid:566903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jfcontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jfcontracovid.com"; sid:566904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobs-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobs-after-corona.com"; sid:566905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobs-after-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobs-after-corona.net"; sid:566906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joyinatimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joyinatimeofcorona.com"; sid:566907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juarezcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juarezcovid19.com"; sid:566908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juarezcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juarezcovid19.net"; sid:566909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k-coronavirus.com"; sid:566910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronasoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronasoap.com"; sid:566911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusli.com"; sid:566912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19li.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19li.com"; sid:566913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidsanitzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidsanitzer.com"; sid:566914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitscorona.com"; sid:566915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitscorona.net"; sid:566916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for klubcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"klubcorona.com"; sid:566917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95covid.com"; sid:566918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95facemasksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95facemasksforcovid19.com"; sid:566919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kooscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kooscorona.com"; sid:566920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kostenlose-coronahilfe-fuer-unternehmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kostenlose-coronahilfe-fuer-unternehmen.com"; sid:566921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2covid.com"; sid:566922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lafayettecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lafayettecovid.com"; sid:566923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamongantanggapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamongantanggapcorona.com"; sid:566924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovidnews.com"; sid:566925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancovid19.club"; sid:566926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyers-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyers-covid19.com"; sid:566927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lendingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lendingforcovid19.com"; sid:566928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesscovid19.com"; sid:566929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringapandemic.com"; sid:566930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringpandemic.com"; sid:566931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthecoronadream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthecoronadream.com"; sid:566932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthecovid19dream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthecovid19dream.com"; sid:566933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loc-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loc-covid-19.com"; sid:566934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncoronaviruscentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncoronaviruscentre.com"; sid:566935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovid19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovid19centre.com"; sid:566936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovidcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovidcentre.com"; sid:566937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longbeachvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longbeachvscovid19.com"; sid:566938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longislandcoronavirusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longislandcoronavirusdisinfection.com"; sid:566939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losttocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losttocovid.com"; sid:566940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofthecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofthecoronavirus.net"; sid:566941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeinpandemic.com"; sid:566942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madisoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madisoncovid.com"; sid:566943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makersagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makersagainstcorona.com"; sid:566944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makespaceforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makespaceforcovid.com"; sid:566945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasanticovid.com"; sid:566946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maniforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maniforcovid.net"; sid:566947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketplacecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketplacecovid19.com"; sid:566948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-covid-19.net"; sid:566949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcoronavirussale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcoronavirussale.com"; sid:566950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-n95-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-n95-coronavirus.com"; sid:566951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-coronavirus.net"; sid:566952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mekhoscontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mekhoscontracorona.com"; sid:566953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meldcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meldcorona.com"; sid:566954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocontracovid19.com"; sid:566955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirusinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirusinsuranceclaim.com"; sid:566956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronaviruslawyers.com"; sid:566957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid-19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid-19insuranceclaim.com"; sid:566958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for misioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"misioncovid.com"; sid:566959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19info.com"; sid:566960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mondocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mondocovid.com"; sid:566961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneybazarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneybazarcovid19.com"; sid:566962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moveovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moveovercovid.com"; sid:566963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacashnow.com"; sid:566964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronathon.com"; sid:566965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19masks.com"; sid:566966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19symptoms.com"; sid:566967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19symptoms.com"; sid:566968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19symptoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19symptoms.net"; sid:566969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19symptoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19symptoms.net"; sid:566970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbox.com"; sid:566971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcashnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcashnow.com"; sid:566972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddiaries.com"; sid:566973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidface.com"; sid:566974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidromance.com"; sid:566975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstimulus.com"; sid:566976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtragedy.com"; sid:566977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtrust.com"; sid:566978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidclaims.com"; sid:566979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidclaims.net"; sid:566980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.supply"; sid:566981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neixerentempsdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neixerentempsdecoronavirus.com"; sid:566982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neversurrendercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neversurrendercovid19.com"; sid:566983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19updates.com"; sid:566984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidupdates.com"; sid:566985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsforcovid19.com"; sid:566986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newswithoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newswithoutcoronavirus.com"; sid:566987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirusdisinfecting.com"; sid:566988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirusdisinfection.com"; sid:566989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixcoronavirus.com"; sid:566990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixcovid19.com"; sid:566991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19sanitizing.com"; sid:566992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidiot.com"; sid:566993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northkoreacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northkoreacoronavirus.com"; sid:566994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noshavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noshavecovid.com"; sid:566995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notesonthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notesonthepandemic.com"; sid:566996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvcovidmfg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvcovidmfg.com"; sid:566997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronahelp.com"; sid:566998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidcompliant.com"; sid:566999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidcompliant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidcompliant.net"; sid:567000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycdisinfectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycdisinfectcovid19.com"; sid:567001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyckillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyckillcoronavirus.com"; sid:567002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidcompliant.com"; sid:567003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nykillcovidnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nykillcovidnj.com"; sid:567004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nystatecovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nystatecovidhelp.com"; sid:567005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidreport.com"; sid:567006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19bankruptcy.com"; sid:567007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19debtrelief.com"; sid:567008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for online-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"online-covid19.com"; sid:567009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid-19.com"; sid:567010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovidclean.com"; sid:567011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outsmartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outsmartcovid19.com"; sid:567012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomecovid-19.com"; sid:567013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic4wd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic4wd.com"; sid:567014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic4x4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic4x4.com"; sid:567015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.blue"; sid:567016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccelebration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccelebration.com"; sid:567017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccelebration.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccelebration.net"; sid:567018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccelebrations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccelebrations.net"; sid:567019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclosure.com"; sid:567020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccomet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccomet.com"; sid:567021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconcert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconcert.net"; sid:567022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconcerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconcerts.net"; sid:567023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdailycarry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdailycarry.com"; sid:567024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdaily.com"; sid:567025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexpression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexpression.com"; sid:567026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexpressions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexpressions.com"; sid:567027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfix.com"; sid:567028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforo.com"; sid:567029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgokit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgokit.com"; sid:567030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgokits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgokits.com"; sid:567031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.land - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.land"; sid:567032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclear.com"; sid:567033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclife2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclife2020.com"; sid:567034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclife2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclife2021.com"; sid:567035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedic.com"; sid:567036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewstoday.com"; sid:567037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewsupdates.com"; sid:567038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoffroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoffroad.com"; sid:567039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicomet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicomet.com"; sid:567040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatio.com"; sid:567041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatiosale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatiosale.com"; sid:567042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.pink - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.pink"; sid:567043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpostcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpostcards.com"; sid:567044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionamerica.com"; sid:567045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionusa.com"; sid:567046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpropagandafilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpropagandafilm.com"; sid:567047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionequipment.com"; sid:567048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-quarantine.com"; sid:567049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicregistry.com"; sid:567050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresistantstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresistantstrategies.com"; sid:567051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictshirtdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictshirtdesign.com"; sid:567052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictshirtdesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictshirtdesigns.com"; sid:567053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicyear.com"; sid:567054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingaftercorona.com"; sid:567055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingduringcorona.com"; sid:567056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passaportocovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passaportocovid.cloud"; sid:567057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passaportocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passaportocovid.com"; sid:567058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patentecovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patentecovid.cloud"; sid:567059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patentecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patentecovid.com"; sid:567060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofcoronavirus.com"; sid:567061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplewelostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplewelostcovid19.com"; sid:567062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplewhobeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplewhobeatcoronavirus.com"; sid:567063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcoronatracker.com"; sid:567064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phonycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phonycorona.com"; sid:567065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phonycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phonycovid.com"; sid:567066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburgh-coronavirus-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburgh-coronavirus-vaccine.com"; sid:567067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pk-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pk-covid19.com"; sid:567068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plastercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plastercoronavirus.com"; sid:567069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadesign.com"; sid:567070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaera.com"; sid:567071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaurbanism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaurbanism.com"; sid:567072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronausa.com"; sid:567073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid2019.com"; sid:567074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid2020.com"; sid:567075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid20.com"; sid:567076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidage.com"; sid:567077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidarchitecture.com"; sid:567078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcertified.com"; sid:567079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddesign.com"; sid:567080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlegal.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlegal.solutions"; sid:567081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmindset.com"; sid:567082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstressbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstressbuster.com"; sid:567083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpartnership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpartnership.com"; sid:567084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicplan.com"; sid:567085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicproject.com"; sid:567086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecorona.com"; sid:567087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-covid19.com"; sid:567088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppeforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppeforcoronavirus.com"; sid:567089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicalcovid19.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicalcovid19.tips"; sid:567090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicalcovid.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicalcovid.tips"; sid:567091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayformecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayformecovid19.com"; sid:567092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precisionpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precisionpandemics.com"; sid:567093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prescriptioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prescriptioncovid19.com"; sid:567094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19spread.com"; sid:567095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovidtest.com"; sid:567096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovid-19.com"; sid:567097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectpsacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectpsacovid.com"; sid:567098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-covid19.com"; sid:567099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmysavingscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmysavingscorona.com"; sid:567100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionecovid.com"; sid:567101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psacovid.com"; sid:567102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psaprojectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psaprojectcovid.com"; sid:567103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicorona.com"; sid:567104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsocovid.com"; sid:567105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purecleancovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purecleancovidkiller.com"; sid:567106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purecleancovidkiller.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purecleancovidkiller.net"; sid:567107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purocleanpandemicpreventionprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purocleanpandemicpreventionprogram.com"; sid:567108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puzzlepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puzzlepandemic.com"; sid:567109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidresults.com"; sid:567110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidresults.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidresults.net"; sid:567111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidry.com"; sid:567112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovidlost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovidlost.com"; sid:567113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renucovid19.com"; sid:567114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repurposingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repurposingcovid19.com"; sid:567115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rigorscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rigorscoronavirus.net"; sid:567116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for run4thecausecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"run4thecausecovid19.com"; sid:567117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runforthecausecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runforthecausecovid19.com"; sid:567118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rutacovidcauca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rutacovidcauca.com"; sid:567119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rwtcoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rwtcoronavirusupdate.com"; sid:567120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetipscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetipscovid19.com"; sid:567121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyproductscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyproductscovid19.com"; sid:567122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecovid.com"; sid:567123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19.services"; sid:567124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovidhelpdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovidhelpdesk.com"; sid:567125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbapandemicloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbapandemicloan.com"; sid:567126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbapandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbapandemicrelief.com"; sid:567127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovidclean.com"; sid:567128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovidclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovidclean.net"; sid:567129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcovid19balls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcovid19balls.com"; sid:567130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secretofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secretofthecovid19.com"; sid:567131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secretofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secretofthecovid19.net"; sid:567132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secretsofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secretsofthecovid.com"; sid:567133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secretsofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secretsofthecovid.net"; sid:567134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfquarantinecovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfquarantinecovidnineteen.com"; sid:567135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfocovid.com"; sid:567136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovid19.com"; sid:567137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovid19graphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovid19graphics.com"; sid:567138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovidchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovidchecker.com"; sid:567139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopfuckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopfuckcovid19.com"; sid:567140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopfuckcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopfuckcovid19.net"; sid:567141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siamcovid19.com"; sid:567142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecovid.com"; sid:567143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecovidtest.com"; sid:567144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecovidtests.com"; sid:567145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sinaicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sinaicovid.com"; sid:567146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skinpatchcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skinpatchcoronavirus.com"; sid:567147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skipthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skipthecovid.com"; sid:567148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sofort-hilfe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sofort-hilfe-corona.com"; sid:567149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somanylostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somanylostcovid19.com"; sid:567150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soutiencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soutiencorona.com"; sid:567151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaldingcovidkindnessteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaldingcovidkindnessteam.com"; sid:567152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spectrum-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spectrum-covid.com"; sid:567153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedycorona.com"; sid:567154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startacovidclaim.com"; sid:567155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayactive-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayactive-covid-19.com"; sid:567156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafe-coronavirus.com"; sid:567157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafecoronavirus.com"; sid:567158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafecovid-19.com"; sid:567159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellcorona.com"; sid:567160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellcovid19.com"; sid:567161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellcovid.com"; sid:567162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellforcorona.com"; sid:567163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellforcovid19.com"; sid:567164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcelltreatmentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcelltreatmentcorona.com"; sid:567165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcelltreatmentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcelltreatmentcovid19.com"; sid:567166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcelltreatmentforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcelltreatmentforcorona.com"; sid:567167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcelltreatmentforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcelltreatmentforcovid19.com"; sid:567168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19intx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19intx.com"; sid:567169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19intx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19intx.net"; sid:567170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19lockdown.com"; sid:567171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19.pro"; sid:567172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19sanitizing.com"; sid:567173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidok.com"; sid:567174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidok.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidok.net"; sid:567175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for streetsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"streetsofcovid.com"; sid:567176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strides4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strides4corona.com"; sid:567177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stridesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stridesforcorona.com"; sid:567178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suckitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suckitcorona.com"; sid:567179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sureforcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sureforcovid19.cloud"; sid:567180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sureforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sureforcovid19.com"; sid:567181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survdcovid19.com"; sid:567182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surveycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surveycovid.com"; sid:567183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecovid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecovid19economy.com"; sid:567184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingwithcovid.com"; sid:567185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid19.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid19.services"; sid:567186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid19.solutions"; sid:567187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofcovid19.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofcovid19.support"; sid:567188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofthecovid19cull.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofthecovid19cull.com"; sid:567189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofthecovid19cull.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofthecovid19cull.media"; sid:567190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofthecovid19cull.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofthecovid19cull.net"; sid:567191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorsofthecovid19cull.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorsofthecovid19cull.network"; sid:567192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for symptomsofcoronavirusinhumans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"symptomsofcoronavirusinhumans.com"; sid:567193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcmtreatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcmtreatcovid-19.com"; sid:567194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachcovid-19.com"; sid:567195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachcovid19.com"; sid:567196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for termlifecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"termlifecoronavirus.com"; sid:567197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for termlifecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"termlifecoronavirus.net"; sid:567198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tested4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tested4covid.com"; sid:567199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tested4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tested4covid.net"; sid:567200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid19now.com"; sid:567201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucovidheroes.com"; sid:567202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thcullofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thcullofthecovid.com"; sid:567203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thcullofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thcullofthecovid.net"; sid:567204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticovid.com"; sid:567205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycoronaviruscentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycoronaviruscentre.com"; sid:567206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycovid19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycovid19centre.com"; sid:567207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecitycovidcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecitycovidcentre.com"; sid:567208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaflight.com"; sid:567209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatrail.com"; sid:567210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusrevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusrevolution.com"; sid:567211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusworld.com"; sid:567212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawear.com"; sid:567213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19dailytimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19dailytimes.com"; sid:567214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19dailytimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19dailytimes.net"; sid:567215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19guru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19guru.com"; sid:567216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19guru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19guru.net"; sid:567217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19impact.com"; sid:567218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19k.com"; sid:567219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pledge.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pledge.center"; sid:567220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19taskforce.com"; sid:567221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19taskforce.com"; sid:567222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19testing.com"; sid:567223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19world.com"; sid:567224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcaregiver.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcaregiver.support"; sid:567225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcouture.com"; sid:567226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcouture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcouture.net"; sid:567227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid-daily-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid-daily-times.com"; sid:567228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid-daily-times.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid-daily-times.net"; sid:567229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgiveback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgiveback.com"; sid:567230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidianday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidianday.com"; sid:567231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtested.com"; sid:567232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtribute.com"; sid:567233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecullofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecullofthecovid19.com"; sid:567234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecullofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecullofthecovid19.net"; sid:567235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecultofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecultofthecovid19.com"; sid:567236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecultofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecultofthecovid19.net"; sid:567237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-daily-covid-times.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-daily-covid-times.cloud"; sid:567238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-daily-covid-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-daily-covid-times.com"; sid:567239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-daily-covid-times.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-daily-covid-times.guru"; sid:567240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-daily-covid-times.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-daily-covid-times.net"; sid:567241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacescovid19.com"; sid:567242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacesofcorona.com"; sid:567243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacesofcoronavirus.com"; sid:567244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacesofcovid19.com"; sid:567245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theglobalpandemicperspective.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theglobalpandemicperspective.international"; sid:567246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncoronaviruscentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncoronaviruscentre.com"; sid:567247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncovid19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncovid19centre.com"; sid:567248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelondoncovidcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelondoncovidcentre.com"; sid:567249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theothersoundofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theothersoundofcorona.com"; sid:567250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemichandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemichandbook.com"; sid:567251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemic-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemic-life.com"; sid:567252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepeopleofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepeopleofcovid19.com"; sid:567253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecretofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecretofcovid19.com"; sid:567254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecretofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecretofcovid19.net"; sid:567255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecretofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecretofthecovid19.com"; sid:567256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecretofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecretofthecovid19.net"; sid:567257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimesofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimesofthecovid19.com"; sid:567258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimesofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimesofthecovid19.net"; sid:567259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thingsyouneedinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thingsyouneedinpandemic.com"; sid:567260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivecorona.com"; sid:567261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidlawyers.com"; sid:567262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for touscontrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"touscontrecovid19.com"; sid:567263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecoronavirusworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecoronavirusworld.com"; sid:567264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traincovid-19.com"; sid:567265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traincovid19.com"; sid:567266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trainingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trainingcovid19.com"; sid:567267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamientocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamientocovid19.com"; sid:567268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercoronavirus.com"; sid:567269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovidmoney.com"; sid:567270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovid.com"; sid:567271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcovidtests.com"; sid:567272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubercovid19.com"; sid:567273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubjjcovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubjjcovidresources.com"; sid:567274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19stories.com"; sid:567275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukgov-covid19relieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukgov-covid19relieve.com"; sid:567276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovided.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovided.com"; sid:567277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovidify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovidify.com"; sid:567278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undercovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undercovidcleaning.com"; sid:567279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandcovid-19.com"; sid:567280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatesoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatesoncovid19.com"; sid:567281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronamask.com"; sid:567282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirus19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirus19cases.com"; sid:567283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruscases.com"; sid:567284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusmask.com"; sid:567285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19cases.com"; sid:567286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19cases.com"; sid:567287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcompliance.com"; sid:567288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcompliant.com"; sid:567289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidmask.com"; sid:567290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicprevention.com"; sid:567291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronarelief.com"; sid:567292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcleaners.com"; sid:567293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidplasma.com"; sid:567294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidplasmaeap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidplasmaeap.com"; sid:567295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidplasmaeap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidplasmaeap.net"; sid:567296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidplasma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidplasma.net"; sid:567297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usecorona.com"; sid:567298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utilitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utilitycovid19.com"; sid:567299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid19.club"; sid:567300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-covid.com"; sid:567301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercovid.com"; sid:567302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid19clinic.com"; sid:567303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid19clinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid19clinics.com"; sid:567304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovidclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovidclinics.com"; sid:567305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid.com"; sid:567306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19coronavirus.com"; sid:567307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidkill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidkill.com"; sid:567308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidmascherine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidmascherine.com"; sid:567309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovidprotection.com"; sid:567310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicemail2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicemail2020covid19.com"; sid:567311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallcovid19.com"; sid:567312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallcovid.com"; sid:567313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watsoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watsoncoronavirus.com"; sid:567314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watsoncovid19.com"; sid:567315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearcovid19.com"; sid:567316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethecultofthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethecultofthecovid19.com"; sid:567317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethecultofthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethecultofthecovid19.net"; sid:567318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethecultofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethecultofthecovid.com"; sid:567319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethecultofthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethecultofthecovid.net"; sid:567320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethesurvivorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethesurvivorsofcovid19.com"; sid:567321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehatethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehatethecoronavirus.com"; sid:567322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillviruscovid.com"; sid:567323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus-info.net"; sid:567324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinfo.net"; sid:567325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus-info.net"; sid:567326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinfo.net"; sid:567327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus-information.net"; sid:567328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirusinformation.net"; sid:567329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus-information.net"; sid:567330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirusinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirusinformation.net"; sid:567331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-coronavirus.net"; sid:567332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcoronavirus.net"; sid:567333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19-information.net"; sid:567334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19information.net"; sid:567335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19-information.net"; sid:567336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19information.net"; sid:567337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19-information.net"; sid:567338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19information.net"; sid:567339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19-information.net"; sid:567340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19information.net"; sid:567341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-19.net"; sid:567342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid19.net"; sid:567343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-19.net"; sid:567344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid19.net"; sid:567345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid-information.net"; sid:567346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covidinformation.net"; sid:567347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid-information.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid-information.net"; sid:567348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovidinformation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovidinformation.net"; sid:567349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-covid.net"; sid:567350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappcovid.net"; sid:567351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-info-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-info-coronavirus.net"; sid:567352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-infocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-infocoronavirus.net"; sid:567353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinfo-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinfo-coronavirus.net"; sid:567354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinfocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinfocoronavirus.net"; sid:567355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-coronavirus.net"; sid:567356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcoronavirus.net"; sid:567357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-coronavirus.net"; sid:567358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcoronavirus.net"; sid:567359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid-19.net"; sid:567360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid19.net"; sid:567361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid-19.net"; sid:567362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid19.net"; sid:567363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid-19.net"; sid:567364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid19.net"; sid:567365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid-19.net"; sid:567366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid19.net"; sid:567367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-information-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-information-covid.net"; sid:567368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsapp-informationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsapp-informationcovid.net"; sid:567369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformation-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformation-covid.net"; sid:567370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsappinformationcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsappinformationcovid.net"; sid:567371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitehousecoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitehousecoronavirustaskforce.com"; sid:567372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitehousecovid-19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitehousecovid-19taskforce.com"; sid:567373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocoronapass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocoronapass.com"; sid:567374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocoronaviruses.com"; sid:567375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wisconsincoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wisconsincoronavirus2019.com"; sid:567376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldagainstcovid-19.com"; sid:567377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronamask.com"; sid:567378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusmask.com"; sid:567379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldfightingcovid.com"; sid:567380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldnewscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldnewscovid-19.com"; sid:567381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldnewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldnewscovid19.com"; sid:567382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicprevention.com"; sid:567383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarpandemic.com"; sid:567384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronaviruscases.com"; sid:567385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid-19cases.com"; sid:567386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19cases.com"; sid:567387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovidcases.com"; sid:567388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpeuropecovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpeuropecovid19resources.com"; sid:567389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandaiyuns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandaiyuns.com"; sid:567390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfubang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfubang.com"; sid:567391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangcb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangcb.com"; sid:567392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhannials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhannials.com"; sid:567393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansoup.com"; sid:567394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantouzi.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantouzi.club"; sid:567395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwpandemic.com"; sid:567396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovids.com"; sid:567397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcovidmecrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcovidmecrazy.com"; sid:567398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcovidmecrazy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcovidmecrazy.net"; sid:567399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidloan.com"; sid:567400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidsba.com"; sid:567401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yuckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yuckcovid.com"; sid:567402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zelfcoronatesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zelfcoronatesten.com"; sid:567403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dprintingvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dprintingvscovid19.com"; sid:567404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 420coronaclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"420coronaclothing.com"; sid:567405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 45covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"45covid19.com"; sid:567406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 8qcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"8qcoronavirusvaccine.com"; sid:567407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadodelcoronavirus.com"; sid:567408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadodelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadodelcovid-19.com"; sid:567409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadodelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadodelcovid19.com"; sid:567410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosdelcoronavirus.com"; sid:567411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosdelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosdelcovid-19.com"; sid:567412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosdelcovid19.com"; sid:567413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actionforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actionforcovid19.com"; sid:567414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adapt2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adapt2covid19.com"; sid:567415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscovid19.com"; sid:567416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adrenocovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adrenocovid2020.com"; sid:567417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectados-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectados-coronavirus.com"; sid:567418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabama2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabama2020covid19.com"; sid:567419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabama2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabama2020pandemic.com"; sid:567420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronavirus2020.com"; sid:567421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alternativesolutionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alternativesolutionscovid19.com"; sid:567422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altocorona.com"; sid:567423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altocovid19.com"; sid:567424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for america2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"america2020covid19.com"; sid:567425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for america2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"america2020pandemic.com"; sid:567426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for america2020pandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"america2020pandemicrecovery.com"; sid:567427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaandcovid-19.com"; sid:567428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for american2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"american2020pandemic.com"; sid:567429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americandreamepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americandreamepidemic.com"; sid:567430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anthologiesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anthologiesofcovid19.com"; sid:567431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiescorona.com"; sid:567432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiescovid19.com"; sid:567433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaglove.com"; sid:567434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.guru"; sid:567435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.solutions"; sid:567436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivirusforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivirusforcorona.com"; sid:567437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appcovid-zero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appcovid-zero.com"; sid:567438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovid19.com"; sid:567439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovidmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovidmune.com"; sid:567440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidlab.com"; sid:567441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidlabs.com"; sid:567442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidresearch.com"; sid:567443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistagainstcovid19.com"; sid:567444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionvictimasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionvictimasdelcoronavirus.com"; sid:567445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assesscorona.com"; sid:567446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astoriacovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astoriacovidresources.com"; sid:567447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19sanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19sanitation.com"; sid:567448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneycovid19.com"; sid:567449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneycovid.com"; sid:567450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiancovid19socialistsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiancovid19socialistsolutions.com"; sid:567451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19corona.com"; sid:567452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19corona.net"; sid:567453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19corona-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19corona-online.com"; sid:567454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamascovid19.com"; sid:567455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bandanascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bandanascovid19.com"; sid:567456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcy2020covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcy2020covid.com"; sid:567457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcycovid-19.com"; sid:567458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcycovid.com"; sid:567459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcbefore-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcbefore-corona.com"; sid:567460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benefitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benefitforcovid19.com"; sid:567461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benevolescovidpf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benevolescovidpf.com"; sid:567462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beridofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beridofcovid.com"; sid:567463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-corona.com"; sid:567464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicorona.com"; sid:567465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boletimcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boletimcorona.com"; sid:567466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boringpandemic.com"; sid:567467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovid19news.com"; sid:567468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspostcorona.com"; sid:567469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspostcovid.com"; sid:567470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyacoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyacoronavirusmask.com"; sid:567471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronamask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronamask.net"; sid:567472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidgear.com"; sid:567473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecoronavirus.net"; sid:567474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid.com"; sid:567475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callingallcovid19surviors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callingallcovid19surviors.com"; sid:567476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callingallcovid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callingallcovid19survivors.com"; sid:567477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camaracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camaracovid19.com"; sid:567478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camaracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camaracovid.com"; sid:567479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camarascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camarascovid.com"; sid:567480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camarascovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camarascovid.net"; sid:567481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camglencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camglencovid.com"; sid:567482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadianmalayaleesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadianmalayaleesforcovid19.com"; sid:567483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashinonthecovid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashinonthecovid19crash.com"; sid:567484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashinonthecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashinonthecovidcrash.com"; sid:567485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcoronainfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcoronainfection.com"; sid:567486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcovid19cases.com"; sid:567487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcovid-19.com"; sid:567488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccppandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccppandemic2020.com"; sid:567489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccppandemic.com"; sid:567490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccppandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccppandemicvirus.com"; sid:567491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpviruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpviruspandemic2020.com"; sid:567492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpviruspandemic.com"; sid:567493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcoronacooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcoronacooking.com"; sid:567494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidhelp.com"; sid:567495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecommunistpartycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecommunistpartycoronavirus.com"; sid:567496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecommunistpartycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecommunistpartycovid19.com"; sid:567497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofcoronathefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofcoronathefilm.com"; sid:567498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovid10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovid10.com"; sid:567499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovid-19.com"; sid:567500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchcovid29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchcovid29.com"; sid:567501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciao-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciao-corona.com"; sid:567502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cierreempresacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cierreempresacoronavirus.com"; sid:567503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcoronavirushome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcoronavirushome.com"; sid:567504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcoronavirusnow.com"; sid:567505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickcovid.com"; sid:567506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachesvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachesvscovid.com"; sid:567507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comment-tuer-le-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comment-tuer-le-covid.com"; sid:567508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commenttuerlecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commenttuerlecovid.com"; sid:567509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commissions4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commissions4covid.com"; sid:567510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprartestcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprartestcoronavirus.net"; sid:567511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprartestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprartestcovid19.com"; sid:567512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contipharma-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contipharma-covid19.com"; sid:567513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingincoronaville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingincoronaville.com"; sid:567514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid19.net"; sid:567515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19claimants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19claimants.com"; sid:567516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19claimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19claimshelp.com"; sid:567517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19kit.com"; sid:567518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19loss.com"; sid:567519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19plaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19plaintiffs.com"; sid:567520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19victims.com"; sid:567521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-after.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-after.com"; sid:567522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairrescue.com"; sid:567523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamap.com"; sid:567524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartist.com"; sid:567525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandana.com"; sid:567526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandana.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandana.net"; sid:567527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabangladesh.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabangladesh.info"; sid:567528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabattles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabattles.com"; sid:567529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioscienses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioscienses.com"; sid:567530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiotech.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiotech.net"; sid:567531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizresources.com"; sid:567532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabumps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabumps.com"; sid:567533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessstaffing.com"; sid:567534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-candle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-candle.com"; sid:567535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaregroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaregroup.com"; sid:567536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaselawyer.com"; sid:567537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacene.com"; sid:567538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacene.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacene.net"; sid:567539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclesdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclesdocumentary.com"; sid:567540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclesthefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclesthefilm.com"; sid:567541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chronology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chronology.com"; sid:567542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimslaw.com"; sid:567543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningusa.com"; sid:567544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearancestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearancestore.com"; sid:567545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothmasks.com"; sid:567546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollaboration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollaboration.com"; sid:567547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comedy.com"; sid:567548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomfortdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomfortdogs.com"; sid:567549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomix.com"; sid:567550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplaints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplaints.com"; sid:567551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplaints.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplaints.net"; sid:567552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcert.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcert.net"; sid:567553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcertseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcertseries.com"; sid:567554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsipracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsipracy.com"; sid:567555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainmentmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainmentmask.com"; sid:567556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontracts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontracts.com"; sid:567557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrolmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrolmask.com"; sid:567558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourtesycovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourtesycovers.com"; sid:567559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverupgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverupgear.com"; sid:567560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoverupmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoverupmask.com"; sid:567561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuredemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuredemployees.com"; sid:567562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacured.net"; sid:567563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuredstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuredstaffing.com"; sid:567564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacustommask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacustommask.com"; sid:567565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadating.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadating.center"; sid:567566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtstopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtstopper.com"; sid:567567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestekpaketial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestekpaketial.com"; sid:567568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadip.com"; sid:567569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasebusinessstaffing.com"; sid:567570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecured.com"; sid:567571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecuredemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecuredemployees.com"; sid:567572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasecuredstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasecuredstaffing.com"; sid:567573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreebusinessstaffing.com"; sid:567574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefree.com"; sid:567575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreeemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreeemployees.com"; sid:567576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreeemployeestaffing.com"; sid:567577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreeemployeestaffing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreeemployeestaffing.net"; sid:567578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreemployment.com"; sid:567579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefree.net"; sid:567580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasefreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasefreestaffing.com"; sid:567581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasehealthyemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasehealthyemployees.com"; sid:567582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasehealthystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasehealthystaffing.com"; sid:567583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseimmunebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseimmunebusinessstaffing.com"; sid:567584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseimmune.com"; sid:567585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseimmuneemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseimmuneemployees.com"; sid:567586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseimmunestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseimmunestaffing.com"; sid:567587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseaseimmunitystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseaseimmunitystaffing.com"; sid:567588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasesafestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasesafestaffing.com"; sid:567589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasevirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasevirusfree.com"; sid:567590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyers.com"; sid:567591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeldercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeldercare.com"; sid:567592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelite.com"; sid:567593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeval.com"; sid:567594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexercise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexercise.com"; sid:567595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirstresponder.com"; sid:567596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoerderung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoerderung.com"; sid:567597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebusinessstaffing.com"; sid:567598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeemployeestaffing.com"; sid:567599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeland.com"; sid:567600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-freemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-freemasks.com"; sid:567601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree-masks.com"; sid:567602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemasks.com"; sid:567603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreemployment.com"; sid:567604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreestaffing.com"; sid:567605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevenue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevenue.com"; sid:567606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeworkplace.com"; sid:567607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreezoning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreezoning.com"; sid:567608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafund1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafund1.com"; sid:567609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundlawyers1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundlawyers1.com"; sid:567610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagame.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagame.center"; sid:567611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagebzedezenfeksiyon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagebzedezenfeksiyon.com"; sid:567612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenius.com"; sid:567613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-give.com"; sid:567614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardusa.com"; sid:567615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagurus.com"; sid:567616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthyemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthyemployees.com"; sid:567617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthystaffing.com"; sid:567618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunebusinessstaffing.com"; sid:567619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuneemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuneemployees.com"; sid:567620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmune.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmune.net"; sid:567621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunestaffing.com"; sid:567622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitystaffing.com"; sid:567623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainhibitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainhibitor.com"; sid:567624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnsa.com"; sid:567625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancelawyers.com"; sid:567626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitis.com"; sid:567627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-keil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-keil.com"; sid:567628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-key.com"; sid:567629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakid.life"; sid:567630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise-2020.com"; sid:567631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krisenhilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krisenhilfe.com"; sid:567632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloca.com"; sid:567633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascarilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascarilla.com"; sid:567634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masken.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masken.net"; sid:567635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksshop.com"; sid:567636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaste.com"; sid:567637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronament.com"; sid:567638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusiclive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusiclive.com"; sid:567639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusic.net"; sid:567640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanumbers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanumbers.world"; sid:567641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaokay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaokay.com"; sid:567642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemiccases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemiccases.com"; sid:567643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicresearch.com"; sid:567644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicspreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicspreading.com"; sid:567645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicstory.com"; sid:567646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicvictims.com"; sid:567647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemin.com"; sid:567648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplasmatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplasmatherapy.com"; sid:567649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappesupply.com"; sid:567650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappmaroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappmaroc.com"; sid:567651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionmask.com"; sid:567652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapropaganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapropaganda.com"; sid:567653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protectivemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protectivemask.com"; sid:567654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quilt-kent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quilt-kent.com"; sid:567655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarag.com"; sid:567656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reha.com"; sid:567657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reha.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reha.net"; sid:567658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarhapsodyrhyoutube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarhapsodyrhyoutube.com"; sid:567659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarumours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarumours.com"; sid:567660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafestaffing.com"; sid:567661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sanatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sanatizer.com"; sid:567662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbot.com"; sid:567663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-school.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-school.com"; sid:567664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzshop.com"; sid:567665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz.tips"; sid:567666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningtest.com"; sid:567667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-socialism.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-socialism.net"; sid:567668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasollution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasollution.com"; sid:567669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspuger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspuger.com"; sid:567670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastressdisorder.com"; sid:567671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubsidy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubsidy.net"; sid:567672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupps.com"; sid:567673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalparty.com"; sid:567674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorparty.com"; sid:567675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taisaku.com"; sid:567676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakibi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakibi.com"; sid:567677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tamilsforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tamilsforum.com"; sid:567678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcentrum.com"; sid:567679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcentrum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcentrum.net"; sid:567680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingplace.com"; sid:567681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapists.com"; sid:567682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimesmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimesmedia.com"; sid:567683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimesonline.com"; sid:567684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronator.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronator.club"; sid:567685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatough.com"; sid:567686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trauma-informed-education.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trauma-informed-education.net"; sid:567687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrucks.com"; sid:567688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausain.com"; sid:567689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav8rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav8rus.com"; sid:567690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinenow.com"; sid:567691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaluemaximizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaluemaximizer.com"; sid:567692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavausa.com"; sid:567693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverify.com"; sid:567694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavict.com"; sid:567695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigilance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigilance.com"; sid:567696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviraldisease19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviraldisease19.com"; sid:567697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviraldisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviraldisease.com"; sid:567698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirousus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirousus.com"; sid:567699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsusnow.com"; sid:567700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.center"; sid:567701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020bankruptcy.com"; sid:567702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020relief.com"; sid:567703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalabama2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalabama2020.com"; sid:567704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandsyria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandsyria.com"; sid:567705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-appstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-appstore.com"; sid:567706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-argentina.com"; sid:567707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelirti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelirti.com"; sid:567708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenefitlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenefitlive.com"; sid:567709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbids.com"; sid:567710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblast.com"; sid:567711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboardgame.com"; sid:567712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboredgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboredgame.com"; sid:567713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakdown.com"; sid:567714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-business-ideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-business-ideas.com"; sid:567715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessstaffing.com"; sid:567716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscardgame.com"; sid:567717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscemetary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscemetary.com"; sid:567718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscerotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscerotto.com"; sid:567719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertificate.com"; sid:567720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinaaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinaaccountability.com"; sid:567721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinaclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinaclassaction.com"; sid:567722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinalaw.com"; sid:567723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinalawsuit.com"; sid:567724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinarestitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinarestitution.com"; sid:567725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicellc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicellc.com"; sid:567726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleansingllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleansingllc.com"; sid:567727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupalpharetta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupalpharetta.com"; sid:567728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupatlanta.com"; sid:567729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupbroward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupbroward.com"; sid:567730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupconyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupconyers.com"; sid:567731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupcovington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupcovington.com"; sid:567732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupdade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupdade.com"; sid:567733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupdunwoody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupdunwoody.com"; sid:567734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupfortmyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupfortmyers.com"; sid:567735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupmarcoisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupmarcoisland.com"; sid:567736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupnaples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupnaples.com"; sid:567737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuposandysprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuposandysprings.com"; sid:567738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuppalmbeachcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuppalmbeachcounty.com"; sid:567739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuproswell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuproswell.com"; sid:567740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothmasks.com"; sid:567741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscog.com"; sid:567742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-com.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-com.biz"; sid:567743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontracts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontracts.com"; sid:567744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselingservices.com"; sid:567745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-coupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-coupons.com"; sid:567746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-online.com"; sid:567747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreations.com"; sid:567748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrimes.com"; sid:567749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrimes.net"; sid:567750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuredemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuredemployees.com"; sid:567751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscured.net"; sid:567752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuredstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuredstaffing.com"; sid:567753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailytips.com"; sid:567754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathpanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathpanel.com"; sid:567755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeception.com"; sid:567756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdemanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdemanda.com"; sid:567757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdemandas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdemandas.com"; sid:567758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasenews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasenews.net"; sid:567759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusegov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusegov.com"; sid:567760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactsandfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactsandfiction.com"; sid:567761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfashions.com"; sid:567762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialadvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialadvisers.com"; sid:567763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialadvisors.com"; sid:567764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fogging.com"; sid:567765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-force.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-force.com"; sid:567766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreebusinessstaffing.com"; sid:567767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeemployeestaffing.com"; sid:567768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeemployment.com"; sid:567769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreejobs.com"; sid:567770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreestaffing.com"; sid:567771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfund1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfund1.com"; sid:567772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalupdate.com"; sid:567773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovtsample.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovtsample.com"; sid:567774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthystaffing.com"; sid:567775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoaxhq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoaxhq.com"; sid:567776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-home-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-home-testing-kit.com"; sid:567777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushost.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushost.net"; sid:567778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushub.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushub.today"; sid:567779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusig.com"; sid:567780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunebusinessstaffing.com"; sid:567781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmuneemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmuneemployees.com"; sid:567782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmune.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmune.net"; sid:567783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunestaffing.com"; sid:567784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunityregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunityregistry.com"; sid:567785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitystaffing.com"; sid:567786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfotracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfotracker.com"; sid:567787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhibitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhibitor.com"; sid:567788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinmarch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinmarch.com"; sid:567789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinua.com"; sid:567790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinuse.com"; sid:567791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitinformation.com"; sid:567792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalaction.com"; sid:567793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalgroup.com"; sid:567794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-legalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-legalinfo.com"; sid:567795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalinformation.com"; sid:567796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap.city"; sid:567797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap-covid-19.com"; sid:567798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-map.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-map.today"; sid:567799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasker.com"; sid:567800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedication.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedication.net"; sid:567801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmgmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmgmt.com"; sid:567802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmistakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmistakes.com"; sid:567803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mpa.com"; sid:567804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmygreatequalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmygreatequalizer.com"; sid:567805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnsnow.com"; sid:567806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewslink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewslink.com"; sid:567807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusocean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusocean.com"; sid:567808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusp3loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusp3loan.com"; sid:567809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemy.com"; sid:567810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspassports.com"; sid:567811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-per-country.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-per-country.com"; sid:567812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspest.com"; sid:567813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppp.com"; sid:567814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionsigns.com"; sid:567815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspsychologicalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspsychologicalservices.com"; sid:567816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-que-puis-je-faire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-que-puis-je-faire.com"; sid:567817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtestingkit.com"; sid:567818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtestingkits.com"; sid:567819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreclamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreclamos.com"; sid:567820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveredemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveredemployment.com"; sid:567821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrehabilitation.com"; sid:567822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieve.com"; sid:567823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremedy.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremedy.life"; sid:567824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestitution.com"; sid:567825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskmitigation.com"; sid:567826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafestaffing.com"; sid:567827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sanitising.com"; sid:567828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-signage.com"; sid:567829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-simulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-simulation.com"; sid:567830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussollution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussollution.com"; sid:567831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussollutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussollutions.com"; sid:567832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppression.com"; sid:567833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor2020.net"; sid:567834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechniques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechniques.com"; sid:567835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthegreatequalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthegreatequalizer.com"; sid:567836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tips-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tips-news.com"; sid:567837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustko.com"; sid:567838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustkokit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustkokit.com"; sid:567839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-t-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-t-shirts.com"; sid:567840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuncovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuncovered.com"; sid:567841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-victims.com"; sid:567842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimsfund.com"; sid:567843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimsfundnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimsfundnyc.com"; sid:567844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimsfundusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimsfundusa.com"; sid:567845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswar2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswar2020.com"; sid:567846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswaste.com"; sid:567847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswastemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswastemanagement.com"; sid:567848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswastemanagement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswastemanagement.net"; sid:567849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswaste.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswaste.net"; sid:567850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswastetracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswastetracking.com"; sid:567851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswastetracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswastetracking.net"; sid:567852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswm.com"; sid:567853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswm.net"; sid:567854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswm.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswm.world"; sid:567855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkfromhomejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkfromhomejobs.com"; sid:567856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldwar.com"; sid:567857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxray.com"; sid:567858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisus-sd.com"; sid:567859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamine.com"; sid:567860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamines.com"; sid:567861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitualizer.com"; sid:567862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavive.com"; sid:567863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrus-sd.com"; sid:567864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarrier.com"; sid:567865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarrior.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarrior.net"; sid:567866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhisky.com"; sid:567867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldpulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldpulse.com"; sid:567868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldtoday.com"; sid:567869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazerorotary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazerorotary.com"; sid:567870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveringcovid.com"; sid:567871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveryourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveryourcorona.com"; sid:567872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-10-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-10-2019.com"; sid:567873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10businesscenter.com"; sid:567874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020bankruptcy.com"; sid:567875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19360.com"; sid:567876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.accountant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.accountant"; sid:567877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19a.com"; sid:567878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19al.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19al.com"; sid:567879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alpabet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alpabet.com"; sid:567880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19amazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19amazon.com"; sid:567881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-analysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-analysis.com"; sid:567882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodyverification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodyverification.com"; sid:567883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19appleinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19appleinc.com"; sid:567884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-apps.com"; sid:567885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19armour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19armour.com"; sid:567886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artist.com"; sid:567887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artists.com"; sid:567888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistanceatmortggefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistanceatmortggefamily.com"; sid:567889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistancemortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistancemortgagefamily.com"; sid:567890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistantmortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistantmortgagefamily.com"; sid:567891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aus-mentalhealthsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aus-mentalhealthsurvey.com"; sid:567892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ayuda.com"; sid:567893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19balkans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19balkans.com"; sid:567894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bangladeshhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bangladeshhelp.com"; sid:567895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bank.com"; sid:567896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcyattorney.com"; sid:567897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyattorney.com"; sid:567898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyfile.com"; sid:567899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcylaw.com"; sid:567900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19b.com"; sid:567901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19benefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19benefit.com"; sid:567902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bids.com"; sid:567903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19billgates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19billgates.com"; sid:567904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biloss.com"; sid:567905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizclaim.com"; sid:567906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizresources.com"; sid:567907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boredom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boredom.com"; sid:567908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buinesscenter.com"; sid:567909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessadvisor.com"; sid:567910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessattorney.com"; sid:567911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscwnter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscwnter.com"; sid:567912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessincomeloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessincomeloss.com"; sid:567913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinteruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinteruption.com"; sid:567914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesslawyer.com"; sid:567915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslosslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslosslawyer.com"; sid:567916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessstaffing.com"; sid:567917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerprotectionplan.com"; sid:567918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyersguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyersguide.com"; sid:567919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19c.com"; sid:567920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cerotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cerotto.com"; sid:567921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinaaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinaaccountability.com"; sid:567922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinaclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinaclassaction.com"; sid:567923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinalaw.com"; sid:567924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinalawsuit.com"; sid:567925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinarestituion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinarestituion.com"; sid:567926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chinese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chinese.com"; sid:567927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19city.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19city.com"; sid:567928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimshelp.com"; sid:567929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionattorneynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionattorneynetwork.com"; sid:567930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionclaim.com"; sid:567931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlitigation.com"; sid:567932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanup2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanup2020.com"; sid:567933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clothmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clothmasks.com"; sid:567934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothmasks.com"; sid:567935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collab.com"; sid:567936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collab.net"; sid:567937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comfortdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comfortdogs.com"; sid:567938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commoncold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commoncold.com"; sid:567939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comp.com"; sid:567940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complaw.com"; sid:567941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contained.com"; sid:567942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contracts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contracts.com"; sid:567943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19control.com"; sid:567944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19controversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19controversy.com"; sid:567945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus-map.com"; sid:567946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirusmap.com"; sid:567947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusupdates.com"; sid:567948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cost.com"; sid:567949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cowboys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cowboys.com"; sid:567950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditscore.com"; sid:567951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crime.com"; sid:567952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crimes.com"; sid:567953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19criminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19criminal.com"; sid:567954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19criminals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19criminals.net"; sid:567955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisischronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisischronicles.com"; sid:567956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curedemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curedemployees.com"; sid:567957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cured.net"; sid:567958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curedstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curedstaffing.com"; sid:567959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curetreatment.com"; sid:567960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datasets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datasets.com"; sid:567961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19d.com"; sid:567962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dead.com"; sid:567963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathlawsuit.com"; sid:567964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathlawsuit.com"; sid:567965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathlawsuits.com"; sid:567966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathlawsuits.com"; sid:567967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19debtsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19debtsupport.com"; sid:567968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deception.com"; sid:567969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deepclean.com"; sid:567970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19demanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19demanda.com"; sid:567971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19demanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19demanda.com"; sid:567972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19demandas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19demandas.com"; sid:567973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-desinfektion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-desinfektion.com"; sid:567974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dinero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dinero.com"; sid:567975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseasefreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseasefreeemployeestaffing.com"; sid:567976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseasefreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseasefreestaffing.com"; sid:567977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfection.com"; sid:567978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19displays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19displays.com"; sid:567979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disposablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disposablemask.com"; sid:567980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distress.com"; sid:567981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divorcelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divorcelaw.com"; sid:567982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19docfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19docfilm.com"; sid:567983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19documentaryfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19documentaryfilm.com"; sid:567984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dollar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dollar.com"; sid:567985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dz.net"; sid:567986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ebay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ebay.com"; sid:567987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19e.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19e.com"; sid:567988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-el-salvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-el-salvador.com"; sid:567989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19elsalvador.com"; sid:567990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsalvafor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsalvafor.com"; sid:567991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsasalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsasalvador.com"; sid:567992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19elsavador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19elsavador.com"; sid:567993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerhelp.com"; sid:567994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlawfirm.com"; sid:567995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19entertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19entertainment.com"; sid:567996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemics.com"; sid:567997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ers.com"; sid:567998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19estateplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19estateplanning.com"; sid:567999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19event.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19event.com"; sid:568000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exercise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exercise.com"; sid:568001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facebook.com"; sid:568002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19familylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19familylaw.com"; sid:568003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familylawyer.com"; sid:568004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familytest.com"; sid:568005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fashions.com"; sid:568006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fighting.com"; sid:568007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fighttogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fighttogether.com"; sid:568008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialadvice.com"; sid:568009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialadvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialadvisers.com"; sid:568010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialadvisors.com"; sid:568011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-firstresponder.com"; sid:568012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridaclaim.com"; sid:568013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fogging.com"; sid:568014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19footage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19footage.com"; sid:568015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forhotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forhotels.com"; sid:568016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebusinessstaffing.com"; sid:568017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeemployees.com"; sid:568018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeemployeestaffing.com"; sid:568019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemployment.com"; sid:568020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freestaffing.com"; sid:568021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ft.com"; sid:568022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundfortheneedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundfortheneedy.com"; sid:568023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundlawyers1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundlawyers1.com"; sid:568024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundlawyers.com"; sid:568025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalinfo.com"; sid:568026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19google.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19google.com"; sid:568027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19group.com"; sid:568028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hardtruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hardtruth.com"; sid:568029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcarepins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcarepins.com"; sid:568030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthdata.com"; sid:568031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-healthdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-healthdata.com"; sid:568032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthyemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthyemployees.com"; sid:568033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthystaffing.com"; sid:568034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesandzeros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesandzeros.com"; sid:568035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hitmusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hitmusic.com"; sid:568036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest-kit.com"; sid:568037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitals.com"; sid:568038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hunter.com"; sid:568039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hunter.com"; sid:568040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hurt.com"; sid:568041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idea.com"; sid:568042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunebusinessstaffing.com"; sid:568043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuneemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuneemployees.com"; sid:568044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunestaffing.com"; sid:568045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitystaffing.com"; sid:568046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inc.com"; sid:568047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infobase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infobase.com"; sid:568048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-info.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-info.biz"; sid:568049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infonow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infonow.com"; sid:568050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19informationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19informationcenter.com"; sid:568051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informer.com"; sid:568052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inglobal.com"; sid:568053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ingreece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ingreece.com"; sid:568054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhibitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhibitor.com"; sid:568055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injections.com"; sid:568056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injuryattorney.com"; sid:568057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injurylawyer.com"; sid:568058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-in-sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-in-sa.com"; sid:568059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insuranceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insuranceattorney.com"; sid:568060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancecounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancecounsel.com"; sid:568061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancelaw.com"; sid:568062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawsuit.com"; sid:568063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancelawsuits.com"; sid:568064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurancelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurancelawsuits.com"; sid:568065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancelawyer.com"; sid:568066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inthebronx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inthebronx.com"; sid:568067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19invent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19invent.com"; sid:568068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19issummid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19issummid.com"; sid:568069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-italia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-italia.com"; sid:568070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jvion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jvion.com"; sid:568071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kansascity.com"; sid:568072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kerala.com"; sid:568073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ksa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ksa.com"; sid:568074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labor.com"; sid:568075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19land.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19land.com"; sid:568076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmnyc.com"; sid:568077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawnsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawnsigns.com"; sid:568078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lie.com"; sid:568079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lies.com"; sid:568080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveaid.com"; sid:568081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanmod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanmod.com"; sid:568082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lssuedbill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lssuedbill.com"; sid:568083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manager.com"; sid:568084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mascara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mascara.com"; sid:568085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masker.com"; sid:568086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masker.com"; sid:568087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskesonline.com"; sid:568088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19math.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19math.net"; sid:568089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medicalsupplies.com"; sid:568090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medication.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medication.net"; sid:568091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicationtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicationtreatment.com"; sid:568092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mich.com"; sid:568093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19microsoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19microsoft.com"; sid:568094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mistakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mistakes.com"; sid:568095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagefamily.com"; sid:568096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movie.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movie.world"; sid:568097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mygreatequalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mygreatequalizer.com"; sid:568098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19myth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19myth.com"; sid:568099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19n95.com"; sid:568100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19n95.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19n95.net"; sid:568101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ncp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ncp.com"; sid:568102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ne.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ne.club"; sid:568103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neg.com"; sid:568104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neworleansfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neworleansfacemask.com"; sid:568105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsclub.com"; sid:568106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-newshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-newshub.com"; sid:568107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newstv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newstv.com"; sid:568108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newupdates.com"; sid:568109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nola.com"; sid:568110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normalityrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normalityrelief.com"; sid:568111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursestaffing.com"; sid:568112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursing.com"; sid:568113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nv.com"; sid:568114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ok.com"; sid:568115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19or.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19or.com"; sid:568116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organisation.com"; sid:568117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19outbreak.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19outbreak.net"; sid:568118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pain.com"; sid:568119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19party.com"; sid:568120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passionproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passionproject.com"; sid:568121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passport.com"; sid:568122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passports.com"; sid:568123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19patients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19patients.com"; sid:568124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pcp.com"; sid:568125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcp.com"; sid:568126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pinata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pinata.com"; sid:568127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pin.com"; sid:568128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pivot.com"; sid:568129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pivot.com"; sid:568130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19poc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19poc.com"; sid:568131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-poc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-poc.com"; sid:568132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-preperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-preperation.com"; sid:568133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prescripcion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prescripcion.com"; sid:568134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventiontools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventiontools.com"; sid:568135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procure.com"; sid:568136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-projection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-projection.com"; sid:568137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protecting-screening-rehousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protecting-screening-rehousing.com"; sid:568138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivekit.com"; sid:568139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivekits.com"; sid:568140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19py.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19py.com"; sid:568141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestingkit.com"; sid:568142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestingkits.com"; sid:568143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkits.net"; sid:568144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestnow.com"; sid:568145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-real-time-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-real-time-map.com"; sid:568146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19receta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19receta.com"; sid:568147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reclamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reclamo.com"; sid:568148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reclamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reclamo.com"; sid:568149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reclamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reclamos.com"; sid:568150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reclamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reclamos.com"; sid:568151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverybillplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverybillplanner.com"; sid:568152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19refunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19refunds.com"; sid:568153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regs.net"; sid:568154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefagents.com"; sid:568155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffundfortheneedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffundfortheneedy.com"; sid:568156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relief.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relief.life"; sid:568157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefnigeria.com"; sid:568158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefnigeria.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefnigeria.net"; sid:568159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescue2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescue2020.com"; sid:568160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchlab.com"; sid:568161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19respirator.com"; sid:568162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratormasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratormasks.com"; sid:568163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratorymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratorymask.com"; sid:568164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19response.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19response.fund"; sid:568165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restituion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restituion.com"; sid:568166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ri.com"; sid:568167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskmitigation.com"; sid:568168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sa.com"; sid:568169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safestaffing.com"; sid:568170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysupply.com"; sid:568171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysupply.net"; sid:568172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salud.com"; sid:568173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizantes.com"; sid:568174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizergel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizergel.com"; sid:568175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizergelnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizergelnow.com"; sid:568176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizergels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizergels.com"; sid:568177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19satx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19satx.com"; sid:568178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbabankclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbabankclassactionlawsuit.com"; sid:568179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbalenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbalenders.com"; sid:568180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scale.com"; sid:568181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolresponse.com"; sid:568182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolresponseteam.com"; sid:568183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scrubpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scrubpins.com"; sid:568184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-search-dev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-search-dev.com"; sid:568185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellerprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellerprotectionplan.com"; sid:568186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-shirts.com"; sid:568187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shoppinglist.com"; sid:568188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sickness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sickness.com"; sid:568189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smemorial.com"; sid:568190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancing.net"; sid:568191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socrates.com"; sid:568192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sollution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sollution.com"; sid:568193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sollutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sollutions.com"; sid:568194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19space.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19space.com"; sid:568195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19spreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19spreading.com"; sid:568196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spreading.com"; sid:568197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19spreadnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19spreadnews.com"; sid:568198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spreadnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spreadnews.com"; sid:568199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ssydey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ssydey.com"; sid:568200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ssydne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ssydne.com"; sid:568201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ssydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ssydney.com"; sid:568202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statedata.com"; sid:568203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19structures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19structures.com"; sid:568204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyline.com"; sid:568205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.fund"; sid:568206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivals.com"; sid:568207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivor.net"; sid:568208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorshirts.com"; sid:568209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sydny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sydny.com"; sid:568210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-taisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-taisaku.com"; sid:568211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19takip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19takip.com"; sid:568212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taskm8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taskm8.com"; sid:568213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxexpert.com"; sid:568214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tele-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tele-health.com"; sid:568215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkit.net"; sid:568216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingservices.com"; sid:568217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingservices.net"; sid:568218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thegreatequalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thegreatequalizer.com"; sid:568219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapist.com"; sid:568220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tourism.com"; sid:568221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracker.net"; sid:568222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traduzido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traduzido.com"; sid:568223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trauma.com"; sid:568224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tutor.com"; sid:568225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacc.com"; sid:568226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vax.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vax.pro"; sid:568227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vax.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vax.today"; sid:568228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19verification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19verification.com"; sid:568229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-verification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-verification.com"; sid:568230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verification.com"; sid:568231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victim.com"; sid:568232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimservices.com"; sid:568233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19video.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19video.today"; sid:568234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusbusters.com"; sid:568235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfree.com"; sid:568236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusimmune.com"; sid:568237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussurvivor.com"; sid:568238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virustestkits.com"; sid:568239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualazer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualazer.com"; sid:568240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visuals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visuals.com"; sid:568241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vpn.com"; sid:568242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warmasks.com"; sid:568243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waste.com"; sid:568244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wastemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wastemanagement.com"; sid:568245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wastemanagement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wastemanagement.net"; sid:568246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waste.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waste.net"; sid:568247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wastetracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wastetracking.com"; sid:568248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wastetracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wastetracking.net"; sid:568249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wastetracking.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wastetracking.world"; sid:568250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waste.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waste.world"; sid:568251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19watcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19watcher.com"; sid:568252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wc.com"; sid:568253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19w.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19w.com"; sid:568254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19webcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19webcast.com"; sid:568255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19webcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19webcast.com"; sid:568256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19website.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19website.com"; sid:568257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19who.com"; sid:568258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wholesale.com"; sid:568259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19willsandtrusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19willsandtrusts.com"; sid:568260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19willsandtrusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19willsandtrusts.com"; sid:568261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldometers.com"; sid:568262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldreport.com"; sid:568263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldwidenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldwidenews.com"; sid:568264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xray.com"; sid:568265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1cdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1cdc.com"; sid:568266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-201.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-201.com"; sid:568267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20a.com"; sid:568268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20b.com"; sid:568269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20gear.com"; sid:568270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21a.com"; sid:568271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21b.com"; sid:568272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21c.com"; sid:568273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.net"; sid:568274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid22.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid22.net"; sid:568275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-66.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-66.com"; sid:568276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-97.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-97.com"; sid:568277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaarchives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaarchives.com"; sid:568278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidab.com"; sid:568279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidahome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidahome.com"; sid:568280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairrescue.com"; sid:568281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaliance.com"; sid:568282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalyse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalyse.net"; sid:568283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalyst.com"; sid:568284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanarchy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanarchy.com"; sid:568285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanswer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanswer.com"; sid:568286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibody-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibody-test.com"; sid:568287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapartmentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapartmentlaw.com"; sid:568288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarchipelago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarchipelago.com"; sid:568289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartist.com"; sid:568290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauapp.com"; sid:568291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyfile.com"; sid:568292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbetting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbetting.com"; sid:568293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizclaim.com"; sid:568294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtestingohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtestingohio.com"; sid:568295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbloodtestohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbloodtestohio.com"; sid:568296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblows.com"; sid:568297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrains.com"; sid:568298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakup.com"; sid:568299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbulgaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbulgaria.com"; sid:568300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessattorney.com"; sid:568301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslawyer.com"; sid:568302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessstaffing.com"; sid:568303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-capable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-capable.com"; sid:568304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.cloud"; sid:568305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareworkers.com"; sid:568306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentralcommand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentralcommand.com"; sid:568307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchataid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchataid.com"; sid:568308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildren.com"; sid:568309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclesthefilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclesthefilm.com"; sid:568310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchurchservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchurchservices.com"; sid:568311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbc.com"; sid:568312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcanada.com"; sid:568313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningpros.com"; sid:568314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsupplies.com"; sid:568315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclues.com"; sid:568316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollaboration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollaboration.com"; sid:568317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-comics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-comics.com"; sid:568318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-community.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-community.com"; sid:568319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityresponse.com"; sid:568320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompletecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompletecare.com"; sid:568321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfession.com"; sid:568322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-connect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-connect.net"; sid:568323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconquerors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconquerors.com"; sid:568324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconquistadors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconquistadors.com"; sid:568325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumed.com"; sid:568326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona.today"; sid:568327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughballs.com"; sid:568328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcount.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcount.world"; sid:568329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourtesymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourtesymask.com"; sid:568330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverings.com"; sid:568331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowboysbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowboysbook.com"; sid:568332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowboysmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowboysmovie.com"; sid:568333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowfolk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowfolk.com"; sid:568334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoworking.com"; sid:568335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazyhairchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazyhairchallenge.com"; sid:568336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditpandemic.com"; sid:568337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditscores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditscores.com"; sid:568338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcremation.com"; sid:568339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcribs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcribs.com"; sid:568340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimes.com"; sid:568341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimes.net"; sid:568342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriminals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriminals.com"; sid:568343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis2020.com"; sid:568344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisclaimscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisclaimscenter.com"; sid:568345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisislawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisislawcenter.com"; sid:568346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisislegalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisislegalcenter.com"; sid:568347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisislitigationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisislitigationcenter.com"; sid:568348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisismediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisismediation.com"; sid:568349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisismediator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisismediator.com"; sid:568350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisismediators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisismediators.com"; sid:568351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrooks.com"; sid:568352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruise.com"; sid:568353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushermask.com"; sid:568354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushermask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushermask.net"; sid:568355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcultures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcultures.com"; sid:568356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuredstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuredstaffing.com"; sid:568357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.deals - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.deals"; sid:568358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefencemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefencemask.com"; sid:568359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiseasefreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiseasefreeemployeestaffing.com"; sid:568360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiseasefreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiseasefreestaffing.com"; sid:568361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectant.com"; sid:568362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorces.com"; sid:568363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddixneuf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddixneuf.com"; sid:568364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddochousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddochousing.com"; sid:568365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrip.com"; sid:568366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19businesscenter.com"; sid:568367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelisa.com"; sid:568368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelisatyest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelisatyest.com"; sid:568369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidends.com"; sid:568370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialsonline.com"; sid:568371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetudescliniques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetudescliniques.com"; sid:568372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidev.com"; sid:568373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexercise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexercise.com"; sid:568374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-falseflag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-falseflag.com"; sid:568375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashionmask.com"; sid:568376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashionmasks.com"; sid:568377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashions.com"; sid:568378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloridaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloridaclaim.com"; sid:568379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebusinesses.com"; sid:568380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebusinessstaffing.com"; sid:568381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeemployees.com"; sid:568382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeemployeestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeemployeestaffing.com"; sid:568383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeemployment.com"; sid:568384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreejobs.com"; sid:568385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestaffing.com"; sid:568386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworker.com"; sid:568387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fu.com"; sid:568388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundinglawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundinglawyer.com"; sid:568389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuture.com"; sid:568390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgal.com"; sid:568391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeographic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeographic.com"; sid:568392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgerm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgerm.com"; sid:568393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgilance.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgilance.world"; sid:568394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglovesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglovesupplies.com"; sid:568395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardusa.com"; sid:568396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguides.com"; sid:568397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthystaffing.com"; sid:568398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpchicago.com"; sid:568399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpregina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpregina.com"; sid:568400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidia-officiel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidia-officiel.com"; sid:568401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidideavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidideavirus.com"; sid:568402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidideavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidideavirus.net"; sid:568403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidified.com"; sid:568404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunebusinessstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunebusinessstaffing.com"; sid:568405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmuneemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmuneemployees.com"; sid:568406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunestaffing.com"; sid:568407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmuneworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmuneworker.com"; sid:568408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunity.net"; sid:568409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitystaffing.com"; sid:568410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinator.com"; sid:568411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiatracker.com"; sid:568412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhibitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhibitor.com"; sid:568413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotism.com"; sid:568414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotoftheday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotoftheday.com"; sid:568415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivici.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivici.com"; sid:568416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjam.com"; sid:568417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjams.com"; sid:568418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoe.com"; sid:568419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-joinzoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-joinzoe.com"; sid:568420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjtrump.com"; sid:568421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsusa.com"; sid:568422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabspro.com"; sid:568423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlandlordclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlandlordclaims.com"; sid:568424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyers4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyers4u.com"; sid:568425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalcenter.com"; sid:568426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanmod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanmod.com"; sid:568427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansba.com"; sid:568428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidly19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidly19.com"; sid:568429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanifesto.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanifesto.net"; sid:568430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanifiesto.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanifiesto.net"; sid:568431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-map.net"; sid:568432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskandglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskandglove.com"; sid:568433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskandsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskandsupplies.com"; sid:568434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskfinder.com"; sid:568435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskguide.com"; sid:568436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mask.net"; sid:568437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasknow.com"; sid:568438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskorder.com"; sid:568439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksandgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksandgloves.com"; sid:568440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksandsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksandsupplies.com"; sid:568441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksandsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksandsupply.com"; sid:568442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksprotect.com"; sid:568443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskssupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskssupply.com"; sid:568444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksupplies.com"; sid:568445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksusa.net"; sid:568446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaterials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaterials.com"; sid:568447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedica.com"; sid:568448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalclaim.com"; sid:568449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicare.com"; sid:568450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonitorutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonitorutah.com"; sid:568451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgages.com"; sid:568452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-movie.com"; sid:568453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-myths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-myths.com"; sid:568454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsresource.com"; sid:568455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnextdoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnextdoor.com"; sid:568456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenbankruptcy.com"; sid:568457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteendeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteendeath.com"; sid:568458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteendeathrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteendeathrate.com"; sid:568459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenquarantine.com"; sid:568460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenrecovery.com"; sid:568461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteentracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteentracer.com"; sid:568462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nj.com"; sid:568463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomas.com"; sid:568464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnowmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnowmobile.com"; sid:568465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursestaffing.com"; sid:568466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoblivious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoblivious.com"; sid:568467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoneninecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoneninecure.com"; sid:568468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoneninequarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoneninequarantine.com"; sid:568469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoomsus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoomsus2020.com"; sid:568470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorders.com"; sid:568471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpac.com"; sid:568472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic20.com"; sid:568473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmatherapy.com"; sid:568474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpmlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpmlaw.com"; sid:568475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-positivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-positivity.com"; sid:568476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositivity.com"; sid:568477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpotion.com"; sid:568478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppemask.com"; sid:568479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppemasks.com"; sid:568480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionmeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionmeasures.com"; sid:568481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionstations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionstations.com"; sid:568482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pro.com"; sid:568483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprogress.com"; sid:568484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprom2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprom2020.com"; sid:568485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotecsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotecsolutions.com"; sid:568486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectioncompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectioncompany.com"; sid:568487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionequipment.com"; sid:568488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionusa.com"; sid:568489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotective.com"; sid:568490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotecto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotecto.com"; sid:568491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprovisions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprovisions.com"; sid:568492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpz.com"; sid:568493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrathernot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrathernot.com"; sid:568494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyma.com"; sid:568495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveredregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveredregistry.com"; sid:568496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefatx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefatx.com"; sid:568497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefuk.com"; sid:568498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefund.com"; sid:568499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefundservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefundservices.com"; sid:568500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchconsulting.com"; sid:568501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchers.com"; sid:568502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchgroup.com"; sid:568503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchlab.com"; sid:568504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchlabs.com"; sid:568505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresturantfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresturantfund.com"; sid:568506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreviews.com"; sid:568507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevival.com"; sid:568508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrix.com"; sid:568509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehouse.com"; sid:568510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferealty.com"; sid:568511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysupplies.com"; sid:568512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanity.com"; sid:568513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscarf.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscarf.biz"; sid:568514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsclear.com"; sid:568515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscope.com"; sid:568516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsfree.com"; sid:568517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignal.com"; sid:568518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialdistancingrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialdistancingrules.com"; sid:568519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocrates.com"; sid:568520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsgroup.com"; sid:568521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-startups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-startups.com"; sid:568522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatin.com"; sid:568523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstorm.com"; sid:568524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstreaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstreaming.com"; sid:568525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstressdisorder.com"; sid:568526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudygroup.com"; sid:568527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuite.com"; sid:568528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-supplies.net"; sid:568529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivals.com"; sid:568530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorclub.com"; sid:568531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorstore.com"; sid:568532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsux.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsux.net"; sid:568533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyd.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyd.club"; sid:568534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyd.com"; sid:568535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyd.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyd.life"; sid:568536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsydney.com"; sid:568537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyd.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyd.today"; sid:568538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyd.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyd.world"; sid:568539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-system.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-system.com"; sid:568540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-system.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-system.net"; sid:568541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteacking.com"; sid:568542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenantclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenantclaims.com"; sid:568543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestca.com"; sid:568544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.services"; sid:568545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkits.biz"; sid:568546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtocure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtocure.com"; sid:568547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtocures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtocures.com"; sid:568548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tool.com"; sid:568549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrcking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrcking.com"; sid:568550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunit.com"; sid:568551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunited.com"; sid:568552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusagear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusagear.com"; sid:568553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacc.com"; sid:568554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine2020.com"; sid:568555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinenow.com"; sid:568556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvent.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvent.net"; sid:568557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvigil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvigil.com"; sid:568558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusconsultant.com"; sid:568559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscured.com"; sid:568560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfree.com"; sid:568561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusimmune.com"; sid:568562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussafestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussafestaffing.com"; sid:568563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussurvivor.com"; sid:568564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualazer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualazer.com"; sid:568565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualializer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualializer.com"; sid:568566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualized.com"; sid:568567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuizer.com"; sid:568568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuliar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuliar.com"; sid:568569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvizualer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvizualer.com"; sid:568570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolonter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolonter.com"; sid:568571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvpn.com"; sid:568572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvusualiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvusualiser.com"; sid:568573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarning.com"; sid:568574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwastetracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwastetracking.com"; sid:568575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwastetracking.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwastetracking.net"; sid:568576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebinar.com"; sid:568577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddings.com"; sid:568578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldwar.com"; sid:568579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixattorney.com"; sid:568580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixattorney.net"; sid:568581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixclaims.com"; sid:568582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixclaims.net"; sid:568583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixlaw.com"; sid:568584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixlaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixlaw.net"; sid:568585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixloan.com"; sid:568586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixrelief.com"; sid:568587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixrelief.net"; sid:568588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixsurvivor.com"; sid:568589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixsurvivor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixsurvivor.net"; sid:568590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxpress.com"; sid:568591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzoomevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzoomevents.com"; sid:568592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditpandemic.com"; sid:568593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditscorepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditscorepandemic.com"; sid:568594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crookscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crookscorona.com"; sid:568595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crstcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crstcoronavirusupdates.com"; sid:568596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbingcovid19.com"; sid:568597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidnineteen.com"; sid:568598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedfromcorona.com"; sid:568599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedfromcovid19.com"; sid:568600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curefromcorona.com"; sid:568601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingcovid-19.com"; sid:568602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid19everything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid19everything.com"; sid:568603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid19masks.com"; sid:568604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyberixcontrecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyberixcontrecorona.com"; sid:568605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidiot.com"; sid:568606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidiot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidiot.net"; sid:568607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascountycovid.com"; sid:568608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid19lawyers.com"; sid:568609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damnyoupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damnyoupandemic.com"; sid:568610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangerscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangerscovid-19.com"; sid:568611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangerscovid19.com"; sid:568612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangersofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangersofcorona.com"; sid:568613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangersofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangersofcovid-19.com"; sid:568614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangersofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangersofcovid19.com"; sid:568615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathbycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathbycoronavirus.com"; sid:568616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debtstoppercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debtstoppercorona.com"; sid:568617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeat-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeat-covid-19.com"; sid:568618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandasdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandasdelcoronavirus.com"; sid:568619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandasdelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandasdelcovid-19.com"; sid:568620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandasdelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandasdelcovid19.com"; sid:568621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dgcovid.com"; sid:568622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didcoronakillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didcoronakillme.com"; sid:568623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for direitocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"direitocovid.com"; sid:568624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discountpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discountpandemic.com"; sid:568625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcoronavirushome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcoronavirushome.com"; sid:568626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disposeablecoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disposeablecoronamask.com"; sid:568627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diyppecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diyppecovid.com"; sid:568628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dj-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dj-covid19.com"; sid:568629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcovidbattles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcovidbattles.com"; sid:568630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djpandemic.com"; sid:568631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingcorona.com"; sid:568632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for does5gcausecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"does5gcausecovid19.com"; sid:568633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacionescovid19.com"; sid:568634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donationsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donationsforcorona.com"; sid:568635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontcovidmetshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontcovidmetshirt.com"; sid:568636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for du-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"du-gegen-corona.com"; sid:568637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eccovid19noticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eccovid19noticias.com"; sid:568638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for echurchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"echurchcovid19.com"; sid:568639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectsofccppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectsofccppandemic.com"; sid:568640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectsofcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectsofcoronapandemic.com"; sid:568641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectsofcoronapandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectsofcoronapandemicvirus.com"; sid:568642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenciacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenciacovid-19.com"; sid:568643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encuestacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encuestacovid-19.com"; sid:568644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofpandemic.com"; sid:568645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enjoycoronalife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enjoycoronalife.com"; sid:568646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entrepreneurs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entrepreneurs-covid19.com"; sid:568647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicpandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicpandemicmovie.com"; sid:568648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicstop.com"; sid:568649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatecovid-19.com"; sid:568650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapefromcovid.com"; sid:568651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyesoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyesoncovid19.com"; sid:568652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fabriziocoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fabriziocoronalive.com"; sid:568653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskscorona.com"; sid:568654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecoronamode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecoronamode.com"; sid:568655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecovid.com"; sid:568656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fhealthcovid.com"; sid:568657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19masks.com"; sid:568658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-epidemic.com"; sid:568659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcorona.world"; sid:568660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightwithcovid.com"; sid:568661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavaccine.com"; sid:568662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirusproducts.com"; sid:568663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidblood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidblood.com"; sid:568664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidcure.com"; sid:568665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidvaccine.com"; sid:568666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcoronavirusresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcoronavirusresponseact.com"; sid:568667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19lawfirm.com"; sid:568668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidresearch.com"; sid:568669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidresearchlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidresearchlab.com"; sid:568670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidresearchlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidresearchlabs.com"; sid:568671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridapandemicrelieforganisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridapandemicrelieforganisation.com"; sid:568672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecheckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecheckcovid19.com"; sid:568673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frick-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frick-covid-19.com"; sid:568674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.party"; sid:568675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckedbycorona.com"; sid:568676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.life"; sid:568677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundacionmexicanoscontraelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundacionmexicanoscontraelcovid19.com"; sid:568678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundraiserforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundraiserforcovid19.com"; sid:568679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for furloughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"furloughcovid19.com"; sid:568680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearforcovid.com"; sid:568681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcovid20.com"; sid:568682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germcovid.com"; sid:568683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavaccine.net"; sid:568684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidclear.com"; sid:568685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfacemasks.com"; sid:568686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getpandemiccleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getpandemiccleaning.com"; sid:568687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gfcovid19.com"; sid:568688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gicovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gicovid19study.com"; sid:568689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global2020covid19.com"; sid:568690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronahoax.com"; sid:568691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19search.com"; sid:568692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicinfo.com"; sid:568693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicnetwork.com"; sid:568694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.today"; sid:568695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidconnect.com"; sid:568696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grants-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grants-covid19.com"; sid:568697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guatecovid.com"; sid:568698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hacktechcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hacktechcovid.com"; sid:568699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcovidnineteen.com"; sid:568700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltingcovid-19.com"; sid:568701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltingcovid19.com"; sid:568702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hboisfreeduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hboisfreeduringcovid.com"; sid:568703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help2covid19.com"; sid:568704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-after-corona.com"; sid:568705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidpets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidpets.com"; sid:568706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidpets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidpets.net"; sid:568707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbs4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbs4corona.com"; sid:568708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hombrescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hombrescorona.com"; sid:568709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homemadecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homemadecovidmask.com"; sid:568710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homemadecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homemadecovidmasks.com"; sid:568711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeinsidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeinsidecovid19.com"; sid:568712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopkinscountytxcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopkinscountytxcovid-19.com"; sid:568713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcorona.com"; sid:568714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidhelp.com"; sid:568715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtokillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtokillcovid.com"; sid:568716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivethecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivethecovidcrash.com"; sid:568717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanityvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanityvscovid.com"; sid:568718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hurtbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hurtbycorona.com"; sid:568719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocovid-19news.com"; sid:568720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idotcovid.com"; sid:568721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iem-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iem-covid19.com"; sid:568722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycoronavirus.com"; sid:568723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycovid.com"; sid:568724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitypassportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitypassportcovid.com"; sid:568725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imrecovid.com"; sid:568726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid19tracker.com"; sid:568727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indivisiblebycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indivisiblebycovid19.com"; sid:568728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectiousdiseasepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectiousdiseasepandemic.com"; sid:568729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid.net"; sid:568730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmemoryofcovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmemoryofcovid19victims.com"; sid:568731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-corona.com"; sid:568732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-corona.net"; sid:568733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-coronavirus.com"; sid:568734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-coronavirus.net"; sid:568735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid-19.com"; sid:568736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid19.com"; sid:568737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid-19.net"; sid:568738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid19.net"; sid:568739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.solutions"; sid:568740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthepandemic.net"; sid:568741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscovid.com"; sid:568742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ittakesapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ittakesapandemic.com"; sid:568743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivermectincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivermectincoronavirus.com"; sid:568744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivoirecovid19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivoirecovid19check.com"; sid:568745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantcovid19test.com"; sid:568746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantcovidtest.com"; sid:568747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantcovidtesting.com"; sid:568748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnhopkinscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnhopkinscorona.com"; sid:568749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnshopkinscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnshopkinscorona.com"; sid:568750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincovidtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincovidtrials.com"; sid:568751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jscovid19.com"; sid:568752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascitycovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascitycovid19relief.com"; sid:568753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenyacovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenyacovidfund.com"; sid:568754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasasst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasasst.com"; sid:568755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasasstee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasasstee.com"; sid:568756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasasstees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasasstees.com"; sid:568757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid-19asst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid-19asst.com"; sid:568758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid19asst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid19asst.com"; sid:568759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid-19asstee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid-19asstee.com"; sid:568760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid-19asstees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid-19asstees.com"; sid:568761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kids4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kids4covid.com"; sid:568762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19.run"; sid:568763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidnineteen.com"; sid:568764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killscovid.com"; sid:568765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kittoolscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kittoolscovid19.com"; sid:568766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kittoolstestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kittoolstestcovid19.com"; sid:568767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacontracorona.com"; sid:568768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lastworldwidepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lastworldwidepandemic.com"; sid:568769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latest-on-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latest-on-covid19.com"; sid:568770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyercovid.com"; sid:568771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalactioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalactioncovid19.com"; sid:568772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid.clinic"; sid:568773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscombatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscombatcovid19.com"; sid:568774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lexingtoncoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lexingtoncoronavirusinfo.com"; sid:568775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lexingtoncovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lexingtoncovidinfo.com"; sid:568776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilltcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilltcovid19testing.com"; sid:568777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillucovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillucovid19testing.com"; sid:568778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19resting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19resting.com"; sid:568779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19teating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19teating.com"; sid:568780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19tesring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19tesring.com"; sid:568781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testig.com"; sid:568782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testimg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testimg.com"; sid:568783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testng.com"; sid:568784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testong.com"; sid:568785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19trsting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19trsting.com"; sid:568786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19tsting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19tsting.com"; sid:568787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezasanticovid.com"; sid:568788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronamusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronamusic.com"; sid:568789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovidhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovidhomes.com"; sid:568790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid19bankruptcylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid19bankruptcylawyer.com"; sid:568791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcovid.com"; sid:568792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecashinthecovid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecashinthecovid19crash.com"; sid:568793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparacovid.com"; sid:568794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapabrasileirodacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapabrasileirodacovid.com"; sid:568795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mappingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mappingthepandemic.com"; sid:568796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for martforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"martforcorona.com"; sid:568797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandchildsupportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandchildsupportcovid19.com"; sid:568798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovid.com"; sid:568799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovidhomologada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovidhomologada.com"; sid:568800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarafacialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarafacialcovid.com"; sid:568801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaraprotectoracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaraprotectoracovid.com"; sid:568802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskofcovid.com"; sid:568803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskthecovid.com"; sid:568804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticorona.com"; sid:568805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquedeprotectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquedeprotectioncovid.com"; sid:568806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueprotectioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueprotectioncorona.com"; sid:568807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-protection-coronavirus-tissu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-protection-coronavirus-tissu.com"; sid:568808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matacoronavirus.com"; sid:568809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materialcovid.com"; sid:568810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meadareacovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meadareacovid19response.com"; sid:568811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentocoronavirus.com"; sid:568812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentocoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentocoronaviruses.com"; sid:568813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentocovid19.com"; sid:568814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicamentocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicamentocovid19.net"; sid:568815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mercyfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mercyfightscovid19.com"; sid:568816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metatoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metatoncovid.com"; sid:568817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meversescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meversescovid19.com"; sid:568818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meversescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meversescovid19.net"; sid:568819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meversescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meversescovid.com"; sid:568820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mevscovid19.com"; sid:568821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mevscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mevscovid.com"; sid:568822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microsoftcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microsoftcovid.com"; sid:568823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minneapoliscovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minneapoliscovidhelp.com"; sid:568824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mondmaskeranticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mondmaskeranticorona.com"; sid:568825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montrealdecontaminationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montrealdecontaminationcovid19.com"; sid:568826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for morthaifightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"morthaifightcovid.com"; sid:568827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mspaccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mspaccovid.com"; sid:568828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiccovidreief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiccovidreief.com"; sid:568829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicovidrelief.com"; sid:568830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myanmarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myanmarcovid.com"; sid:568831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacleaning.com"; sid:568832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronascore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronascore.com"; sid:568833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusnews.com"; sid:568834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19score.com"; sid:568835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19score.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19score.net"; sid:568836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcompanion.com"; sid:568837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmask.net"; sid:568838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidpass.com"; sid:568839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidscore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidscore.net"; sid:568840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtesting.com"; sid:568841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtesting.net"; sid:568842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95mask-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95mask-covid19.com"; sid:568843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95mask-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95mask-covid19.net"; sid:568844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95pandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95pandemicmasks.com"; sid:568845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95pandemicmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95pandemicmasks.net"; sid:568846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necovidcheck.com"; sid:568847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neurocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neurocovid19.com"; sid:568848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neurocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neurocovid.net"; sid:568849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincoronadiseasestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincoronadiseasestaffing.com"; sid:568850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincoronastaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincoronastaffing.com"; sid:568851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincovid19staffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincovid19staffing.com"; sid:568852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neveragaincovidstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neveragaincovidstaffing.com"; sid:568853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaprotection.com"; sid:568854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscovidmask.com"; sid:568855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidbenefits.com"; sid:568856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nihayatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nihayatcovid19.com"; sid:568857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixcorona.com"; sid:568858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidlaw.com"; sid:568859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaviruscr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaviruscr.com"; sid:568860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-covid-19.net"; sid:568861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19scarf.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19scarf.biz"; sid:568862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidhere.com"; sid:568863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomocovidboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomocovidboutique.com"; sid:568864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomocovid.com"; sid:568865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-morecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-morecovid.com"; sid:568866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncovid19houses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncovid19houses.com"; sid:568867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcoronatest.com"; sid:568868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursestaffingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursestaffingcovid19.com"; sid:568869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursestaffingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursestaffingcovid.com"; sid:568870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursingcorona.com"; sid:568871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursingcoronavirus.com"; sid:568872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronaviruslegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronaviruslegal.com"; sid:568873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19lawfirm.com"; sid:568874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid.com"; sid:568875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nychhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nychhcovid.com"; sid:568876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19disability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19disability.com"; sid:568877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19watchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19watchdog.com"; sid:568878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoviddisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoviddisability.com"; sid:568879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidlawfirm.com"; sid:568880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysccoronavirusessettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysccoronavirusessettlement.com"; sid:568881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysccoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysccoronaviruslawsuit.com"; sid:568882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysccoronavirussettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysccoronavirussettlement.com"; sid:568883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysccovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysccovid19lawsuit.com"; sid:568884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysccovid19settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysccovid19settlement.com"; sid:568885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscoviddisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscoviddisability.com"; sid:568886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid19healthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid19healthinfo.com"; sid:568887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacovid.com"; sid:568888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponapandemic.com"; sid:568889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponapandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponapandemic.net"; sid:568890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecovid19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecovid19data.com"; sid:568891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronacare.com"; sid:568892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid.com"; sid:568893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovid19testing.com"; sid:568894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovidtesting.com"; sid:568895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operatingwithoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operatingwithoutcorona.com"; sid:568896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercoronamask.com"; sid:568897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for originalcovidcouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"originalcovidcouture.com"; sid:568898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlivecorona.com"; sid:568899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pahlawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pahlawancovid19.com"; sid:568900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-20.com"; sid:568901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusiness.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusiness.guide"; sid:568902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccam.net"; sid:568903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccamwhore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccamwhore.com"; sid:568904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccast.com"; sid:568905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccast.net"; sid:568906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-compliance.com"; sid:568907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccues.com"; sid:568908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicculture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicculture.com"; sid:568909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdirectbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdirectbook.com"; sid:568910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.email"; sid:568911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencysupplies.com"; sid:568912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfilmfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfilmfest.com"; sid:568913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfitness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfitness.net"; sid:568914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgearguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgearguide.com"; sid:568915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichandbook.com"; sid:568916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickitz.com"; sid:568917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicleader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicleader.com"; sid:568918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclyfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclyfe.com"; sid:568919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmask.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmask.center"; sid:568920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparade.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparade.life"; sid:568921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparts.com"; sid:568922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpenpals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpenpals.com"; sid:568923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonification.com"; sid:568924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpianoguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpianoguy.com"; sid:568925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplants.com"; sid:568926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoem.com"; sid:568927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepkits.com"; sid:568928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionservices.com"; sid:568929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpups.com"; sid:568930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadyusa.com"; sid:568931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsecret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsecret.com"; sid:568932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshappen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshappen.net"; sid:568933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsmart.com"; sid:568934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstructure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstructure.com"; sid:568935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstructures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstructures.com"; sid:568936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-studios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-studios.com"; sid:568937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliesonline.com"; sid:568938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplycompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplycompany.com"; sid:568939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplyonline.com"; sid:568940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalshop.com"; sid:568941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicusa2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicusa2020.com"; sid:568942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pbacovid-19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pbacovid-19relieffund.com"; sid:568943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovid19.com"; sid:568944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pencegahancovid19poldapb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pencegahancovid19poldapb.com"; sid:568945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perimenopausalinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perimenopausalinapandemic.com"; sid:568946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perlengkapananticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perlengkapananticorona.com"; sid:568947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phoenixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phoenixcovid19.com"; sid:568948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmaforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmaforcovid.com"; sid:568949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataforma-afectados-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataforma-afectados-coronavirus.com"; sid:568950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataforma-afectats-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataforma-afectats-coronavirus.com"; sid:568951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona20.com"; sid:568952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.business"; sid:568953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadays.com"; sid:568954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaviruslegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaviruslegalhelp.com"; sid:568955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaviruslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaviruslife.com"; sid:568956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19resources.com"; sid:568957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovideconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovideconomics.com"; sid:568958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidera.com"; sid:568959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidkids.com"; sid:568960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlegal.com"; sid:568961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlegalhelp.com"; sid:568962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsociety.com"; sid:568963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsolutions.com"; sid:568964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstress.com"; sid:568965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemichandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemichandbook.com"; sid:568966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpartyplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpartyplanner.com"; sid:568967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicplatform.com"; sid:568968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicstressdisorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicstressdisorder.com"; sid:568969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe4covid.com"; sid:568970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecovid19.com"; sid:568971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppeforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppeforcovid-19.com"; sid:568972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppphelp4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppphelp4covid.com"; sid:568973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycorona.com"; sid:568974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparingforthenextpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparingforthenextpandemic.com"; sid:568975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencioncovid19.com"; sid:568976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19infection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19infection.com"; sid:568977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productscoronavirus.com"; sid:568978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcovidstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcovidstaff.com"; sid:568979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectedfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectedfromcovid.com"; sid:568980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionproductsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionproductsforcoronavirus.com"; sid:568981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmefromcoronavirus.com"; sid:568982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectusfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectusfromcovid.com"; sid:568983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocollocinemacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocollocinemacovid.net"; sid:568984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punecovid.com"; sid:568985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punefightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punefightscorona.com"; sid:568986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for q8coronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"q8coronavaccine.com"; sid:568987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecovidonenine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecovidonenine.com"; sid:568988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quebecdecontaminationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quebecdecontaminationcovid19.com"; sid:568989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitforcovid19.com"; sid:568990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radionocovidphuket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radionocovidphuket.com"; sid:568991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ran-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ran-covid.com"; sid:568992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidstrong.com"; sid:568993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relawangugascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relawangugascovid19.com"; sid:568994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relementationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relementationcovid.com"; sid:568995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcoronapandemicvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcoronapandemicvictims.com"; sid:568996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovid-19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovid-19victims.com"; sid:568997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovid19victims.com"; sid:568998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailvscovid.com"; sid:568999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runforcovid.com"; sid:569000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars2-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars2-covid-19.com"; sid:569001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveacorona.com"; sid:569002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for save-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"save-corona.com"; sid:569003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savecovid.com"; sid:569004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savethecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savethecorona.com"; sid:569005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveyourassinthecovid19crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveyourassinthecovid19crash.com"; sid:569006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveyourassinthecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveyourassinthecovidcrash.com"; sid:569007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sba-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sba-covid.com"; sid:569008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-loans.com"; sid:569009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbapandemicloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbapandemicloans.com"; sid:569010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccoronavirushelp.com"; sid:569011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccoronavirusinfo.com"; sid:569012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccoronavirusresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccoronavirusresources.com"; sid:569013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccoronavirusresponse.com"; sid:569014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccovid.com"; sid:569015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccovidhelp.com"; sid:569016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sccovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sccovidresponse.com"; sid:569017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolscovid19.com"; sid:569018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scorecovid19.com"; sid:569019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenforcorona.com"; sid:569020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenforcoronavirus.com"; sid:569021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seasonalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seasonalcovid.com"; sid:569022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secureinfocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secureinfocovid.com"; sid:569023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsthilfecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsthilfecovid19.com"; sid:569024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selbsthilfecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selbsthilfecovid19.net"; sid:569025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serbiancovid-19de-germer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serbiancovid-19de-germer.com"; sid:569026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-avoidcovid19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-avoidcovid19corona.com"; sid:569027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopnocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopnocovid.com"; sid:569028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shunyacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shunyacorona.com"; sid:569029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sickofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sickofcovid.com"; sid:569030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovidnineteen.com"; sid:569031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialisminthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialisminthetimeofcorona.net"; sid:569032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sociologyinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sociologyinthetimeofcorona.net"; sid:569033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionesdeproteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionesdeproteccioncovid.com"; sid:569034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southorangecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southorangecovid.com"; sid:569035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportsclubcoronavirussettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportsclubcoronavirussettlement.com"; sid:569036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingcovid19.com"; sid:569037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingcovid.com"; sid:569038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupcovid19.com"; sid:569039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stats4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stats4covid.com"; sid:569040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staypandemicsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staypandemicsafe.com"; sid:569041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcellcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcellcovid.net"; sid:569042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickerpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickerpandemic.com"; sid:569043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona-virus-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona-virus-2020.com"; sid:569044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.world"; sid:569045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidnineteen.com"; sid:569046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcorona.com"; sid:569047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storeforcovidprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storeforcovidprevention.com"; sid:569048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentsagainstcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentsagainstcorona.net"; sid:569049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivethecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivethecovidcrash.com"; sid:569050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecovidcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecovidcrash.com"; sid:569051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecontrolovercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecontrolovercorona.com"; sid:569052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takesapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takesapandemic.com"; sid:569053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesfromthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesfromthecorona.com"; sid:569054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tanggapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tanggapcovid19.com"; sid:569055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2020.com"; sid:569056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2021.com"; sid:569057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2022.com"; sid:569058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2023.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2023.com"; sid:569059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2024.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2024.com"; sid:569060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovid2025.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovid2025.com"; sid:569061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tepcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tepcoronavirus.com"; sid:569062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teracovid.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teracovid.group"; sid:569063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terapiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terapiacovid19.com"; sid:569064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.biz"; sid:569065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing4covid.com"; sid:569066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitsforcovid-19.com"; sid:569067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsitecovid19.com"; sid:569068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19bankruptcy.com"; sid:569069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19lawfirm.com"; sid:569070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.center"; sid:569071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaconversations.com"; sid:569072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacrisiscamp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacrisiscamp.club"; sid:569073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronadiaries.com"; sid:569074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaforum.com"; sid:569075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafundrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafundrecovery.com"; sid:569076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapost.com"; sid:569077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaprayer.com"; sid:569078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronarepublic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronarepublic.com"; sid:569079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatimes.net"; sid:569080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatribune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatribune.com"; sid:569081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatruth.com"; sid:569082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavaccination.com"; sid:569083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushomepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushomepage.com"; sid:569084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19antidote.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19antidote.club"; sid:569085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19cures.com"; sid:569086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19heroes.com"; sid:569087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19killer.com"; sid:569088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19outbreak2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19outbreak2020.com"; sid:569089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcaregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcaregiver.com"; sid:569090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcorps.com"; sid:569091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcured.com"; sid:569092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddays.com"; sid:569093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddays.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddays.net"; sid:569094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkiller.com"; sid:569095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidknights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidknights.com"; sid:569096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidknights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidknights.net"; sid:569097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnights.com"; sid:569098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnights.net"; sid:569099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpositive.com"; sid:569100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidprepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidprepper.com"; sid:569101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstory.com"; sid:569102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidteam.com"; sid:569103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefightagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefightagainstcorona.com"; sid:569104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicnow.com"; sid:569105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thermocamaracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thermocamaracovid.com"; sid:569106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisiscovid.com"; sid:569107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeaftercorona.com"; sid:569108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for time-after-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"time-after-covid19.com"; sid:569109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timesharecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timesharecovid19.com"; sid:569110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timesharecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timesharecovid.com"; sid:569111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoparaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoparaelcoronavirus.com"; sid:569112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoparaelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoparaelcovid.com"; sid:569113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transcarecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transcarecovid-19.com"; sid:569114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamientocompletocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamientocompletocovid19.com"; sid:569115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tratamientoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tratamientoscovid19.com"; sid:569116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcovid-19.com"; sid:569117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatingcovid19.net"; sid:569118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triagecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triagecovid19.com"; sid:569119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trivalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trivalcovid.com"; sid:569120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcoronacare.com"; sid:569121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovid19erp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovid19erp.com"; sid:569122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubuntucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubuntucorona.com"; sid:569123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for udhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"udhealthcovid.com"; sid:569124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uffhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uffhealthcovid.com"; sid:569125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufgealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufgealthcovid.com"; sid:569126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufheaalthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufheaalthcovid.com"; sid:569127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufheakthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufheakthcovid.com"; sid:569128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealrhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealrhcovid.com"; sid:569129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealtgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealtgcovid.com"; sid:569130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealthccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealthccovid.com"; sid:569131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealthhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealthhcovid.com"; sid:569132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealtjcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealtjcovid.com"; sid:569133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealtthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealtthcovid.com"; sid:569134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealyhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealyhcovid.com"; sid:569135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufheealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufheealthcovid.com"; sid:569136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhhealthcovid.com"; sid:569137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhralthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhralthcovid.com"; sid:569138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufjealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufjealthcovid.com"; sid:569139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescorona.com"; sid:569140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirusmask.com"; sid:569141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemic2020.com"; sid:569142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicrelieforganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicrelieforganization.com"; sid:569143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirussearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirussearch.com"; sid:569144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19charts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19charts.com"; sid:569145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19rate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19rate.com"; sid:569146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19search.com"; sid:569147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcure.com"; sid:569148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidrate.com"; sid:569149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid.today"; sid:569150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usfightcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usfightcovid.club"; sid:569151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovid-19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovid-19killer.com"; sid:569152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovid19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovid19killer.com"; sid:569153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vanquishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vanquishcorona.com"; sid:569154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vanquishcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vanquishcorona.net"; sid:569155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorsforcovid19.com"; sid:569156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorsforcovid.com"; sid:569157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizon-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizon-covid19.com"; sid:569158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncovid-19.com"; sid:569159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncovid19.com"; sid:569160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimscovid-19.com"; sid:569161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-corona.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-corona.international"; sid:569162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voiceofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voiceofcorona.net"; sid:569163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vs-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vs-coronavirus.com"; sid:569164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waspadacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waspadacorona.com"; sid:569165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearacovidmask.com"; sid:569166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearerecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearerecovid.com"; sid:569167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearrecovid.com"; sid:569168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearthecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearthecovidmask.com"; sid:569169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wedonotdopandemicalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wedonotdopandemicalone.com"; sid:569170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wercorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wercorona2020.com"; sid:569171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for werincoronamode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"werincoronamode.com"; sid:569172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcausescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcausescovid.com"; sid:569173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencovidends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencovidends.com"; sid:569174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winningthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winningthepandemic.com"; sid:569175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthepandemic.com"; sid:569176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipecovidout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipecovidout.com"; sid:569177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for womenagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"womenagainstcovid19.com"; sid:569178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirussearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirussearch.com"; sid:569179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid-19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid-19search.com"; sid:569180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldocorona.com"; sid:569181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemic.net"; sid:569182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwithcorona.com"; sid:569183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrenthamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrenthamcovid19.com"; sid:569184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfulang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfulang.com"; sid:569185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanscam.com"; sid:569186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid19businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid19businesscenter.com"; sid:569187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid.com"; sid:569188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovidvisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovidvisualizer.com"; sid:569189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--afectadoscoronavirusespaa-woc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--afectadoscoronavirusespaa-woc.com"; sid:569190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronazn-6za.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronazn-6za.com"; sid:569191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronazn-6za.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronazn-6za.net"; sid:569192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yfhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yfhealthcovid.com"; sid:569193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidscore.com"; sid:569194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidtesting.com"; sid:569195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidtesting.net"; sid:569196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19aftermath.com"; sid:569197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19fallout.com"; sid:569198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicfallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicfallout.com"; sid:569199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicmonument.com"; sid:569200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-worldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-worldpandemic.com"; sid:569201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6feetcovid19.com"; sid:569202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6ftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6ftcovid19.com"; sid:569203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911corona911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911corona911.com"; sid:569204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronavirus911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronavirus911.com"; sid:569205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogaciacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogaciacoronavirus.com"; sid:569206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronaviruscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronaviruscovid19.net"; sid:569207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronavirusmadrid.com"; sid:569208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronavirusvalencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronavirusvalencia.com"; sid:569209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosvictimascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosvictimascovid19.com"; sid:569210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-covid-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-covid-19.today"; sid:569211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accessoricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accessoricovid.com"; sid:569212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acingcovid19.com"; sid:569213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid19test.com"; sid:569214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualcovid19deathcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualcovid19deathcount.com"; sid:569215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidsummit.com"; sid:569216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftermath2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftermath2020covid19.com"; sid:569217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agevolazionicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agevolazionicovid-19.com"; sid:569218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agjcontraocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agjcontraocovid.com"; sid:569219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcoronavirus.club"; sid:569220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allpandemics.com"; sid:569221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amaalacorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amaalacorona.club"; sid:569222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for american2020covid19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"american2020covid19aftermath.com"; sid:569223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for american2020covid19fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"american2020covid19fallout.com"; sid:569224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid-19.com"; sid:569225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanscovid-19.com"; sid:569226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanswarcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanswarcovid-19.com"; sid:569227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanswaroncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanswaroncovid-19.com"; sid:569228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analisiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analisiscoronavirus.com"; sid:569229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analisiscovid19.com"; sid:569230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analisiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analisiscovid.com"; sid:569231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid19.com"; sid:569232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafood.com"; sid:569233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfoil.com"; sid:569234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidnow.com"; sid:569235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycorona19.com"; sid:569236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycorona19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycorona19mask.com"; sid:569237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid19mask.com"; sid:569238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovidmask.com"; sid:569239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applyforcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applyforcovid19relief.com"; sid:569240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arducovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arducovid.com"; sid:569241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for art4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"art4covid.net"; sid:569242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artofcovid.com"; sid:569243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asacoronavirus.com"; sid:569244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a-sane-coronavirus-response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a-sane-coronavirus-response.com"; sid:569245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacionafectadosporelcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacionafectadosporelcoronavirus2020.com"; sid:569246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid19.com"; sid:569247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid2019.com"; sid:569248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid2020.com"; sid:569249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid2021.com"; sid:569250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid2022.com"; sid:569251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid20.com"; sid:569252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid21.com"; sid:569253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid22.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid22.com"; sid:569254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid911.com"; sid:569255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid.com"; sid:569256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athenscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athenscovid19.com"; sid:569257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid.net"; sid:569258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovidhair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovidhair.com"; sid:569259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bagcovid19.com"; sid:569260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidgarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidgarden.com"; sid:569261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidgardens.com"; sid:569262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid-usa.com"; sid:569263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedstuycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedstuycovid19.com"; sid:569264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovid-19.com"; sid:569265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidmasks.com"; sid:569266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestfacemasksforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestfacemasksforcoronavirus.com"; sid:569267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid.com"; sid:569268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovid19.com"; sid:569269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovidquarantine.com"; sid:569270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovidquarantine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovidquarantine.net"; sid:569271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brennerscovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brennerscovidkiller.com"; sid:569272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bsulpandemic-journal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bsulpandemic-journal.net"; sid:569273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruscure.com"; sid:569274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camdencovidservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camdencovidservice.com"; sid:569275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuscovid19.com"; sid:569276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuscovid.com"; sid:569277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninesagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninesagainstcovid.com"; sid:569278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careervscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careervscovid19.com"; sid:569279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caterinacovidolympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caterinacovidolympics.com"; sid:569280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caza-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caza-coronavirus.com"; sid:569281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpcoronavirushistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpcoronavirushistory.com"; sid:569282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdcdefeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdcdefeatcovid19.com"; sid:569283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceasecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceasecovid.com"; sid:569284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changecovid.com"; sid:569285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changedbycovid.com"; sid:569286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chlorineprophylaxiscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chlorineprophylaxiscovid-19.com"; sid:569287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chpkpandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chpkpandemicresponse.com"; sid:569288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchofcovid.com"; sid:569289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanmycovid.com"; sid:569290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanpandemicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanpandemicdata.com"; sid:569291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevercovidwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevercovidwear.com"; sid:569292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatecoronavirus.com"; sid:569293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combateocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combateocoronavirus.com"; sid:569294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conniescoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conniescoronadiary.com"; sid:569295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constant-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constant-corona.com"; sid:569296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constantcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constantcorona.com"; sid:569297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contagiouscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contagiouscovid19.com"; sid:569298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contributicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contributicovid-19.com"; sid:569299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contributicovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contributicovid-19.net"; sid:569300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19armour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19armour.com"; sid:569301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19protector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19protector.com"; sid:569302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona20.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona20.biz"; sid:569303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona20match.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona20match.com"; sid:569304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaccomplishmentchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaccomplishmentchallenge.com"; sid:569305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactive.com"; sid:569306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaerzte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaerzte.com"; sid:569307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alarm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alarm.net"; sid:569308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalaska.com"; sid:569309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaangel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaangel.com"; sid:569310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanniversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanniversary.com"; sid:569311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antibody.com"; sid:569312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaareas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaareas.com"; sid:569313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarizona.com"; sid:569314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarkansas.com"; sid:569315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarticle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarticle.com"; sid:569316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarzt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarzt.com"; sid:569317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattendant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattendant.com"; sid:569318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattendants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattendants.com"; sid:569319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bae.com"; sid:569320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaballoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaballoon.com"; sid:569321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabelittlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabelittlement.com"; sid:569322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestattung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestattung.com"; sid:569323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestattungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestattungen.com"; sid:569324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabloodserum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabloodserum.com"; sid:569325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboundary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboundary.com"; sid:569326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboyz.com"; sid:569327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathing.com"; sid:569328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreeze.com"; sid:569329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabriefings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabriefings.com"; sid:569330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulo.com"; sid:569331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburn.com"; sid:569332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacake.com"; sid:569333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacallcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacallcenter.com"; sid:569334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamgirl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamgirl.com"; sid:569335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamgirlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamgirlz.com"; sid:569336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamsgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamsgirls.com"; sid:569337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapacities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapacities.com"; sid:569338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapacity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapacity.com"; sid:569339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasanova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasanova.com"; sid:569340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaskets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaskets.com"; sid:569341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatalyst.com"; sid:569342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronic.com"; sid:569343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacite.com"; sid:569344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolorado.com"; sid:569345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombos.com"; sid:569346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedy.club"; sid:569347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcentration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcentration.com"; sid:569348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcentrator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcentrator.com"; sid:569349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconclusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconclusion.com"; sid:569350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconferences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconferences.com"; sid:569351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainementrbl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainementrbl.com"; sid:569352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoupechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoupechallenge.com"; sid:569353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoupe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoupe.com"; sid:569354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourses.com"; sid:569355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisconquered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisconquered.com"; sid:569356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisissolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisissolutions.com"; sid:569357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrown.com"; sid:569358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrown.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrown.net"; sid:569359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurezone.com"; sid:569360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cutie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cutie.com"; sid:569361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacypto.com"; sid:569362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadataset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadataset.com"; sid:569363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadayscomic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadayscomic.com"; sid:569364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefinition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefinition.com"; sid:569365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelaware.com"; sid:569366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelay.com"; sid:569367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelays.com"; sid:569368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diploma.com"; sid:569369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcelawyernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcelawyernyc.com"; sid:569370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcenyc.com"; sid:569371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadom.com"; sid:569372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-donor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-donor.com"; sid:569373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-donor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-donor.net"; sid:569374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonor.net"; sid:569375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoside.com"; sid:569376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadourbanfarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadourbanfarm.com"; sid:569377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencyrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencyrooms.com"; sid:569378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaencounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaencounters.com"; sid:569379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-erasor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-erasor.com"; sid:569380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpedite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpedite.com"; sid:569381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafenix.com"; sid:569382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforschung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforschung.com"; sid:569383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecomedy.com"; sid:569384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedomday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedomday.com"; sid:569385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.events"; sid:569386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeface.com"; sid:569387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehookupwithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehookupwithme.com"; sid:569388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreenotary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreenotary.com"; sid:569389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreenotary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreenotary.net"; sid:569390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevi.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevi.club"; sid:569391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevi.com"; sid:569392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevi.net"; sid:569393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.world"; sid:569394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-funding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-funding.com"; sid:569395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagears.com"; sid:569396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageorgia.com"; sid:569397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoodies.com"; sid:569398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbs.net"; sid:569399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-bruchsal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-bruchsal.com"; sid:569400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfebruchsal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfebruchsal.com"; sid:569401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-deutschland.com"; sid:569402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahousingcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahousingcrisis.com"; sid:569403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaicinmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaicinmaske.com"; sid:569404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunecertificate.com"; sid:569405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immune.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immune.club"; sid:569406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitycertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitycertificate.com"; sid:569407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitytest.com"; sid:569408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiana.com"; sid:569409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfect.com"; sid:569410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfobd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfobd.com"; sid:569411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintroduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintroduction.com"; sid:569412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiowa.com"; sid:569413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitforward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitforward.com"; sid:569414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakansas.com"; sid:569415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakavach.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakavach.life"; sid:569416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakentucky.com"; sid:569417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakills-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakills-uv.com"; sid:569418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakill-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakill-uv.com"; sid:569419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaklna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaklna.com"; sid:569420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabama.com"; sid:569421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyernyc.com"; sid:569422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalines.com"; sid:569423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalingus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalingus.com"; sid:569424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-local-heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-local-heroes.com"; sid:569425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalouisiana.com"; sid:569426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagazines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagazines.com"; sid:569427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaine.com"; sid:569428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanager.com"; sid:569429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaryland.com"; sid:569430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamassachusetts.com"; sid:569431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicus.com"; sid:569432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemoir.com"; sid:569433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemoir.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemoir.net"; sid:569434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemoirs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemoirs.net"; sid:569435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamigration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamigration.com"; sid:569436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminnesota.com"; sid:569437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamississippi.com"; sid:569438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamissouri.com"; sid:569439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamistakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamistakes.com"; sid:569440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamontana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamontana.com"; sid:569441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortality.com"; sid:569442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanebraska.com"; sid:569443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanevada.com"; sid:569444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewhampshire.com"; sid:569445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewjersey.com"; sid:569446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewmexico.com"; sid:569447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewstime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewstime.com"; sid:569448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanorthcaronlina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanorthcaronlina.com"; sid:569449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanorthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanorthdakota.com"; sid:569450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanuts.com"; sid:569451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoklahoma.com"; sid:569452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoregon.com"; sid:569453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverall.com"; sid:569454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoveralls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoveralls.com"; sid:569455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverload.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverload.com"; sid:569456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoxy.com"; sid:569457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicclassactionlawsuit.com"; sid:569458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicday.com"; sid:569459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemichistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemichistory.com"; sid:569460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemiclawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemiclawsuit.com"; sid:569461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pandemie-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pandemie-deutschland.com"; sid:569462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparcel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparcel.com"; sid:569463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparcels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparcels.com"; sid:569464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapennsylvania.com"; sid:569465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaph.com"; sid:569466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapneumo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapneumo.com"; sid:569467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapokerclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapokerclub.com"; sid:569468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-police.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-police.com"; sid:569469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolicies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolicies.com"; sid:569470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoliticians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoliticians.com"; sid:569471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprobabilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprobabilities.com"; sid:569472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprobability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprobability.com"; sid:569473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraid.com"; sid:569474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealness.com"; sid:569475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recht.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recht.expert"; sid:569476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefuge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefuge.com"; sid:569477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabilition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabilition.com"; sid:569478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremovers.com"; sid:569479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchers.com"; sid:569480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarhodeisland.com"; sid:569481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaring.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaring.net"; sid:569482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafehotel.com"; sid:569483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafehotels.com"; sid:569484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafenyc.com"; sid:569485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafesalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafesalon.com"; sid:569486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyequipment.com"; sid:569487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyneed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyneed.com"; sid:569488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasage.com"; sid:569489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalgini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalgini.com"; sid:569490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizenyc.com"; sid:569491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascleaner.com"; sid:569492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppinglist.com"; sid:569493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasitter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasitter.com"; sid:569494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmartwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmartwatch.com"; sid:569495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasniffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasniffer.com"; sid:569496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasomnia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasomnia.com"; sid:569497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthcarolina.com"; sid:569498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouth.com"; sid:569499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthdakota.com"; sid:569500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasponsors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasponsors.com"; sid:569501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspreader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspreader.com"; sid:569502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastates.com"; sid:569503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastompers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastompers.com"; sid:569504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresstherapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresstherapie.com"; sid:569505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresstherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresstherapy.com"; sid:569506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresstherapyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresstherapyonline.com"; sid:569507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastupid.com"; sid:569508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuppliesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuppliesusa.com"; sid:569509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplycrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplycrate.com"; sid:569510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasweb.com"; sid:569511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taxrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taxrefund.com"; sid:569512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemperature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemperature.com"; sid:569513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatennessee.com"; sid:569514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatokens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatokens.com"; sid:569515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatope.com"; sid:569516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraumatherapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraumatherapie.com"; sid:569517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraumatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraumatherapy.com"; sid:569518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrivialization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrivialization.com"; sid:569519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatry.com"; sid:569520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatesgy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatesgy.com"; sid:569521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronautah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronautah.com"; sid:569522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveros.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveros.club"; sid:569523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversteher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversteher.com"; sid:569524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimes.com"; sid:569525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimfundlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimfundlawyer.com"; sid:569526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavips.com"; sid:569527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirginia.com"; sid:569528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirues.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirues.world"; sid:569529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19funds.com"; sid:569530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19pandemic.com"; sid:569531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19ptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19ptsd.com"; sid:569532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus247news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus247news.com"; sid:569533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus928.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus928.com"; sid:569534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-abogados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-abogados.com"; sid:569535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaustralia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaustralia.net"; sid:569536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestfacemasks.com"; sid:569537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblues.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblues.net"; sid:569538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreaking.com"; sid:569539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessupport.com"; sid:569540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaregivers.com"; sid:569541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaretakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaretakers.com"; sid:569542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashflow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashflow.net"; sid:569543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscodered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscodered.com"; sid:569544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommercialdisinfectionanddecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommercialdisinfectionanddecontamination.com"; sid:569545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommercialdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommercialdisinfection.com"; sid:569546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconjob.com"; sid:569547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconvalescentplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconvalescentplasma.com"; sid:569548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounters.com"; sid:569549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19live.com"; sid:569550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailycharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailycharts.com"; sid:569551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesinfecciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesinfecciones.com"; sid:569552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdiagnostics.com"; sid:569553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-discrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-discrimination.com"; sid:569554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusencounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusencounters.com"; sid:569555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepi.com"; sid:569556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses2019.com"; sid:569557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesnews.com"; sid:569558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacecoverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacecoverings.com"; sid:569559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastvaccine.com"; sid:569560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfastvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfastvax.com"; sid:569561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfeedback.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfeedback.net"; sid:569562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fraud.com"; sid:569563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedentist.com"; sid:569564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpermap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpermap.com"; sid:569565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-home-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-home-test-kits.com"; sid:569566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushour.com"; sid:569567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushows.com"; sid:569568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-impfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-impfstoff.com"; sid:569569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloanguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloanguide.com"; sid:569570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakerscanarias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakerscanarias.com"; sid:569571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmugs.com"; sid:569572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusof2020.com"; sid:569573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonenine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonenine.com"; sid:569574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusontheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusontheworld.com"; sid:569575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparodysongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparodysongs.com"; sid:569576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparodyvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparodyvideos.com"; sid:569577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusperth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusperth.net"; sid:569578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplr.com"; sid:569579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusptsd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusptsd.net"; sid:569580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublishing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublishing.com"; sid:569581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchinstitute.com"; sid:569582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresidentialdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresidentialdisinfection.com"; sid:569583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresource.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresource.center"; sid:569584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrumors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrumors.net"; sid:569585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetydisplays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetydisplays.com"; sid:569586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyswag.com"; sid:569587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussayac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussayac.com"; sid:569588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshit.com"; sid:569589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-social-distancing-strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-social-distancing-strategy.com"; sid:569590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulas.com"; sid:569591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupport.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupport.biz"; sid:569592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurveyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurveyonline.com"; sid:569593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustenantforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustenantforms.com"; sid:569594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.guru"; sid:569595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates1.com"; sid:569596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-war.com"; sid:569597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswithus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswithus.com"; sid:569598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldupdate.com"; sid:569599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavittles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavittles.com"; sid:569600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawalks.com"; sid:569601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawar.net"; sid:569602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriors.net"; sid:569603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashingtondc.com"; sid:569604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawears.com"; sid:569605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebsitehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebsitehelp.com"; sid:569606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawestvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawestvirginia.com"; sid:569607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawisconsin.com"; sid:569608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawitness.com"; sid:569609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawitnesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawitnesses.com"; sid:569610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawonder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawonder.com"; sid:569611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawyoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawyoming.com"; sid:569612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronax19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronax19.com"; sid:569613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronax19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronax19.net"; sid:569614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxxxx.com"; sid:569615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazapp.com"; sid:569616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cottoncovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cottoncovidmasks.com"; sid:569617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020pack.com"; sid:569618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1942.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1942.com"; sid:569619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aanaonlinemeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aanaonlinemeeting.com"; sid:569620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accountants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accountants.com"; sid:569621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adjusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adjusters.com"; sid:569622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agency.com"; sid:569623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19americanswar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19americanswar.com"; sid:569624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anarchy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anarchy.com"; sid:569625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anniversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anniversary.com"; sid:569626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyscreening.com"; sid:569627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appreciation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appreciation.com"; sid:569628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19armor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19armor.com"; sid:569629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19armory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19armory.com"; sid:569630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artgallery.com"; sid:569631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ascension.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ascension.com"; sid:569632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistancefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistancefund.com"; sid:569633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistantfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistantfund.com"; sid:569634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atta.com"; sid:569635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attitudes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attitudes.com"; sid:569636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19awake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19awake.com"; sid:569637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awake.com"; sid:569638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aware.com"; sid:569639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beautychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beautychallenge.com"; sid:569640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beautychallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beautychallenge.net"; sid:569641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beauty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beauty.com"; sid:569642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19begone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19begone.com"; sid:569643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bill.com"; sid:569644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blooddrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blooddrive.com"; sid:569645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blues.com"; sid:569646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bueno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bueno.com"; sid:569647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscente.com"; sid:569648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyingsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyingsource.com"; sid:569649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calendarshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calendarshirts.com"; sid:569650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19campaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19campaign.com"; sid:569651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19campus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19campus.com"; sid:569652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19candles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19candles.com"; sid:569653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caregivers.com"; sid:569654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caretakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caretakers.com"; sid:569655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careuk.com"; sid:569656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cc.com"; sid:569657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19champ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19champ.com"; sid:569658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkin.com"; sid:569659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classes.com"; sid:569660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanair.com"; sid:569661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cleaning.com"; sid:569662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningminnesota.com"; sid:569663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmn.com"; sid:569664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningwi.com"; sid:569665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningwisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningwisconsin.com"; sid:569666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clear.net"; sid:569667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clothingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clothingcompany.com"; sid:569668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clothmask.com"; sid:569669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19codered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19codered.com"; sid:569670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19codered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19codered.com"; sid:569671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19codered.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19codered.net"; sid:569672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19codered.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19codered.net"; sid:569673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collect.com"; sid:569674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commercialdisinfectionanddecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commercialdisinfectionanddecontamination.com"; sid:569675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commercialdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commercialdisinfection.com"; sid:569676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultation.com"; sid:569677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consumerproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consumerproducts.com"; sid:569678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19convalescentplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19convalescentplasma.com"; sid:569679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cookbook.com"; sid:569680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-credits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-credits.com"; sid:569681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-crisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-crisis.net"; sid:569682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cycle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cycle.com"; sid:569683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datascience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datascience.com"; sid:569684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataset.com"; sid:569685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dateline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dateline.com"; sid:569686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digitalcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digitalcertificate.com"; sid:569687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19direct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19direct.com"; sid:569688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19directprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19directprotect.com"; sid:569689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discount.com"; sid:569690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discrimination.com"; sid:569691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discrimination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discrimination.net"; sid:569692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disease-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disease-testing.com"; sid:569693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectent.com"; sid:569694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectent.com"; sid:569695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distance.com"; sid:569696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distancing.com"; sid:569697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19districts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19districts.com"; sid:569698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donor.com"; sid:569699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drafting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drafting.com"; sid:569700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dubai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dubai.com"; sid:569701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dzs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dzs.com"; sid:569702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecosystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecosystem.com"; sid:569703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeeprotection.com"; sid:569704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.biz"; sid:569705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictionlawyers.com"; sid:569706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictionprotection.com"; sid:569707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19extrapolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19extrapolation.com"; sid:569708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19face.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19face.com"; sid:569709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facecoverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facecoverings.com"; sid:569710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faceprotection.com"; sid:569711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facesmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facesmasks.com"; sid:569712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsandfears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsandfears.com"; sid:569713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastvax.com"; sid:569714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19figures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19figures.com"; sid:569715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialhacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialhacks.com"; sid:569716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fly.com"; sid:569717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foggers.com"; sid:569718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodshortages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodshortages.com"; sid:569719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-forward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-forward.com"; sid:569720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foundations.com"; sid:569721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freemask.com"; sid:569722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gateway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gateway.com"; sid:569723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gearforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gearforyou.com"; sid:569724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gear.net"; sid:569725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gift.com"; sid:569726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-googleplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-googleplay.com"; sid:569727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentgrants.com"; sid:569728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19governmentloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19governmentloans.com"; sid:569729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hats.com"; sid:569730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpfund315.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpfund315.com"; sid:569731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hireme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hireme.com"; sid:569732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hiroshima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hiroshima.com"; sid:569733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest.biz"; sid:569734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotels.com"; sid:569735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19illegaltermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19illegaltermination.com"; sid:569736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitytests.com"; sid:569737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impactdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impactdata.com"; sid:569738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impactsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impactsurvey.com"; sid:569739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incubation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incubation.com"; sid:569740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19induatrialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19induatrialcleaning.com"; sid:569741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19industrialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19industrialcleaning.com"; sid:569742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19industrialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19industrialcleaning.com"; sid:569743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inject.com"; sid:569744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inopulse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inopulse.com"; sid:569745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceplan.com"; sid:569746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inus.com"; sid:569747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19konnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19konnect.com"; sid:569748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawguide.com"; sid:569749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyernyc.com"; sid:569750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerny.com"; sid:569751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leaders.com"; sid:569752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaloptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaloptions.com"; sid:569753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresourcecenter.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresourcecenter.biz"; sid:569754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanguide.com"; sid:569755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19locater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19locater.com"; sid:569756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19locators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19locators.com"; sid:569757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-logistics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-logistics.net"; sid:569758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lottery.com"; sid:569759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19markets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19markets.com"; sid:569760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskhq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskhq.com"; sid:569761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks.world"; sid:569762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mauritius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mauritius.com"; sid:569763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19m.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19m.com"; sid:569764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalinsurance.com"; sid:569765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medics.com"; sid:569766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentor.com"; sid:569767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-meter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-meter.com"; sid:569768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mexico-netflixx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mexico-netflixx.com"; sid:569769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mymoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mymoney.com"; sid:569770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news4u.com"; sid:569771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsalert.com"; sid:569772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newssite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newssite.com"; sid:569773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-newstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-newstoday.com"; sid:569774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nitricoxide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nitricoxide.com"; sid:569775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nitricoxide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nitricoxide.net"; sid:569776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19no.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19no.com"; sid:569777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nus.com"; sid:569778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-occupiedhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-occupiedhome.com"; sid:569779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offers.com"; sid:569780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officedisinfecting.com"; sid:569781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officedisinfecting.com"; sid:569782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opportunity.com"; sid:569783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicstatus.com"; sid:569784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicstatus.com"; sid:569785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passes.com"; sid:569786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pay.com"; sid:569787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19payrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19payrent.com"; sid:569788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payrollprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payrollprotection.com"; sid:569789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19planner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19planner.com"; sid:569790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmabank.com"; sid:569791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plasma.com"; sid:569792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonor.com"; sid:569793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasm.com"; sid:569794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19positivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19positivenews.com"; sid:569795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19power.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19power.com"; sid:569796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppe.net"; sid:569797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppe.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppe.world"; sid:569798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-prep.com"; sid:569799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionguidance.com"; sid:569800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19profile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19profile.com"; sid:569801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19promo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19promo.com"; sid:569802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivefacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivefacemask.com"; sid:569803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivemasks.com"; sid:569804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19provisions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19provisions.com"; sid:569805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19q.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19q.com"; sid:569806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qns.com"; sid:569807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantineworkshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantineworkshop.com"; sid:569808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidvax.com"; sid:569809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rating.com"; sid:569810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ratings.com"; sid:569811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rebate.com"; sid:569812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recipes.com"; sid:569813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveredregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveredregistry.com"; sid:569814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registration.com"; sid:569815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rehabilitation.com"; sid:569816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.reisen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.reisen"; sid:569817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieffundeffort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieffundeffort.com"; sid:569818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reset.com"; sid:569819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19residentialdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19residentialdisinfection.com"; sid:569820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resume.com"; sid:569821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resumes.com"; sid:569822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rewards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rewards.com"; sid:569823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedentist.com"; sid:569824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehouses.com"; sid:569825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyitems.com"; sid:569826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymeasures.com"; sid:569827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyswag.com"; sid:569828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safewear.com"; sid:569829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbanow.com"; sid:569830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scammers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scammers.com"; sid:569831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scamwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scamwatch.com"; sid:569832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seniors.com"; sid:569833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19series.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19series.com"; sid:569834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serumdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serumdrive.com"; sid:569835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serumtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serumtest.com"; sid:569836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serumtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serumtests.com"; sid:569837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sideeffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sideeffect.com"; sid:569838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simplecottonmasksforhospitals.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simplecottonmasksforhospitals.fail"; sid:569839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19slayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19slayer.com"; sid:569840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smallbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smallbusinessrelief.com"; sid:569841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sneezeguard.com"; sid:569842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneezeguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneezeguard.net"; sid:569843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-s.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-s.net"; sid:569844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialmap.com"; sid:569845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sos.net"; sid:569846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sport.com"; sid:569847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stand.com"; sid:569848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19station.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19station.com"; sid:569849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strategiesforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strategiesforbusiness.com"; sid:569850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19streams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19streams.com"; sid:569851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stresscase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stresscase.com"; sid:569852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strikes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strikes.com"; sid:569853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strikes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strikes.com"; sid:569854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-study.com"; sid:569855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19study.com"; sid:569856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sum.com"; sid:569857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superheros.com"; sid:569858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-supplies.net"; sid:569859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyxl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyxl.com"; sid:569860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surveillance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surveillance.com"; sid:569861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surveillance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surveillance.net"; sid:569862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surveys.com"; sid:569863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabs.com"; sid:569864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxclaim.com"; sid:569865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19technologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19technologies.com"; sid:569866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.dental"; sid:569867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsuplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsuplier.com"; sid:569868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsupplier.com"; sid:569869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapy.net"; sid:569870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19threads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19threads.com"; sid:569871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-time-critical-transport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-time-critical-transport.com"; sid:569872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timelines.com"; sid:569873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tours.com"; sid:569874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toys.com"; sid:569875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-transport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-transport.com"; sid:569876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-transport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-transport.net"; sid:569877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tribunal.com"; sid:569878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tribunal.com"; sid:569879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turkish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turkish.com"; sid:569880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turquoise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turquoise.com"; sid:569881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tvseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tvseries.com"; sid:569882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unemployment.com"; sid:569883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usdatabase.com"; sid:569884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usnews.com"; sid:569885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineinfo.com"; sid:569886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxcine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxcine.com"; sid:569887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushealth.com"; sid:569888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruslivestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruslivestatus.com"; sid:569889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vision.com"; sid:569890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wealth.com"; sid:569891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19well.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19well.com"; sid:569892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wire.com"; sid:569893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wisconsin.com"; sid:569894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-world-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-world-news.com"; sid:569895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfultermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfultermination.com"; sid:569896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfulterminationnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfulterminationnow.com"; sid:569897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfulterminationpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfulterminationpro.com"; sid:569898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfulterminationweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfulterminationweb.com"; sid:569899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xl.com"; sid:569900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zero.com"; sid:569901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zones.com"; sid:569902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1businesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1businesscenter.com"; sid:569903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.biz"; sid:569904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019n95.com"; sid:569905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019n95mask.com"; sid:569906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019survivor.com"; sid:569907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020masks.com"; sid:569908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020.net"; sid:569909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20survivor.com"; sid:569910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21vaccines.com"; sid:569911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-5g.com"; sid:569912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafteraction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafteraction.com"; sid:569913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidnow.com"; sid:569914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidsupply.com"; sid:569915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairlinerefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairlinerefund.com"; sid:569916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairlinerefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairlinerefunds.com"; sid:569917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandmarkets.com"; sid:569918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytesting.com"; sid:569919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidap.com"; sid:569920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaritas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaritas.com"; sid:569921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmory.com"; sid:569922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattitudes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattitudes.com"; sid:569923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauction.com"; sid:569924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauctions.com"; sid:569925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbanners.com"; sid:569926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeach.com"; sid:569927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizloan.com"; sid:569928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblacklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblacklist.com"; sid:569929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblasters.com"; sid:569930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboys.com"; sid:569931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrain.net"; sid:569932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrainrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrainrx.com"; sid:569933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbright.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbright.com"; sid:569934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamgirl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamgirl.com"; sid:569935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampus.com"; sid:569936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamwomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamwomen.com"; sid:569937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare247.com"; sid:569938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremask.com"; sid:569939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarerelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarerelieffund.com"; sid:569940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchamber.com"; sid:569941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchamp.com"; sid:569942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchemicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchemicals.com"; sid:569943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancommunity.com"; sid:569944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningminnesota.com"; sid:569945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmn.com"; sid:569946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwi.com"; sid:569947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwisconsin.com"; sid:569948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanteam.net"; sid:569949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothfacemasks.com"; sid:569950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodered.com"; sid:569951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodered.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodered.net"; sid:569952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensationclaims.com"; sid:569953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-concerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-concerts.com"; sid:569954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consumer.com"; sid:569955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsuts.com"; sid:569956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontainmentbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontainmentbox.com"; sid:569957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcook.com"; sid:569958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorner.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorner.club"; sid:569959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronavirusnews.com"; sid:569960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronavirusvaccine.com"; sid:569961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorruption.com"; sid:569962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounty.com"; sid:569963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcp.com"; sid:569964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrises2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrises2020.com"; sid:569965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisarbitration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisarbitration.com"; sid:569966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.center"; sid:569967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscenter.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscenter.support"; sid:569968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrusaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrusaders.com"; sid:569969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurbside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurbside.com"; sid:569970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcute.com"; sid:569971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddance.com"; sid:569972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatafeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatafeed.com"; sid:569973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatafeeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatafeeds.com"; sid:569974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecons.com"; sid:569975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcelawyer.com"; sid:569976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcenyc.com"; sid:569977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiyguide.com"; sid:569978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonor.com"; sid:569979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddown.com"; sid:569980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideffort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideffort.com"; sid:569981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideliminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideliminate.com"; sid:569982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidempleo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidempleo.com"; sid:569983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoconference.com"; sid:569984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexterminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexterminators.com"; sid:569985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflash.com"; sid:569986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoggers.com"; sid:569987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosurerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosurerelief.com"; sid:569988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeamazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeamazon.com"; sid:569989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedentist.com"; sid:569990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedining.com"; sid:569991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedirectory.com"; sid:569992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedoctors.com"; sid:569993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.events"; sid:569994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehealth.com"; sid:569995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelyft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelyft.com"; sid:569996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenearme.com"; sid:569997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepeople.com"; sid:569998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeplaces.com"; sid:569999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeshipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeshipping.com"; sid:570000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetaxi.com"; sid:570001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetravel.com"; sid:570002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeuber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeuber.com"; sid:570003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfu.com"; sid:570004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfufacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfufacemask.com"; sid:570005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfufacemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfufacemask.net"; sid:570006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundingnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundingnetwork.com"; sid:570007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamejam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamejam.com"; sid:570008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardens.com"; sid:570009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgay.com"; sid:570010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgobrrr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgobrrr.com"; sid:570011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.gratis - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.gratis"; sid:570012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.center"; sid:570013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhonors.com"; sid:570014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiaventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiaventilators.com"; sid:570015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinequalityproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinequalityproject.com"; sid:570016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinpictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinpictures.com"; sid:570017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthevalley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthevalley.com"; sid:570018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidions.com"; sid:570019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots19.com"; sid:570020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidipsum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidipsum.com"; sid:570021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjournal2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjournal2020.com"; sid:570022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkabin.com"; sid:570023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiddies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiddies.com"; sid:570024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsapparel.com"; sid:570025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kuban.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kuban.info"; sid:570026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalhelp.net"; sid:570027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlib.com"; sid:570028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifestyles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifestyles.com"; sid:570029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanaid.com"; sid:570030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanapplication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanapplication.com"; sid:570031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanexperts.com"; sid:570032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanmodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanmodification.com"; sid:570033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanmodificationsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanmodificationsolutions.com"; sid:570034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlounge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlounge.com"; sid:570035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-love.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-love.com"; sid:570036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidluv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidluv.com"; sid:570037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmantra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmantra.com"; sid:570038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskme.com"; sid:570039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks19.com"; sid:570040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksbulk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksbulk.com"; sid:570041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatrix.com"; sid:570042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeans.com"; sid:570043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-merch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-merch.net"; sid:570044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmist.com"; sid:570045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonument.com"; sid:570046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmood.com"; sid:570047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn95newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn95newyork.com"; sid:570048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneveralone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneveralone.com"; sid:570049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteen.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteen.events"; sid:570050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoevil.com"; sid:570051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotalone.com"; sid:570052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidor.com"; sid:570053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpalooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpalooza.com"; sid:570054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpark.com"; sid:570055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpasses.com"; sid:570056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pharma.com"; sid:570057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pharma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pharma.net"; sid:570058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplus.net"; sid:570059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecisiontracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecisiontracking.com"; sid:570060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpr.net"; sid:570061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproof.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproof.biz"; sid:570062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionmasks.com"; sid:570063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionmasks.net"; sid:570064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionshop.com"; sid:570065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-qrpc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-qrpc.com"; sid:570066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidvax.com"; sid:570067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreamer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreamer.com"; sid:570068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidred.com"; sid:570069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffoundation.com"; sid:570070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefmd.com"; sid:570071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefpoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefpoker.com"; sid:570072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenfrewcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenfrewcounty.com"; sid:570073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepair.com"; sid:570074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcelibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcelibrary.com"; sid:570075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespondersunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespondersunited.com"; sid:570076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespondersunited.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespondersunited.net"; sid:570077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids-19sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids-19sars.com"; sid:570078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids-19sars-cov-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids-19sars-cov-2.com"; sid:570079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids-19tracker.com"; sid:570080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehotel.com"; sid:570081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehotels.com"; sid:570082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizenyc.com"; sid:570083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizerspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizerspray.com"; sid:570084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsba.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsba.loan"; sid:570085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschule.com"; sid:570086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscribbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscribbles.com"; sid:570087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfreport.com"; sid:570088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldpro.com"; sid:570089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshirtcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshirtcompany.com"; sid:570090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsideeffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsideeffect.com"; sid:570091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneezeguard.com"; sid:570092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneezeguardvancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneezeguardvancouver.com"; sid:570093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-s.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-s.net"; sid:570094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolicitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolicitor.com"; sid:570095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolicitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolicitors.com"; sid:570096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaffprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaffprotection.com"; sid:570097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsticker.com"; sid:570098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudyregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudyregistry.com"; sid:570099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sucks-ass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sucks-ass.com"; sid:570100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupermask.com"; sid:570101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies.pro"; sid:570102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurplusstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurplusstore.com"; sid:570103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-switzerland.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-switzerland.today"; sid:570104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomstracker.com"; sid:570105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsys.com"; sid:570106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsys.net"; sid:570107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteams.com"; sid:570108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestimmunity.com"; sid:570109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingantibody.com"; sid:570110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.pro"; sid:570111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthroughthelens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthroughthelens.com"; sid:570112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtopia.com"; sid:570113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtshirts2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtshirts2020.com"; sid:570114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.digital"; sid:570115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfund.com"; sid:570116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustoday.com"; sid:570117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvyrusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvyrusmasks.com"; sid:570118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.dog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.dog"; sid:570119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwear19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwear19.com"; sid:570120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wherecanigo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wherecanigo.com"; sid:570121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyardsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyardsigns.com"; sid:570122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curincovid.com"; sid:570123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curincovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curincovid.net"; sid:570124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcoronamasks.com"; sid:570125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcoronavirusmasks.com"; sid:570126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidmaskcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidmaskcom.com"; sid:570127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminatingcoronavirus.com"; sid:570128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminatingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminatingcovid-19.com"; sid:570129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19vaccine.com"; sid:570130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for degreesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"degreesofcovid.com"; sid:570131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandascoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandascoronaviruscovid19.com"; sid:570132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designcovid19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designcovid19facemask.com"; sid:570133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designcovid19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designcovid19facemasks.com"; sid:570134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dezynfekcja-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dezynfekcja-covid-19.com"; sid:570135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dezynfekcja-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dezynfekcja-covid19.com"; sid:570136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariodeconfinamientocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariodeconfinamientocovid.com"; sid:570137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dienlanhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dienlanhcorona.com"; sid:570138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseaseofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseaseofcorona.com"; sid:570139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectinganddecontaminatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectinganddecontaminatingcoronavirus.com"; sid:570140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectinganddecontaminatingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectinganddecontaminatingcovid-19.com"; sid:570141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcorona-virus.com"; sid:570142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcovid19.com"; sid:570143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectionafteracoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectionafteracoronavirusoutbreak.com"; sid:570144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectionafteracovid-19outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectionafteracovid-19outbreak.com"; sid:570145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doit6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doit6feetcovid19.com"; sid:570146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doit6ftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doit6ftcovid19.com"; sid:570147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doitsixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doitsixfeetcovid19.com"; sid:570148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doitsixftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doitsixftcovid19.com"; sid:570149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doitsocialdistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doitsocialdistancecovid19.com"; sid:570150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donewithcorona.com"; sid:570151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donewithcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donewithcorona.net"; sid:570152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donewithcovid.com"; sid:570153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drnzkcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drnzkcoronavirusmask.com"; sid:570154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e3covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e3covidtest.com"; sid:570155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovida.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovida.life"; sid:570156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elmundotraselcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elmundotraselcovid19.com"; sid:570157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emcovidstories.com"; sid:570158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empleo-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empleo-covid.com"; sid:570159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidph.com"; sid:570160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enduringcovid19.com"; sid:570161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enduringcovid.com"; sid:570162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdailynews.com"; sid:570163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicweekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicweekly.com"; sid:570164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipementcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipementcovid.com"; sid:570165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipementscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipementscovid.com"; sid:570166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercovid19.com"; sid:570167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercovid20.com"; sid:570168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escaperoomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escaperoomcoronavirus.com"; sid:570169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europacovid-19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europacovid-19.cloud"; sid:570170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europacovid-19.com"; sid:570171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europecovid-19.com"; sid:570172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingcovid-19.com"; sid:570173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for extracashduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"extracashduringcovid.com"; sid:570174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecoveringstoprotectfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecoveringstoprotectfromcoronavirus.com"; sid:570175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecoveringstoprotectfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecoveringstoprotectfromcovid19.com"; sid:570176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid.today"; sid:570177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factscovid19.com"; sid:570178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fast4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fast4covid19.com"; sid:570179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidresults.com"; sid:570180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaideas.com"; sid:570181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.network"; sid:570182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidmask.com"; sid:570183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.network"; sid:570184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightofcorona.com"; sid:570185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finanziamenticovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finanziamenticovid-19.com"; sid:570186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcorona19.com"; sid:570187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingcoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingcoronavirussolutions.com"; sid:570188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingcovid.com"; sid:570189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitcovid19.com"; sid:570190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid19.com"; sid:570191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flashcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flashcovid.com"; sid:570192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foreverfitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foreverfitcovid19.com"; sid:570193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19legaladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19legaladvice.com"; sid:570194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19mask.com"; sid:570195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freewebinarsintimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freewebinarsintimesofcorona.com"; sid:570196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcorona.net"; sid:570197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gethooked-on-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gethooked-on-covid19.com"; sid:570198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givemecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givemecovid.com"; sid:570199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19photos.com"; sid:570200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19photos.com"; sid:570201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid2019.com"; sid:570202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicday.net"; sid:570203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicstatus.com"; sid:570204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glovescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glovescovid19.com"; sid:570205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gnicovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gnicovideo.com"; sid:570206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronadata.com"; sid:570207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronastat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronastat.com"; sid:570208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcovid19.com"; sid:570209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotchacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotchacovid.com"; sid:570210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotestcorona.com"; sid:570211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gouvcanadacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gouvcanadacovid-19.com"; sid:570212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greygardenscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greygardenscorona.com"; sid:570213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtnicovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtnicovideo.com"; sid:570214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcovid19.com"; sid:570215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltpandemic.com"; sid:570216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizecovid.com"; sid:570217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizerscovid19.com"; sid:570218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizersforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizersforcoronavirus.com"; sid:570219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizersforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizersforcovid19.com"; sid:570220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hatscovid19.com"; sid:570221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforpandemic.com"; sid:570222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroes-of-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroes-of-covid-19.com"; sid:570223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homesduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homesduringcovid.com"; sid:570224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honorcovid19.com"; sid:570225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostcovidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostcovidnyc.com"; sid:570226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcovid.com"; sid:570227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodisinfectcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodisinfectcoronavirus.net"; sid:570228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodisinfectcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodisinfectcovid-19.com"; sid:570229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hrblockcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hrblockcoronavirus.com"; sid:570230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for htnicovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"htnicovideo.com"; sid:570231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humansinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humansinthetimeofcorona.com"; sid:570232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinecovid-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinecovid-19cure.com"; sid:570233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinecovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinecovid19cure.com"; sid:570234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquinepandemiccure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquinepandemiccure.com"; sid:570235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilivedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilivedcoronavirus.com"; sid:570236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilivedcovid19.com"; sid:570237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilivedcovid.com"; sid:570238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocompromisedcovidtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocompromisedcovidtherapy.com"; sid:570239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactofcovid19.com"; sid:570240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovidrelief.com"; sid:570241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indycorona.com"; sid:570242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for influencersagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"influencersagainstcorona.com"; sid:570243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspiringstoriesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspiringstoriesofcovid19.com"; sid:570244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19news.com"; sid:570245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid20.com"; sid:570246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jakeandscotthangoutanddontgetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jakeandscotthangoutanddontgetcoronavirus.com"; sid:570247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalofthecoronayear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalofthecoronayear.com"; sid:570248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for journalofthecovidyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"journalofthecovidyear.com"; sid:570249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keacovid.com"; sid:570250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcovidcalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcovidcalm.com"; sid:570251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickoutcovid19.com"; sid:570252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kittestcovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kittestcovid19mexico.com"; sid:570253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95corona.com"; sid:570254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95covidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95covidmask.com"; sid:570255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95covidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95covidmasks.com"; sid:570256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kncoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kncoronavirusmask.com"; sid:570257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kncovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kncovidmasks.com"; sid:570258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovid19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovid19movie.com"; sid:570259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavidacorona.com"; sid:570260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancovid.com"; sid:570261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitschinacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitschinacovid-19.com"; sid:570262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerforcovid.com"; sid:570263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lecampuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lecampuscovid19.com"; sid:570264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonslearnedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonslearnedcovid19.com"; sid:570265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstrackcovid.com"; sid:570266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercorona.net"; sid:570267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19summit.com"; sid:570268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovidsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovidsummit.com"; sid:570269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeeveraftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeeveraftercorona.com"; sid:570270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpieza-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpieza-coronavirus.com"; sid:570271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livedatacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livedatacovid19.com"; sid:570272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthecoviddream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthecoviddream.com"; sid:570273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingthecoviddreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingthecoviddreams.com"; sid:570274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid-19.com"; sid:570275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistics-covid19.com"; sid:570276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistics-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistics-covid19.net"; sid:570277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louder-than-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louder-than-covid.com"; sid:570278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love6feetcovid19.com"; sid:570279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveaftercovid.com"; sid:570280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecoronaseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecoronaseries.com"; sid:570281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.house"; sid:570282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovesixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovesixfeetcovid19.com"; sid:570283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovesocialdistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovesocialdistancecovid19.com"; sid:570284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madisoncovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madisoncovidhelp.com"; sid:570285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for majocoronavirusbootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"majocoronavirusbootcamp.com"; sid:570286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manccovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manccovidsupport.com"; sid:570287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marcopostemergenzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marcopostemergenzacovid.com"; sid:570288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-proteccion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-proteccion-coronavirus.com"; sid:570289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-proteccion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-proteccion-covid19.com"; sid:570290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcovid19.com"; sid:570291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcovid.net"; sid:570292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskitcovid19.com"; sid:570293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskprotectcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskprotectcoronavirus.com"; sid:570294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksagainstcovid19.com"; sid:570295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksagainstcovid.com"; sid:570296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-corona-virus.com"; sid:570297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescovid.com"; sid:570298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcwcovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcwcovidsitters.com"; sid:570299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meandcovid.com"; sid:570300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialecovid19.com"; sid:570301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialmaskcovid19.com"; sid:570302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mildcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mildcorona.com"; sid:570303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mmmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mmmcovid19.com"; sid:570304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovidmasksewists.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovidmasksewists.net"; sid:570305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitoringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitoringcovid19.com"; sid:570306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacamgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacamgirls.com"; sid:570307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakids.com"; sid:570308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-status.com"; sid:570309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusesexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusesexperience.com"; sid:570310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushub.com"; sid:570311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19group.com"; sid:570312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfacemask.com"; sid:570313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmasks.com"; sid:570314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfitcovid19.com"; sid:570315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfitnesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfitnesscovid19.com"; sid:570316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymemorialmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymemorialmaskcovid19.com"; sid:570317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymemorialmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymemorialmaskscovid19.com"; sid:570318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicperks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicperks.com"; sid:570319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoviddatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoviddatabase.com"; sid:570320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalecoronatest.com"; sid:570321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidnews.com"; sid:570322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neomcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neomcorona.club"; sid:570323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19info.com"; sid:570324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovideconomy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovideconomy.club"; sid:570325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovideconomy.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovideconomy.mobi"; sid:570326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovideconomy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovideconomy.net"; sid:570327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkpandemic.com"; sid:570328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona4me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona4me.com"; sid:570329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronawifi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronawifi.com"; sid:570330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.pro"; sid:570331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascorona.com"; sid:570332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nottodaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nottodaycovid19.com"; sid:570333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronadash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronadash.com"; sid:570334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidresources.com"; sid:570335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19attorney.com"; sid:570336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19lawyer.com"; sid:570337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for odszkodowaniecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"odszkodowaniecovid.com"; sid:570338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronavirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronavirussupport.com"; sid:570339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponaglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponaglobalpandemic.com"; sid:570340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid19testing.com"; sid:570341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for optimumhealthinthepandemicage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"optimumhealthinthepandemicage.com"; sid:570342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orthomcncoronaadviceforpatients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orthomcncoronaadviceforpatients.com"; sid:570343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcorona.com"; sid:570344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pahlawanviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pahlawanviruscorona.com"; sid:570345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020game.com"; sid:570346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvancedresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvancedresponse.com"; sid:570347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvanceresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvanceresponse.com"; sid:570348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicanalysis.com"; sid:570349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-based-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-based-medicine.com"; sid:570350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbasedmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbasedmedicine.com"; sid:570351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.biz"; sid:570352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccache.com"; sid:570353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccannabis.com"; sid:570354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclothmask.com"; sid:570355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid19info.com"; sid:570356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid.com"; sid:570357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdailynews.com"; sid:570358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdatascience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdatascience.com"; sid:570359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdonuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdonuts.com"; sid:570360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-era.com"; sid:570361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-era.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-era.net"; sid:570362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflujobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflujobs.com"; sid:570363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgoodnews.com"; sid:570364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichousedoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichousedoctors.com"; sid:570365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichugs.com"; sid:570366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicid.com"; sid:570367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestor.com"; sid:570368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjoggers.com"; sid:570369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmonument.com"; sid:570370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnetworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnetworks.com"; sid:570371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparaphernalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparaphernalia.com"; sid:570372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpayout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpayout.com"; sid:570373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpins.com"; sid:570374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanningsolutions.com"; sid:570375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpools.com"; sid:570376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicposh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicposh.com"; sid:570377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpounds.com"; sid:570378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotected.com"; sid:570379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpsychology.com"; sid:570380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreporter.com"; sid:570381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreview.com"; sid:570382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrock.com"; sid:570383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalkitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalkitz.com"; sid:570384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsweats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsweats.com"; sid:570385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthriving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthriving.com"; sid:570386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictraumatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictraumatherapy.com"; sid:570387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictyranny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictyranny.com"; sid:570388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirus20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirus20.com"; sid:570389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicweekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicweekly.com"; sid:570390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentinginapandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentinginapandemic.life"; sid:570391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasaportecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasaportecoronavirus.com"; sid:570392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasaportecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasaportecovid19.com"; sid:570393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasaportecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasaportecovid.com"; sid:570394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passcovid19.com"; sid:570395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passcovid.com"; sid:570396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pepcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pepcovid.com"; sid:570397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalizedmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalizedmaskcovid19.com"; sid:570398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phoenixcovid19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phoenixcovid19facemasks.com"; sid:570399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetcovid19.com"; sid:570400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasma4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasma4covid.com"; sid:570401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playbookforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playbookforpandemics.com"; sid:570402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for popcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"popcovid.com"; sid:570403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid19.net"; sid:570404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19prep.com"; sid:570405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.loan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.loan"; sid:570406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemic-era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemic-era.com"; sid:570407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicera.com"; sid:570408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemic-era.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemic-era.net"; sid:570409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicera.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicera.net"; sid:570410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronamasks.com"; sid:570411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusfree.com"; sid:570412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirustherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirustherapy.com"; sid:570413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirustoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirustoday.com"; sid:570414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivemaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivemaskcovid19.com"; sid:570415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteksicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteksicovid.com"; sid:570416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebaanticuerposcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebaanticuerposcovid19.com"; sid:570417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacovid19mexico.com"; sid:570418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycorona.com"; sid:570419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qiddiyacorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qiddiyacorona.club"; sid:570420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qldcovid19rpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qldcovid19rpm.com"; sid:570421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queenscovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queenscovidresources.com"; sid:570422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdc-coronavirus.com"; sid:570423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamoscorona.com"; sid:570424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamoscoronavirus.com"; sid:570425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovidvictims.com"; sid:570426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repelcorona.com"; sid:570427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repelcovid-19.com"; sid:570428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovid-19.com"; sid:570429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risetostopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risetostopcovid-19.com"; sid:570430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risetostopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risetostopcovid19.com"; sid:570431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risetostopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risetostopcovid-19.net"; sid:570432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rpmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rpmcovid19.com"; sid:570433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for s6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"s6feetcovid19.com"; sid:570434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for s6ftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"s6ftcovid19.com"; sid:570435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetysignsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetysignsforcoronavirus.com"; sid:570436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetysignsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetysignsforcovid19.com"; sid:570437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saludmental-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saludmental-covid19.com"; sid:570438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanarcoronavirus.com"; sid:570439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecoronavirus.cloud"; sid:570440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveafricafromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveafricafromcovid19.com"; sid:570441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scarfscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scarfscovid19.com"; sid:570442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scarvescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scarvescovid19.com"; sid:570443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovid19.com"; sid:570444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sd6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sd6feetcovid19.com"; sid:570445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sd6ftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sd6ftcovid19.com"; sid:570446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdsixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdsixfeetcovid19.com"; sid:570447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdsixftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdsixftcovid19.com"; sid:570448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semcovid-19.com"; sid:570449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecovidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecovidexperience.com"; sid:570450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shareyourcovidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shareyourcovidexperience.com"; sid:570451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidmasks.com"; sid:570452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sidecashduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sidecashduringcovid.com"; sid:570453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simcorona.com"; sid:570454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sim-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sim-covid19.com"; sid:570455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singapore-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singapore-covid19.com"; sid:570456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singaporecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singaporecovid19.com"; sid:570457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sixfeetcovid19.com"; sid:570458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sixftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sixftcovid19.com"; sid:570459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skippingcovidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skippingcovidquarantine.com"; sid:570460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartpandemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartpandemicmask.com"; sid:570461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialdistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialdistancecovid19.com"; sid:570462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparedmylungsfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparedmylungsfromcovid.com"; sid:570463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ssdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ssdcovid19.com"; sid:570464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ssixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ssixfeetcovid19.com"; sid:570465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ssixftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ssixftcovid19.com"; sid:570466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statisticscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statisticscoronavirus.com"; sid:570467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steuerberater-corona-krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steuerberater-corona-krise.com"; sid:570468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steuerberatercoronakrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steuerberatercoronakrise.com"; sid:570469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steuerberater-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steuerberater-corona-virus.com"; sid:570470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steuerberatercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steuerberatercoronavirus.com"; sid:570471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronadisease.com"; sid:570472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusfraud.com"; sid:570473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusfree.com"; sid:570474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19fraud.com"; sid:570475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidstl.com"; sid:570476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopwishecovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopwishecovideos.com"; sid:570477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiesofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiesofcovid19.net"; sid:570478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for summerofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"summerofcovid-19.com"; sid:570479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for summerofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"summerofcovid19.com"; sid:570480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for summerofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"summerofcovid.com"; sid:570481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surfingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surfingthroughcorona.com"; sid:570482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalcoronavirus.com"; sid:570483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survived6feetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survived6feetcovid19.com"; sid:570484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survived6ftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survived6ftcovid19.com"; sid:570485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedsixfeetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedsixfeetcovid19.com"; sid:570486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedsixftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedsixftcovid19.com"; sid:570487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedsocialdistancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedsocialdistancecovid19.com"; sid:570488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirus.biz"; sid:570489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivor-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivor-corona.com"; sid:570490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcovid19.com"; sid:570491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamicoronavirus.com"; sid:570492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamicovid-19.com"; sid:570493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamicovid19.com"; sid:570494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamicovid.com"; sid:570495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapabocacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapabocacovid19.com"; sid:570496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamsurvivorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamsurvivorcovid19.com"; sid:570497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamsurvivorscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamsurvivorscovid19.com"; sid:570498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19fromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19fromhome.com"; sid:570499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19mexico.com"; sid:570500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcovid19.com"; sid:570501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcovid.com"; sid:570502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmycorona.net"; sid:570503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidocovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidocovid19mexico.com"; sid:570504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testyourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testyourcorona.com"; sid:570505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcovid19lawyer.com"; sid:570506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theboywhocriedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theboywhocriedcorona.com"; sid:570507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theboywhocriedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theboywhocriedcoronavirus.com"; sid:570508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona19mask.com"; sid:570509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadidntgetme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadidntgetme.com"; sid:570510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaexodus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaexodus.com"; sid:570511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafighter.com"; sid:570512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainitiative.com"; sid:570513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainitiative.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainitiative.mobi"; sid:570514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainitiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainitiative.net"; sid:570515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaliving.com"; sid:570516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavaccin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavaccin.com"; sid:570517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavaccines.com"; sid:570518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusheroes.com"; sid:570519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19antidote.com"; sid:570520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19artgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19artgallery.com"; sid:570521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19economy.com"; sid:570522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19killers.com"; sid:570523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19portal.com"; sid:570524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidanxietytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidanxietytoolkit.com"; sid:570525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbirthartproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbirthartproject.com"; sid:570526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcook.com"; sid:570527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfacemask.com"; sid:570528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidjournals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidjournals.com"; sid:570529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrevolution.com"; sid:570530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theepidemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theepidemicmask.com"; sid:570531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thememorialmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thememorialmaskcovid19.com"; sid:570532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thememorialmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thememorialmaskscovid19.com"; sid:570533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemichistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemichistory.com"; sid:570534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpainter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpainter.com"; sid:570535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovid19.com"; sid:570536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemicplan.com"; sid:570537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thestoriesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thestoriesofcovid19.com"; sid:570538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theviruscovid19.com"; sid:570539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanman.com"; sid:570540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theyearofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theyearofcorona.com"; sid:570541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for think-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"think-corona.com"; sid:570542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiscovidnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiscovidnepal.com"; sid:570543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thriveaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thriveaftercovid.com"; sid:570544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trabajadoresafectadoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trabajadoresafectadoscoronavirus.com"; sid:570545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trabajocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trabajocovid.com"; sid:570546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcorona.today"; sid:570547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transport-covid19.com"; sid:570548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transportcovid19.com"; sid:570549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transport-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transport-covid19.net"; sid:570550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercovid19.com"; sid:570551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelaftercovid19.net"; sid:570552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treating-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treating-covid-19.com"; sid:570553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treating-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treating-covid19.com"; sid:570554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tscovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tscovidtracker.com"; sid:570555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuttosulcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuttosulcoronavirus.com"; sid:570556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tx-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tx-covid19.com"; sid:570557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedapartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedapartcovid19.com"; sid:570558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uppervalleycovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uppervalleycovidrelief.com"; sid:570559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidrelief.com"; sid:570560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usahelpstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usahelpstopcovid.com"; sid:570561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usastopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usastopcovid.com"; sid:570562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusrelief.com"; sid:570563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19stats.com"; sid:570564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-covid.com"; sid:570565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for user97801covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"user97801covid19.com"; sid:570566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovid.com"; sid:570567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uubocovid-19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uubocovid-19hub.com"; sid:570568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvckillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvckillscorona.com"; sid:570569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvckillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvckillscovid19.com"; sid:570570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidizer.com"; sid:570571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidrelief.com"; sid:570572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid19.cloud"; sid:570573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for versuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"versuscorona.com"; sid:570574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimascoronavirus.net"; sid:570575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercorona-virus.com"; sid:570576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercoronavirus.net"; sid:570577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigilanciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigilanciacovid19.com"; sid:570578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19mexico.com"; sid:570579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemic2020.com"; sid:570580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruspandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruspandemics.com"; sid:570581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vzwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vzwcovid19.com"; sid:570582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for w3corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"w3corona.com"; sid:570583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warriorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warriorsofcovid19.com"; sid:570584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wedefeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wedefeatcoronavirus.com"; sid:570585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesaycorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesaycorona.wtf"; sid:570586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westopcovid.com"; sid:570587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatshouldidointhiscoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatshouldidointhiscoronatimes.com"; sid:570588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirustracker.com"; sid:570589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoutriesfight4covidiotsflouting.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoutriesfight4covidiotsflouting.golf"; sid:570590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicday.net"; sid:570591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicstatus.com"; sid:570592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbioweaponmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbioweaponmovie.com"; sid:570593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusclothmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusclothmask.com"; sid:570594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanweishi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanweishi.com"; sid:570595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19espaa-khb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19espaa-khb.com"; sid:570596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19trke-v9a4y.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19trke-v9a4y.com"; sid:570597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofthepandemic.com"; sid:570598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcanbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcanbeatcorona.com"; sid:570599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidcheck.com"; sid:570600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-800-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-800-covid19.com"; sid:570601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1866covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1866covid19.com"; sid:570602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covid19info.com"; sid:570603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911-covid19.com"; sid:570604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadocovid.com"; sid:570605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovidlaw.com"; sid:570606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acecorona.com"; sid:570607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthecorona.com"; sid:570608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agendadefeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agendadefeatcovid.com"; sid:570609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-covid19.com"; sid:570610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alienware-wuhan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alienware-wuhan.club"; sid:570611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid-19.com"; sid:570612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amancovid19.com"; sid:570613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americadefeatscovid-19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americadefeatscovid-19together.com"; sid:570614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anabaptistcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anabaptistcovidresponse.com"; sid:570615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamall.com"; sid:570616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamall.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamall.net"; sid:570617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid101.com"; sid:570618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidblood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidblood.com"; sid:570619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-epidemicmaterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-epidemicmaterial.com"; sid:570620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemicmaterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemicmaterial.com"; sid:570621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipandemickit.com"; sid:570622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipandemicsupplies.com"; sid:570623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aplicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aplicovid.com"; sid:570624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aplicovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aplicovid.net"; sid:570625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applyforcoronavirusstimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applyforcoronavirusstimuluscheck.com"; sid:570626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assicurazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assicurazionecoronavirus.com"; sid:570627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackcovid19.com"; sid:570628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auxilioemergencialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auxilioemergencialcovid.com"; sid:570629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidinfo.com"; sid:570630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcg4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcg4covid19.com"; sid:570631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcg4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcg4covid19.net"; sid:570632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beachhousecovidvictimsunite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beachhousecovidvictimsunite.com"; sid:570633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidnews.com"; sid:570634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beautycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beautycovid19.com"; sid:570635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovidaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovidaftercovid.com"; sid:570636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovidaftercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovidaftercovid.net"; sid:570637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belcovid19.com"; sid:570638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepandemicsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepandemicsafe.com"; sid:570639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronasurvivalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronasurvivalkits.com"; sid:570640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruskits.com"; sid:570641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusprevention.com"; sid:570642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirussurvivalkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirussurvivalkits.com"; sid:570643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-mask-for-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-mask-for-coronavirus.com"; sid:570644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bipap4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bipap4covid.com"; sid:570645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for black-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"black-covid-19.com"; sid:570646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockingcovid.com"; sid:570647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidmaskexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidmaskexchange.com"; sid:570648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btzmedical-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btzmedical-covid19.com"; sid:570649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingahomeduringthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingahomeduringthepandemic.com"; sid:570650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinascovid.com"; sid:570651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callingcovid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callingcovid19survivors.com"; sid:570652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaigningforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaigningforcovid.com"; sid:570653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuscorona.com"; sid:570654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canada-corona-virus-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canada-corona-virus-conspiracy.com"; sid:570655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadiancovidconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadiancovidconspiracy.com"; sid:570656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpaycoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpaycoronavirus.biz"; sid:570657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canyouavoidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canyouavoidcovid19.com"; sid:570658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstcovid.com"; sid:570659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careeraftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careeraftercovid.com"; sid:570660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carefromcoronavirus.com"; sid:570661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringcorona.com"; sid:570662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalystpandemicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalystpandemicdata.com"; sid:570663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralfloridacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralfloridacoronaviruslawyer.com"; sid:570664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanercorona.com"; sid:570665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanercovid.com"; sid:570666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachingthroughcovid.com"; sid:570667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectedcovid.com"; sid:570668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consortiumforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consortiumforcovid-19.com"; sid:570669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consortiumforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consortiumforcovid19.com"; sid:570670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracovid-19.com"; sid:570671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingcovid19.com"; sid:570672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19lawsuits.com"; sid:570673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-masks.com"; sid:570674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19screenme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19screenme.com"; sid:570675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19victim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19victim.com"; sid:570676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19victim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19victim.net"; sid:570677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2college.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2college.com"; sid:570678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactions.com"; sid:570679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaads.com"; sid:570680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaerosol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaerosol.com"; sid:570681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairsanitizer.com"; sid:570682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalcoholics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalcoholics.com"; sid:570683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaltruism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaltruism.com"; sid:570684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanxietytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanxietytoolkit.com"; sid:570685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapocalyptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapocalyptic.com"; sid:570686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaauktion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaauktion.com"; sid:570687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaauktionen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaauktionen.com"; sid:570688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beatmungsgeraet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beatmungsgeraet.com"; sid:570689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeatmungsgeraet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeatmungsgeraet.com"; sid:570690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaberichte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaberichte.com"; sid:570691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeskyttet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeskyttet.com"; sid:570692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabluesmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabluesmovie.com"; sid:570693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabomber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabomber.com"; sid:570694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburial.com"; sid:570695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburials.com"; sid:570696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburning.com"; sid:570697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalculation.com"; sid:570698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalculations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalculations.com"; sid:570699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareguideforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareguideforbusiness.com"; sid:570700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareguideforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareguideforbusinesses.com"; sid:570701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareguidefordealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareguidefordealers.com"; sid:570702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaroling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaroling.com"; sid:570703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesinindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesinindia.com"; sid:570704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaccess.com"; sid:570705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachaos2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachaos2020.com"; sid:570706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachaser.com"; sid:570707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckonline.com"; sid:570708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachesschallenge.com"; sid:570709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles.club"; sid:570710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidesale.com"; sid:570711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidestore.com"; sid:570712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacivility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacivility.com"; sid:570713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimcenters.com"; sid:570714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimscenter.com"; sid:570715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolaps.com"; sid:570716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompetitive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompetitive.com"; sid:570717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconspire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconspire.com"; sid:570718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontroversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontroversy.com"; sid:570719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoughing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoughing.com"; sid:570720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounselingnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounselingnewyork.com"; sid:570721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrematorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrematorium.com"; sid:570722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisattorneys.com"; sid:570723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacts.com"; sid:570724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurves.com"; sid:570725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeal.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeal.biz"; sid:570726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecency.com"; sid:570727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadept.com"; sid:570728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfection.com"; sid:570729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadirect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadirect.net"; sid:570730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscussions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscussions.com"; sid:570731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisputes.com"; sid:570732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadontsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadontsurf.com"; sid:570733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadragon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadragon.com"; sid:570734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeconomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeconomist.com"; sid:570735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeconomists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeconomists.com"; sid:570736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeeze.com"; sid:570737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-emergency-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-emergency-aid.com"; sid:570738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-emergency-number.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-emergency-number.com"; sid:570739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entschaedigung.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entschaedigung.expert"; sid:570740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeradicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeradicate.com"; sid:570741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaerrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaerrors.com"; sid:570742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaestatus.com"; sid:570743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactcheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactcheck.net"; sid:570744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafb.com"; sid:570745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafet.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafet.life"; sid:570746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.club"; sid:570747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiji.com"; sid:570748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-files.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-files.net"; sid:570749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafogger.com"; sid:570750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforall.com"; sid:570751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafortress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafortress.com"; sid:570752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafortresses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafortresses.com"; sid:570753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehotels.com"; sid:570754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetours.com"; sid:570755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafributik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafributik.com"; sid:570756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafri.com"; sid:570757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrishopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrishopping.com"; sid:570758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrit.com"; sid:570759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundclaims.com"; sid:570760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrad.com"; sid:570761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagram.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagram.club"; sid:570762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahacks.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahacks.win"; sid:570763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthins.com"; sid:570764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelploans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelploans.com"; sid:570765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherofund.com"; sid:570766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahideouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahideouts.com"; sid:570767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfskredite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfskredite.com"; sid:570768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomehelp.com"; sid:570769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahumanity.com"; sid:570770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunecomplex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunecomplex.com"; sid:570771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincineration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincineration.com"; sid:570772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincinerations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincinerations.com"; sid:570773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaincinerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaincinerator.com"; sid:570774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainitiativen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainitiativen.com"; sid:570775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaise.com"; sid:570776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jokin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jokin.com"; sid:570777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajyoseikinn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajyoseikinn.com"; sid:570778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kinkyu-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kinkyu-action.com"; sid:570779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknits.com"; sid:570780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatest-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatest-news.com"; sid:570781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliberties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliberties.com"; sid:570782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalibya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalibya.com"; sid:570783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveconcerts.com"; sid:570784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloanservices.com"; sid:570785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalone.net"; sid:570786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloner.net"; sid:570787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyfe.com"; sid:570788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyticsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyticsus.com"; sid:570789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamantrajaap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamantrajaap.com"; sid:570790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskattorney.com"; sid:570791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksfast.com"; sid:570792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatters.com"; sid:570793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-measures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-measures.com"; sid:570794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-measures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-measures.net"; sid:570795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedikament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedikament.com"; sid:570796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedikamente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedikamente.com"; sid:570797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedizin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedizin.com"; sid:570798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamicrobes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamicrobes.com"; sid:570799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mietenstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mietenstop.com"; sid:570800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mietenstopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mietenstopp.com"; sid:570801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-msb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-msb.biz"; sid:570802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamsb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamsb.biz"; sid:570803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanote.com"; sid:570804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorigin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorigin.com"; sid:570805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapackagesanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapackagesanitizer.com"; sid:570806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemic-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemic-app.com"; sid:570807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapettest.com"; sid:570808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapractitioner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapractitioner.com"; sid:570809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapractitioners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapractitioners.com"; sid:570810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreparednesskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreparednesskit.com"; sid:570811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprof.com"; sid:570812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofessor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofessor.com"; sid:570813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofessors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofessors.com"; sid:570814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofiteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofiteer.com"; sid:570815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofiteering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofiteering.com"; sid:570816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectebook.com"; sid:570817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quick-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quick-test.com"; sid:570818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareadybiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareadybiz.com"; sid:570819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareliefmortgages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareliefmortgages.com"; sid:570820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reto.com"; sid:570821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretreat.com"; sid:570822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretreats.com"; sid:570823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarides.com"; sid:570824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeenvironment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeenvironment.com"; sid:570825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetourism.com"; sid:570826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetours.com"; sid:570827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetravel.com"; sid:570828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetrips.com"; sid:570829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetybox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetybox.com"; sid:570830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safety-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safety-products.com"; sid:570831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschemes.com"; sid:570832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzmasken.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzmasken.net"; sid:570833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascientists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascientists.com"; sid:570834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningcenter.com"; sid:570835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningcenters.com"; sid:570836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreenme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreenme.com"; sid:570837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseattle.com"; sid:570838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashelters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashelters.com"; sid:570839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasikker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasikker.com"; sid:570840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasikkerhed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasikkerhed.com"; sid:570841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasit.com"; sid:570842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskiller.com"; sid:570843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasl.com"; sid:570844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sofort-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sofort-check.com"; sid:570845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolicitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolicitor.com"; sid:570846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeech.com"; sid:570847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeeches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeeches.com"; sid:570848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatements.com"; sid:570849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatistik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatistik.com"; sid:570850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatsupdate.com"; sid:570851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasticks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasticks.com"; sid:570852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrongusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrongusa.com"; sid:570853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucks.biz"; sid:570854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-suedtirol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-suedtirol.com"; sid:570855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportportal.com"; sid:570856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorcorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorcorps.net"; sid:570857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivortshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivortshirts.com"; sid:570858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuspects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuspects.com"; sid:570859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxappeal.com"; sid:570860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxis.com"; sid:570861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.international"; sid:570862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatourist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatourist.com"; sid:570863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tra.com"; sid:570864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrainings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrainings.com"; sid:570865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatv.show - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatv.show"; sid:570866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdate24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdate24.com"; sid:570867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvcfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvcfilter.com"; sid:570868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveil.com"; sid:570869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavets.com"; sid:570870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicious.com"; sid:570871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimbenefit.com"; sid:570872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimbenefits.com"; sid:570873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavintheword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavintheword.com"; sid:570874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavintheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavintheworld.com"; sid:570875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral.today"; sid:570876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsus.com"; sid:570877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19attorney.com"; sid:570878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19attorneys.com"; sid:570879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19boiselawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19boiselawfirm.com"; sid:570880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19chicagolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19chicagolawfirm.com"; sid:570881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19dallaslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19dallaslawfirm.com"; sid:570882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19houstonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19houstonlawfirm.com"; sid:570883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19lawfirm.com"; sid:570884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19lawyers.com"; sid:570885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19losangeleslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19losangeleslawfirm.com"; sid:570886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19newyorkcitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19newyorkcitylawfirm.com"; sid:570887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19philadelphialawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19philadelphialawfirm.com"; sid:570888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19phoenixlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19phoenixlawfirm.com"; sid:570889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19sanfranciscolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19sanfranciscolawfirm.com"; sid:570890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19seattlelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19seattlelawfirm.com"; sid:570891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19washingtondclawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19washingtondclawfirm.com"; sid:570892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020suvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020suvivor.com"; sid:570893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.accountant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.accountant"; sid:570894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-aid.com"; sid:570895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantiviralprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantiviralprotection.com"; sid:570896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantiviralremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantiviralremedy.com"; sid:570897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyboise.com"; sid:570898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneychicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneychicago.com"; sid:570899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneydallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneydallas.com"; sid:570900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyhonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyhonolulu.com"; sid:570901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyhouston.com"; sid:570902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneylosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneylosangeles.com"; sid:570903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneynewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneynewyorkcity.com"; sid:570904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyphiladelphia.com"; sid:570905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyphoenix.com"; sid:570906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysanfrancisco.com"; sid:570907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyseattle.com"; sid:570908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneywashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneywashingtondc.com"; sid:570909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirtoplumsalhareket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirtoplumsalhareket.com"; sid:570910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboiselawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboiselawfirm.com"; sid:570911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboost.com"; sid:570912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertificate.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertificate.life"; sid:570913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertificates.com"; sid:570914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertificate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertificate.world"; sid:570915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschaser.com"; sid:570916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschicagolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschicagolawfirm.com"; sid:570917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanair.com"; sid:570918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningstlouis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningstlouis.com"; sid:570919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.condos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.condos"; sid:570920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongame.com"; sid:570921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-conspiracy.com"; sid:570922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-count.com"; sid:570923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-update.com"; sid:570924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscpap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscpap.com"; sid:570925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscriminaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscriminaldefense.com"; sid:570926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdallaslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdallaslawfirm.com"; sid:570927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dataset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dataset.com"; sid:570928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.diamonds - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.diamonds"; sid:570929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocument.com"; sid:570930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogmask.com"; sid:570931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethroughmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethroughmd.com"; sid:570932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethroughtestingmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethroughtestingmd.com"; sid:570933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-esri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-esri.com"; sid:570934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfiji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfiji.com"; sid:570935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.florist - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.florist"; sid:570936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfondo.com"; sid:570937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforbearancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforbearancehelp.com"; sid:570938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.furniture - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.furniture"; sid:570939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.glass - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.glass"; sid:570940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalparty.com"; sid:570941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.hockey"; sid:570942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.holdings - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.holdings"; sid:570943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-home-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-home-test-kits.com"; sid:570944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoustonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoustonlawfirm.com"; sid:570945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusinfection.com"; sid:570946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjury.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjury.claims"; sid:570947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.jewelry - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.jewelry"; sid:570948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmboise.com"; sid:570949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmchicago.com"; sid:570950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmdallas.com"; sid:570951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmhonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmhonolulu.com"; sid:570952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmhouston.com"; sid:570953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmlosangeles.com"; sid:570954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmnewyorkcity.com"; sid:570955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmphiladelphia.com"; sid:570956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmphoenix.com"; sid:570957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmsanfrancisco.com"; sid:570958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmseattle.com"; sid:570959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmwashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmwashingtondc.com"; sid:570960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersusa.com"; sid:570961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.lease - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.lease"; sid:570962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.limo - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.limo"; sid:570963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloansrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloansrelief.com"; sid:570964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosangeleslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosangeleslawfirm.com"; sid:570965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmafia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmafia.com"; sid:570966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.maison - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.maison"; sid:570967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskattorney.com"; sid:570968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasklawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasklawsuit.com"; sid:570969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskssale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskssale.com"; sid:570970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.agency"; sid:570971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkcitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkcitylawfirm.com"; sid:570972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoticias.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoticias.net"; sid:570973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandem.com"; sid:570974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspass.com"; sid:570975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspassport.com"; sid:570976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspettest.com"; sid:570977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphiladelphialawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphiladelphialawfirm.com"; sid:570978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoenixlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoenixlawfirm.com"; sid:570979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.plumbing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.plumbing"; sid:570980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreformation.com"; sid:570981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieftherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieftherapy.com"; sid:570982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrightslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrightslawyer.com"; sid:570983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfranciscolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfranciscolawfirm.com"; sid:570984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.sarl - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.sarl"; sid:570985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseattlelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseattlelawfirm.com"; sid:570986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseo.com"; sid:570987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.solar - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.solar"; sid:570988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-supplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-supplements.com"; sid:570989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.surgery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.surgery"; sid:570990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorcorps.com"; sid:570991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorcorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorcorps.net"; sid:570992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-taisaku.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-taisaku.life"; sid:570993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusten.com"; sid:570994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.tennis - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.tennis"; sid:570995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitunitedkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitunitedkingdom.com"; sid:570996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.theater - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.theater"; sid:570997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-top10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-top10.com"; sid:570998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracing.com"; sid:570999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracingteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracingteams.com"; sid:571000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates.club"; sid:571001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacuna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacuna.net"; sid:571002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveracruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveracruz.com"; sid:571003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.villas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.villas"; sid:571004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashingtondclawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashingtondclawfirm.com"; sid:571005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswriters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswriters.com"; sid:571006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisa.com"; sid:571007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisors.com"; sid:571008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavital24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavital24.com"; sid:571009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavizdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavizdepot.com"; sid:571010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawasher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawasher.com"; sid:571011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaterwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaterwipes.com"; sid:571012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawestafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawestafrica.com"; sid:571013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawestafrica.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawestafrica.net"; sid:571014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhistleblowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhistleblowers.com"; sid:571015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawisco.com"; sid:571016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawork.com"; sid:571017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkcomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkcomp.com"; sid:571018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazahlen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazahlen.com"; sid:571019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatepandemicconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatepandemicconsulting.com"; sid:571020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counselingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counselingcovid.com"; sid:571021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid0whisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid0whisky.com"; sid:571022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10minutetest.com"; sid:571023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-360.com"; sid:571024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19360.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19360.net"; sid:571025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actioncoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actioncoalition.com"; sid:571026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actioncoalition.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actioncoalition.net"; sid:571027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allnews.com"; sid:571028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alovestory.com"; sid:571029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ans.com"; sid:571030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19app.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19app.club"; sid:571031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19army.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19army.com"; sid:571032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arts.com"; sid:571033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-assay.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-assay.net"; sid:571034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-atemschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-atemschutzmasken.com"; sid:571035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyboise.com"; sid:571036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneychicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneychicago.com"; sid:571037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneydallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneydallas.com"; sid:571038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyhonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyhonolulu.com"; sid:571039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyhouston.com"; sid:571040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneylosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneylosangeles.com"; sid:571041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneynewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneynewyorkcity.com"; sid:571042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyphiladelphia.com"; sid:571043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyphoenix.com"; sid:571044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysanfrancisco.com"; sid:571045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyseattle.com"; sid:571046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneywashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneywashingtondc.com"; sid:571047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19au.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19au.com"; sid:571048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19australia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19australia.net"; sid:571049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avoid.com"; sid:571050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beinformed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beinformed.com"; sid:571051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bisinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bisinesscenter.com"; sid:571052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtester.com"; sid:571053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19braintrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19braintrust.com"; sid:571054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busibesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busibesscenter.com"; sid:571055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busimesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busimesscenter.com"; sid:571056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscemter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscemter.com"; sid:571057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscentet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscentet.com"; sid:571058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessimpact.com"; sid:571059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessloan.com"; sid:571060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessolution.com"; sid:571061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessolutions.com"; sid:571062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssolution.com"; sid:571063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssolutions.com"; sid:571064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busunesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busunesscenter.com"; sid:571065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canines.com"; sid:571066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caregiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caregiving.com"; sid:571067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casemanagement.com"; sid:571068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cattest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cattest.com"; sid:571069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19celebrity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19celebrity.com"; sid:571070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certificates.com"; sid:571071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedcleaning.com"; sid:571072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chaser.com"; sid:571073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chesschallenge.com"; sid:571074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chip.com"; sid:571075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.biz"; sid:571076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claims.net"; sid:571077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupcrews.com"; sid:571078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupusa.com"; sid:571079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communityhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communityhelp.com"; sid:571080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19copingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19copingkit.com"; sid:571081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirusnews.com"; sid:571082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cpap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cpap.com"; sid:571083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crime.com"; sid:571084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dashboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dashboard.net"; sid:571085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datacompare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datacompare.com"; sid:571086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datausa.com"; sid:571087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dcc.com"; sid:571088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtcounselingrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtcounselingrelief.com"; sid:571089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dinkesluwu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dinkesluwu.com"; sid:571090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfecting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfecting.net"; sid:571091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectstore.com"; sid:571092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19document.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19document.com"; sid:571093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethroughmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethroughmd.com"; sid:571094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethroughtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethroughtesting.com"; sid:571095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethroughtestingmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethroughtestingmd.com"; sid:571096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19duties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19duties.com"; sid:571097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19effect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19effect.net"; sid:571098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyshower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyshower.com"; sid:571099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emirates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emirates.com"; sid:571100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-emojis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-emojis.com"; sid:571101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employee.com"; sid:571102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19entconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19entconsult.com"; sid:571103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19equipped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19equipped.com"; sid:571104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equipped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equipped.com"; sid:571105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fails.com"; sid:571106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fastkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fastkit.com"; sid:571107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fiji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fiji.com"; sid:571108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fondo.com"; sid:571109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebeijing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebeijing.com"; sid:571110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebrazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebrazil.com"; sid:571111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecalifornia.com"; sid:571112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecanada.com"; sid:571113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedubai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedubai.com"; sid:571114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeengland.com"; sid:571115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeflorida.com"; sid:571116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freefrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freefrance.com"; sid:571117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeguadalupe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeguadalupe.com"; sid:571118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeguangzhou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeguangzhou.com"; sid:571119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeitaly.com"; sid:571120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freejakarta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freejakarta.com"; sid:571121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freelife.com"; sid:571122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freelondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freelondon.com"; sid:571123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemanila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemanila.com"; sid:571124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemexicocity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemexicocity.com"; sid:571125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemexico.com"; sid:571126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemoscow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemoscow.com"; sid:571127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemumbai.com"; sid:571128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freenetherlands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freenetherlands.com"; sid:571129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freenewyork.com"; sid:571130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freenigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freenigeria.com"; sid:571131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeoman.com"; sid:571132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeosaka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeosaka.com"; sid:571133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freerussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freerussia.com"; sid:571134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesanfrancisco.com"; sid:571135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesaopaulo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesaopaulo.com"; sid:571136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeseoul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeseoul.com"; sid:571137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeseychelles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeseychelles.com"; sid:571138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesouthafrica.com"; sid:571139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freespain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freespain.com"; sid:571140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freetexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freetexas.com"; sid:571141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freetokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freetokyo.com"; sid:571142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freewuhan.com"; sid:571143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freshstart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freshstart.com"; sid:571144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundclaim.com"; sid:571145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundclaims.com"; sid:571146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gavi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gavi.com"; sid:571147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaleconomyimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaleconomyimpact.com"; sid:571148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19global.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19global.today"; sid:571149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gohome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gohome.com"; sid:571150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gotmelaidoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gotmelaidoff.com"; sid:571151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gr.com"; sid:571152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19greece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19greece.com"; sid:571153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19greenlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19greenlight.com"; sid:571154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19guards.com"; sid:571155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haircut.com"; sid:571156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haircuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haircuts.com"; sid:571157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-harmony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-harmony.com"; sid:571158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harmony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harmony.com"; sid:571159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19headlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19headlines.com"; sid:571160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-help.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-help.cloud"; sid:571161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help-law.com"; sid:571162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesfund.com"; sid:571163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herofund.com"; sid:571164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19horizon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19horizon.com"; sid:571165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hydroxychloroquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hydroxychloroquine.com"; sid:571166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infopedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infopedia.com"; sid:571167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmass.com"; sid:571168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inquarantine.com"; sid:571169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insights.com"; sid:571170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instantupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instantupdate.com"; sid:571171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19item.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19item.com"; sid:571172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k9s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k9s.com"; sid:571173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k9testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k9testing.com"; sid:571174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kekasucok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kekasucok.com"; sid:571175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiosk.com"; sid:571176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kitstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kitstest.com"; sid:571177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kitstests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kitstests.com"; sid:571178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kittest.com"; sid:571179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19latestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19latestnews.com"; sid:571180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmboise.com"; sid:571181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmchicago.com"; sid:571182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmdallas.com"; sid:571183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmhonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmhonolulu.com"; sid:571184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmhouston.com"; sid:571185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmlosangeles.com"; sid:571186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmphiladelphia.com"; sid:571187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmphoenix.com"; sid:571188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmsanfrancisco.com"; sid:571189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmseattle.com"; sid:571190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmwashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmwashingtondc.com"; sid:571191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuit.biz"; sid:571192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalblog.com"; sid:571193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19libya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19libya.com"; sid:571194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifehacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifehacks.com"; sid:571195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livenewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livenewsupdate.com"; sid:571196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lyfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lyfe.com"; sid:571197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19magic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19magic.com"; sid:571198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maluku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maluku.com"; sid:571199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskattorney.com"; sid:571200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masklawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masklawsuit.com"; sid:571201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mask.life"; sid:571202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masktutorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masktutorial.com"; sid:571203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19md.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19md.clinic"; sid:571204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialpage.com"; sid:571205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mex.net"; sid:571206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19migrante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19migrante.com"; sid:571207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19moneymatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19moneymatters.com"; sid:571208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneymatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneymatters.com"; sid:571209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19msb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19msb.biz"; sid:571210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-msb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-msb.biz"; sid:571211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msb.biz"; sid:571212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nevadastrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nevadastrong.com"; sid:571213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsanddiseaseinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsanddiseaseinfo.com"; sid:571214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newscoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newscoverage.com"; sid:571215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsgeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsgeorgia.com"; sid:571216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newstracker.com"; sid:571217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19norge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19norge.com"; sid:571218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nsw.com"; sid:571219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nusinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nusinesscenter.com"; sid:571220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ops.com"; sid:571221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicmedications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicmedications.com"; sid:571222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.life"; sid:571223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.services"; sid:571224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.today"; sid:571225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.world"; sid:571226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pbc.com"; sid:571227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pbc.com"; sid:571228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.photography"; sid:571229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.pictures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.pictures"; sid:571230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonation.com"; sid:571231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmatreatment.com"; sid:571232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmatreatment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmatreatment.net"; sid:571233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventiontips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventiontips.com"; sid:571234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-projections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-projections.com"; sid:571235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ps.com"; sid:571236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ps.net"; sid:571237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktester.com"; sid:571238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktips.com"; sid:571239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktracker.com"; sid:571240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidkit.com"; sid:571241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtester.com"; sid:571242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestmexico.com"; sid:571243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rates.com"; sid:571244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatereport.com"; sid:571245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rebuild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rebuild.com"; sid:571246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reformation.com"; sid:571247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefaid.com"; sid:571248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefs.com"; sid:571249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remembrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remembrance.com"; sid:571250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembranceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembranceday.com"; sid:571251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revolt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revolt.com"; sid:571252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rmc.com"; sid:571253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetips.com"; sid:571254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-saglikbakanligi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-saglikbakanligi.com"; sid:571255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitized.com"; sid:571256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbabusinessloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbabusinessloan.com"; sid:571257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbamoney.com"; sid:571258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbastimulusassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbastimulusassist.com"; sid:571259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scientist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scientist.com"; sid:571260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfdefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfdefence.com"; sid:571261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seo.com"; sid:571262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-seva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-seva.com"; sid:571263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seva.com"; sid:571264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ship.com"; sid:571265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shopper.com"; sid:571266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shopper.com"; sid:571267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shut-down.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shut-down.com"; sid:571268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shutdown.com"; sid:571269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-situation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-situation.com"; sid:571270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19squad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19squad.com"; sid:571271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19squad.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19squad.life"; sid:571272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19squad.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19squad.net"; sid:571273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stamps.com"; sid:571274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stfapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stfapparel.com"; sid:571275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suppliesusahotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suppliesusahotline.com"; sid:571276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyworld.com"; sid:571277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalinfo.com"; sid:571278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalist.com"; sid:571279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalnews.com"; sid:571280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorcorps.com"; sid:571281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorcorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorcorps.net"; sid:571282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swiftkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swiftkit.com"; sid:571283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teamwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teamwork.com"; sid:571284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teeshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teeshirt.com"; sid:571285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ten.com"; sid:571286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testator.com"; sid:571287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingstation.com"; sid:571288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitmexico.com"; sid:571289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thecoven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thecoven.com"; sid:571290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thecure.com"; sid:571291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.tienda - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.tienda"; sid:571292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tourismni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tourismni.com"; sid:571293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracerapp.com"; sid:571294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracingteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracingteams.com"; sid:571295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackeronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackeronline.com"; sid:571296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackusa.com"; sid:571297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-traitement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-traitement.com"; sid:571298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uae.com"; sid:571299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unemployed.com"; sid:571300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unemployed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unemployed.com"; sid:571301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19univers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19univers.com"; sid:571302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19univers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19univers.net"; sid:571303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19useconomyimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19useconomyimpact.com"; sid:571304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinefound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinefound.com"; sid:571305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacuna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacuna.net"; sid:571306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veteran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veteran.com"; sid:571307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.viajes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.viajes"; sid:571308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimbenefit.com"; sid:571309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimbenefits.com"; sid:571310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victim.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victim.fund"; sid:571311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualregistry.com"; sid:571312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusmedications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusmedications.com"; sid:571313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visa.com"; sid:571314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warning.com"; sid:571315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wave.com"; sid:571316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workforce.com"; sid:571317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldhealth.com"; sid:571318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-worldtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-worldtracker.com"; sid:571319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldupdates.com"; sid:571320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19writers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19writers.com"; sid:571321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zoe.com"; sid:571322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zoneonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zoneonline.com"; sid:571323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.center"; sid:571324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20handsanitizer.com"; sid:571325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20handsanitizer.com"; sid:571326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid24h.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid24h.com"; sid:571327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2k20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2k20.com"; sid:571328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid45news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid45news.com"; sid:571329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid50.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid50.com"; sid:571330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabogado.com"; sid:571331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-after.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-after.com"; sid:571332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidexpresslane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidexpresslane.com"; sid:571333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaimes.com"; sid:571334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxietytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxietytoolkit.com"; sid:571335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarea.com"; sid:571336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidareas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidareas.com"; sid:571337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartproject.net"; sid:571338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-atemschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-atemschutzmasken.com"; sid:571339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattendant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattendant.com"; sid:571340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattendants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattendants.com"; sid:571341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidazon.com"; sid:571342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcy.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcy.biz"; sid:571343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbc.com"; sid:571344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefit.com"; sid:571345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizrescue.com"; sid:571346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizsupport.com"; sid:571347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblok.com"; sid:571348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bracelet.com"; sid:571349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bracelet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bracelet.net"; sid:571350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelets.com"; sid:571351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbriefings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbriefings.com"; sid:571352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbureau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbureau.com"; sid:571353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburial.com"; sid:571354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessclaim.biz"; sid:571355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruption.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruption.biz"; sid:571356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalculation.com"; sid:571357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampania.com"; sid:571358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanines.com"; sid:571359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareprogram.com"; sid:571360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcartoons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcartoons.com"; sid:571361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcash.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcash.biz"; sid:571362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchaser.com"; sid:571363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchip.com"; sid:571364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaim.biz"; sid:571365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimcenters.com"; sid:571366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-class.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-class.com"; sid:571367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearinghouse.com"; sid:571368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearworker.com"; sid:571369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclock.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclock.fyi"; sid:571370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-collapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-collapse.com"; sid:571371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollar.com"; sid:571372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomix.com"; sid:571373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunism.com"; sid:571374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompetitive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompetitive.com"; sid:571375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcentration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcentration.com"; sid:571376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconferences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconferences.com"; sid:571377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcongame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcongame.com"; sid:571378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconqueror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconqueror.com"; sid:571379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooperative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooperative.com"; sid:571380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronamask.com"; sid:571381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoughing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoughing.com"; sid:571382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-countdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-countdown.com"; sid:571383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrematorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrematorium.com"; sid:571384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisiscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisiscenters.com"; sid:571385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurelab.com"; sid:571386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure.world"; sid:571387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailyforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailyforecast.com"; sid:571388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatefinder.com"; sid:571389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddates.com"; sid:571390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddaybydayforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddaybydayforecast.com"; sid:571391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddcc.com"; sid:571392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevelopment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevelopment.com"; sid:571393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscussions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscussions.com"; sid:571394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectstore.com"; sid:571395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisputes.com"; sid:571396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddogs.com"; sid:571397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddomains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddomains.com"; sid:571398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddone.com"; sid:571399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrinks.com"; sid:571400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidduty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidduty.com"; sid:571401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide-19.com"; sid:571402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidebt.com"; sid:571403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyroom.com"; sid:571404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyrooms.com"; sid:571405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenergy.com"; sid:571406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideostudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideostudio.com"; sid:571407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepidemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepidemy.com"; sid:571408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderase.com"; sid:571409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideraser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideraser.com"; sid:571410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covider.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covider.biz"; sid:571411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidereservecorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidereservecorps.com"; sid:571412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderrors.com"; sid:571413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesports.com"; sid:571414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestate.com"; sid:571415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-et-apres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-et-apres.com"; sid:571416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ether.com"; sid:571417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceprotection.com"; sid:571418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.faith - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.faith"; sid:571419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarm.com"; sid:571420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialhelp.net"; sid:571421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfm.com"; sid:571422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfondo.com"; sid:571423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforbearancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforbearancehelp.com"; sid:571424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfortress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfortress.com"; sid:571425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedj.com"; sid:571426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedjs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedjs.com"; sid:571427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeevents.com"; sid:571428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeglobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeglobe.com"; sid:571429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelife.com"; sid:571430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeme.com"; sid:571431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeparties.com"; sid:571432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesd.com"; sid:571433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundbook.com"; sid:571434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundclaim.com"; sid:571435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundclaims.com"; sid:571436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundlawyers.com"; sid:571437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunerals.com"; sid:571438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamestation.com"; sid:571439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgears.com"; sid:571440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalmap.com"; sid:571441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrantsandloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrantsandloans.com"; sid:571442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrantsandloans.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrantsandloans.education"; sid:571443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrantsandloans.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrantsandloans.expert"; sid:571444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gt.com"; sid:571445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcoverage.com"; sid:571446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthins.com"; sid:571447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthscreen.com"; sid:571448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp4u.com"; sid:571449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhideout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhideout.com"; sid:571450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhideouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhideouts.com"; sid:571451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hope.com"; sid:571452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhopefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhopefoundation.com"; sid:571453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotspots.com"; sid:571454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhub.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhub.digital"; sid:571455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanity.com"; sid:571456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidication.com"; sid:571457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunes.com"; sid:571458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunetesting.com"; sid:571459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunities.com"; sid:571460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincineration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincineration.com"; sid:571461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincinerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincinerator.com"; sid:571462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia.net"; sid:571463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfected.com"; sid:571464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-infos.com"; sid:571465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinitiatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinitiatives.com"; sid:571466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidins.com"; sid:571467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancecash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancecash.com"; sid:571468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaim.biz"; sid:571469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruption.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruption.biz"; sid:571470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintubationbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintubationbox.com"; sid:571471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocy19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocy19.com"; sid:571472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioten.com"; sid:571473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ipsum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ipsum.com"; sid:571474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiq.net"; sid:571475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidja.com"; sid:571476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9s.com"; sid:571477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9test.com"; sid:571478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9testing.com"; sid:571479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkindness.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkindness.world"; sid:571480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearnings.com"; sid:571481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlibraries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlibraries.com"; sid:571482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlines.com"; sid:571483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloans-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloans-app.com"; sid:571484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlossclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlossclaim.com"; sid:571485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlubbock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlubbock.com"; sid:571486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlyfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlyfe.com"; sid:571487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagazine.com"; sid:571488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagazines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagazines.com"; sid:571489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketplaceclm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketplaceclm.com"; sid:571490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskcovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskcovers.com"; sid:571491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskgear.com"; sid:571492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskmom.com"; sid:571493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksforsale.com"; sid:571494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksky.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksky.net"; sid:571495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasque.com"; sid:571496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.clinic"; sid:571497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicus.com"; sid:571498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeet.com"; sid:571499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessage.com"; sid:571500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicrobes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicrobes.com"; sid:571501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmillionaire.com"; sid:571502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmis.com"; sid:571503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmistakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmistakes.com"; sid:571504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletest.com"; sid:571505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortality.com"; sid:571506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortalitycompare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortalitycompare.com"; sid:571507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-msb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-msb.biz"; sid:571508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmsb.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmsb.biz"; sid:571509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmvax.com"; sid:571510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-neunzehn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-neunzehn.com"; sid:571511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnever.com"; sid:571512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-newdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-newdeal.com"; sid:571513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewstracker.com"; sid:571514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteen.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteen.club"; sid:571515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteen.net"; sid:571516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ninteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ninteen.com"; sid:571517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nouvelle-donne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nouvelle-donne.com"; sid:571518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidntx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidntx.com"; sid:571519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-off.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-off.com"; sid:571520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidogs.com"; sid:571521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoquine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoquine.com"; sid:571522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutreachhamilton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutreachhamilton.com"; sid:571523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpalace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpalace.com"; sid:571524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanama.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanama.net"; sid:571525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemy.com"; sid:571526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.net"; sid:571527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassports.com"; sid:571528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpast.com"; sid:571529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaycheckprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaycheckprotectionplan.com"; sid:571530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpelis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpelis.com"; sid:571531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmadonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmadonor.com"; sid:571532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmasavealife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmasavealife.com"; sid:571533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpost.com"; sid:571534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpractitioner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpractitioner.com"; sid:571535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpractitioners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpractitioners.com"; sid:571536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevention.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevention.care"; sid:571537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventions.com"; sid:571538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprimer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprimer.com"; sid:571539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofessors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofessors.com"; sid:571540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofiteering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofiteering.com"; sid:571541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpropertytax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpropertytax.com"; sid:571542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpropertytaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpropertytaxes.com"; sid:571543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproteccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproteccion.com"; sid:571544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotections.com"; sid:571545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionsupply.com"; sid:571546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadybiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadybiz.com"; sid:571547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcoalition.com"; sid:571548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrememberanceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrememberanceproject.com"; sid:571549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembranceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembranceproject.com"; sid:571550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreservecorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreservecorp.com"; sid:571551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.supply"; sid:571552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsesupply.com"; sid:571553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretreats.com"; sid:571554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrightslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrightslawyer.com"; sid:571555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rnercadolibre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rnercadolibre.com"; sid:571556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeoffice.com"; sid:571557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeoffice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeoffice.net"; sid:571558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeplaces.com"; sid:571559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafer.com"; sid:571560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafespaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafespaces.com"; sid:571561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafespaces.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafespaces.net"; sid:571562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsandiego.com"; sid:571563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschemes.com"; sid:571564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscientists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscientists.com"; sid:571565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningcenter.com"; sid:571566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningcenters.com"; sid:571567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreenme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreenme.com"; sid:571568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseo.com"; sid:571569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsexpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsexpartners.com"; sid:571570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshelters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshelters.com"; sid:571571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageprinting.com"; sid:571572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialism.com"; sid:571573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthwesttexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthwesttexas.com"; sid:571574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeeches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeeches.com"; sid:571575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsport.com"; sid:571576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatements.com"; sid:571577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatistik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatistik.com"; sid:571578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.mobi"; sid:571579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplement.com"; sid:571580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyworld.com"; sid:571581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportgroup.com"; sid:571582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalstore.com"; sid:571583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivaltexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivaltexas.com"; sid:571584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalus.com"; sid:571585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorcorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorcorps.net"; sid:571586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtampabay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtampabay.com"; sid:571587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtapao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtapao.com"; sid:571588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxappeal.com"; sid:571589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxappeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxappeals.com"; sid:571590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxi.com"; sid:571591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxis.com"; sid:571592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxplanning.com"; sid:571593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelevision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelevision.com"; sid:571594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest1.com"; sid:571595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsd.com"; sid:571596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtough.com"; sid:571597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrading.com"; sid:571598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransmissions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransmissions.com"; sid:571599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunitesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunitesus.com"; sid:571600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdate.world"; sid:571601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedelivery.com"; sid:571602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvet.com"; sid:571603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveterans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveterans.com"; sid:571604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvi.com"; sid:571605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimbenefits.com"; sid:571606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimfund.com"; sid:571607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimsfund.com"; sid:571608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vigilant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vigilant.com"; sid:571609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvips.com"; sid:571610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.life"; sid:571611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-news.com"; sid:571612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisa.com"; sid:571613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchbd.com"; sid:571614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwedding.com"; sid:571615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellbeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellbeing.com"; sid:571616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwish.com"; sid:571617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkcomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkcomp.com"; sid:571618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwriters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwriters.com"; sid:571619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzahlen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzahlen.com"; sid:571620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatingthroughcovid.com"; sid:571621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativityincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativityincovid.com"; sid:571622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid2020.com"; sid:571623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct-coronavirus-nonprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct-coronavirus-nonprofit.com"; sid:571624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuisinedecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuisinedecorona.com"; sid:571625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultureaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultureaftercorona.com"; sid:571626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultureaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultureaftercovid.com"; sid:571627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacovid-19.com"; sid:571628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacovid-19.net"; sid:571629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid-19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid-19facemasks.com"; sid:571630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcoronavirus.com"; sid:571631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daleelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daleelcorona.com"; sid:571632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingintheageofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingintheageofcovid19.com"; sid:571633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datinginthetimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datinginthetimeofcovid-19.com"; sid:571634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayaftercoronavirus.com"; sid:571635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayaftercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayaftercoronavirus.net"; sid:571636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidnow.com"; sid:571637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacoronavirus.net"; sid:571638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfetante-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfetante-coronavirus.com"; sid:571639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuesdelcoronavirusque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuesdelcoronavirusque.com"; sid:571640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroy-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroy-coronavirus.com"; sid:571641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diese-firma-ist-wegen-corona-gestorben.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diese-firma-ist-wegen-corona-gestorben.com"; sid:571642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcorona.com"; sid:571643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositivicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositivicovid19.com"; sid:571644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositivicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositivicovid.com"; sid:571645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distancecorona.com"; sid:571646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distince-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distince-corona.com"; sid:571647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorce-in-the-time-of-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorce-in-the-time-of-corona.com"; sid:571648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divorce-in-the-time-of-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divorce-in-the-time-of-covid-19.com"; sid:571649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorcovidstories.com"; sid:571650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacionescovid.com"; sid:571651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donate2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donate2corona.com"; sid:571652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateplasmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateplasmacovid19.com"; sid:571653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocorona.com"; sid:571654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpicovid-19.com"; sid:571655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpicovid19.com"; sid:571656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovidex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovidex.com"; sid:571657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economiacovid.com"; sid:571658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educacioncovid.com"; sid:571659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eeunitedcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eeunitedcovidresponse.com"; sid:571660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entcovid.com"; sid:571661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic2019.com"; sid:571662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicequipment.com"; sid:571663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.insure - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.insure"; sid:571664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erythromycincoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erythromycincoronaviruscure.com"; sid:571665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erythromycincovid-19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erythromycincovid-19cure.com"; sid:571666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erythromycincovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erythromycincovid19cure.com"; sid:571667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exoduscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exoduscorona.com"; sid:571668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f45covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f45covid19.com"; sid:571669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks4covid19.com"; sid:571670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks4covid.com"; sid:571671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasksforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasksforcovid.com"; sid:571672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for face-shields-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"face-shields-covid19.com"; sid:571673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshields-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshields-covid19.com"; sid:571674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factualcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factualcovid.com"; sid:571675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familydiarycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familydiarycovid.com"; sid:571676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcashcorona.com"; sid:571677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronacash.com"; sid:571678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ffp2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ffp2covid.com"; sid:571679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidvirus.com"; sid:571680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finanziamenticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finanziamenticovid.com"; sid:571681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fit30covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fit30covid19.com"; sid:571682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fit45covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fit45covid19.com"; sid:571683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitbodycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitbodycovid19.com"; sid:571684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidnews.com"; sid:571685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridapandemic.com"; sid:571686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19healthcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19healthcheck.com"; sid:571687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freshjuicecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freshjuicecovid19.com"; sid:571688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freshproducecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freshproducecovid19.com"; sid:571689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freshproduceworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freshproduceworldcovid19.com"; sid:571690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucklacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucklacovid.com"; sid:571691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovidly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovidly.com"; sid:571692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fufitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fufitcovid19.com"; sid:571693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundcovid19.com"; sid:571694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundcovid19vaccine.com"; sid:571695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundscovid19.com"; sid:571696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funeris-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funeris-covid19.com"; sid:571697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid-19.com"; sid:571698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gelanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gelanticovid19.com"; sid:571699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generacioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generacioncovid-19.com"; sid:571700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronacide.com"; sid:571701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getfundedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getfundedcovid19.com"; sid:571702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getfundscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getfundscovid19.com"; sid:571703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getnovelcoronavirustreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getnovelcoronavirustreatments.com"; sid:571704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getpandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getpandemickits.com"; sid:571705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicconsulting.com"; sid:571706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocorona.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocorona.run"; sid:571707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid-19.com"; sid:571708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for good-covid-19-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"good-covid-19-news.com"; sid:571709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcoronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcoronahoax.com"; sid:571710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gscovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gscovidlife.com"; sid:571711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gscovidlife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gscovidlife.net"; sid:571712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guardagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guardagainstcorona.com"; sid:571713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happinesspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happinesspandemic.com"; sid:571714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrisonburgagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrisonburgagainstcorona.com"; sid:571715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthyaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthyaftercovid.com"; sid:571716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpatcoronavirus.com"; sid:571717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcorona19.com"; sid:571718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid19-2020.com"; sid:571719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid192020.com"; sid:571720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpduringcovid.com"; sid:571721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-homeless-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-homeless-covid19.com"; sid:571722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmycoviddebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmycoviddebt.com"; sid:571723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hollywoodcovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hollywoodcovidtestnow.com"; sid:571724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homepandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homepandemickits.com"; sid:571725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometogocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometogocovid19.com"; sid:571726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howicaughtcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howicaughtcovid19.com"; sid:571727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydroxychloroquine-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydroxychloroquine-coronavirus.com"; sid:571728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidnegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidnegative.com"; sid:571729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidence.com"; sid:571730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronaimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronaimmune.com"; sid:571731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impresecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impresecovid.com"; sid:571732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidiantimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidiantimes.com"; sid:571733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovidmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovidmodel.com"; sid:571734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infermiericovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infermiericovid.com"; sid:571735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocoronavirusmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocoronavirusmexico.com"; sid:571736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19cameroon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19cameroon.com"; sid:571737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovidcameroon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovidcameroon.com"; sid:571738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovidcameroon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovidcameroon.net"; sid:571739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-covid19.com"; sid:571740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmunidadalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmunidadalcoronavirus.com"; sid:571741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inpscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inpscovid.com"; sid:571742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intesa-corona-it.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intesa-corona-it.com"; sid:571743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for introcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"introcovid.com"; sid:571744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investigacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investigacioncoronavirus.com"; sid:571745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscovid.com"; sid:571746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovid19aflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovid19aflu.com"; sid:571747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istandagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istandagainstcovid19.com"; sid:571748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isyourbusinesscovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isyourbusinesscovidready.com"; sid:571749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiapostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiapostcovid19.com"; sid:571750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itslegalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itslegalcovid19.com"; sid:571751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jspm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jspm-covid19.com"; sid:571752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jvscovid19.com"; sid:571753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jvsworldfitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jvsworldfitcovid19.com"; sid:571754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9covid19.com"; sid:571755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9covidtest.com"; sid:571756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9covidtesting.com"; sid:571757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kakuchincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kakuchincovid-19.com"; sid:571758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccovidcleaning.com"; sid:571759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcovidaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcovidaway.com"; sid:571760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickoutcovid.com"; sid:571761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killedbycovid.com"; sid:571762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-the-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-the-covid19.com"; sid:571763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindnessaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindnessaftercovid.com"; sid:571764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcharlescoronationlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcharlescoronationlive.com"; sid:571765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcovidxix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcovidxix.com"; sid:571766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingofcorona.com"; sid:571767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingscoronationlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingscoronationlive.com"; sid:571768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ko-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ko-covid19.com"; sid:571769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for larkswoodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"larkswoodcovid19.com"; sid:571770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovid19news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovid19news.net"; sid:571771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecoachcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecoachcovid19.com"; sid:571772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecoronavirus.com"; sid:571773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liillycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liillycovid19testing.com"; sid:571774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilcovid.com"; sid:571775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19tessting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19tessting.com"; sid:571776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testibg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testibg.com"; sid:571777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testinf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testinf.com"; sid:571778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testinh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testinh.com"; sid:571779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillyycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillyycovid19testing.com"; sid:571780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for linkhelp4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"linkhelp4covid.com"; sid:571781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lipandemic.com"; sid:571782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livefromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livefromthepandemic.com"; sid:571783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinginthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinginthetimeofcorona.net"; sid:571784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovebeatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovebeatscovid19.com"; sid:571785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinacovidclimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinacovidclimate.com"; sid:571786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronastories.com"; sid:571787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeacovidclaim.com"; sid:571788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeacovidclaims.com"; sid:571789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeppecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeppecovid19.com"; sid:571790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makers-vs-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makers-vs-covid.com"; sid:571791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manvscorona.com"; sid:571792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherine-covid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherine-covid.cloud"; sid:571793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid.cloud"; sid:571794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-for-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-for-corona.com"; sid:571795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-for-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-for-corona.net"; sid:571796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcoronavirusn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcoronavirusn95.com"; sid:571797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maski-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maski-covid19.com"; sid:571798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maylocnuocmuacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maylocnuocmuacovid.com"; sid:571799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovidstories.com"; sid:571800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medcorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medcorecovid19.com"; sid:571801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalepidemicequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalepidemicequipment.com"; sid:571802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicicovid.com"; sid:571803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medlinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medlinecovid19.com"; sid:571804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meds-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meds-corona.com"; sid:571805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorial-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorial-covid19.com"; sid:571806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamipandemic.com"; sid:571807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancoronaviruslawyer.com"; sid:571808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mimexicoencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mimexicoencovid.com"; sid:571809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronavirus.mobi"; sid:571810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovidsitters.com"; sid:571811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernloveinthetimeofcorona.com"; sid:571812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneydurincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneydurincorona.com"; sid:571813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for move4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"move4corona.com"; sid:571814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muertescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muertescoronavirus.com"; sid:571815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muestrascovid19adomicilio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muestrascovid19adomicilio.com"; sid:571816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronamug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronamug.com"; sid:571817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19debtrelief.com"; sid:571818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covid-assist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covid-assist.com"; sid:571819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcase.com"; sid:571820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddebtrelief.com"; sid:571821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddoc.com"; sid:571822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtaxes.com"; sid:571823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfightcorona.com"; sid:571824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtest.com"; sid:571825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovidmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovidmanagement.com"; sid:571826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neuroscorecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neuroscorecovid19.net"; sid:571827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newportbeachcovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newportbeachcovidtestnow.com"; sid:571828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsandviewspandemic2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsandviewspandemic2020.world"; sid:571829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsforcoronawow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsforcoronawow.com"; sid:571830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidrelief.com"; sid:571831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.biz"; sid:571832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomascoronavirus.com"; sid:571833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronainfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronainfection.com"; sid:571834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusonline.com"; sid:571835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntxcovid.com"; sid:571836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nudeart-coronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nudeart-coronarelief.com"; sid:571837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursecovid19.com"; sid:571838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19complaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19complaw.com"; sid:571839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidhistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidhistory.com"; sid:571840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onepandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onepandemicday.com"; sid:571841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecovidtestnow.com"; sid:571842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercoronacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercoronacide.com"; sid:571843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourfamilyscovid19adventure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourfamilyscovid19adventure.com"; sid:571844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourworldcovid19.com"; sid:571845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outcovid.com"; sid:571846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcoronavirustest.com"; sid:571847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid-19test.com"; sid:571848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid19test.com"; sid:571849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outofcovid.com"; sid:571850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pajamapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pajamapandemic.com"; sid:571851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic4hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic4hope.com"; sid:571852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvance.com"; sid:571853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicauthority.com"; sid:571854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconcept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconcept.com"; sid:571855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-con.com"; sid:571856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccon.com"; sid:571857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid1910.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid1910.com"; sid:571858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid191.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid191.com"; sid:571859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid192.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid192.com"; sid:571860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid193.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid193.com"; sid:571861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid194.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid194.com"; sid:571862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid195.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid195.com"; sid:571863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid196.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid196.com"; sid:571864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid197.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid197.com"; sid:571865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid198.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid198.com"; sid:571866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid199.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid199.com"; sid:571867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefensecorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefensecorp.com"; sid:571868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefenseinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefenseinc.com"; sid:571869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemia.com"; sid:571870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemia.net"; sid:571871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-go.com"; sid:571872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichomeschooling.com"; sid:571873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichomes.com"; sid:571874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichygienics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichygienics.com"; sid:571875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurance.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurance.agency"; sid:571876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurance.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurance.guru"; sid:571877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicletters.com"; sid:571878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeasures.com"; sid:571879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnecessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnecessities.com"; sid:571880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpackages.com"; sid:571881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpackages.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpackages.net"; sid:571882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpacket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpacket.com"; sid:571883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpickle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpickle.com"; sid:571884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpicky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpicky.com"; sid:571885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplays.com"; sid:571886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreppingpackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreppingpackages.com"; sid:571887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreppingpackages.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreppingpackages.net"; sid:571888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofproducts.com"; sid:571889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsenetwork.com"; sid:571890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrpt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrpt.com"; sid:571891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrpt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrpt.net"; sid:571892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.biz"; sid:571893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-scrapbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-scrapbook.com"; sid:571894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshelp.com"; sid:571895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshutdown.com"; sid:571896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicssurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicssurvivalkit.com"; sid:571897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstop.net"; sid:571898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrong.com"; sid:571899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstudy.com"; sid:571900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuperworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuperworker.com"; sid:571901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliescompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliescompany.com"; sid:571902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliesllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliesllc.com"; sid:571903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppression.com"; sid:571904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalgroup.com"; sid:571905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalsupplies.com"; sid:571906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictracer.com"; sid:571907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patientcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patientcovidstories.com"; sid:571908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patientguardcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patientguardcovidtest.com"; sid:571909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcrcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcrcoronavirus.com"; sid:571910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedscovid19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedscovid19registry.com"; sid:571911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pfccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pfccovid19.com"; sid:571912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pfcovid19.com"; sid:571913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinchecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinchecovid.com"; sid:571914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformadeafectadosporcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformadeafectadosporcovid19.com"; sid:571915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playbookforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playbookforpandemic.com"; sid:571916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poshpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poshpandemic.com"; sid:571917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for posopedulicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"posopedulicorona.com"; sid:571918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona-world.com"; sid:571919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcompliance.com"; sid:571920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsurvivor.com"; sid:571921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppepandemic.com"; sid:571922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pppcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pppcovid.com"; sid:571923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicecovid19.com"; sid:571924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirus.life"; sid:571925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid20.com"; sid:571926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecoronavirus.com"; sid:571927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proceedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proceedcovid19.com"; sid:571928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovidhalo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovidhalo.com"; sid:571929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for project-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"project-covid.net"; sid:571930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prosegurcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prosegurcoronavirus.com"; sid:571931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncoronavirusonline.com"; sid:571932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid19.net"; sid:571933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecovid19.com"; sid:571934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protivocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protivocovid.com"; sid:571935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidadetecciondeanticuerposcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidadetecciondeanticuerposcovid19.com"; sid:571936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychcovid19.com"; sid:571937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycholoogcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycholoogcorona.com"; sid:571938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publixcovidmaskclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publixcovidmaskclassaction.com"; sid:571939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purbalinggacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purbalinggacovid19.com"; sid:571940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purchasecoronacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purchasecoronacide.com"; sid:571941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puyenggara2coronayobabi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puyenggara2coronayobabi.com"; sid:571942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queencovidia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queencovidia.com"; sid:571943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronacash.com"; sid:571944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronarecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronarecovery.com"; sid:571945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radarcovid.com"; sid:571946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidpointofcaretestingkitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidpointofcaretestingkitscovid19.com"; sid:571947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rastreocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rastreocovid-19.com"; sid:571948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronanews.com"; sid:571949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registeredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registeredcovid.com"; sid:571950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinventyourbusinessduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinventyourbusinessduringcovid19.com"; sid:571951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rejectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rejectcovid19.com"; sid:571952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcovid192020.com"; sid:571953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remember-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remember-covid19.com"; sid:571954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renfort-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renfort-covid.com"; sid:571955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renforts-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renforts-covid.com"; sid:571956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantscovid19.com"; sid:571957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantstogocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantstogocovid19.com"; sid:571958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reverebeachhousecovidawarenesscoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reverebeachhousecovidawarenesscoalition.com"; sid:571959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riccionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riccionecovid19.com"; sid:571960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridofcovid.com"; sid:571961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rootscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rootscovid19.com"; sid:571962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid19solution.com"; sid:571963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecarecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecarecovid19test.com"; sid:571964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecarecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecarecovidtest.com"; sid:571965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycovid19.com"; sid:571966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saloncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saloncovid19.com"; sid:571967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificacovid.com"; sid:571968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitaricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitaricovid.com"; sid:571969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacoronavirusloanrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacoronavirusloanrelief.com"; sid:571970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid-19loanassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid-19loanassist.com"; sid:571971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scaleppecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scaleppecovid19.com"; sid:571972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scratchoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scratchoutcorona.com"; sid:571973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenmecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenmecorona.com"; sid:571974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securecovid19.com"; sid:571975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shields-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shields-covid19.com"; sid:571976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezzacovid19.com"; sid:571977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezzacovid.com"; sid:571978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sio2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sio2covid19.com"; sid:571979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowpandemic.com"; sid:571980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowpandemics.com"; sid:571981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smacovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smacovid19stories.com"; sid:571982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snapcovid.com"; sid:571983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spraycovidaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spraycovidaway.com"; sid:571984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standup2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standup2covid19.com"; sid:571985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayingconnectedduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayingconnectedduringcovid19.com"; sid:571986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stbcovid19.com"; sid:571987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlouiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlouiscoronavirus.com"; sid:571988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlouiscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlouiscovid-19.com"; sid:571989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlouiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlouiscovid19.com"; sid:571990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stompcovidph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stompcovidph.com"; sid:571991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona19.com"; sid:571992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.pro"; sid:571993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovidiots.com"; sid:571994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storyofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storyofcoronavirus.com"; sid:571995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid19band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid19band.com"; sid:571996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacklingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacklingcovid19.com"; sid:571997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taladcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taladcovid.com"; sid:571998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taladcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taladcovid.net"; sid:571999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tankedoffcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tankedoffcorona.com"; sid:572000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxescovid.com"; sid:572001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19virus.com"; sid:572002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texas-coronavirus-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texas-coronavirus-lawyer.com"; sid:572003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona15.com"; sid:572004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaanxietytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaanxietytoolkit.com"; sid:572005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacon.com"; sid:572006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafaq.com"; sid:572007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronameltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronameltdown.com"; sid:572008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashirt.com"; sid:572009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfaq.com"; sid:572010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaway.com"; sid:572011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19class.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19class.com"; sid:572012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19database.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19database.com"; sid:572013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19gratitudeproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19gratitudeproject.com"; sid:572014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidarmy.com"; sid:572015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbands.com"; sid:572016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbands.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbands.net"; sid:572017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcareproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcareproject.com"; sid:572018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclass2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclass2020.com"; sid:572019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclass.com"; sid:572020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinfo.com"; sid:572021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtee.com"; sid:572022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecuretocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecuretocoronavirus.com"; sid:572023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcoronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcoronahoax.com"; sid:572024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themaskcovid19.com"; sid:572025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenewscovid19.com"; sid:572026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccovid19.com"; sid:572027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicheroes.com"; sid:572028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsurvivalkit.com"; sid:572029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapistcovid19.com"; sid:572030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapistscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapistscovid19.com"; sid:572031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thestoryofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thestoryofcoronavirus.com"; sid:572032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldcovid19.com"; sid:572033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theybeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theybeatcovid19.com"; sid:572034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theygotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theygotcovid.com"; sid:572035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisworldcovid19.com"; sid:572036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todocontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todocontraelcovid.com"; sid:572037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontraocorona.com"; sid:572038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todosjuntoscontraocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todosjuntoscontraocovid.com"; sid:572039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togocovid19.com"; sid:572040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalwarcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalwarcovid-19.com"; sid:572041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tot-wegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tot-wegen-corona.com"; sid:572042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovids19.com"; sid:572043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovid19.com"; sid:572044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovid.com"; sid:572045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tudosobrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tudosobrecovid19.com"; sid:572046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tureinosincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tureinosincorona.com"; sid:572047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidevictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidevictions.com"; sid:572048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unite-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unite-against-corona.com"; sid:572049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedincovid.com"; sid:572050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedwestandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedwestandcovid19.com"; sid:572051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universitycovid19.com"; sid:572052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unternehmensberatung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unternehmensberatung-corona.com"; sid:572053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19relief.com"; sid:572054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19supply.com"; sid:572055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoviddebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoviddebtrelief.com"; sid:572056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19.net"; sid:572057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19relief.com"; sid:572058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utopiancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utopiancovid19.com"; sid:572059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccoronavirus.com"; sid:572060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uwscovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uwscovidresources.com"; sid:572061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid19.net"; sid:572062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacovid19.net"; sid:572063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigipandemic.com"; sid:572064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualsmilecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualsmilecoronado.com"; sid:572065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viseirascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viseirascovid19.com"; sid:572066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscoronavirus2020.com"; sid:572067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wealthinpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wealthinpandemics.com"; sid:572068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecoronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecoronafighters.com"; sid:572069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for web247covid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"web247covid19news.com"; sid:572070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecuredcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecuredcorona.com"; sid:572071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecuredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecuredcovid.com"; sid:572072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weltcoronatag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weltcoronatag.com"; sid:572073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivecoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivecoronashop.com"; sid:572074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatisloveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatisloveinthetimeofcorona.com"; sid:572075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatshouldidointhesecoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatshouldidointhesecoronatimes.com"; sid:572076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whycovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whycovid19map.com"; sid:572077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winagainstcovid-19.com"; sid:572078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for win-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"win-covid.com"; sid:572079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-corona-day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-corona-day.com"; sid:572080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidnews.com"; sid:572081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldoffreshproducecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldoffreshproducecovid19.com"; sid:572082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwar-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwar-corona.com"; sid:572083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwar-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwar-covid.com"; sid:572084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpcoronavirus.com"; sid:572085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpcovid19.com"; sid:572086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wristbands4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wristbands4covid.com"; sid:572087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wristbands4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wristbands4covid.net"; sid:572088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbaozhuangji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbaozhuangji.com"; sid:572089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandonghu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandonghu.com"; sid:572090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanflutees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanflutees.com"; sid:572091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangym.com"; sid:572092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjiyi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjiyi.net"; sid:572093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmemory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmemory.net"; sid:572094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmm.com"; sid:572095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrex.com"; sid:572096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhibei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhibei.com"; sid:572097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for x-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"x-covid19.net"; sid:572098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-beatmungsgert-tzb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-beatmungsgert-tzb.com"; sid:572099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronabeatmungsgert-xwb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronabeatmungsgert-xwb.com"; sid:572100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronafritomrde-tlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronafritomrde-tlb.com"; sid:572101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-virs-2hb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-virs-2hb.com"; sid:572102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-virs-2hb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-virs-2hb.net"; sid:572103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--sistemadesinfeccincoronavirus-c3c.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--sistemadesinfeccincoronavirus-c3c.com"; sid:572104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xraycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xraycovid19.com"; sid:572105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yodespuesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yodespuesdelcoronavirus.com"; sid:572106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidtaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidtaxes.com"; sid:572107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100bellscoronaviruspandemiclockdown.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100bellscoronaviruspandemiclockdown.golf"; sid:572108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1globe-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1globe-covid19.com"; sid:572109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019-covid-19.com"; sid:572110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019-covid-19.net"; sid:572111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidcrisis.com"; sid:572112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020march-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020march-covid19.com"; sid:572113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360covid.com"; sid:572114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4bestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4bestcovidtest.com"; sid:572115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidtesting.com"; sid:572116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5experttipsprotectionduringpandemic.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5experttipsprotectionduringpandemic.fail"; sid:572117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcovid-19.com"; sid:572118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 666coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"666coronavirus.com"; sid:572119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aapisagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aapisagainstcovid.com"; sid:572120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutbrazil-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutbrazil-covid.com"; sid:572121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovidtest.com"; sid:572122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a-covid.com"; sid:572123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africoronavirus.com"; sid:572124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africovid19.com"; sid:572125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronacare.com"; sid:572126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahefcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahefcoronavirus.com"; sid:572127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all4coronavirus.com"; sid:572128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatscorona.com"; sid:572129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidiot.com"; sid:572130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americansfightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americansfightcorona.com"; sid:572131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies4corona.com"; sid:572132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies4covid19.com"; sid:572133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies4covid19.net"; sid:572134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies4covid.com"; sid:572135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibody4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibody4corona.com"; sid:572136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibody4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibody4covid19.com"; sid:572137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibody4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibody4covid.com"; sid:572138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytest4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytest4corona.com"; sid:572139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytest4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytest4covid19.com"; sid:572140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytest4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytest4covid.com"; sid:572141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafoods.com"; sid:572142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.world"; sid:572143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbox.com"; sid:572144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfood.com"; sid:572145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfoods.com"; sid:572146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoviddrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoviddrugs.com"; sid:572147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidtests.com"; sid:572148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacioncoronavirus.com"; sid:572149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assesscovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assesscovid19now.com"; sid:572150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtest.com"; sid:572151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbcovidresponse.com"; sid:572152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbcovidresponse.net"; sid:572153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatbackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatbackcorona.com"; sid:572154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforethepandemic.com"; sid:572155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19vaccine.com"; sid:572156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgatescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgatescovid19.com"; sid:572157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitof45magicduringcoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitof45magicduringcoronavirus.cloud"; sid:572158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bondowosocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bondowosocovid.com"; sid:572159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boutique-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boutique-covid19.com"; sid:572160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brokerofdomainscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brokerofdomainscovid19.com"; sid:572161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bullycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bullycorona.com"; sid:572162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidrecovery.com"; sid:572163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycorona19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycorona19mask.com"; sid:572164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycorona19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycorona19masks.com"; sid:572165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusmasksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusmasksonline.com"; sid:572166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buypandemicproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buypandemicproducts.com"; sid:572167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyyourcovid19testhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyyourcovid19testhere.com"; sid:572168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bvcovidwarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bvcovidwarriors.com"; sid:572169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidessentials.com"; sid:572170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecoronavirus.com"; sid:572171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canigetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canigetcovid.com"; sid:572172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcoronavirus.com"; sid:572173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcovid-19.com"; sid:572174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcovid19.com"; sid:572175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcovid.com"; sid:572176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcovid.net"; sid:572177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannibisagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannibisagainstcovid19.com"; sid:572178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caughtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caughtcoronavirus.com"; sid:572179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdphcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdphcovid19.com"; sid:572180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdphcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdphcovid.com"; sid:572181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralvalleycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralvalleycovid.com"; sid:572182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifycovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifycovidclear.com"; sid:572183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chalkituptocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chalkituptocovid.com"; sid:572184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checknowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checknowcovid19.com"; sid:572185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chongcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chongcovid.com"; sid:572186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cifrascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cifrascovid19.com"; sid:572187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencovid19relief.com"; sid:572188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencovid19relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencovid19relief.net"; sid:572189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classcovid2020.com"; sid:572190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classcovid.com"; sid:572191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovid-19.com"; sid:572192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicasincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicasincovid-19.com"; sid:572193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachescovid19.com"; sid:572194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachesvscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachesvscovid-19.com"; sid:572195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachsvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachsvscovid19.com"; sid:572196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commentjetraitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commentjetraitecovid19.com"; sid:572197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for continuemylifeaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"continuemylifeaftercovid19.com"; sid:572198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid-19.com"; sid:572199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.life"; sid:572200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corecovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corecovidclinic.com"; sid:572201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19care.com"; sid:572202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1claims.com"; sid:572203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1virusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1virusclaims.com"; sid:572204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaftercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaftercare.com"; sid:572205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arab.com"; sid:572206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaart.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaart.gallery"; sid:572207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyrush.com"; sid:572208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabagis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabagis.com"; sid:572209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabars.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabars.net"; sid:572210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeachswimsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeachswimsuits.com"; sid:572211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeachwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeachwear.com"; sid:572212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-betrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-betrug.com"; sid:572213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabg.com"; sid:572214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-billion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-billion.com"; sid:572215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiocide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiocide.com"; sid:572216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablasters.com"; sid:572217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboombaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboombaby.com"; sid:572218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabully.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabully.com"; sid:572219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.agency"; sid:572220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.care"; sid:572221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.company"; sid:572222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacali.com"; sid:572223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cards.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cards.net"; sid:572224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chances.com"; sid:572225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachatfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachatfeed.com"; sid:572226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsattorneys.com"; sid:572227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclalit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclalit.com"; sid:572228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoveragenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoveragenow.com"; sid:572229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacr.com"; sid:572230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.guru"; sid:572231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dailynews.com"; sid:572232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadata.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadata.world"; sid:572233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatenspende.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatenspende.com"; sid:572234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivorcefaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivorcefaq.com"; sid:572235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohsfootball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohsfootball.com"; sid:572236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoonlinehomeworksupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoonlinehomeworksupport.com"; sid:572237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadostrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadostrong.com"; sid:572238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexch.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexch.club"; sid:572239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafarma.com"; sid:572240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafifa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafifa.com"; sid:572241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafilament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafilament.com"; sid:572242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreak.com"; sid:572243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalhelp.com"; sid:572244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardlabs.com"; sid:572245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardlabs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardlabs.net"; sid:572246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunleri.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunleri.biz"; sid:572247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hasan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hasan.net"; sid:572248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelper.net"; sid:572249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahustle.com"; sid:572250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-id.com"; sid:572251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuniteitstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuniteitstest.com"; sid:572252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo.world"; sid:572253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairusa.com"; sid:572254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajnusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajnusa.com"; sid:572255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakid2020.com"; sid:572256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidss.com"; sid:572257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleaner.com"; sid:572258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawtaskforce.com"; sid:572259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalayoffstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalayoffstories.com"; sid:572260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegaler.com"; sid:572261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegaltaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegaltaskforce.com"; sid:572262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalierus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalierus.com"; sid:572263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalos.com"; sid:572264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamace.com"; sid:572265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasken1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasken1.com"; sid:572266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonarch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonarch.com"; sid:572267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoon.com"; sid:572268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamute.com"; sid:572269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamvp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamvp.com"; sid:572270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsline.com"; sid:572271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanme.com"; sid:572272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoia.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoia.life"; sid:572273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanyork.com"; sid:572274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanyusahin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanyusahin.com"; sid:572275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplexiglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplexiglass.com"; sid:572276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieftestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieftestkits.com"; sid:572277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarencontre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarencontre.com"; sid:572278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareturn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareturn.com"; sid:572279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-returns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-returns.com"; sid:572280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarikon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarikon.com"; sid:572281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroyals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroyals.com"; sid:572282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronart.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronart.gallery"; sid:572283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarts.net"; sid:572284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaglik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaglik.com"; sid:572285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasamen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasamen.com"; sid:572286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizationdelhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizationdelhi.com"; sid:572287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz1.com"; sid:572288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sd.com"; sid:572289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaserenades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaserenades.com"; sid:572290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnow.com"; sid:572291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-speed-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-speed-check.com"; sid:572292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrikeforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrikeforce.com"; sid:572293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrikeforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrikeforce.net"; sid:572294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrongbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrongbands.com"; sid:572295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastyle.com"; sid:572296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasubscription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasubscription.com"; sid:572297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalist.com"; sid:572298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalstories.com"; sid:572299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatechnolegies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatechnolegies.com"; sid:572300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestband.com"; sid:572301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingfinder.com"; sid:572302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingmap.com"; sid:572303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestjezelf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestjezelf.com"; sid:572304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathepod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathepod.com"; sid:572305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatohell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatohell.com"; sid:572306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackapp.com"; sid:572307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatradingclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatradingclub.com"; sid:572308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatradingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatradingcompany.com"; sid:572309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-update.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-update.life"; sid:572310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-uvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-uvc.com"; sid:572311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-uv.com"; sid:572312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavifusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavifusnow.com"; sid:572313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruainusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruainusa.com"; sid:572314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19-testing.com"; sid:572315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountabilityproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountabilityproject.com"; sid:572316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietysolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietysolution.com"; sid:572317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusart.net"; sid:572318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbroker.com"; sid:572319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuisness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuisness.com"; sid:572320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscadillac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscadillac.com"; sid:572321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbsnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbsnews.com"; sid:572322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cd.com"; sid:572323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschristmasornament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschristmasornament.com"; sid:572324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmichigan.com"; sid:572325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupportcharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupportcharlotte.com"; sid:572326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanuppuntagorda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanuppuntagorda.com"; sid:572327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupsarasota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupsarasota.com"; sid:572328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir-us.com"; sid:572329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultinggroup.com"; sid:572330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounters.net"; sid:572331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19mask.com"; sid:572332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-covid.net"; sid:572333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisiscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisiscenter.com"; sid:572334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseclassaction.com"; sid:572335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruisecompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruisecompensation.com"; sid:572336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseinjury.com"; sid:572337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdell.com"; sid:572338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-details.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-details.com"; sid:572339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdonation.com"; sid:572340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdonations.com"; sid:572341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrugstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrugstore.com"; sid:572342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ds.com"; sid:572343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusegovoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusegovoc.com"; sid:572344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusepidemic.com"; sid:572345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusers.com"; sid:572346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfail.com"; sid:572347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfollower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfollower.com"; sid:572348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcedwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcedwork.com"; sid:572349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreecovid-19.com"; sid:572350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreecovid19.com"; sid:572351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-greece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-greece.com"; sid:572352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguinee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguinee.com"; sid:572353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-headlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-headlines.com"; sid:572354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virushotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virushotline.com"; sid:572355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-informer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-informer.com"; sid:572356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryclaim.com"; sid:572357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsclaims.com"; sid:572358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinternationalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinternationalnews.com"; sid:572359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinuae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinuae.com"; sid:572360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalanswers.com"; sid:572361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalquestions.com"; sid:572362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-legislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-legislation.com"; sid:572363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivedailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivedailyupdates.com"; sid:572364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusluxuryrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusluxuryrealestate.com"; sid:572365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskandsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskandsupply.com"; sid:572366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksandsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksandsupplies.com"; sid:572367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmatters.com"; sid:572368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemoriale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemoriale.com"; sid:572369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichaeldell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichaeldell.com"; sid:572370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmitigate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmitigate.com"; sid:572371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmrsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmrsa.com"; sid:572372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmythbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmythbusters.com"; sid:572373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinemasks.com"; sid:572374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppestore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppestore.net"; sid:572375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusptsd.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusptsd.biz"; sid:572376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponders.com"; sid:572377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreturns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreturns.com"; sid:572378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafework.com"; sid:572379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus--sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus--sd.com"; sid:572380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstemcells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstemcells.com"; sid:572381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstop.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstop.cloud"; sid:572382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-strain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-strain.com"; sid:572383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussubaru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussubaru.com"; sid:572384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyonline.com"; sid:572385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportcenter.com"; sid:572386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportline.com"; sid:572387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvival-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvival-stories.com"; sid:572388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalstory.com"; sid:572389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechhandbok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechhandbok.com"; sid:572390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingtucson.com"; sid:572391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-theofficialstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-theofficialstore.com"; sid:572392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracjer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracjer.com"; sid:572393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrial-signup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrial-signup.com"; sid:572394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunus.com"; sid:572395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusupdate.com"; sid:572396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususatruth.com"; sid:572397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-uv.com"; sid:572398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.biz"; sid:572399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinedrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinedrugs.com"; sid:572400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaxine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaxine.com"; sid:572401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarbond.com"; sid:572402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswin.com"; sid:572403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavizualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavizualizer.com"; sid:572404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavox.com"; sid:572405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawars.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawars.net"; sid:572406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweight.com"; sid:572407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronax19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronax19.biz"; sid:572408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronax.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronax.biz"; sid:572409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazelftesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazelftesten.com"; sid:572410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costcoduringthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costcoduringthecoronavirus.com"; sid:572411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coverallcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coverallcovid.com"; sid:572412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid019.net"; sid:572413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid05.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid05.com"; sid:572414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10tracker.com"; sid:572415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aar.com"; sid:572416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19activities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19activities.com"; sid:572417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aeu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aeu.com"; sid:572418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19americanheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19americanheroes.com"; sid:572419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andlunginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andlunginfo.com"; sid:572420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19angola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19angola.com"; sid:572421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyregistry.com"; sid:572422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyregistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyregistry.net"; sid:572423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibody-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibody-test.com"; sid:572424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestresults.com"; sid:572425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appointment.com"; sid:572426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19asone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19asone.com"; sid:572427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19austria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19austria.com"; sid:572428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azassistance.com"; sid:572429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azhelp.com"; sid:572430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bahrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bahrain.com"; sid:572431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19belgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19belgium.com"; sid:572432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bigquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bigquestions.com"; sid:572433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biocleaning.com"; sid:572434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19born.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19born.com"; sid:572435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brokerofdomains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brokerofdomains.com"; sid:572436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buisness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buisness.com"; sid:572437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessassistance.com"; sid:572438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinsuranceclaim.com"; sid:572439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buy.com"; sid:572440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerprotection.com"; sid:572441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-canada-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-canada-update.com"; sid:572442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19capital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19capital.com"; sid:572443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catalog.com"; sid:572444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catalog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catalog.net"; sid:572445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-channel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-channel.com"; sid:572446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chemical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chemical.com"; sid:572447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chronicles.net"; sid:572448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19circuitbreaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19circuitbreaker.com"; sid:572449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clothing.com"; sid:572450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19conferencecall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19conferencecall.com"; sid:572451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19congo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19congo.com"; sid:572452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corona-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corona-live.com"; sid:572453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusfree.com"; sid:572454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19costumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19costumes.com"; sid:572455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19court.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19court.com"; sid:572456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coveragenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coveragenow.com"; sid:572457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crisis2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crisis2020.com"; sid:572458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisishotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisishotline.com"; sid:572459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19croatia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19croatia.com"; sid:572460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseclassaction.com"; sid:572461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseinjury.com"; sid:572462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19currentinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19currentinfo.com"; sid:572463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19currentnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19currentnews.com"; sid:572464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19curve.com"; sid:572465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19czechia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19czechia.com"; sid:572466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dailyupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dailyupdate.com"; sid:572467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dap.com"; sid:572468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dell.com"; sid:572469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19denmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19denmark.com"; sid:572470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desinfections.com"; sid:572471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detailing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detailing.com"; sid:572472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dickeymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dickeymask.com"; sid:572473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diseaseoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diseaseoutbreak.com"; sid:572474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divorcefaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divorcefaq.com"; sid:572475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dmc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dmc.com"; sid:572476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dnschanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dnschanger.com"; sid:572477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dominicanrepublic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dominicanrepublic.com"; sid:572478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drivethutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drivethutest.com"; sid:572479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dronevideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dronevideo.com"; sid:572480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecom.com"; sid:572481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19electricianrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19electricianrelief.com"; sid:572482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emergencyfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emergencyfunds.com"; sid:572483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyhotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyhotline.com"; sid:572484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employment-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employment-law.com"; sid:572485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19empresa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19empresa.com"; sid:572486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equityresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equityresponse.com"; sid:572487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19era.com"; sid:572488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19estonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19estonia.com"; sid:572489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19europe.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19europe.cloud"; sid:572490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exch.com"; sid:572491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exclusivemember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exclusivemember.com"; sid:572492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fail.com"; sid:572493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fatalities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fatalities.com"; sid:572494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19final.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19final.com"; sid:572495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19finland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19finland.com"; sid:572496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstcheck.com"; sid:572497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstresponder.com"; sid:572498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fitbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fitbody.com"; sid:572499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fits.com"; sid:572500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forcedwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forcedwork.com"; sid:572501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fr.com"; sid:572502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gamenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gamenight.com"; sid:572503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19garagedoorinstallerrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19garagedoorinstallerrelief.com"; sid:572504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-globalstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-globalstatistics.com"; sid:572505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalxyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalxyz.com"; sid:572506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-healthcare.com"; sid:572507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareprovider.com"; sid:572508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareprovider.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareprovider.net"; sid:572509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcentre.com"; sid:572510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthshop.com"; sid:572511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heathdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heathdata.com"; sid:572512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroes.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroes.life"; sid:572513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroes.net"; sid:572514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecarekit.com"; sid:572515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hongkong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hongkong.com"; sid:572516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humanitarians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humanitarians.com"; sid:572517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hvacrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hvacrelief.com"; sid:572518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ideation.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ideation.club"; sid:572519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ideation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ideation.com"; sid:572520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ideation.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ideation.world"; sid:572521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ilaaj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ilaaj.com"; sid:572522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuniteitstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuniteitstest.com"; sid:572523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunization.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunization.net"; sid:572524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiainfo.com"; sid:572525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobsitesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobsitesigns.com"; sid:572526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jordan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jordan.com"; sid:572527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jvion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jvion.com"; sid:572528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keyinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keyinsights.com"; sid:572529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiev.com"; sid:572530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kpolom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kpolom.com"; sid:572531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kuwait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kuwait.com"; sid:572532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kyiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kyiv.com"; sid:572533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborlaws.com"; sid:572534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19landlordissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19landlordissues.com"; sid:572535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lastnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lastnews.com"; sid:572536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latestupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latestupdates.com"; sid:572537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawadvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawadvise.com"; sid:572538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawadvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawadvisers.com"; sid:572539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19layoffshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19layoffshelp.com"; sid:572540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leader.com"; sid:572541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvise.com"; sid:572542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvisers.com"; sid:572543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19library.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19library.net"; sid:572544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19licence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19licence.com"; sid:572545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestat.com"; sid:572546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-livestatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-livestatistics.com"; sid:572547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestatistics.com"; sid:572548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loanprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loanprogram.com"; sid:572549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loanprograms.com"; sid:572550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanprograms.com"; sid:572551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19luxembourg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19luxembourg.com"; sid:572552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mailintest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mailintest.com"; sid:572553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketdata.com"; sid:572554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketeffects.com"; sid:572555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maroc.com"; sid:572556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksareus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksareus.com"; sid:572557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskschina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskschina.com"; sid:572558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19md.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19md.support"; sid:572559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memoriale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memoriale.com"; sid:572560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorialfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorialfund.com"; sid:572561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialfund.com"; sid:572562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19michaeldell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19michaeldell.com"; sid:572563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobile.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobile.net"; sid:572564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monaco.com"; sid:572565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19montreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19montreal.com"; sid:572566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalpandemic.com"; sid:572567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalcure.com"; sid:572568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19negativ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19negativ.com"; sid:572569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-netflix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-netflix.com"; sid:572570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19netherlands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19netherlands.com"; sid:572571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news24.com"; sid:572572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newshq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newshq.com"; sid:572573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.report"; sid:572574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nomore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nomore.net"; sid:572575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19norway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19norway.com"; sid:572576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19novel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19novel.com"; sid:572577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nullnvoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nullnvoid.com"; sid:572578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nursestaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nursestaffing.com"; sid:572579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nyctaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nyctaskforce.com"; sid:572580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ontario.com"; sid:572581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ottawa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ottawa.com"; sid:572582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19palestine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19palestine.com"; sid:572583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandamic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandamic.com"; sid:572584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemic2020.com"; sid:572585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicphotography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicphotography.com"; sid:572586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parodysongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parodysongs.com"; sid:572587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parodyvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parodyvideos.com"; sid:572588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partners.net"; sid:572589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plumberrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plumberrelief.com"; sid:572590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poland.com"; sid:572591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppp.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppp.biz"; sid:572592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivegear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivegear.net"; sid:572593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ptsdhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ptsdhelp.com"; sid:572594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-r0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-r0.com"; sid:572595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestings.com"; sid:572596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realworlddataanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realworlddataanalytics.com"; sid:572597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realworlddataanalytics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realworlddataanalytics.net"; sid:572598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recovery.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recovery.club"; sid:572599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19releiffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19releiffunds.com"; sid:572600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefagent.com"; sid:572601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefcoalition.com"; sid:572602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefnigeria.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefnigeria.biz"; sid:572603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rencontre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rencontre.com"; sid:572604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renterissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renterissues.com"; sid:572605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reparations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reparations.com"; sid:572606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchnews.com"; sid:572607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchnews.net"; sid:572608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ronatees.com"; sid:572609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rsjatim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rsjatim.com"; sid:572610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.biz"; sid:572611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.biz"; sid:572612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyfirst.com"; sid:572613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymall.com"; sid:572614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sale.com"; sid:572615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19saudiarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19saudiarabia.com"; sid:572616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saudiarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saudiarabia.com"; sid:572617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saudi.com"; sid:572618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbaloanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbaloanprograms.com"; sid:572619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaloanprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaloanprograms.com"; sid:572620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sbaprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sbaprograms.com"; sid:572621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbaprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbaprograms.com"; sid:572622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scans.com"; sid:572623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scienceworkgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scienceworkgroup.com"; sid:572624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scienceworkgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scienceworkgroup.com"; sid:572625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scientificworkgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scientificworkgroup.com"; sid:572626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scientificworkgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scientificworkgroup.com"; sid:572627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sd.com"; sid:572628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sd.com"; sid:572629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serbia.com"; sid:572630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shift.com"; sid:572631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shkreli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shkreli.com"; sid:572632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shkreli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shkreli.com"; sid:572633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19singapore.com"; sid:572634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19slovenia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19slovenia.com"; sid:572635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialsecurity.com"; sid:572636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialsecuritydisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialsecuritydisability.com"; sid:572637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialsecurity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialsecurity.net"; sid:572638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidarity.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidarity.fund"; sid:572639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-spray.com"; sid:572640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statslive.com"; sid:572641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stemcells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stemcells.com"; sid:572642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stemcelltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stemcelltherapy.com"; sid:572643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sudan.com"; sid:572644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sultanteofoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sultanteofoman.com"; sid:572645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19support.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19support.club"; sid:572646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supporthub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supporthub.com"; sid:572647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalgo.com"; sid:572648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalratecalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalratecalculator.com"; sid:572649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.sydney"; sid:572650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomsmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomsmap.com"; sid:572651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syria.com"; sid:572652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taiwan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taiwan.com"; sid:572653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-takecarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-takecarekit.com"; sid:572654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19talks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19talks.com"; sid:572655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxadvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxadvise.com"; sid:572656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxadvisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxadvisers.com"; sid:572657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxcreditinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxcreditinfo.com"; sid:572658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testall.com"; sid:572659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdirectory.com"; sid:572660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thenovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thenovel.com"; sid:572661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toutcomprendre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toutcomprendre.com"; sid:572662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19townhall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19townhall.com"; sid:572663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trackerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trackerpro.com"; sid:572664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.report"; sid:572665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracks.com"; sid:572666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trial-signup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trial-signup.com"; sid:572667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trust-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trust-uk.com"; sid:572668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uganda.com"; sid:572669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victory.com"; sid:572670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusbusinessinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusbusinessinterruptionclaim.com"; sid:572671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-free.com"; sid:572672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virushunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virushunter.com"; sid:572673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushunter.com"; sid:572674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virushunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virushunters.com"; sid:572675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushunters.com"; sid:572676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruspandemic2020.com"; sid:572677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workingcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workingcapital.com"; sid:572678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacelaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacelaws.com"; sid:572679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldcrisisorworldhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldcrisisorworldhealing.com"; sid:572680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldoutbreak.com"; sid:572681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldstrong.com"; sid:572682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-worldtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-worldtour.com"; sid:572683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019channel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019channel.com"; sid:572684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020themovie.com"; sid:572685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021.net"; sid:572686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.biz"; sid:572687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2u.com"; sid:572688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-40.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-40.com"; sid:572689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid40.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid40.com"; sid:572690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid69wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid69wear.com"; sid:572691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teen.net"; sid:572692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccountabilityproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccountabilityproject.com"; sid:572693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagentmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagentmodel.com"; sid:572694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaids.com"; sid:572695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidsupporthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidsupporthelp.com"; sid:572696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyprofile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyprofile.com"; sid:572697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapart.com"; sid:572698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappointment.com"; sid:572699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-archive.com"; sid:572700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasanitize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasanitize.com"; sid:572701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidass.com"; sid:572702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidata-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidata-19.com"; sid:572703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidated.com"; sid:572704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidated.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidated.net"; sid:572705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidativa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidativa.com"; sid:572706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneysnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneysnearme.com"; sid:572707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbars.com"; sid:572708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbars.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbars.net"; sid:572709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbda.com"; sid:572710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiocide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiocide.com"; sid:572711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizconnect.com"; sid:572712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooks.com"; sid:572713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooth.com"; sid:572714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecoverycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecoverycenter.com"; sid:572715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecoveryjeffparish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecoveryjeffparish.com"; sid:572716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecoverykenner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecoverykenner.com"; sid:572717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrecoverysela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrecoverysela.com"; sid:572718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.biz"; sid:572719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcadavercarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcadavercarts.com"; sid:572720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregiving.com"; sid:572721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregiving.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregiving.net"; sid:572722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cares.com"; sid:572723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasescanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasescanada.com"; sid:572724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcases.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcases.world"; sid:572725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcauses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcauses.com"; sid:572726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcarecollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcarecollaborative.com"; sid:572727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronical.com"; sid:572728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcircuitbreaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcircuitbreaker.com"; sid:572729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclan.com"; sid:572730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearhire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearhire.com"; sid:572731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcockblock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcockblock.com"; sid:572732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcockpit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcockpit.com"; sid:572733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcohesive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcohesive.com"; sid:572734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollab.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollab.care"; sid:572735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommons.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommons.net"; sid:572736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-concierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-concierge.com"; sid:572737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconformity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconformity.com"; sid:572738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracing.com"; sid:572739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouncil.com"; sid:572740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveragenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveragenow.com"; sid:572741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoversongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoversongs.com"; sid:572742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcpr.com"; sid:572743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreated.com"; sid:572744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisgame.com"; sid:572745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisgame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisgame.net"; sid:572746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crusaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crusaders.com"; sid:572747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crusaders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crusaders.net"; sid:572748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcvd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcvd.com"; sid:572749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcvd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcvd.net"; sid:572750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectionservice.com"; sid:572751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcefaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcefaq.com"; sid:572752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddreams.com"; sid:572753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddvm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddvm.com"; sid:572754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidea.net"; sid:572755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconcierge.com"; sid:572756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocleaning.com"; sid:572757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoservices.com"; sid:572758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideotherapy.com"; sid:572759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepicenter.com"; sid:572760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-escape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-escape.com"; sid:572761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidession.com"; sid:572762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetracking.com"; sid:572763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfedloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfedloans.com"; sid:572764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfile.com"; sid:572765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.finance"; sid:572766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialcure.com"; sid:572767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoodfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoodfund.com"; sid:572768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforcedwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforcedwork.com"; sid:572769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforniture.com"; sid:572770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreaks.com"; sid:572771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriday.com"; sid:572772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgap.com"; sid:572773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgiftcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgiftcards.com"; sid:572774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgolfstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgolfstore.com"; sid:572775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidharyana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidharyana.com"; sid:572776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.guru"; sid:572777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesafe.com"; sid:572778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalist.com"; sid:572779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhtn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhtn.com"; sid:572780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhtn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhtn.net"; sid:572781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhumanity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhumanity.net"; sid:572782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hunters.com"; sid:572783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhustle.com"; sid:572784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianlifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianlifestyle.com"; sid:572785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiaries2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiaries2020.com"; sid:572786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotdistancing.com"; sid:572787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisinfect.com"; sid:572788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisntreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisntreal.com"; sid:572789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjvion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjvion.com"; sid:572790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillers19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillers19.com"; sid:572791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkings.com"; sid:572792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkink.com"; sid:572793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaunch626.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaunch626.com"; sid:572794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaunch.com"; sid:572795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalanswers.com"; sid:572796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalquestions.com"; sid:572797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovestory.com"; sid:572798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.biz"; sid:572799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mcu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mcu.com"; sid:572800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmcu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmcu.com"; sid:572801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.net"; sid:572802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.support"; sid:572803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedisupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedisupply.com"; sid:572804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeerut22.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeerut22.club"; sid:572805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialproducts.com"; sid:572806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobile.com"; sid:572807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonday.com"; sid:572808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneytips.com"; sid:572809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mosquito.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mosquito.com"; sid:572810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmosquito.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmosquito.com"; sid:572811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmosquitos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmosquitos.com"; sid:572812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneartou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneartou.com"; sid:572813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnet.net"; sid:572814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneworleans.com"; sid:572815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewscentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewscentral.com"; sid:572816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsworld.com"; sid:572817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopensource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopensource.com"; sid:572818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanda.com"; sid:572819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpractice.com"; sid:572820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofile.com"; sid:572821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectiveclothmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectiveclothmasks.com"; sid:572822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrating.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrating.biz"; sid:572823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverybatonrouge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverybatonrouge.com"; sid:572824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycenter.com"; sid:572825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryjeffparish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryjeffparish.com"; sid:572826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverylouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverylouisiana.com"; sid:572827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryneworleans.com"; sid:572828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefeffort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefeffort.com"; sid:572829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrencontre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrencontre.com"; sid:572830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreparations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreparations.com"; sid:572831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreporting.com"; sid:572832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistance.net"; sid:572833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistance.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistance.network"; sid:572834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresist.net"; sid:572835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesli.com"; sid:572836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepartners.com"; sid:572837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisk.net"; sid:572838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-russia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-russia.com"; sid:572839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.cloud"; sid:572840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.community"; sid:572841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.company"; sid:572842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeplace.com"; sid:572843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.pro"; sid:572844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepro.com"; sid:572845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafes.com"; sid:572846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.today"; sid:572847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.training"; sid:572848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.world"; sid:572849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationbodyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationbodyshop.com"; sid:572850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationvehicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationvehicle.com"; sid:572851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaturday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaturday.com"; sid:572852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sd.com"; sid:572853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsgear.com"; sid:572854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsgear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsgear.net"; sid:572855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshifa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshifa.com"; sid:572856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidso.com"; sid:572857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsongs.com"; sid:572858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsports.com"; sid:572859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspring.com"; sid:572860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsspcnay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsspcnay.com"; sid:572861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstandards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstandards.com"; sid:572862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstartupkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstartupkit.com"; sid:572863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatscanada.com"; sid:572864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstresshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstresshelp.com"; sid:572865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsubscriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsubscriptions.com"; sid:572866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsunday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsunday.com"; sid:572867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplieshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplieshub.com"; sid:572868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesusa.com"; sid:572869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyshops.com"; sid:572870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplywholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplywholesale.com"; sid:572871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalcalculator.com"; sid:572872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survival-essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survival-essentials.com"; sid:572873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuspect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuspect.com"; sid:572874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtakeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtakeout.com"; sid:572875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalk.net"; sid:572876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtbay.com"; sid:572877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteam.net"; sid:572878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestband.com"; sid:572879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting4u.com"; sid:572880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestorder.com"; sid:572881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresult.com"; sid:572882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthebadgerm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthebadgerm.com"; sid:572883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheory.com"; sid:572884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthursday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthursday.com"; sid:572885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-times.com"; sid:572886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaper.com"; sid:572887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaperexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaperexchange.com"; sid:572888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaperexchange.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaperexchange.net"; sid:572889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaper.net"; sid:572890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaperproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaperproject.com"; sid:572891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoiletpaperproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoiletpaperproject.net"; sid:572892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtownhall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtownhall.com"; sid:572893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracke.com"; sid:572894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackertracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackertracker.com"; sid:572895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackimg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackimg.com"; sid:572896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackong.com"; sid:572897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracling.com"; sid:572898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtradingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtradingco.com"; sid:572899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtradingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtradingcompany.com"; sid:572900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtradinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtradinggroup.com"; sid:572901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsuit.com"; sid:572902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tshirts.com"; sid:572903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtuesday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtuesday.com"; sid:572904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunsubscribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunsubscribe.com"; sid:572905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusadoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusadoctor.com"; sid:572906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusmd.com"; sid:572907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uvc.com"; sid:572908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uv.com"; sid:572909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvconsult.com"; sid:572910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvconsult.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvconsult.net"; sid:572911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideo.net"; sid:572912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviolators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviolators.com"; sid:572913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushealthnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushealthnews.com"; sid:572914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushometest.com"; sid:572915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushunter.com"; sid:572916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushunters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushunters.com"; sid:572917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslife.com"; sid:572918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virusmask.com"; sid:572919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusmasksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusmasksonline.com"; sid:572920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusreparations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusreparations.com"; sid:572921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussupplies.com"; sid:572922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussuppliesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussuppliesonline.com"; sid:572923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualezer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualezer.com"; sid:572924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizor.com"; sid:572925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvmd.com"; sid:572926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteerconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteerconsult.com"; sid:572927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwednesday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwednesday.com"; sid:572928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhispers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhispers.com"; sid:572929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldnews.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldnews.net"; sid:572930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxlab.com"; sid:572931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxrays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxrays.com"; sid:572932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-yul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-yul.com"; sid:572933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcoronatest.com"; sid:572934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuarentenatimecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuarentenatimecovid19.com"; sid:572935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacaocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacaocorona.com"; sid:572936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19together.com"; sid:572937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidnumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidnumbers.com"; sid:572938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailynewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailynewscovid19.com"; sid:572939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datecovidfree.com"; sid:572940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingintheageofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingintheageofcovid-19.com"; sid:572941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysofcovid.com"; sid:572942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysofthecovid.com"; sid:572943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovidga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovidga.com"; sid:572944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dellcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dellcoronavirus.com"; sid:572945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dellcovid19.com"; sid:572946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronaviruscolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronaviruscolombia.com"; sid:572947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for devotedtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"devotedtocovid.com"; sid:572948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariocovid19.com"; sid:572949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dirtycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dirtycorona.com"; sid:572950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ditchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ditchcorona.com"; sid:572951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctordrpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctordrpandemic.com"; sid:572952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for does5gcausecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"does5gcausecoronavirus.com"; sid:572953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doingmypartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doingmypartcovid19.com"; sid:572954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dokterpahlawancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dokterpahlawancovid.com"; sid:572955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaparapandemiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaparapandemiacovid19.com"; sid:572956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaparapandemiacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaparapandemiacovid19.net"; sid:572957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforpandemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforpandemiccovid19.com"; sid:572958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dr-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dr-corona.com"; sid:572959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucovidtesting.com"; sid:572960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dr-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dr-pandemic.com"; sid:572961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthaftercorona.com"; sid:572962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecrancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecrancoronavirus.com"; sid:572963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emscovid19.com"; sid:572964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endthespreadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endthespreadcovid19.com"; sid:572965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enemycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enemycovid-19.com"; sid:572966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enemycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enemycovid19.com"; sid:572967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfermodecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfermodecovid19.com"; sid:572968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfermodecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfermodecovid.com"; sid:572969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfermoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfermoscovid19.com"; sid:572970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfermosdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfermosdecovid19.com"; sid:572971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfermosdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfermosdecovid.com"; sid:572972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccovid-19.com"; sid:572973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccovid19.com"; sid:572974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-stat.com"; sid:572975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicstoday.com"; sid:572976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evo-guide-surviving-a-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evo-guide-surviving-a-pandemic.com"; sid:572977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examcovid19now.com"; sid:572978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exploitationofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exploitationofcovid-19.com"; sid:572979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecovid19.com"; sid:572980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakepandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakepandemic2020.com"; sid:572981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakepandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakepandemic20.com"; sid:572982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcorona.net"; sid:572983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for femacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"femacoronavirus.com"; sid:572984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.cloud"; sid:572985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidnow.com"; sid:572986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidtoday.com"; sid:572987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingbackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingbackcorona.com"; sid:572988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcovid19.net"; sid:572989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fmcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fmcovidhelp.com"; sid:572990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocovid.com"; sid:572991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromcovid.com"; sid:572992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromthecoronacoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromthecoronacoop.com"; sid:572993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckgmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckgmcovid19.com"; sid:572994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckingcovid19.com"; sid:572995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycoronavirusmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycoronavirusmemes.com"; sid:572996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnyday-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnyday-covid.com"; sid:572997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generation-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generation-pandemic.com"; sid:572998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geocovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geocovidapp.com"; sid:572999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcoronamask.com"; sid:573000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronatracker.com"; sid:573001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusplague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusplague.com"; sid:573002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19vaccine.com"; sid:573003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-covid.com"; sid:573004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidfunds.com"; sid:573005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalepidemic.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalepidemic.fund"; sid:573006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.fund"; sid:573007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic.report"; sid:573008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for go-corona-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"go-corona-go.com"; sid:573009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.net"; sid:573010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godhatescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godhatescorona.com"; sid:573011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gofindcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gofindcovid19.com"; sid:573012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gov-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gov-coronavirus.com"; sid:573013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupepeakcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupepeakcovid19.com"; sid:573014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guidelinescovid19.com"; sid:573015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haleyscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haleyscovid.com"; sid:573016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happinesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happinesscorona.com"; sid:573017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hartacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hartacoronavirus.com"; sid:573018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helptrackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helptrackcovid19.com"; sid:573019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpuscorona.com"; sid:573020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbs4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbs4covid.com"; sid:573021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hhs-stopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hhs-stopcovid19.com"; sid:573022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higialimpiezacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higialimpiezacovid19.com"; sid:573023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historiasdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historiasdelcorona.com"; sid:573024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometest4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometest4covid.com"; sid:573025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoisurvivecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoisurvivecorona.com"; sid:573026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobecoronafree.com"; sid:573027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hsscmissioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hsscmissioncovid.com"; sid:573028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntsvillefightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntsvillefightscovid.com"; sid:573029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid19defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid19defense.com"; sid:573030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-hate-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-hate-covid19.com"; sid:573031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19free.com"; sid:573032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19free.net"; sid:573033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inacovid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inacovid19world.com"; sid:573034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidtimes.com"; sid:573035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19cameroon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19cameroon.net"; sid:573036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inocovid.com"; sid:573037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumoscovid19.com"; sid:573038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intheknowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intheknowcovid19.com"; sid:573039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivethecoronavirus.com"; sid:573040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaboncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaboncoronavirus.com"; sid:573041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeffersonparishcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeffersonparishcovidrecovery.com"; sid:573042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovid19.com"; sid:573043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnhopkinscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnhopkinscoronavirus.com"; sid:573044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcoronafacts.com"; sid:573045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovid19.com"; sid:573046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovid19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovid19facts.com"; sid:573047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kilcoronavirus.com"; sid:573048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labusinesscovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labusinesscovidrecovery.com"; sid:573049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-coronavirus.com"; sid:573050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidprodservicenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidprodservicenow.com"; sid:573051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadingthroughcovid.com"; sid:573052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnwithcorona.com"; sid:573053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscovid.com"; sid:573054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidmap.com"; sid:573055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livemusiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livemusiccorona.com"; sid:573056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livincovidaloca.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livincovidaloca.life"; sid:573057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingstoncovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingstoncovid19resources.com"; sid:573058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localbizcovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localbizcovidfunds.com"; sid:573059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lonelycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lonelycorona.com"; sid:573060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loseweightaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loseweightaftercovid.com"; sid:573061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lousianacovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lousianacovidrecovery.com"; sid:573062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecoronatime.com"; sid:573063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofapandemic.com"; sid:573064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luzernecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luzernecovid.com"; sid:573065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascovid19.com"; sid:573066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masantecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masantecovid19.com"; sid:573067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcovidprotection.com"; sid:573068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid.net"; sid:573069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-covid19.com"; sid:573070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materielcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materielcovid19.com"; sid:573071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metairiebusinesscovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metairiebusinesscovidrecovery.com"; sid:573072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meversescovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meversescovid19.biz"; sid:573073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mflocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mflocovid.com"; sid:573074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michaeldellcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michaeldellcoronavirus.com"; sid:573075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michaeldellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michaeldellcovid19.com"; sid:573076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microsoftcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microsoftcoronavirus.com"; sid:573077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mistercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mistercovid-19.com"; sid:573078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronaviruscalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronaviruscalifornia.com"; sid:573079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronavirus.com"; sid:573080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronaviruses.com"; sid:573081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronavirus.net"; sid:573082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monmasquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monmasquecovid.com"; sid:573083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mricoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mricoronatest.com"; sid:573084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mritestforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mritestforcorona.com"; sid:573085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrpandemic.com"; sid:573086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatest.net"; sid:573087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatimes.com"; sid:573088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19help.com"; sid:573089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19help.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19help.net"; sid:573090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19risks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19risks.com"; sid:573091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidea.com"; sid:573092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlifestyle.com"; sid:573093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrisks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrisks.com"; sid:573094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myvitalscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myvitalscovid19.com"; sid:573095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronaviruspandemic.com"; sid:573096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemiccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemiccoronavirus.com"; sid:573097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalpandemicprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalpandemicprotection.com"; sid:573098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needscovid19test.com"; sid:573099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepacovid19.com"; sid:573100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflixcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflixcovid-19.com"; sid:573101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronationresearchinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronationresearchinstitute.com"; sid:573102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscovidbusinessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscovidbusinessrecovery.com"; sid:573103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neworleanscovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neworleanscovidrecovery.com"; sid:573104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngcovid19.com"; sid:573105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid19jobs.com"; sid:573106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no4corona.com"; sid:573107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid2020.com"; sid:573108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidhome.com"; sid:573109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidzone.com"; sid:573110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomocoronavirus.com"; sid:573111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursestaffingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursestaffingcovid-19.com"; sid:573112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirushelp.com"; sid:573113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19help.com"; sid:573114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19legal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19legal.com"; sid:573115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirushelp.com"; sid:573116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruslegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruslegal.com"; sid:573117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19help.com"; sid:573118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19law.com"; sid:573119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid19lawyers.com"; sid:573120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysarcovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysarcovidupdate.com"; sid:573121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oguilhermecaiudebikepegoucoronaemalucocara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oguilhermecaiudebikepegoucoronaemalucocara.com"; sid:573122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponatimethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponatimethecoronavirus.com"; sid:573123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponatimethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponatimethecovid19.com"; sid:573124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onionwarscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onionwarscovid19.com"; sid:573125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinepandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinepandemicsupplies.com"; sid:573126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlytookapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlytookapandemic.com"; sid:573127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opcoronatesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opcoronatesten.com"; sid:573128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidtests.com"; sid:573129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020china.com"; sid:573130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020italy.com"; sid:573131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020newyork.com"; sid:573132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020us.com"; sid:573133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbananas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbananas.com"; sid:573134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicepicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicepicenter.com"; sid:573135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexpenseclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexpenseclaims.com"; sid:573136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexpenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexpenses.com"; sid:573137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflusearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflusearch.com"; sid:573138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfund.net"; sid:573139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicisland.com"; sid:573140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicislands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicislands.com"; sid:573141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjohnny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjohnny.com"; sid:573142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjonny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjonny.com"; sid:573143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclegalhelp.com"; sid:573144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclife.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclife.guide"; sid:573145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmodel.com"; sid:573146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoflovesanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoflovesanjose.com"; sid:573147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplayhaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplayhaus.com"; sid:573148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prepped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prepped.com"; sid:573149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepped.com"; sid:573150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-prepping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-prepping.com"; sid:573151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreppinguk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreppinguk.com"; sid:573152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-priorities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-priorities.com"; sid:573153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpriorities.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpriorities.net"; sid:573154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofitscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofitscenter.com"; sid:573155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.com"; sid:573156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooftradingclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooftradingclub.com"; sid:573157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooftradingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooftradingco.com"; sid:573158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooftradingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooftradingcompany.com"; sid:573159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreimbursementclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreimbursementclaims.com"; sid:573160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-relief.com"; sid:573161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelief.net"; sid:573162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse2020.com"; sid:573163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse2020.net"; sid:573164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.fund"; sid:573165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsefund.com"; sid:573166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetysupplies.com"; sid:573167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskit.com"; sid:573168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskit.net"; sid:573169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolidarity.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolidarity.fund"; sid:573170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolidarityfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolidarityfund.com"; sid:573171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstar.com"; sid:573172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplyshop.com"; sid:573173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-vaccine.com"; sid:573174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvaccine.net"; sid:573175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvaccines.net"; sid:573176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusmask.com"; sid:573177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusmasks.com"; sid:573178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusvaccine.com"; sid:573179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwisdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwisdom.com"; sid:573180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworks.com"; sid:573181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passeportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passeportcoronavirus.com"; sid:573182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcorona.com"; sid:573183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcoronavirus.com"; sid:573184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patentecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patentecovid19.com"; sid:573185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcccovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcccovidupdate.com"; sid:573186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peakgroupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peakgroupcovid19.com"; sid:573187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pegasusforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pegasusforcovid19.com"; sid:573188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pet3thepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pet3thepandemic.com"; sid:573189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pet3thepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pet3thepandemic.net"; sid:573190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycoronavirushelp.com"; sid:573191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycoronaviruslegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycoronaviruslegal.com"; sid:573192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycovid19help.com"; sid:573193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasma4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasma4covid19.com"; sid:573194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasma4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasma4covid19.net"; sid:573195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmadonationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmadonationcovid19.com"; sid:573196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmadonationcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmadonationcovid19.world"; sid:573197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pme-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pme-covid19.com"; sid:573198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poncecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poncecovidrelief.com"; sid:573199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pontelaverdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pontelaverdecovid19.com"; sid:573200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for popayancaucacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"popayancaucacorona.com"; sid:573201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafinance.com"; sid:573202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronainvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronainvesting.com"; sid:573203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19rebootcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19rebootcom.com"; sid:573204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovida.com"; sid:573205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-retail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-retail.com"; sid:573206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic2020.com"; sid:573207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.club"; sid:573208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-pandemic.com"; sid:573209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestiticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestiticoronavirus.com"; sid:573210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presumedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presumedcovid.com"; sid:573211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princetoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princetoncovid.com"; sid:573212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for project-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"project-pandemic.com"; sid:573213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-covid.com"; sid:573214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-covid-19.net"; sid:573215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid-19cdmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid-19cdmx.com"; sid:573216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puppypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puppypandemic.com"; sid:573217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidcheck.com"; sid:573218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitalelacoronaalvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitalelacoronaalvirus.com"; sid:573219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quitalelacoronaalvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quitalelacoronaalvirus.net"; sid:573220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quizcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quizcorona.com"; sid:573221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveredfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveredfromcovid19.com"; sid:573222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reddingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reddingcovid.com"; sid:573223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reframecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reframecovid.com"; sid:573224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relationships-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relationships-covid19.com"; sid:573225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe2covidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe2covidapp.com"; sid:573226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe2covidapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe2covidapp.net"; sid:573227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe-corona.com"; sid:573228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyforcovid19.com"; sid:573229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetymaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetymaskcovid19.com"; sid:573230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salutecovid19heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salutecovid19heros.com"; sid:573231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-coronavirus-liveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-coronavirus-liveupdate.com"; sid:573232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for satgaslawancoronadpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"satgaslawancoronadpr.com"; sid:573233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveworldcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveworldcovid-19.com"; sid:573234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveworldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveworldcovid19.com"; sid:573235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwkgmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwkgmcovid19.com"; sid:573236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scsucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scsucovid19.com"; sid:573237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellinginpandemictimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellinginpandemictimes.com"; sid:573238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for senioralphablogoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"senioralphablogoncovid19.com"; sid:573239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shmcovid.com"; sid:573240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singaporecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singaporecovid.com"; sid:573241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionscovid19.com"; sid:573242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoronabeachswimsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoronabeachswimsuits.com"; sid:573243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoronabeachwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoronabeachwear.com"; sid:573244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffingcovid-19.com"; sid:573245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecovid-19.com"; sid:573246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayupagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayupagainstcorona.com"; sid:573247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcovid.com"; sid:573248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusmali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusmali.com"; sid:573249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusonline.com"; sid:573250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19banten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19banten.com"; sid:573251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.express"; sid:573252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidmask.com"; sid:573253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidonline.com"; sid:573254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidshop.com"; sid:573255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovidiots.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovidiots.net"; sid:573256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strictlycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strictlycovid.com"; sid:573257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suicidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suicidecorona.com"; sid:573258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suprimentoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suprimentoscovid.com"; sid:573259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ted-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ted-covid19.com"; sid:573260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ted-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ted-covid19.net"; sid:573261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.today"; sid:573262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testfamily4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testfamily4covid.com"; sid:573263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcorona.net"; sid:573264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcoronavirusonline.com"; sid:573265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcoronavirus19.com"; sid:573266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testyourselfoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testyourselfoncorona.com"; sid:573267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-guide.com"; sid:573268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapicturebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapicturebook.com"; sid:573269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaprotection.com"; sid:573270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashot.com"; sid:573271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastudy.com"; sid:573272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus-global-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus-global-news.com"; sid:573273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus-news.com"; sid:573274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19trackers.com"; sid:573275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19virus.com"; sid:573276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19virus.net"; sid:573277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidanalytics.com"; sid:573278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbox.com"; sid:573279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgear.com"; sid:573280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiaries.com"; sid:573281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlining.com"; sid:573282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpledge.com"; sid:573283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpledge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpledge.net"; sid:573284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtaskforce.com"; sid:573285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwar.com"; sid:573286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedailycovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedailycovid19virus.com"; sid:573287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedailycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedailycovid.net"; sid:573288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefryingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefryingpandemic.com"; sid:573289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicplayhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicplayhouse.com"; sid:573290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theprojectpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theprojectpandemic.com"; sid:573291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theriseofcovidiocracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theriseofcovidiocracy.com"; sid:573292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcovid19.world"; sid:573293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidattorneys.com"; sid:573294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topianticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topianticorona.com"; sid:573295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topicorona.com"; sid:573296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tralcovid.com"; sid:573297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triacovid.com"; sid:573298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tropicalepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tropicalepidemic.com"; sid:573299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tropicalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tropicalpandemic.com"; sid:573300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trrialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trrialcovid.com"; sid:573301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumppandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumppandemic2020.com"; sid:573302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustcovid.com"; sid:573303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustshmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustshmcovid.com"; sid:573304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turbotaxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turbotaxcoronavirus.com"; sid:573305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufa-covid19.com"; sid:573306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovercovid.com"; sid:573307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unemployedaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unemployedaftercorona.com"; sid:573308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unemploymentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unemploymentcorona.com"; sid:573309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unite2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unite2020pandemic.com"; sid:573310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upstatecovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upstatecovidresources.com"; sid:573311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urbanismocontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urbanismocontracorona.com"; sid:573312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urbanistascontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urbanistascontracorona.com"; sid:573313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19mask.com"; sid:573314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19masks.com"; sid:573315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19tracker.com"; sid:573316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidmask.com"; sid:573317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemicresponsecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemicresponsecenter.com"; sid:573318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemicresponse.com"; sid:573319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationforcovid-19.com"; sid:573320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineforcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineforcovid-19virus.com"; sid:573321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoviruscorona.com"; sid:573322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaincrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaincrecovid19.com"; sid:573323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vente-agri-covid-lacme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vente-agri-covid-lacme.com"; sid:573324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifycovid.com"; sid:573325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimadelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimadelcorona.com"; sid:573326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimofcorona.com"; sid:573327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victoryovercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victoryovercovid-19.com"; sid:573328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronamasks.com"; sid:573329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19mask.com"; sid:573330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19masks.com"; sid:573331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusmaskcovid19.com"; sid:573332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusmaskscovid19.com"; sid:573333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusulcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusulcorona.com"; sid:573334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vizcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vizcovid.com"; sid:573335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtoncovidscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtoncovidscam.com"; sid:573336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waycombatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waycombatecovid.com"; sid:573337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearcovid19mask.com"; sid:573338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearcovid19masks.com"; sid:573339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearethepandemic.com"; sid:573340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whenwillthecoronavirusend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whenwillthecoronavirusend.com"; sid:573341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcovid19getme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcovid19getme.com"; sid:573342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovidthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovidthailand.com"; sid:573343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthecovid19.com"; sid:573344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wnycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wnycovid19.com"; sid:573345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world2020covid19.com"; sid:573346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world2020pandemic.com"; sid:573347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusepidemic.com"; sid:573348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaviruspandemic.com"; sid:573349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldstopcovid-19.com"; sid:573350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldstopcovid19.com"; sid:573351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwithoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwithoutcovid19.com"; sid:573352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpacovidcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpacovidcurve.com"; sid:573353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhannoodle1950.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhannoodle1950.com"; sid:573354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanorganicfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanorganicfood.com"; sid:573355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronaviruscolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronaviruscolombia.com"; sid:573356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtrialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtrialcovid.com"; sid:573357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirus-dsinfection-ncc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirus-dsinfection-ncc.com"; sid:573358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--dsinfection-coronavirus-bcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--dsinfection-coronavirus-bcc.com"; sid:573359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yahoocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yahoocorona.com"; sid:573360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidmask.com"; sid:573361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourhomecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourhomecovidtesting.com"; sid:573362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zithromaxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zithromaxcovid19.com"; sid:573363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19forcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19forcovid19.com"; sid:573364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-19relief.com"; sid:573365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19relief.com"; sid:573366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-19relieftn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-19relieftn.com"; sid:573367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19relieftn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19relieftn.com"; sid:573368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19reliefus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19reliefus.com"; sid:573369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidpandemic.com"; sid:573370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidrelief.com"; sid:573371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpolicy.com"; sid:573372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpolicy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpolicy.net"; sid:573373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020postpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020postpandemic.com"; sid:573374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20minutecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20minutecovid19test.com"; sid:573375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20minutecovidtest.com"; sid:573376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 365coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"365coronavirus.com"; sid:573377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1covidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1covidcleaning.com"; sid:573378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aacorona.com"; sid:573379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcoronavirus.com"; sid:573380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcoronavirustesting.com"; sid:573381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovid19testing.com"; sid:573382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoreclamacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoreclamacionescovid.com"; sid:573383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actanticovid.com"; sid:573384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actanticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actanticovid.net"; sid:573385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actaxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actaxcorona.com"; sid:573386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoptanursecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoptanursecovid.com"; sid:573387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aid-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aid-covid-19.com"; sid:573388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allusacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allusacovid19.com"; sid:573389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alreadyhadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alreadyhadcorona.com"; sid:573390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanpandemic2020.com"; sid:573391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapandemic2020.com"; sid:573392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapostpandemic.com"; sid:573393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amigoingtodieofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amigoingtodieofcoronavirus.com"; sid:573394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analyzecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analyzecovid.com"; sid:573395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ananthologyofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ananthologyofcovid-19.com"; sid:573396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona1.com"; sid:573397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona2.com"; sid:573398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus.farm - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus.farm"; sid:573399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19.cloud"; sid:573400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19.cloud"; sid:573401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpro.com"; sid:573402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-shop.com"; sid:573403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipandemicdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipandemicdesign.com"; sid:573404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprenderdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprenderdecoronavirus.com"; sid:573405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ascovid19.com"; sid:573406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asesorlegalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asesorlegalcovid.com"; sid:573407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcoronavirus.com"; sid:573408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcovid19.com"; sid:573409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackonwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackonwuhan.com"; sid:573410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austinfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austinfightingcovid.com"; sid:573411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austinfightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austinfightscovid.com"; sid:573412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austinfightscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austinfightscovid.net"; sid:573413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudasalquilercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudasalquilercovid19.com"; sid:573414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid.net"; sid:573415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorefightingcovid.com"; sid:573416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorefightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorefightscovid.com"; sid:573417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batch99againstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batch99againstcovid19.com"; sid:573418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcgcovid.com"; sid:573419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronabracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronabracelet.com"; sid:573420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronaooooo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronaooooo.com"; sid:573421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidstrong.com"; sid:573422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beritacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beritacovid.com"; sid:573423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafe-corona.com"; sid:573424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercovidproducts.com"; sid:573425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhopalcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhopalcovidtracker.com"; sid:573426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitchcorona.com"; sid:573427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid.com"; sid:573428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcoronavirus.com"; sid:573429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecoronasunglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecoronasunglasses.com"; sid:573430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bohcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bohcovid.com"; sid:573431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boussignac-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boussignac-covid19.com"; sid:573432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brupharm-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brupharm-covid.com"; sid:573433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bsmpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bsmpandemic.com"; sid:573434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessbeyondcovid.com"; sid:573435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspostpandemic.com"; sid:573436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesswithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesswithcorona.com"; sid:573437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for butseriouslycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"butseriouslycovid19.com"; sid:573438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusmedicalsupplies.com"; sid:573439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19test.com"; sid:573440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidsupplies.com"; sid:573441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buymedicalsuppliesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buymedicalsuppliesforcoronavirus.com"; sid:573442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c-19pandemic.com"; sid:573443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cache-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cache-corona.com"; sid:573444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calltokillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calltokillcoronavirus.com"; sid:573445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calltokillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calltokillcovid19.com"; sid:573446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninesforcovid.com"; sid:573447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisforcovid.com"; sid:573448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for captaincoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"captaincoronado.com"; sid:573449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsforcorona.com"; sid:573450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carplugcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carplugcovid19.com"; sid:573451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscovid-19.com"; sid:573452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpglobalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpglobalpandemic.com"; sid:573453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccppandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccppandemicmemorial.com"; sid:573454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidmask.com"; sid:573455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chagavscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chagavscorona.com"; sid:573456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chagavscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chagavscoronavirus.com"; sid:573457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinamadecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinamadecorona.com"; sid:573458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimedbycorona.com"; sid:573459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanofcovid.com"; sid:573460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cliffordscoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cliffordscoronacleaners.com"; sid:573461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicacovid19.com"; sid:573462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnscoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnscoronavirustesting.com"; sid:573463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnscovid19testing.com"; sid:573464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cohawksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cohawksforcovid19.com"; sid:573465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorsofcovid.com"; sid:573466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloursofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloursofcovid.com"; sid:573467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronaviruss.com"; sid:573468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsensecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsensecovid19.com"; sid:573469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparativecovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparativecovidlaw.com"; sid:573470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontcovid.com"; sid:573471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consciouscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consciouscovid.com"; sid:573472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consciouscovidpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consciouscovidpodcast.com"; sid:573473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contactocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contactocovid19.com"; sid:573474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conteocovidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conteocovidmx.com"; sid:573475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coping-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coping-corona.com"; sid:573476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaroundtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaroundtheworld.com"; sid:573477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattorneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattorneyhelp.com"; sid:573478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabewertungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabewertungen.com"; sid:573479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessattorney.com"; sid:573480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslawyer.com"; sid:573481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business.net"; sid:573482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterfrance.com"; sid:573483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster-shop.com"; sid:573484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustershop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustershop.com"; sid:573485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacantstopus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacantstopus.com"; sid:573486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarclean.com"; sid:573487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacitywise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacitywise.com"; sid:573488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassics.com"; sid:573489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cloth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cloth.com"; sid:573490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-companies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-companies.com"; sid:573491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacopy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacopy.com"; sid:573492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrux.com"; sid:573493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuff.com"; sid:573494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacutz.com"; sid:573495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadark.com"; sid:573496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatenspendeapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatenspendeapp.com"; sid:573497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatenspende.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatenspende.care"; sid:573498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadays2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadays2020.com"; sid:573499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiamond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiamond.com"; sid:573500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-disinfecting.com"; sid:573501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonates.com"; sid:573502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafarma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafarma.net"; sid:573503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafilm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafilm.net"; sid:573504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafins.com"; sid:573505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforpeople.com"; sid:573506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeo.com"; sid:573507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahuisjes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahuisjes.com"; sid:573508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahuisjes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahuisjes.net"; sid:573509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahyper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahyper.com"; sid:573510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahys.com"; sid:573511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahyssteri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahyssteri.com"; sid:573512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahysteri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahysteri.com"; sid:573513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidnow.com"; sid:573514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnederland.com"; sid:573515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruptionattorney.com"; sid:573516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruptionclaim.com"; sid:573517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruptionlawyer.com"; sid:573518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.world"; sid:573519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitz.com"; sid:573520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakontor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakontor.com"; sid:573521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleadgen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleadgen.com"; sid:573522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveresults.com"; sid:573523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivetest.com"; sid:573524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaman2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaman2020.com"; sid:573525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksandgels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksandgels.com"; sid:573526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-med.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-med.care"; sid:573527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamortgageassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamortgageassistance.com"; sid:573528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsreport.com"; sid:573529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-noia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-noia.com"; sid:573530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoffececlean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoffececlean.com"; sid:573531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficeclean.com"; sid:573532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaone19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaone19.com"; sid:573533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaouttahere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaouttahere.com"; sid:573534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemictruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemictruth.com"; sid:573535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapass.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapass.mobi"; sid:573536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapm25mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapm25mask.com"; sid:573537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaposter.com"; sid:573538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectedarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectedarea.com"; sid:573539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquaranteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquaranteen.com"; sid:573540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaratesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaratesonline.com"; sid:573541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecovervirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecovervirus.com"; sid:573542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarens.com"; sid:573543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareparation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareparation.net"; sid:573544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarid.net"; sid:573545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaidno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaidno.com"; sid:573546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascash.com"; sid:573547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschallenge.com"; sid:573548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecretsrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecretsrevealed.com"; sid:573549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashomar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashomar.com"; sid:573550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolo5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolo5k.com"; sid:573551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastats123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastats123.com"; sid:573552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoreclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoreclean.com"; sid:573553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunglasses.com"; sid:573554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatage.com"; sid:573555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcentre.com"; sid:573556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationorganics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationorganics.com"; sid:573557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackeronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackeronline.com"; sid:573558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineregister.com"; sid:573559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virenschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virenschutz.com"; sid:573560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.today"; sid:573561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabbott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabbott.com"; sid:573562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairborne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairborne.com"; sid:573563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandcreativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandcreativity.com"; sid:573564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusbaby.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusbaby.company"; sid:573565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbooth.com"; sid:573566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuildingdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuildingdisinfecting.com"; sid:573567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesslawyers.com"; sid:573568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuymedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuymedicalsupplies.com"; sid:573569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscases.com"; sid:573570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscases.net"; sid:573571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschallenge.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschallenge.club"; sid:573572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultants.net"; sid:573573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-map.com"; sid:573574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminations.com"; sid:573575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdepistage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdepistage.com"; sid:573576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaselive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaselive.com"; sid:573577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaseprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaseprotection.com"; sid:573578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingcleaning.com"; sid:573579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingcompany.com"; sid:573580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionchico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionchico.com"; sid:573581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionredding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionredding.com"; sid:573582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionreno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionreno.com"; sid:573583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionsacramento.com"; sid:573584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionyubacity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionyubacity.com"; sid:573585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusera.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusera.net"; sid:573586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesclaims.com"; sid:573587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirmresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirmresource.com"; sid:573588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgene.com"; sid:573589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrants.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrants.wales"; sid:573590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinformationcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinformationcenters.com"; sid:573591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinlawsuit.com"; sid:573592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinspection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinspection.com"; sid:573593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceattorney.com"; sid:573594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceattorneys.com"; sid:573595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceexperts.com"; sid:573596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancelawfirm.com"; sid:573597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancelawsuit.com"; sid:573598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancelawyers.com"; sid:573599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusla.com"; sid:573600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawexperts.com"; sid:573601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyernewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyernewjersey.com"; sid:573602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerphiladelphia.com"; sid:573603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskandgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskandgloves.com"; sid:573604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-meme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-meme.com"; sid:573605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmerch2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmerch2020.com"; sid:573606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgageassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgageassistance.com"; sid:573607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-naturalcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-naturalcure.com"; sid:573608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newjersey.com"; sid:573609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghome.com"; sid:573610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemia2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemia2020.com"; sid:573611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspeoplecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspeoplecare.com"; sid:573612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetcare.com"; sid:573613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverydance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverydance.com"; sid:573614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverygroup.com"; sid:573615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreliefmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreliefmask.com"; sid:573616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstick.com"; sid:573617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivors-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivors-2020.com"; sid:573618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivors-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivors-2020.net"; sid:573619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustask.com"; sid:573620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxresource.com"; sid:573621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmethods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmethods.com"; sid:573622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingseattle.com"; sid:573623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsite.com"; sid:573624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingwa.com"; sid:573625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tracker.net"; sid:573626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustwitter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustwitter.com"; sid:573627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatesnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatesnow.net"; sid:573628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineillinois.com"; sid:573629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideira.com"; sid:573630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkcomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkcomp.com"; sid:573631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkerscomplaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkerscomplaw.com"; sid:573632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld.cloud"; sid:573633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatcher.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatcher.net"; sid:573634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldalert.com"; sid:573635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoga-hawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoga-hawaii.com"; sid:573636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countycovid19.com"; sid:573637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid01.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid01.com"; sid:573638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020.net"; sid:573639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19about.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19about.net"; sid:573640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19advisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19advisors.com"; sid:573641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19air.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19air.com"; sid:573642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airlift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airlift.com"; sid:573643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-alerte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-alerte.com"; sid:573644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andvn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andvn.com"; sid:573645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anti.com"; sid:573646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19audit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19audit.com"; sid:573647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19authority.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19authority.net"; sid:573648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beskyttet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beskyttet.com"; sid:573649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bibleprophecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bibleprophecy.com"; sid:573650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bond.com"; sid:573651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bonds.com"; sid:573652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19booksource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19booksource.com"; sid:573653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19booth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19booth.com"; sid:573654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-boycott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-boycott.com"; sid:573655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingfogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingfogging.com"; sid:573656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bulgaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bulgaria.com"; sid:573657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionattorney.com"; sid:573658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlawyer.com"; sid:573659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19california.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19california.today"; sid:573660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caregiver.com"; sid:573661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashaid.com"; sid:573662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cash-loan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cash-loan.com"; sid:573663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashloan.com"; sid:573664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cashloans.com"; sid:573665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19champs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19champs.com"; sid:573666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cl.com"; sid:573667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcompanies.com"; sid:573668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cochise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cochise.com"; sid:573669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collaborationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collaborationcenter.com"; sid:573670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleaningservices.com"; sid:573671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-companies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-companies.com"; sid:573672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-companyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-companyreport.com"; sid:573673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companyreport.com"; sid:573674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-companyreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-companyreview.com"; sid:573675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companyreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companyreview.com"; sid:573676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companyreviewer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companyreviewer.com"; sid:573677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companyreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companyreviews.com"; sid:573678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19connection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19connection.com"; sid:573679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-conseil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-conseil.com"; sid:573680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultants.net"; sid:573681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corpreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corpreview.com"; sid:573682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coverup.com"; sid:573683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crewclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crewclaims.com"; sid:573684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curekits.com"; sid:573685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cy.com"; sid:573686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cyprus.com"; sid:573687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datatracker.com"; sid:573688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathsyndrome.com"; sid:573689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathsyndrome.com"; sid:573690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discover.com"; sid:573691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfect.com"; sid:573692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingservices.com"; sid:573693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectioncrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectioncrew.com"; sid:573694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectioncrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectioncrews.com"; sid:573695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectionservices.com"; sid:573696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionteam.com"; sid:573697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionteams.com"; sid:573698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19distress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19distress.com"; sid:573699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donate.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donate.fund"; sid:573700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drs.com"; sid:573701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-drugs.com"; sid:573702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dvm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dvm.com"; sid:573703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencysupply.com"; sid:573704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eviction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eviction.com"; sid:573705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fabricmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fabricmasks.com"; sid:573706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facebookhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facebookhelp.com"; sid:573707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-factsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-factsearch.com"; sid:573708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fever.com"; sid:573709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fever.com"; sid:573710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmvar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmvar.net"; sid:573711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fl.com"; sid:573712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-florida.com"; sid:573713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flukit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flukit.com"; sid:573714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forchange.com"; sid:573715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freeusa.com"; sid:573716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontliner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontliner.com"; sid:573717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fs.com"; sid:573718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gear.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gear.biz"; sid:573719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalpandemic.com"; sid:573720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19glove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19glove.com"; sid:573721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gop.com"; sid:573722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-gov.com"; sid:573723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-govuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-govuk.com"; sid:573724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handssanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handssanitizer.com"; sid:573725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpers.net"; sid:573726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.fund"; sid:573727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homemasks.com"; sid:573728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homemasks.com"; sid:573729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humanitarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humanitarian.com"; sid:573730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igg.com"; sid:573731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iggpos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iggpos.com"; sid:573732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunehelp.com"; sid:573733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indemnizaciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indemnizaciones.com"; sid:573734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informacao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informacao.com"; sid:573735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19informd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19informd.com"; sid:573736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infos.net"; sid:573737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceexperts.com"; sid:573738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19italia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19italia.com"; sid:573739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiddo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiddo.com"; sid:573740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19landlord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19landlord.com"; sid:573741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19landlords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19landlords.com"; sid:573742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lattorney.com"; sid:573743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawaid.com"; sid:573744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawexperts.com"; sid:573745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19league.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19league.com"; sid:573746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalaction.com"; sid:573747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19litigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19litigations.com"; sid:573748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livemapusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livemapusa.com"; sid:573749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19live.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19live.net"; sid:573750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveresults.com"; sid:573751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livestats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livestats.net"; sid:573752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-liveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-liveupdates.com"; sid:573753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-loansassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-loansassist.com"; sid:573754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loans.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loans.today"; sid:573755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19madeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19madeinchina.com"; sid:573756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mask-project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mask-project.com"; sid:573757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medkits.com"; sid:573758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mx.com"; sid:573759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naplesrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naplesrealestate.com"; sid:573760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naplesrealestatereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naplesrealestatereport.com"; sid:573761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newscenter.com"; sid:573762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsdesk.com"; sid:573763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newssite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newssite.com"; sid:573764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newssource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newssource.com"; sid:573765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nfe.com"; sid:573766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nfo.com"; sid:573767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ny.com"; sid:573768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offensive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offensive.com"; sid:573769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outfitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outfitters.com"; sid:573770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemie.net"; sid:573771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pass.com"; sid:573772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paycheckprotectionprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paycheckprotectionprogram.com"; sid:573773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phototherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phototherapy.com"; sid:573774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19playbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19playbook.com"; sid:573775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppe.biz"; sid:573776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19programs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19programs.com"; sid:573777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19programs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19programs.com"; sid:573778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ptsd.com"; sid:573779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ptsd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ptsd.net"; sid:573780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-radio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-radio.com"; sid:573781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19r.com"; sid:573782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rdc.com"; sid:573783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ready.com"; sid:573784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverylawyers.com"; sid:573785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rehabilitation.com"; sid:573786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reimbursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reimbursement.com"; sid:573787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieflawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieflawyer.com"; sid:573788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieftn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieftn.com"; sid:573789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefus.com"; sid:573790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renter.com"; sid:573791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renters.com"; sid:573792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantrescue.com"; sid:573793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-review.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-review.com"; sid:573794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revival.com"; sid:573795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19routine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19routine.com"; sid:573796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19routine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19routine.com"; sid:573797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtls.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtls.world"; sid:573798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.business"; sid:573799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.care"; sid:573800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.clinic"; sid:573801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.club"; sid:573802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.coffee"; sid:573803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.company"; sid:573804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.delivery"; sid:573805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.education"; sid:573806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.events"; sid:573807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.film - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.film"; sid:573808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.fitness"; sid:573809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.healthcare"; sid:573810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.restaurant"; sid:573811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.science"; sid:573812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.services"; sid:573813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.voyage"; sid:573814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saudia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saudia.com"; sid:573815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securedarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securedarea.com"; sid:573816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellerprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellerprotection.com"; sid:573817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s.email"; sid:573818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serve.com"; sid:573819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-services.com"; sid:573820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shame.com"; sid:573821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shame.com"; sid:573822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shitlist.com"; sid:573823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smasks.com"; sid:573824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-statistic.com"; sid:573825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statss.com"; sid:573826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statstracker.com"; sid:573827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stester.com"; sid:573828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stickers.com"; sid:573829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stresscheckhope1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stresscheckhope1.com"; sid:573830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesplus.com"; sid:573831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-survey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-survey.net"; sid:573832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalstore.com"; sid:573833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivors-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivors-2020.com"; sid:573834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivors-2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivors-2020.net"; sid:573835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19systemreset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19systemreset.com"; sid:573836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tagengo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tagengo.com"; sid:573837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techs.com"; sid:573838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tenant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tenant.com"; sid:573839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tenants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tenants.com"; sid:573840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19terminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19terminators.com"; sid:573841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tester.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tester.life"; sid:573842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testimony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testimony.com"; sid:573843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmethods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmethods.com"; sid:573844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingseattle.com"; sid:573845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitweb.com"; sid:573846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testresults.com"; sid:573847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testseattle.com"; sid:573848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststarterkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststarterkit.com"; sid:573849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testwa.com"; sid:573850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19timeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19timeline.com"; sid:573851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-traitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-traitors.com"; sid:573852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelclaims.com"; sid:573853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trending.com"; sid:573854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turmeric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turmeric.com"; sid:573855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updater.com"; sid:573856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19updates.net"; sid:573857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usa.net"; sid:573858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19va4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19va4.com"; sid:573859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccination-injury-settlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccination-injury-settlements.com"; sid:573860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine-settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine-settlement.com"; sid:573861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19v.com"; sid:573862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.expert"; sid:573863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wall.com"; sid:573864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-webinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-webinfo.com"; sid:573865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19websitehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19websitehelp.com"; sid:573866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcompattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcompattorney.com"; sid:573867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcomp.com"; sid:573868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcomp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcomp.net"; sid:573869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerlawsuits.com"; sid:573870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscompattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscompattorney.com"; sid:573871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscomplaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscomplaw.com"; sid:573872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worthynewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worthynewsupdates.com"; sid:573873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zerotolerance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zerotolerance.com"; sid:573874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4test.com"; sid:573875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9mortgageassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9mortgageassistance.com"; sid:573876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactu.com"; sid:573877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaintnojoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaintnojoke.com"; sid:573878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairlift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairlift.com"; sid:573879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaline.com"; sid:573880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalone.com"; sid:573881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanaes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanaes.com"; sid:573882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidausmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidausmap.com"; sid:573883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbigdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbigdata.com"; sid:573884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbigdata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbigdata.net"; sid:573885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptionattorney.com"; sid:573886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptionlawyer.com"; sid:573887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssigns.com"; sid:573888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcahier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcahier.com"; sid:573889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaps.net"; sid:573890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaptives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaptives.com"; sid:573891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareapp.com"; sid:573892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarebd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarebd.com"; sid:573893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarewear.com"; sid:573894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarib.com"; sid:573895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashloan.com"; sid:573896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashloans.com"; sid:573897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidceotoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidceotoolkit.com"; sid:573898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchoir.com"; sid:573899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcide.net"; sid:573900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cm.com"; sid:573901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollaborationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollaborationcenter.com"; sid:573902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-companies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-companies.com"; sid:573903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcept.com"; sid:573904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfess.com"; sid:573905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultants.net"; sid:573906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-contact-tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-contact-tracer.com"; sid:573907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvo.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvo.world"; sid:573908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounters.com"; sid:573909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcount.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcount.today"; sid:573910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovid-19.com"; sid:573911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovid19.com"; sid:573912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrackers.com"; sid:573913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrats.com"; sid:573914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredithelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredithelp.com"; sid:573915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrebuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrebuilding.com"; sid:573916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditrecovery.com"; sid:573917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditsoultions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditsoultions.com"; sid:573918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatahub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatahub.com"; sid:573919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatanow.com"; sid:573920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeal.com"; sid:573921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathsyndrome.com"; sid:573922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diagnostics.com"; sid:573923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiy.com"; sid:573924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19cruiselineclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19cruiselineclaims.com"; sid:573925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19disneycrewclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19disneycrewclaims.com"; sid:573926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepidemiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepidemiology.com"; sid:573927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacecovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacecovers.com"; sid:573928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfied.com"; sid:573929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilms.com"; sid:573930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirmresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirmresource.com"; sid:573931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapartments.com"; sid:573932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeid.com"; sid:573933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontliner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontliner.com"; sid:573934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundinghelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundinghelp.com"; sid:573935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundsupply.com"; sid:573936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.gallery"; sid:573937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamble.com"; sid:573938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgame.net"; sid:573939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalimpact.com"; sid:573940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgone.net"; sid:573941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-graphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-graphs.com"; sid:573942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaircut.com"; sid:573943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhallofshame.com"; sid:573944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhallofshame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhallofshame.net"; sid:573945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp4heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp4heroes.com"; sid:573946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpfl.com"; sid:573947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpsc.com"; sid:573948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesinscrubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesinscrubs.com"; sid:573949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomesolutions.com"; sid:573950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhowto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhowto.com"; sid:573951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhudhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhudhomes.com"; sid:573952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhudhomes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhudhomes.net"; sid:573953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigg.com"; sid:573954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiggpos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiggpos.com"; sid:573955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunestaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunestaff.com"; sid:573956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityid.com"; sid:573957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidine.net"; sid:573958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinne.com"; sid:573959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinne.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinne.net"; sid:573960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidin.net"; sid:573961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceattorneys.com"; sid:573962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawyers.com"; sid:573963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelegal.com"; sid:573964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionattorney.com"; sid:573965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionlawyer.com"; sid:573966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotpresident.com"; sid:573967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorcehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorcehelp.com"; sid:573968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorcelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorcelawyers.com"; sid:573969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorcestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorcestories.com"; sid:573970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorcesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorcesupport.com"; sid:573971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidix9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidix9.com"; sid:573972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidize.com"; sid:573973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkashmir.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkashmir.net"; sid:573974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidklean19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidklean19.com"; sid:573975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitcenter.com"; sid:573976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitguide.com"; sid:573977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlayofflist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlayofflist.com"; sid:573978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-legalclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-legalclaims.com"; sid:573979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlife.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlife.life"; sid:573980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivedata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivedata.net"; sid:573981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlk.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlk.today"; sid:573982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloantracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloantracker.com"; sid:573983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmab.com"; sid:573984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapper.net"; sid:573985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskri.com"; sid:573986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masques.com"; sid:573987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmdcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmdcommunity.com"; sid:573988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsupdates.com"; sid:573989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoral.com"; sid:573990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pass.com"; sid:573991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeak.com"; sid:573992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeoplecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeoplecare.com"; sid:573993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpercent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpercent.com"; sid:573994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpetcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpetcare.com"; sid:573995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonesanitizercom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonesanitizercom.com"; sid:573996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprognosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprognosis.com"; sid:573997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromo.com"; sid:573998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromotion.com"; sid:573999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprophet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprophet.com"; sid:574000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotege.com"; sid:574001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotezioni.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotezioni.cloud"; sid:574002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotezioni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotezioni.com"; sid:574003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidantibodytest.com"; sid:574004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidantibodytesting.com"; sid:574005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapiddirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapiddirect.com"; sid:574006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidkits.com"; sid:574007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtesting.com"; sid:574008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rdf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rdf.com"; sid:574009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycorner.com"; sid:574010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidred.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidred.net"; sid:574011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.cleaning"; sid:574012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsecleaning.com"; sid:574013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantrescue.com"; sid:574014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidri.com"; sid:574015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrigs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrigs.com"; sid:574016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroad.com"; sid:574017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsales.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsales.net"; sid:574018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sb.com"; sid:574019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscan.net"; sid:574020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscenarios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscenarios.com"; sid:574021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.school - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.school"; sid:574022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshielding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshielding.com"; sid:574023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldplus.com"; sid:574024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmelltestchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmelltestchallenge.com"; sid:574025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatus.net"; sid:574026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstick.com"; sid:574027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstills.com"; sid:574028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriesproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriesproject.com"; sid:574029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyco.com"; sid:574030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyfund.com"; sid:574031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplypartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplypartners.com"; sid:574032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgery.com"; sid:574033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuspectpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuspectpro.com"; sid:574034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswab.com"; sid:574035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsystems.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsystems.net"; sid:574036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtainment.com"; sid:574037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxportal.com"; sid:574038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxresource.com"; sid:574039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelecounselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelecounselling.com"; sid:574040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.chat"; sid:574041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingservices.com"; sid:574042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestspots.com"; sid:574043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-theugly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-theugly.com"; sid:574044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheugly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheugly.com"; sid:574045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthuistest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthuistest.net"; sid:574046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidticker.com"; sid:574047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimecapsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimecapsule.com"; sid:574048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtomakeadifference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtomakeadifference.com"; sid:574049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackr.com"; sid:574050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrip.com"; sid:574051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtwostep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtwostep.com"; sid:574052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdatestoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdatestoday.com"; sid:574053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vancouver.com"; sid:574054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-verifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-verifier.com"; sid:574055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverifier.com"; sid:574056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscleaner.com"; sid:574057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoiceover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoiceover.com"; sid:574058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvstrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvstrump.com"; sid:574059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchdogs.com"; sid:574060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchnepal.com"; sid:574061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyoddha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyoddha.com"; sid:574062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createdduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createdduringcorona.com"; sid:574063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cycovid19.com"; sid:574064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronaupdates.com"; sid:574065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallasfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallasfightingcovid.com"; sid:574066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data-covid-19.com"; sid:574067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davidsonfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davidsonfightingcovid.com"; sid:574068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathtocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathtocovid19.com"; sid:574069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-covid.com"; sid:574070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-covider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-covider.com"; sid:574071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deniedcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deniedcoronaclaim.com"; sid:574072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deniedcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deniedcovidclaim.com"; sid:574073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentonfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentonfightingcovid.com"; sid:574074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistagecoronavirus.com"; sid:574075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dercoronavirus.com"; sid:574076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designfightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designfightscovid.com"; sid:574077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitfightingcovid.com"; sid:574078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwfightingcovid.com"; sid:574079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhuafapedulicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhuafapedulicorona.com"; sid:574080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetes-covid19.com"; sid:574081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetescovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetescovidsupport.com"; sid:574082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavethecoronavirusgene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavethecoronavirusgene.com"; sid:574083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthaftercovid.com"; sid:574084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economypostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economypostpandemic.com"; sid:574085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edisonfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edisonfightingcovid.com"; sid:574086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edmontonfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edmontonfightingcovid.com"; sid:574087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcovid-19.com"; sid:574088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endmycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endmycoronavirus.com"; sid:574089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicarc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicarc.com"; sid:574090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicark.com"; sid:574091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicforecaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicforecaster.com"; sid:574092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-tracker.com"; sid:574093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradelcoronavirus.com"; sid:574094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eu2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eu2020covid19.com"; sid:574095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscoronadeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscoronadeaths.com"; sid:574096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscoronavirusdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscoronavirusdeaths.com"; sid:574097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronaresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronaresults.com"; sid:574098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19results.com"; sid:574099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckthecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckthecovidmask.com"; sid:574100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcoronavirusmasks.com"; sid:574101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for felizcovidad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"felizcovidad.com"; sid:574102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-the-corona-waistline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-the-corona-waistline.com"; sid:574103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitpandemic.com"; sid:574104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruslawfirm.com"; sid:574105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogoutcovid.com"; sid:574106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followcovid-19.com"; sid:574107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forgetitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forgetitcovid19.com"; sid:574108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formacioncovid.com"; sid:574109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forumcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forumcovid.com"; sid:574110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxlawsuitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxlawsuitcovid19.com"; sid:574111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxnewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxnewscovid19.com"; sid:574112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foxnewscovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foxnewscovid19lawsuit.com"; sid:574113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free-corona.com"; sid:574114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidfacemasks.com"; sid:574115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidmasks.com"; sid:574116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtherapy.com"; sid:574117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcovid.com"; sid:574118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcovid.net"; sid:574119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freelancingpostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freelancingpostpandemic.com"; sid:574120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendscovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendscovidfund.com"; sid:574121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frontlinersofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frontlinersofcovid19.com"; sid:574122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-u-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-u-coronavirus.com"; sid:574123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid-2020.com"; sid:574124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid2020.com"; sid:574125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundingcovid19research.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundingcovid19research.net"; sid:574126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fxkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fxkcoronavirus.com"; sid:574127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fyicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fyicovid19.com"; sid:574128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gedcoronalaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gedcoronalaw.com"; sid:574129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gedcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gedcovidlaw.com"; sid:574130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronagadgets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronagadgets.com"; sid:574131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidimmune.com"; sid:574132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovid19gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovid19gear.com"; sid:574133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gigworkpostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gigworkpostpandemic.com"; sid:574134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giveforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giveforcovid.com"; sid:574135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaviruslaw.com"; sid:574136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaviruslitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaviruslitigation.com"; sid:574137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicsurvivor.com"; sid:574138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globaltdg-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globaltdg-covid.com"; sid:574139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcovidgame.com"; sid:574140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guaranteedcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guaranteedcovid19free.com"; sid:574141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guaranteedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guaranteedcovidfree.com"; sid:574142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guerrerosentiemposdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guerrerosentiemposdelcoronavirus.com"; sid:574143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healedfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healedfromcovid19.com"; sid:574144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingfromcovid19.com"; sid:574145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid-sale.com"; sid:574146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcovid-19.com"; sid:574147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpforcovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpforcovid19victims.com"; sid:574148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpministries2020covid-19donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpministries2020covid-19donate.com"; sid:574149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpministries2020covid-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpministries2020covid-19help.com"; sid:574150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmmscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmmscovid19.com"; sid:574151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronaresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronaresults.com"; sid:574152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19.com"; sid:574153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19results.com"; sid:574154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid-19test.com"; sid:574155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitforcoronavirus.com"; sid:574156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitforcovid19.com"; sid:574157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitsforcoronavirus.com"; sid:574158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitsforcovid19.com"; sid:574159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hopeintimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hopeintimesofcorona.com"; sid:574160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for housecheckcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"housecheckcovidclean.com"; sid:574161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirusbusinessgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirusbusinessgroup.com"; sid:574162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstonfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstonfightingcovid.com"; sid:574163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i5covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i5covid19.com"; sid:574164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihealedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihealedcoronavirus.com"; sid:574165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihealedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihealedcovid19.com"; sid:574166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickdcorona.com"; sid:574167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickedcorona.com"; sid:574168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickedcovid19.com"; sid:574169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickedcovid.com"; sid:574170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickedcovidsass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickedcovidsass.com"; sid:574171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilovecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilovecoronavirus.com"; sid:574172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for industriavscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"industriavscovid19.com"; sid:574173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for industriavscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"industriavscovid.com"; sid:574174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid-bot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid-bot.com"; sid:574175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcovid19.com"; sid:574176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipswichcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipswichcovid19.com"; sid:574177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcoronastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcoronastats.com"; sid:574178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-corona.net"; sid:574179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19tshirts.com"; sid:574180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid.com"; sid:574181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksonvillefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksonvillefightingcovid.com"; sid:574182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeffersoncovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeffersoncovidstories.com"; sid:574183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jejakcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jejakcovid.com"; sid:574184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jerseycovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jerseycovid19stats.com"; sid:574185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovid19news.com"; sid:574186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kabarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kabarcorona.com"; sid:574187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kissimmeefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kissimmeefightingcovid.com"; sid:574188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitalawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitalawancovid19.com"; sid:574189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knoxvillefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knoxvillefightingcovid.com"; sid:574190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2covidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2covidsupport.com"; sid:574191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19care.com"; sid:574192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidprod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidprod.com"; sid:574193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laeradelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laeradelcoronavirus.com"; sid:574194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lafightingcovid.com"; sid:574195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lastcovid.com"; sid:574196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcovid19fox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcovid19fox.com"; sid:574197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyercoronavirusnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyercoronavirusnewyork.com"; sid:574198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerforcovid19.com"; sid:574199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcovid19.net"; sid:574200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learningfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learningfromcorona.com"; sid:574201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for level2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"level2covid.com"; sid:574202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libecovid.com"; sid:574203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifegoescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifegoescovid19.com"; sid:574204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifegoescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifegoescovid.com"; sid:574205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeincovid19.com"; sid:574206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostpandemic.com"; sid:574207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveticker-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveticker-corona.com"; sid:574208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longbeachfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longbeachfightingcovid.com"; sid:574209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelesfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelesfightingcovid.com"; sid:574210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovepandemic.net"; sid:574211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lucovid19.com"; sid:574212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-corona.com"; sid:574213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapofcovid19.com"; sid:574214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingandcovid.com"; sid:574215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingduringcovid.com"; sid:574216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingincovid.com"; sid:574217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillas-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillas-covid19.com"; sid:574218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasdesechablescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasdesechablescoronavirus.com"; sid:574219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovidfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovidfashion.com"; sid:574220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovidmoda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovidmoda.com"; sid:574221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskthecovid19.com"; sid:574222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-anticovid.com"; sid:574223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-covid-19.com"; sid:574224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-covid-19.com"; sid:574225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maxcovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maxcovidproducts.com"; sid:574226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediacovid-19.com"; sid:574227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalsuppliescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalsuppliescovid19.com"; sid:574228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalsuppliesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalsuppliesforcoronavirus.com"; sid:574229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidassocialescovid19andalucia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidassocialescovid19andalucia.com"; sid:574230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memphisfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memphisfightingcovid.com"; sid:574231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milliondollarpandemiccash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milliondollarpandemiccash.com"; sid:574232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mimcovid.com"; sid:574233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modularcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modularcovid.com"; sid:574234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montclairfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montclairfightingcovid.com"; sid:574235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montgomeryfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montgomeryfightingcovid.com"; sid:574236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montrealfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montrealfightingcovid.com"; sid:574237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moucoronakhaninma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moucoronakhaninma.com"; sid:574238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movetocoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movetocoronado.com"; sid:574239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mscoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mscoronamask.com"; sid:574240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my2020pandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my2020pandemicstory.com"; sid:574241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabuster.com"; sid:574242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-care.com"; sid:574243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadiet.com"; sid:574244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19essentials.com"; sid:574245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcontent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcontent.com"; sid:574246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhub.com"; sid:574247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidiaries.com"; sid:574248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidiary.com"; sid:574249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtest19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtest19.com"; sid:574250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicmemorial.com"; sid:574251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatecovid.com"; sid:574252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcoronavirus.com"; sid:574253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.watch"; sid:574254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidcases.com"; sid:574255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidnewsnow.com"; sid:574256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidprotection.com"; sid:574257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netlixfixcovidurget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netlixfixcovidurget.com"; sid:574258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovideconomy.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovideconomy.biz"; sid:574259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycoronaviruslawyer.com"; sid:574260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.guru"; sid:574261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidnineteen.com"; sid:574262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nosycrowcoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nosycrowcoronavirusbook.com"; sid:574263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for now-castingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"now-castingcovid-19.com"; sid:574264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirus.net"; sid:574265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycfightingcovid.com"; sid:574266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyfightingcovid.com"; sid:574267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nygrantscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nygrantscovid.com"; sid:574268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocfightingcovid.com"; sid:574269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid.com"; sid:574270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid-19.com"; sid:574271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregonfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregonfightingcovid19.com"; sid:574272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandofightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandofightscovid.com"; sid:574273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourtakeoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourtakeoncorona.com"; sid:574274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outruncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outruncovid.com"; sid:574275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overnightcoronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overnightcoronavirusmoney.com"; sid:574276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overnightpandemicmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overnightpandemicmoney.com"; sid:574277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overthrowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overthrowcorona.com"; sid:574278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020covid19.com"; sid:574279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020facts.com"; sid:574280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020impact.com"; sid:574281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020movie.com"; sid:574282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020secrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020secrets.com"; sid:574283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic5g.com"; sid:574284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-attorneys.com"; sid:574285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbirthstoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbirthstoryproject.com"; sid:574286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbirthstoryproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbirthstoryproject.net"; sid:574287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbreak.com"; sid:574288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid-192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid-192020.com"; sid:574289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid-19.net"; sid:574290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdad.com"; sid:574291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicease.com"; sid:574292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergency.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergency.fund"; sid:574293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicesq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicesq.com"; sid:574294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirearms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirearms.com"; sid:574295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemich3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemich3.com"; sid:574296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichaiku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichaiku.com"; sid:574297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvest.com"; sid:574298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestment.com"; sid:574299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickiller.com"; sid:574300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicloan.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicloan.center"; sid:574301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicloans.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicloans.today"; sid:574302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnationalmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnationalmemorial.com"; sid:574303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-party.com"; sid:574304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpicnic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpicnic.com"; sid:574305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpill.com"; sid:574306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolicy2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolicy2020.com"; sid:574307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolicy2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolicy2020.net"; sid:574308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-politics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-politics.com"; sid:574309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpollyanna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpollyanna.com"; sid:574310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionbydesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionbydesign.com"; sid:574311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofclosings.com"; sid:574312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectiongroup.com"; sid:574313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionsupplies.com"; sid:574314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecover.com"; sid:574315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresilience.com"; sid:574316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrv.com"; sid:574317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafeguard.com"; sid:574318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsanitizer.com"; sid:574319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsim.com"; sid:574320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspathmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspathmakers.com"; sid:574321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicterror.com"; sid:574322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictography.com"; sid:574323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoronto.com"; sid:574324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvans.com"; sid:574325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pattersofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pattersofcovid.com"; sid:574326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatriccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatriccovid.com"; sid:574327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatriccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatriccovid.net"; sid:574328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleforcovid19.com"; sid:574329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadephiacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadephiacoronaviruslawyer.com"; sid:574330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadephiacoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadephiacoronaviruslawyers.com"; sid:574331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycovidcleaners.com"; sid:574332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycovidcleaning.com"; sid:574333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillyfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillyfightingcovid.com"; sid:574334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phuckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phuckcovid19.com"; sid:574335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phuckcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phuckcovid19.net"; sid:574336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaciudadanacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaciudadanacovid.com"; sid:574337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portlandfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portlandfightingcovid19.com"; sid:574338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscovid19.com"; sid:574339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19syndrome.com"; sid:574340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbusiness.com"; sid:574341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicdiet.com"; sid:574342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pp-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pp-covid-19.com"; sid:574343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforcovid.com"; sid:574344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevcovid-19.com"; sid:574345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencaocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencaocovid-19.com"; sid:574346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for primepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"primepandemic.com"; sid:574347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promoepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promoepidemic.com"; sid:574348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecovid.net"; sid:574349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivemask-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivemask-corona.com"; sid:574350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionicovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionicovid.cloud"; sid:574351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychrescue-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychrescue-covid19.com"; sid:574352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queercovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queercovidrelief.com"; sid:574353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioncovid.com"; sid:574354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceagainstcoronavirus.com"; sid:574355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdccovid19.com"; sid:574356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebukecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebukecoronavirus.com"; sid:574357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionescovid.com"; sid:574358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for re-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"re-covid-19.com"; sid:574359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for re-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"re-covid.com"; sid:574360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reduringcovid.com"; sid:574361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovidcase.com"; sid:574362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restriccioncovidcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restriccioncovidcr.com"; sid:574363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for richmondfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"richmondfightingcovid.com"; sid:574364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rimborsocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rimborsocoronavirus.com"; sid:574365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rimborsocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rimborsocovid.com"; sid:574366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rochesterfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rochesterfightingcovid.com"; sid:574367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubanblanccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubanblanccovid19.com"; sid:574368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runtostopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runtostopcovid.com"; sid:574369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rvafightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rvafightcovid.com"; sid:574370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rvsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rvsforcovid19.com"; sid:574371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronaseal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronaseal.com"; sid:574372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saltlakecityfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saltlakecityfightingcovid19.com"; sid:574373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saltlakecityfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saltlakecityfightingcovid.com"; sid:574374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saludcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saludcovid19.com"; sid:574375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegofightingcovid.com"; sid:574376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscofightingcovid.com"; sid:574377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for satgaslawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"satgaslawancovid19.com"; sid:574378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savecovidlives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savecovidlives.com"; sid:574379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayno2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayno2covid19.com"; sid:574380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingmynashvillehomeduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingmynashvillehomeduringcovid19.com"; sid:574381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shingatacoronavirusnoarekore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shingatacoronavirusnoarekore.com"; sid:574382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sirirajcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sirirajcovid.com"; sid:574383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slcovidtracker.com"; sid:574384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snfcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snfcovid.com"; sid:574385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sniffoutcovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sniffoutcovidchallenge.com"; sid:574386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobreviviralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobreviviralcovid.com"; sid:574387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalfightingcovid.com"; sid:574388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidarityfundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidarityfundcovid19.com"; sid:574389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovid19.com"; sid:574390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutions-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutions-covid.com"; sid:574391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speakingcovidly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speakingcovidly.com"; sid:574392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standup2corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standup2corona.club"; sid:574393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizecovid.com"; sid:574394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopblackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopblackcovid19.com"; sid:574395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopblackcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopblackcovid19.net"; sid:574396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcocovid.com"; sid:574397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronagate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronagate.com"; sid:574398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19fast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19fast.com"; sid:574399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19forever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19forever.com"; sid:574400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.solutions"; sid:574401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopnegligenciascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopnegligenciascovid19.com"; sid:574402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespread-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespread-covid19.com"; sid:574403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for superbiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"superbiocovid19.com"; sid:574404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survived-2020-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survived-2020-pandemic.com"; sid:574405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survived-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survived-corona.net"; sid:574406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingapandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingapandemic.net"; sid:574407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t2dcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t2dcovid.com"; sid:574408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tallahasseefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tallahasseefightingcovid.com"; sid:574409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tds-vs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tds-vs-covid19.com"; sid:574410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ted-covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ted-covid19.club"; sid:574411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellyourcoronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellyourcoronastory.com"; sid:574412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-kit-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-kit-coronavirus.com"; sid:574413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovids.com"; sid:574414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucovid-19.com"; sid:574415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaco.com"; sid:574416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaguy.com"; sid:574417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronareview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronareview.com"; sid:574418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmuseum.com"; sid:574419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustruth.com"; sid:574420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19museum.com"; sid:574421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19supplies.com"; sid:574422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19supplies.net"; sid:574423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19truth.com"; sid:574424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19truth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19truth.com"; sid:574425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovida.com"; sid:574426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidapocalypse.com"; sid:574427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfund.com"; sid:574428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgamble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgamble.com"; sid:574429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgame.net"; sid:574430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidheroes.com"; sid:574431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpool.com"; sid:574432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidprotect.com"; sid:574433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsupply.com"; sid:574434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtales.com"; sid:574435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theglobalpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theglobalpandemic2020.com"; sid:574436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcovidgame.com"; sid:574437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicmemorial.com"; sid:574438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicparty.com"; sid:574439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicprotocols.com"; sid:574440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemicdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemicdiet.com"; sid:574441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetrumppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetrumppandemic.com"; sid:574442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthbehindcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthbehindcovid19.com"; sid:574443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiendacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiendacovid.com"; sid:574444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tokyocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tokyocoronavirus.com"; sid:574445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tonglawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tonglawancorona.com"; sid:574446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocovid-19.com"; sid:574447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocovid19training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocovid19training.com"; sid:574448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontofightingcovid.com"; sid:574449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for touscontrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"touscontrecovid.com"; sid:574450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trace-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trace-covid.com"; sid:574451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracovid.com"; sid:574452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trend-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trend-covid19.com"; sid:574453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpdidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpdidcorona.com"; sid:574454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-vs-corona-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-vs-corona-2020.com"; sid:574455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpvscovid.com"; sid:574456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcorona.com"; sid:574457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trusted-corona-review.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trusted-corona-review.com"; sid:574458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustedcoronareview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustedcoronareview.com"; sid:574459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcoronapandemic.com"; sid:574460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufealthcovid.com"; sid:574461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhaelthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhaelthcovid.com"; sid:574462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhealthcovidd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhealthcovidd.com"; sid:574463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufhwalthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufhwalthcovid.com"; sid:574464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronanews.com"; sid:574465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronavirusnews.com"; sid:574466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undercovid19.com"; sid:574467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unforgettblecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unforgettblecovid.com"; sid:574468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unionfenosagas-frente-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unionfenosagas-frente-covid19.com"; sid:574469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usafightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usafightingcovid19.com"; sid:574470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaftercovid.com"; sid:574471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usagainstcoronavirus.com"; sid:574472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapostpandemic.com"; sid:574473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahfightingcovid19.com"; sid:574474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uufhealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uufhealthcovid.com"; sid:574475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidrescue.com"; sid:574476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinepandemic.com"; sid:574477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovid19trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovid19trends.com"; sid:574478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaincrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaincrecovid.com"; sid:574479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veterancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veterancovid19.com"; sid:574480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovids19.com"; sid:574481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscoronapack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscoronapack.com"; sid:574482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waronpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waronpandemic.com"; sid:574483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovid19free.com"; sid:574484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidfree.com"; sid:574485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightpandemic.com"; sid:574486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekickedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekickedcorona.com"; sid:574487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcovid19virus.com"; sid:574488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewouldhavelovedtodoaphysicaldastbutcoronavirusfuckeditup.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewouldhavelovedtodoaphysicaldastbutcoronavirusfuckeditup.life"; sid:574489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatthebiblesaysaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatthebiblesaysaboutcovid19.com"; sid:574490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatthecovid.com"; sid:574491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wijwillengeencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wijwillengeencorona.com"; sid:574492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipecovid.com"; sid:574493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcovid-19.com"; sid:574494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workduringcovid.com"; sid:574495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingpostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingpostpandemic.com"; sid:574496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldspandemic.com"; sid:574497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wp-pandemic-theme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wp-pandemic-theme.com"; sid:574498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfishmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfishmarket.com"; sid:574499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangift.com"; sid:574500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhaninstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhaninstitute.com"; sid:574501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjiagu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjiagu.com"; sid:574502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankiller.com"; sid:574503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmicoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmicoe.com"; sid:574504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanspa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanspa.net"; sid:574505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwuhan.com"; sid:574506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcleancovid-19.com"; sid:574507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcleancovid19.com"; sid:574508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronarengring-zqb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronarengring-zqb.com"; sid:574509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yakkoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yakkoscovid.com"; sid:574510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidclean.com"; sid:574511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yubasutterfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yubasutterfightingcovid.com"; sid:574512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yzwuhanmj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yzwuhanmj.com"; sid:574513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18jobstogetbeyondyourcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18jobstogetbeyondyourcoronacrisis.com"; sid:574514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18jobstogetbeyondyourcovid19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18jobstogetbeyondyourcovid19crisis.com"; sid:574515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 18jobstogetbeyondyourcovidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"18jobstogetbeyondyourcovidcrisis.com"; sid:574516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemics.com"; sid:574517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2bcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2bcoronafree.com"; sid:574518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2becoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2becoronafree.com"; sid:574519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2becovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2becovidfree.com"; sid:574520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4coronavirus.biz"; sid:574521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5g-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5g-coronavirus.com"; sid:574522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abncovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abncovidhelp.com"; sid:574523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoalquilercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoalquilercoronavirus.com"; sid:574524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoalquilercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoalquilercovid19.com"; sid:574525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadobancariocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadobancariocoronavirus.com"; sid:574526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadolaboralcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadolaboralcoronavirus.com"; sid:574527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadolaboralcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadolaboralcovid19.com"; sid:574528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acabaconelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acabaconelcoronavirus.com"; sid:574529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acceleratedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acceleratedcovidtesting.com"; sid:574530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscoronavirus.club"; sid:574531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventhealthcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventhealthcoronavirustesting.com"; sid:574532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventhealthcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventhealthcoronavirustests.com"; sid:574533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventhealthcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventhealthcovidtesting.com"; sid:574534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidlife.com"; sid:574535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-the-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-the-corona-virus.com"; sid:574536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aicovid.com"; sid:574537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albanycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albanycovidtracker.com"; sid:574538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for algerie-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"algerie-covid.com"; sid:574539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allo-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allo-covid.com"; sid:574540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allocovid.com"; sid:574541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingscovid19.com"; sid:574542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingscovid.com"; sid:574543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid-19assimalation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid-19assimalation.com"; sid:574544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid19assimalation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid19assimalation.com"; sid:574545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid-19.com"; sid:574546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid19.com"; sid:574547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid-19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid-19experience.com"; sid:574548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid19experience.com"; sid:574549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid-19process.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid-19process.com"; sid:574550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altercovid19process.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altercovid19process.com"; sid:574551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaandcovid19.com"; sid:574552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americastopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americastopcovid-19.com"; sid:574553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anchoragefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anchoragefightingcovid.com"; sid:574554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronabiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronabiotics.com"; sid:574555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronacoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronacoronaclub.com"; sid:574556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-maske.com"; sid:574557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronashield.com"; sid:574558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti--covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti--covid19.com"; sid:574559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-24.com"; sid:574560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcovidclub.com"; sid:574561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anything-but-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anything-but-corona.com"; sid:574562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arubaitaliancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arubaitaliancovid.com"; sid:574563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asianstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asianstopcovid-19.com"; sid:574564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asintomaticoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asintomaticoscovid19.com"; sid:574565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid19tests.com"; sid:574566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacoronavirustest.com"; sid:574567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacoronavirustesting.com"; sid:574568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacoronavirustests.com"; sid:574569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid-19test.com"; sid:574570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19test.com"; sid:574571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid-19testing.com"; sid:574572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19testing.com"; sid:574573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid-19tests.com"; sid:574574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19tests.com"; sid:574575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscovid.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscovid.chat"; sid:574576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aussiecorona.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aussiecorona.chat"; sid:574577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiastopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiastopcovid-19.com"; sid:574578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiastopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiastopcovid19.com"; sid:574579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayolawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayolawancorona.com"; sid:574580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamascoronavirus.com"; sid:574581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bandacoronacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bandacoronacion.com"; sid:574582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barometrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barometrecovid19.com"; sid:574583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareakindnesspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareakindnesspandemic.com"; sid:574584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bb-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bb-covid.com"; sid:574585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona-19.com"; sid:574586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona19.com"; sid:574587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19usa.com"; sid:574588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusn95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusn95mask.com"; sid:574589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19mask.com"; sid:574590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besthandsanitizerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besthandsanitizerforcoronavirus.com"; sid:574591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovidcrisis.com"; sid:574592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocoronavirus.com"; sid:574593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidfacts.com"; sid:574594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blacksagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blacksagainstcovid19.com"; sid:574595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcovid-19.com"; sid:574596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boostcovid19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boostcovid19-recovery.com"; sid:574597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boostcovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boostcovid19recovery.com"; sid:574598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid19academicsup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid19academicsup.com"; sid:574599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19vaccine.com"; sid:574600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19vaccine.com"; sid:574601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-bye-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-bye-corona.club"; sid:574602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-bye-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-bye-corona.com"; sid:574603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidtest.com"; sid:574604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidtesting.com"; sid:574605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calgaryfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calgaryfightingcovid.com"; sid:574606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirustesting.com"; sid:574607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirustests.com"; sid:574608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19test.com"; sid:574609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19test.com"; sid:574610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19testing.com"; sid:574611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19testing.com"; sid:574612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19tests.com"; sid:574613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19tests.com"; sid:574614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caminocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caminocovid.com"; sid:574615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidppe.com"; sid:574616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadianpandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadianpandemicsupply.com"; sid:574617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcovid.biz"; sid:574618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbd4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbd4covid19.com"; sid:574619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdforcovid19.com"; sid:574620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cellexcovidtestafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cellexcovidtestafrica.com"; sid:574621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for censocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"censocovid-19.com"; sid:574622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncoronavirustest.com"; sid:574623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncoronavirustesting.com"; sid:574624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncoronavirustests.com"; sid:574625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid-19test.com"; sid:574626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid19test.com"; sid:574627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid-19testing.com"; sid:574628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid19testing.com"; sid:574629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid-19tests.com"; sid:574630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charlestoncovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charlestoncovid19tests.com"; sid:574631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasingcovid19.com"; sid:574632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasingcovid.com"; sid:574633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid19status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid19status.com"; sid:574634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronavirustest.com"; sid:574635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronavirustesting.com"; sid:574636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronavirustests.com"; sid:574637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19test.com"; sid:574638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19test.com"; sid:574639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19testing.com"; sid:574640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19testing.com"; sid:574641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid-19tests.com"; sid:574642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19tests.com"; sid:574643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chirosvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chirosvscovid19.com"; sid:574644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for civilianscoronacorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"civilianscoronacorps.com"; sid:574645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claims4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claims4corona.com"; sid:574646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimscoronavirus.com"; sid:574647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearofcovid19.com"; sid:574648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickcorona.com"; sid:574649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cochran-covidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cochran-covidhelp.com"; sid:574650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronatesting.com"; sid:574651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscoronavirustest.com"; sid:574652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscoronavirustesting.com"; sid:574653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscoronavirustests.com"; sid:574654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid-19test.com"; sid:574655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid19test.com"; sid:574656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid-19testing.com"; sid:574657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid19testing.com"; sid:574658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid-19tests.com"; sid:574659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovid19tests.com"; sid:574660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronavirus19.com"; sid:574661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidcare.com"; sid:574662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19health.com"; sid:574663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19security.com"; sid:574664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.life"; sid:574665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaffect.com"; sid:574666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabacklog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabacklog.com"; sid:574667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bd.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bd.world"; sid:574668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiotics.com"; sid:574669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablaraby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablaraby.com"; sid:574670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-block.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-block.com"; sid:574671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrainstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrainstorm.com"; sid:574672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-consulting.com"; sid:574673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabypass.com"; sid:574674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaptives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaptives.com"; sid:574675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarolers.com"; sid:574676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachrysalis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachrysalis.com"; sid:574677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanfree.com"; sid:574678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedychallenge.com"; sid:574679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensator.com"; sid:574680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsults.com"; sid:574681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacordycep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacordycep.com"; sid:574682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacourts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacourts.com"; sid:574683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cov19.com"; sid:574684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreditrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreditrelief.com"; sid:574685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadenier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadenier.com"; sid:574686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadenierflier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadenierflier.com"; sid:574687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadenierflyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadenierflyer.com"; sid:574688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesintox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesintox.com"; sid:574689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detox.com"; sid:574690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadhona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadhona.com"; sid:574691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadidntkillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadidntkillme.com"; sid:574692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectiontunnel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectiontunnel.com"; sid:574693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectiontunnels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectiontunnels.com"; sid:574694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomanagementpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomanagementpartners.com"; sid:574695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopacificsothebys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopacificsothebys.com"; sid:574696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelectrician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelectrician.com"; sid:574697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecleaning.com"; sid:574698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagezond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagezond.com"; sid:574699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahcq.com"; sid:574700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelphand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelphand.com"; sid:574701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-herbs.com"; sid:574702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheronews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheronews.com"; sid:574703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomegyms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomegyms.com"; sid:574704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahygene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahygene.com"; sid:574705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaizle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaizle.com"; sid:574706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuriste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuriste.com"; sid:574707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarten.com"; sid:574708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakathe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakathe.com"; sid:574709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakn95.com"; sid:574710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyerco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyerco.com"; sid:574711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyercolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyercolorado.com"; sid:574712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaldn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaldn.com"; sid:574713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronality.com"; sid:574714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-logo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-logo.com"; sid:574715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamanchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamanchester.com"; sid:574716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaroc.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaroc.life"; sid:574717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskfactory.com"; sid:574718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksforsale.com"; sid:574719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksusa.com"; sid:574720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamcr.com"; sid:574721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuseum.com"; sid:574722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneverforgotten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneverforgotten.com"; sid:574723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewyorkcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewyorkcount.com"; sid:574724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronannihilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronannihilation.com"; sid:574725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotforgotten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotforgotten.com"; sid:574726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficecheck.com"; sid:574727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoriginal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoriginal.com"; sid:574728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparikshan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparikshan.com"; sid:574729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse-now.com"; sid:574730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofshop.com"; sid:574731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectivesystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectivesystems.com"; sid:574732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantineromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantineromance.com"; sid:574733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquilla.com"; sid:574734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarahat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarahat.com"; sid:574735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarakshak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarakshak.com"; sid:574736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarchivos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarchivos.com"; sid:574737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregs.com"; sid:574738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregulations.com"; sid:574739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremedie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremedie.com"; sid:574740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzkleidung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzkleidung.com"; sid:574741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecuredarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecuredarea.com"; sid:574742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiblings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiblings.com"; sid:574743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiren.com"; sid:574744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sougi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sougi.com"; sid:574745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasougi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasougi.com"; sid:574746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatusbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatusbd.com"; sid:574747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterigel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterigel.com"; sid:574748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-story.com"; sid:574749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastorymall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastorymall.com"; sid:574750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplysource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplysource.com"; sid:574751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivortees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivortees.com"; sid:574752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcentrenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcentrenewyork.com"; sid:574753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcentreny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcentreny.com"; sid:574754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnewyork.com"; sid:574755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatif.com"; sid:574756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatigers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatigers.com"; sid:574757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimes.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimes.biz"; sid:574758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trump.com"; sid:574759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcomedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcomedies.com"; sid:574760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcomedy.com"; sid:574761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcomedyfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcomedyfest.com"; sid:574762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-verband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-verband.com"; sid:574763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverband.com"; sid:574764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverite.com"; sid:574765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.cloud"; sid:574766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalmanac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalmanac.com"; sid:574767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodiestesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodiestesting.com"; sid:574768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarab.com"; sid:574769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawakening.com"; sid:574770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbasilicata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbasilicata.com"; sid:574771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-breathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-breathing.com"; sid:574772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaims.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaims.group"; sid:574773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsservice.com"; sid:574774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningltd.com"; sid:574775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensation.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensation.legal"; sid:574776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensator.com"; sid:574777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-ppe.com"; sid:574778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19ppe.com"; sid:574779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeceasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeceasecure.com"; sid:574780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdenier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdenier.com"; sid:574781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorces.com"; sid:574782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorcesct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorcesct.com"; sid:574783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdraincleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdraincleaning.com"; sid:574784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrainclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrainclearance.com"; sid:574785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenfrance.com"; sid:574786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinds.com"; sid:574787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoundationforkenya2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoundationforkenya2.com"; sid:574788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoundationforkenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoundationforkenya.com"; sid:574789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundsaccountablility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundsaccountablility.com"; sid:574790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguilty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguilty.com"; sid:574791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanitizer2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanitizer2020.com"; sid:574792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushistory2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushistory2020.com"; sid:574793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeresource.com"; sid:574794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotnews.com"; sid:574795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjersey.com"; sid:574796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-karta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-karta.com"; sid:574797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslacity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslacity.com"; sid:574798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitfund.com"; sid:574799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitfunding.com"; sid:574800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitsettlement.com"; sid:574801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitsettlements.com"; sid:574802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalfund.com"; sid:574803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalfunding.com"; sid:574804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsettlement.com"; sid:574805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalsettlements.com"; sid:574806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivecount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivecount.com"; sid:574807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloansuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloansuk.com"; sid:574808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmap24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmap24.com"; sid:574809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksandgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksandgloves.com"; sid:574810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonolugues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonolugues.com"; sid:574811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusngo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusngo.com"; sid:574812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinetests.com"; sid:574813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusphotos.com"; sid:574814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspivot.com"; sid:574815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplasmacanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplasmacanada.com"; sid:574816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspuzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspuzzles.com"; sid:574817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquitam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquitam.com"; sid:574818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquizonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquizonline.com"; sid:574819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryhandbook.com"; sid:574820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremovalbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremovalbaltimore.com"; sid:574821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safemask.com"; sid:574822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettlementfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettlementfunding.com"; sid:574823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoldiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoldiers.com"; sid:574824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockphotos.com"; sid:574825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivor2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivor2020.com"; sid:574826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingantibodies.com"; sid:574827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustribute.com"; sid:574828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunmasked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunmasked.com"; sid:574829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdategoogle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdategoogle.com"; sid:574830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateonline.com"; sid:574831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusverified.com"; sid:574832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavstories.com"; sid:574833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavstory.com"; sid:574834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhustoblame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhustoblame.com"; sid:574835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wirtschaftskrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wirtschaftskrise.com"; sid:574836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldmeters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldmeters.com"; sid:574837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxix.com"; sid:574838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveredthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveredthrucovid.com"; sid:574839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-019.com"; sid:574840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-64.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-64.com"; sid:574841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accordwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accordwarrior.com"; sid:574842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anonyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anonyme.com"; sid:574843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ao.com"; sid:574844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ards.com"; sid:574845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19armed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19armed.com"; sid:574846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneyfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneyfirst.com"; sid:574847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyfirst.com"; sid:574848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19authority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19authority.com"; sid:574849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-az.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-az.com"; sid:574850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bcs.com"; sid:574851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bikinticuh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bikinticuh.com"; sid:574852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blocker.com"; sid:574853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessadvisorygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessadvisorygroup.com"; sid:574854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessadvisorygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessadvisorygroup.com"; sid:574855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinsurance.com"; sid:574856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caribbean.com"; sid:574857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-catastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-catastrophe.com"; sid:574858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-catastrophe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-catastrophe.com"; sid:574859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certificate.com"; sid:574860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checkin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checkin.com"; sid:574861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsconsultants.com"; sid:574862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimshelp.com"; sid:574863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanups.com"; sid:574864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clips.com"; sid:574865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closedmybusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closedmybusiness.com"; sid:574866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coaches.com"; sid:574867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-co.com"; sid:574868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlpr.com"; sid:574869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19copd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19copd.com"; sid:574870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corp.com"; sid:574871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coverageattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coverageattorneys.com"; sid:574872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coveragelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coveragelawyers.com"; sid:574873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditexpert.com"; sid:574874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditexpertwitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditexpertwitness.com"; sid:574875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cyberthreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cyberthreats.com"; sid:574876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datos.com"; sid:574877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19day.com"; sid:574878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deceasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deceasecure.com"; sid:574879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19denier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19denier.com"; sid:574880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19didnotgetme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19didnotgetme.com"; sid:574881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disasterhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disasterhelp.com"; sid:574882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-divorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-divorce.com"; sid:574883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-donation.com"; sid:574884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-donations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-donations.com"; sid:574885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-donations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-donations.com"; sid:574886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtreatment.com"; sid:574887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elsalvado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elsalvado.com"; sid:574888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergenciamipymes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergenciamipymes.com"; sid:574889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19endup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19endup.com"; sid:574890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-face-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-face-mask.com"; sid:574891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-face-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-face-mask.com"; sid:574892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-face-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-face-masks.com"; sid:574893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-face-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-face-masks.com"; sid:574894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosurehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosurehelp.com"; sid:574895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freecertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freecertification.com"; sid:574896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ganas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ganas.com"; sid:574897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19geomodeller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19geomodeller.com"; sid:574898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gm.com"; sid:574899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19golfcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19golfcoach.com"; sid:574900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19health.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19health.world"; sid:574901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpinglawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpinglawyer.com"; sid:574902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpinglawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpinglawyer.com"; sid:574903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroesmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroesmuseum.com"; sid:574904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesmuseum.com"; sid:574905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeadvisors.com"; sid:574906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homehelp.com"; sid:574907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hour.com"; sid:574908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hour.com"; sid:574909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hurtmybusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hurtmybusiness.com"; sid:574910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infonews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infonews.com"; sid:574911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infonews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infonews.com"; sid:574912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innovationhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innovationhub.com"; sid:574913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19innovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19innovations.com"; sid:574914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-inoculation.com"; sid:574915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceattorney.com"; sid:574916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancecoverage.com"; sid:574917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancecoverage.com"; sid:574918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancedispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancedispute.com"; sid:574919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investors.com"; sid:574920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-jobs.com"; sid:574921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kariadebasvuruyap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kariadebasvuruyap.com"; sid:574922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kartiadebasvuruyap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kartiadebasvuruyap.com"; sid:574923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kitforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kitforall.com"; sid:574924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kn95facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kn95facemasks.com"; sid:574925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kupwara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kupwara.com"; sid:574926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawnow.com"; sid:574927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawnow.com"; sid:574928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitfund.com"; sid:574929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitfunding.com"; sid:574930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitsettlements.com"; sid:574931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lease.com"; sid:574932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalfund.com"; sid:574933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalfunding.com"; sid:574934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalhelpnow.com"; sid:574935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalhelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalhelpnow.com"; sid:574936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalsettlement.com"; sid:574937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalsettlements.com"; sid:574938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legislation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legislation.com"; sid:574939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loansuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loansuk.com"; sid:574940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19local.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19local.services"; sid:574941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19magazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19magazine.com"; sid:574942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskforsale.com"; sid:574943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalconcerns.com"; sid:574944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalgear.com"; sid:574945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalproblems.com"; sid:574946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meetup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meetup.com"; sid:574947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneyhelp.com"; sid:574948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortgagehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortgagehelp.com"; sid:574949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musicmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musicmap.com"; sid:574950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mustknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mustknow.com"; sid:574951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mustknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mustknow.com"; sid:574952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19neverforgotten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19neverforgotten.com"; sid:574953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19new.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19new.com"; sid:574954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newspaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newspaper.com"; sid:574955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nm.com"; sid:574956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nomore.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nomore.biz"; sid:574957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19northcyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19northcyprus.com"; sid:574958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notforgotten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notforgotten.com"; sid:574959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19number.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19number.today"; sid:574960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nycomplaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nycomplaw.com"; sid:574961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19observer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19observer.com"; sid:574962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obzor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obzor.com"; sid:574963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ok.com"; sid:574964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinetests.com"; sid:574965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personal.com"; sid:574966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personals.com"; sid:574967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pr.com"; sid:574968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prod.com"; sid:574969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19property.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19property.com"; sid:574970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19questionnaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19questionnaire.com"; sid:574971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-questions.com"; sid:574972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quizonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quizonline.com"; sid:574973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidkits.com"; sid:574974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtests.com"; sid:574975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtesttoday.com"; sid:574976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reagents.com"; sid:574977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryadvice.com"; sid:574978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoveryhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoveryhandbook.com"; sid:574979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryhelp.com"; sid:574980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recoverysuggestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recoverysuggestions.com"; sid:574981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverysupport.com"; sid:574982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-release.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-release.com"; sid:574983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefrights.com"; sid:574984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rental.com"; sid:574985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19representation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19representation.com"; sid:574986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19representation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19representation.com"; sid:574987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-resourcehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-resourcehelp.com"; sid:574988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcehelp.com"; sid:574989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ribbon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ribbon.com"; sid:574990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19romance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19romance.com"; sid:574991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtls.com"; sid:574992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rule.com"; sid:574993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rule.com"; sid:574994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rxcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rxcure.com"; sid:574995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-saudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-saudi.com"; sid:574996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19screens.com"; sid:574997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19se.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19se.com"; sid:574998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellyourhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellyourhome.com"; sid:574999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlementfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlementfunding.com"; sid:575000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shareyourstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shareyourstories.com"; sid:575001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19souvenirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19souvenirs.com"; sid:575002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19squad.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19squad.biz"; sid:575003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stimulus.com"; sid:575004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19streetview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19streetview.com"; sid:575005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19success.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19success.com"; sid:575006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suite.com"; sid:575007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survior.com"; sid:575008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survival-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survival-kit.com"; sid:575009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testforyou.com"; sid:575010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testing-kit.com"; sid:575011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing-kit.com"; sid:575012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testing-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testing-kits.com"; sid:575013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing-kits.com"; sid:575014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkit.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkit.solutions"; sid:575015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkit.today"; sid:575016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkit.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkit.tools"; sid:575017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlosangeles.com"; sid:575018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnewyork.com"; sid:575019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsonline.com"; sid:575020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtracker.com"; sid:575021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thegame.com"; sid:575022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tk.com"; sid:575023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerr.com"; sid:575024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentspro.com"; sid:575025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tx.com"; sid:575026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unitedkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unitedkingdom.com"; sid:575027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upchaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upchaar.com"; sid:575028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ut.com"; sid:575029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimsmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimsmemorial.com"; sid:575030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscures.com"; sid:575031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warmonument.com"; sid:575032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19watch.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19watch.life"; sid:575033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19weddingchapel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19weddingchapel.com"; sid:575034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weddingchapel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weddingchapel.com"; sid:575035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellcare.com"; sid:575036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wizard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wizard.com"; sid:575037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019antibodies.com"; sid:575038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.care"; sid:575039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019supplies.com"; sid:575040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019supply.com"; sid:575041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20-inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20-inoculation.com"; sid:575042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-inoculation.com"; sid:575043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20inoculation.com"; sid:575044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4-0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4-0.com"; sid:575045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4800.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4800.com"; sid:575046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4president.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4president.com"; sid:575047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-86.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-86.com"; sid:575048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachella.com"; sid:575049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid19.com"; sid:575050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid2021.com"; sid:575051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidboise.com"; sid:575052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalimony-ct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalimony-ct.com"; sid:575053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalimonyct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalimonyct.com"; sid:575054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandmentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandmentalhealth.com"; sid:575055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodiestesting4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodiestesting4u.com"; sid:575056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodiestesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodiestesting.com"; sid:575057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantiibodypositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantiibodypositive.com"; sid:575058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarena.com"; sid:575059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreaker.com"; sid:575060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalchallenge.com"; sid:575061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareersupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareersupport.com"; sid:575062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarestore.com"; sid:575063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarolers.com"; sid:575064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcash19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcash19.com"; sid:575065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashflowchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashflowchallenge.com"; sid:575066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcave.com"; sid:575067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-charts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-charts.com"; sid:575068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchellalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchellalive.com"; sid:575069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcareillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcareillinois.com"; sid:575070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcarenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcarenewyork.com"; sid:575071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcareny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcareny.com"; sid:575072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildcarewashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildcarewashington.com"; sid:575073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildsupportct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildsupportct.com"; sid:575074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchrysalis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchrysalis.com"; sid:575075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchurchresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchurchresources.com"; sid:575076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcionario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcionario.com"; sid:575077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimdenied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimdenied.com"; sid:575078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimeconomicsettlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimeconomicsettlementfund.com"; sid:575079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimfund.com"; sid:575080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimfundhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimfundhelp.com"; sid:575081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimhelp.com"; sid:575082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimprep.com"; sid:575083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsconsultants.com"; sid:575084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsettlement.com"; sid:575085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimshelp.com"; sid:575086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsprep.com"; sid:575087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaw.com"; sid:575088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanair.com"; sid:575089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanfree.com"; sid:575090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clean-up.com"; sid:575091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclimate.com"; sid:575092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicregistration.com"; sid:575093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclip.com"; sid:575094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothingcompany.com"; sid:575095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coach.com"; sid:575096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoin.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoin.agency"; sid:575097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoin.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoin.club"; sid:575098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoin.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoin.company"; sid:575099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombinator.com"; sid:575100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercials.com"; sid:575101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensationny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensationny.com"; sid:575102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplaw.com"; sid:575103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstitution.com"; sid:575104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-control.com"; sid:575105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookies.com"; sid:575106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopd.com"; sid:575107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopy.com"; sid:575108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostmemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostmemoney.com"; sid:575109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouch.com"; sid:575110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouchrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouchrn.com"; sid:575111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourts.com"; sid:575112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coverage.com"; sid:575113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveredcouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveredcouture.com"; sid:575114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisrelief.com"; sid:575115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcup.com"; sid:575116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure19vaccine.com"; sid:575117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustody-ct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustody-ct.com"; sid:575118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustodyct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustodyct.com"; sid:575119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailytracker.com"; sid:575120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenials.com"; sid:575121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenier.com"; sid:575122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenierflier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenierflier.com"; sid:575123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenierflyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenierflyer.com"; sid:575124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-detection.com"; sid:575125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveup.com"; sid:575126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideath.com"; sid:575127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideducationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideducationfund.com"; sid:575128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidens.com"; sid:575129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidest.com"; sid:575130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideyefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideyefacts.com"; sid:575131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactcenter.com"; sid:575132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsforall.com"; sid:575133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyfun.com"; sid:575134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfestival2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfestival2021.com"; sid:575135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-flu-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-flu-help.com"; sid:575136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeandme.com"; sid:575137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcareppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcareppe.com"; sid:575138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpforall.com"; sid:575139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.foundation"; sid:575140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhms.com"; sid:575141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax2020.com"; sid:575142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousecall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousecall.com"; sid:575143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousecalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousecalls.com"; sid:575144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiagnosticenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiagnosticenter.com"; sid:575145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiagnostichub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiagnostichub.com"; sid:575146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiagnosticscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiagnosticscenter.com"; sid:575147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiagnosticshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiagnosticshub.com"; sid:575148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiels.com"; sid:575149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immemory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immemory.com"; sid:575150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityproject.com"; sid:575151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinblue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinblue.com"; sid:575152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia.life"; sid:575153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiamap.com"; sid:575154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-inoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-inoculation.com"; sid:575155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinoculation.com"; sid:575156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinslaw.com"; sid:575157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisolationgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisolationgames.com"; sid:575158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorce-ct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorce-ct.com"; sid:575159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorcect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorcect.com"; sid:575160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidized.com"; sid:575161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobsusa.com"; sid:575162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjusticeteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjusticeteam.com"; sid:575163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkart.com"; sid:575164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillernyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillernyc.com"; sid:575165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillersnyc.com"; sid:575166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkombat.com"; sid:575167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkpi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkpi.com"; sid:575168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawnow.com"; sid:575169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuit-il.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuit-il.com"; sid:575170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalnow.com"; sid:575171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeshop.com"; sid:575172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivecount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivecount.com"; sid:575173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivetweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivetweets.com"; sid:575174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliveupdate.com"; sid:575175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloandoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloandoc.com"; sid:575176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmama.com"; sid:575177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmamas.com"; sid:575178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascherine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascherine.com"; sid:575179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskforsale.com"; sid:575180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalhub.com"; sid:575181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessyboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessyboy.com"; sid:575182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmexiconoticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmexiconoticias.com"; sid:575183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilelabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilelabs.com"; sid:575184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidms.com"; sid:575185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmustknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmustknow.com"; sid:575186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninememe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninememe.com"; sid:575187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursejobs.com"; sid:575188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidokr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidokr.com"; sid:575189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopirin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopirin.com"; sid:575190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidozono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidozono.com"; sid:575191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanik.com"; sid:575192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-passkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-passkey.com"; sid:575193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientdata.com"; sid:575194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpg.com"; sid:575195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphuket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphuket.com"; sid:575196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppehealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppehealthcare.com"; sid:575197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppehelp.com"; sid:575198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppeproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppeproject.com"; sid:575199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesupply.com"; sid:575200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproc.com"; sid:575201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsych.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsych.com"; sid:575202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpt.com"; sid:575203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreader.com"; sid:575204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealdata.com"; sid:575205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecon.com"; sid:575206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-record.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-record.com"; sid:575207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverytesting4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverytesting4u.com"; sid:575208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregistry.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregistry.world"; sid:575209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-release.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-release.com"; sid:575210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefalabama.com"; sid:575211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreport2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreport2020.com"; sid:575212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchub.com"; sid:575213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rid.com"; sid:575214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrncouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrncouch.com"; sid:575215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrtls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrtls.com"; sid:575216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrtls.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrtls.world"; sid:575217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrule.com"; sid:575218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafephonecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafephonecase.com"; sid:575219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepractice.com"; sid:575220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesalon.com"; sid:575221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.healthcare"; sid:575222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanjivani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanjivani.com"; sid:575223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sante.com"; sid:575224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreened.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreened.com"; sid:575225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsdg.finance - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsdg.finance"; sid:575226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurit.com"; sid:575227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsiperlik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsiperlik.com"; sid:575228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-statinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-statinfo.com"; sid:575229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstat.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstat.today"; sid:575230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstockphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstockphotos.com"; sid:575231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrong2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrong2020.com"; sid:575232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudios.com"; sid:575233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplycompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplycompany.com"; sid:575234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplysource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplysource.com"; sid:575235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tag.com"; sid:575236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtag.com"; sid:575237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaking.com"; sid:575238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtakinglawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtakinglawyer.com"; sid:575239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalent.com"; sid:575240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalents.com"; sid:575241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting4antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting4antibodies.com"; sid:575242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingca.com"; sid:575243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingforantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingforantibodies.com"; sid:575244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtelehealth.com"; sid:575245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-kits.com"; sid:575246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttracker.com"; sid:575247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtp.com"; sid:575248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerng.com"; sid:575249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackeronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackeronline.com"; sid:575250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-training.com"; sid:575251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrash.com"; sid:575252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmenthub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmenthub.com"; sid:575253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtribunal.com"; sid:575254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidturning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidturning.com"; sid:575255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtweetslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtweetslive.com"; sid:575256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviducation.com"; sid:575257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidversusflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidversusflu.com"; sid:575258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussupply.com"; sid:575259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustracker.com"; sid:575260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vs-trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vs-trump.com"; sid:575261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashing.com"; sid:575262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwave.com"; sid:575263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingchapel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingchapel.com"; sid:575264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddinghelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddinghelper.com"; sid:575265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwfmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwfmonitor.com"; sid:575266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwms.com"; sid:575267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkforcemonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkforcemonitoring.com"; sid:575268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkhealth.com"; sid:575269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacesafety.com"; sid:575270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyodha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyodha.com"; sid:575271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyouandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyouandme.com"; sid:575272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createforcovid.com"; sid:575273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crmcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crmcovidhelp.com"; sid:575274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubacoronachannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubacoronachannel.com"; sid:575275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubingawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubingawaycorona.com"; sid:575276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curut-covid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curut-covid20.com"; sid:575277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvacovid19.com"; sid:575278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcoronamask.com"; sid:575279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcorona-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcorona-masks.com"; sid:575280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacoronavirus.com"; sid:575281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacovid-19.com"; sid:575282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid-19test.com"; sid:575283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid19test.com"; sid:575284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid-19testing.com"; sid:575285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovid-19tests.com"; sid:575286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dawnofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dawnofthecorona.com"; sid:575287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ddecoronabudget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ddecoronabudget.com"; sid:575288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandasporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandasporcoronavirus.com"; sid:575289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demandasporcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demandasporcovid19.com"; sid:575290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirustest.com"; sid:575291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirustesting.com"; sid:575292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirustests.com"; sid:575293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid-19test.com"; sid:575294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19test.com"; sid:575295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid-19testing.com"; sid:575296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19testing.com"; sid:575297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid-19tests.com"; sid:575298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid19tests.com"; sid:575299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designforcovid.com"; sid:575300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronavirustest.com"; sid:575301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronavirustesting.com"; sid:575302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronavirustests.com"; sid:575303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid-19test.com"; sid:575304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid19test.com"; sid:575305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid-19testing.com"; sid:575306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid19testing.com"; sid:575307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid-19tests.com"; sid:575308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovid19tests.com"; sid:575309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfezionecovid.com"; sid:575310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divisoricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divisoricovid.com"; sid:575311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diyversuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diyversuscovid.com"; sid:575312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dubacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dubacovid-19.com"; sid:575313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dxcovid.com"; sid:575314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecuadorsincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecuadorsincovid.com"; sid:575315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronaenchile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronaenchile.com"; sid:575316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for email-covidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"email-covidmd.com"; sid:575317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enactcovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enactcovid-19recovery.com"; sid:575318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enactcovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enactcovid19recovery.com"; sid:575319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encouragecovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encouragecovid-19recovery.com"; sid:575320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encouragecovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encouragecovid19recovery.com"; sid:575321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19.company"; sid:575322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ending-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ending-covid-19.com"; sid:575323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enhancecovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enhancecovid-19recovery.com"; sid:575324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enhancecovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enhancecovid19recovery.com"; sid:575325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ennisfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ennisfightingcovid.com"; sid:575326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enparacovid19.com"; sid:575327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entrenaencasacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entrenaencasacoronavirus.com"; sid:575328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemia-covid19.com"; sid:575329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotectionkit.com"; sid:575330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eraantipandemica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eraantipandemica.com"; sid:575331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurostopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurostopcovid-19.com"; sid:575332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evenhatershatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evenhatershatecoronavirus.com"; sid:575333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitcoronavirus.com"; sid:575334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for experiencecovid-19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"experiencecovid-19-recovery.com"; sid:575335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for experiencecovid19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"experiencecovid19-recovery.com"; sid:575336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for face-masks-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"face-masks-coronavirus.com"; sid:575337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsofcovid19.com"; sid:575338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familycoronagroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familycoronagroup.com"; sid:575339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronavirustesting.com"; sid:575340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronavirustests.com"; sid:575341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid-19testing.com"; sid:575342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19testing.com"; sid:575343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovidmask.com"; sid:575344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fidelizarenunmundocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fidelizarenunmundocovid.com"; sid:575345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-against-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-against-coronavirus.com"; sid:575346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19lawyers.com"; sid:575347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponderscoronalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponderscoronalawsuit.com"; sid:575348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponderscoronalawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponderscoronalawsuits.com"; sid:575349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponderscovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponderscovidlawsuit.com"; sid:575350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstresponderscovidlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstresponderscovidlawsuits.com"; sid:575351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitfordutyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitfordutyaftercovid19.com"; sid:575352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-covid19claim.com"; sid:575353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19claim.com"; sid:575354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-covid19claims.com"; sid:575355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-covid19.com"; sid:575356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-covid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-covid19insuranceclaim.com"; sid:575357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19insuranceclaim.com"; sid:575358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19insuranceclaims.com"; sid:575359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidtesting.com"; sid:575360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacare4covidcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacare4covidcc.com"; sid:575361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacare4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacare4covid.com"; sid:575362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacare4covidequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacare4covidequipment.com"; sid:575363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacare4covidequipmentmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacare4covidequipmentmanager.com"; sid:575364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacare4covidsm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacare4covidsm.com"; sid:575365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirustest.com"; sid:575366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirustesting.com"; sid:575367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirustests.com"; sid:575368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-covid19claim.com"; sid:575369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-covid19claims.com"; sid:575370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-covid19.com"; sid:575371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-covid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-covid19insuranceclaim.com"; sid:575372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19insuranceclaim.com"; sid:575373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for florida-covid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"florida-covid19insuranceclaims.com"; sid:575374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19test.com"; sid:575375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19test.com"; sid:575376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19testing.com"; sid:575377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19testing.com"; sid:575378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid-19tests.com"; sid:575379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19tests.com"; sid:575380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidclaim.com"; sid:575381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidinsuranceclaimcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidinsuranceclaimcom.com"; sid:575382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodwithlovecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodwithlovecovid19.com"; sid:575383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortifycovid-19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortifycovid-19-recovery.com"; sid:575384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortifycovid19-recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortifycovid19-recovery.com"; sid:575385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthfightingcovid.com"; sid:575386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19vaccine.com"; sid:575387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19vaccine.com"; sid:575388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freseniuskabi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freseniuskabi-covid19.com"; sid:575389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frompandemic2purpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frompandemic2purpose.com"; sid:575390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frompandemictopurpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frompandemictopurpose.com"; sid:575391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucorona.club"; sid:575392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.club"; sid:575393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncontracoronavirus.com"; sid:575394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ga-covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ga-covid19claim.com"; sid:575395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19claim.com"; sid:575396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ga-covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ga-covid19claims.com"; sid:575397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19claims.com"; sid:575398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ga-covid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ga-covid19insuranceclaim.com"; sid:575399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19insuranceclaim.com"; sid:575400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ga-covid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ga-covid19insuranceclaims.com"; sid:575401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19insuranceclaims.com"; sid:575402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gainesvillecovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gainesvillecovidlawyers.com"; sid:575403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamepandemic.com"; sid:575404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearforcorona.com"; sid:575405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gelcovid.com"; sid:575406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geligienizzantecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geligienizzantecovid.com"; sid:575407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationcorona2020.com"; sid:575408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgia-covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgia-covid19claim.com"; sid:575409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19claim.com"; sid:575410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19claims.com"; sid:575411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgia-covid19.com"; sid:575412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgia-covid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgia-covid19insuranceclaim.com"; sid:575413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19insuranceclaim.com"; sid:575414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgia-covid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgia-covid19insuranceclaims.com"; sid:575415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19insuranceclaims.com"; sid:575416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreadyforcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreadyforcovid20.com"; sid:575417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirustreatment.com"; sid:575418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidhub.com"; sid:575419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemickits.com"; sid:575420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gobeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gobeyondcovid.com"; sid:575421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godstopcovid-19.com"; sid:575422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goovcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goovcovid19.com"; sid:575423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goovcovid19remboursement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goovcovid19remboursement.com"; sid:575424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grantspassfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grantspassfightingcovid.com"; sid:575425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemicpaint-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemicpaint-in.com"; sid:575426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemicpaintin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemicpaintin.com"; sid:575427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grievingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grievingcovid.com"; sid:575428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcoronavirusfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcoronavirusfast.com"; sid:575429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herosofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herosofcovid19.com"; sid:575430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidays-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidays-after-corona.com"; sid:575431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidaysaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidaysaftercorona.com"; sid:575432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidays-after-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidays-after-covid-19.com"; sid:575433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homesafehomecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homesafehomecovidrelief.com"; sid:575434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostingcorona.com"; sid:575435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronacleaners.com"; sid:575436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovid19clean.com"; sid:575437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovid19cleaning.com"; sid:575438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovid19.com"; sid:575439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovid19services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovid19services.com"; sid:575440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidcleaners.com"; sid:575441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirustest.com"; sid:575442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirustesting.com"; sid:575443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirustests.com"; sid:575444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19test.com"; sid:575445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19test.com"; sid:575446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19testing.com"; sid:575447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid-19tests.com"; sid:575448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoes5gcausecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoes5gcausecoronavirus.com"; sid:575449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howlongcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howlongcovid.com"; sid:575450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcoronavirus-19.com"; sid:575451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcoronavirus19.com"; sid:575452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcovid-19.com"; sid:575453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcovid19.com"; sid:575454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hurtbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hurtbycovid19.com"; sid:575455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid19.club"; sid:575456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icastcovid19.com"; sid:575457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahofightingcovid.com"; sid:575458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ificorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ificorona.com"; sid:575459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifuckedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifuckedcorona.com"; sid:575460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifuckedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifuckedcovid19.com"; sid:575461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igienizzanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igienizzanticovid.com"; sid:575462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickedcovid-19.com"; sid:575463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impressioncovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impressioncovid2019.com"; sid:575464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionesporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionesporcoronavirus.com"; sid:575465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovid19tests.com"; sid:575466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmemoryofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmemoryofcovid19.com"; sid:575467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmemoryofcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmemoryofcovid19.life"; sid:575468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for integrativecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"integrativecovid-19.com"; sid:575469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for integrativecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"integrativecovid.com"; sid:575470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ircovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ircovidtest.com"; sid:575471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedepidemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedepidemicof2020.com"; sid:575472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobcovid19.com"; sid:575473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovid.com"; sid:575474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jordancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jordancovid19.com"; sid:575475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jordancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jordancovid.com"; sid:575476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntosfrentealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntosfrentealcoronavirus.com"; sid:575477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcovidout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcovidout.com"; sid:575478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kulinerbebascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kulinerbebascorona.com"; sid:575479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronavirustest.com"; sid:575480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronavirustesting.com"; sid:575481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronavirustests.com"; sid:575482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid-19test.com"; sid:575483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19test.com"; sid:575484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid-19testing.com"; sid:575485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19testing.com"; sid:575486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid-19tests.com"; sid:575487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19tests.com"; sid:575488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestpandemicnews.com"; sid:575489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laureacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laureacovid.com"; sid:575490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcoronavirus19.com"; sid:575491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lets-beat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lets-beat-covid19.com"; sid:575492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscurecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscurecovid.com"; sid:575493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lets-stop-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lets-stop-covid19.com"; sid:575494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsstopcovid.com"; sid:575495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for licovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"licovid19law.com"; sid:575496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeyondcovid.com"; sid:575497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveinthetimeofcorona.com"; sid:575498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingbeyondcovid.com"; sid:575499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescoronavirustest.com"; sid:575500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescoronavirustesting.com"; sid:575501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescoronavirustests.com"; sid:575502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid-19test.com"; sid:575503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid19test.com"; sid:575504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid-19testing.com"; sid:575505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid19testing.com"; sid:575506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid-19tests.com"; sid:575507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losangelescovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losangelescovid19tests.com"; sid:575508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona2020.com"; sid:575509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loyaltypostcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loyaltypostcoronaworld.com"; sid:575510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvfightingcovid.com"; sid:575511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maba3d-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maba3d-corona.com"; sid:575512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maba3dcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maba3dcorona.com"; sid:575513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidtesting.com"; sid:575514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-of-coronavirus.com"; sid:575515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascara-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascara-covid19.com"; sid:575516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascheracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascheracovid.com"; sid:575517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid.biz"; sid:575518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherineigienizzanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherineigienizzanticovid.com"; sid:575519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherineprotezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherineprotezionecovid.com"; sid:575520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-pour-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-pour-coronavirus.com"; sid:575521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matancovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matancovid19response.com"; sid:575522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for melatonina-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"melatonina-corona.com"; sid:575523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memepandemic.com"; sid:575524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicovid-19-promocionexclusio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicovid-19-promocionexclusio.com"; sid:575525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miacovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miacovidsitters.com"; sid:575526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirustest.com"; sid:575527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicoronavirustests.com"; sid:575528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid-19test.com"; sid:575529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19test.com"; sid:575530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid-19testing.com"; sid:575531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19testing.com"; sid:575532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid-19tests.com"; sid:575533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovid19tests.com"; sid:575534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milpitasfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milpitasfightingcovid19.com"; sid:575535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milpitasfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milpitasfightingcovid.com"; sid:575536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcoronavirus.biz"; sid:575537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mon-masque-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mon-masque-covid19.com"; sid:575538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mpfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mpfightscorona.com"; sid:575539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museodelcoronavirus.com"; sid:575540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumofcovid-19.com"; sid:575541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumofcovid19.com"; sid:575542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumofcovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumofcovid-19heroes.com"; sid:575543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mvhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mvhcovid.com"; sid:575544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronastories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronastories.com"; sid:575545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatime.com"; sid:575546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavstory.com"; sid:575547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19claim.com"; sid:575548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19insuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19insuranceclaim.com"; sid:575549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19testclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19testclub.com"; sid:575550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcard.com"; sid:575551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19.com"; sid:575552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalantibioticsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalantibioticsforcovid-19.com"; sid:575553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalantibioticsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalantibioticsforcovid19.com"; sid:575554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalremediesforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalremediesforcovid-19.com"; sid:575555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalremediesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalremediesforcovid19.com"; sid:575556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19tester.com"; sid:575557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid2019.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid2019.today"; sid:575558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid2019.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid2019.world"; sid:575559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidjobs.com"; sid:575560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemics.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemics.bid"; sid:575561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycoronavirustest.com"; sid:575562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycoronavirustesting.com"; sid:575563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycoronavirustests.com"; sid:575564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid-19test.com"; sid:575565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid19test.com"; sid:575566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid-19testing.com"; sid:575567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid19testing.com"; sid:575568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid-19tests.com"; sid:575569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitycovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitycovid19tests.com"; sid:575570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirustest.com"; sid:575571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirustesting.com"; sid:575572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavirustests.com"; sid:575573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid-19test.com"; sid:575574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19test.com"; sid:575575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid-19testing.com"; sid:575576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19testing.com"; sid:575577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid-19tests.com"; sid:575578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19tests.com"; sid:575579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextcovid.com"; sid:575580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcovidcare.com"; sid:575581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhfightingcovid.com"; sid:575582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.world"; sid:575583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for non-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"non-coronavirus.com"; sid:575584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northkoreancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northkoreancorona.com"; sid:575585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecoronalawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecoronalawsuit.com"; sid:575586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecoronalawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecoronalawsuits.com"; sid:575587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovidlawsuit.com"; sid:575588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovidlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovidlawsuits.com"; sid:575589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19connect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19connect.com"; sid:575590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidcompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidcompensation.com"; sid:575591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidtesting.com"; sid:575592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nystopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nystopcovid-19.com"; sid:575593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid19testing.com"; sid:575594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for odt-covid19togo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"odt-covid19togo.com"; sid:575595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for optumcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"optumcovid.com"; sid:575596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocoronavirustest.com"; sid:575597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocoronavirustesting.com"; sid:575598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocoronavirustests.com"; sid:575599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid-19test.com"; sid:575600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid19test.com"; sid:575601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid-19testing.com"; sid:575602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid19testing.com"; sid:575603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid-19tests.com"; sid:575604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid19tests.com"; sid:575605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovidtesting.com"; sid:575606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcoronavirustesting.com"; sid:575607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcoronavirustests.com"; sid:575608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid-19testing.com"; sid:575609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid19testing.com"; sid:575610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid-19tests.com"; sid:575611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outdoorcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outdoorcovid19tests.com"; sid:575612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcome-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcome-covid19.com"; sid:575613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocovid.com"; sid:575614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paloaltofightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paloaltofightingcovid19.com"; sid:575615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paloaltofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paloaltofightingcovid.com"; sid:575616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2purpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2purpose.com"; sid:575617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic3dprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic3dprint.com"; sid:575618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic3dprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic3dprinting.com"; sid:575619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadviser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadviser.com"; sid:575620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicartist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicartist.com"; sid:575621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemications.com"; sid:575622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbooklet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbooklet.com"; sid:575623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessrelief.com"; sid:575624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccorovavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccorovavirus.com"; sid:575625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid-20.com"; sid:575626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccreditexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccreditexpert.com"; sid:575627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeniers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeniers.com"; sid:575628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdme.com"; sid:575629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyresponsetools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyresponsetools.com"; sid:575630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexpertwitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexpertwitness.com"; sid:575631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-fallout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-fallout.com"; sid:575632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfog.com"; sid:575633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichaircuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichaircuts.com"; sid:575634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinnovators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinnovators.com"; sid:575635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnomore.com"; sid:575636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-nurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-nurse.com"; sid:575637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicof2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicof2021.com"; sid:575638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofgoodnessandkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofgoodnessandkindness.com"; sid:575639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofgoodness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofgoodness.com"; sid:575640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofkindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofkindness.com"; sid:575641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicorovavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicorovavirus.com"; sid:575642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicovid-19.com"; sid:575643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpayments.com"; sid:575644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperimeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperimeter.com"; sid:575645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpowergrab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpowergrab.com"; sid:575646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprocessing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprocessing.com"; sid:575647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofit.com"; sid:575648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooftech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooftech.com"; sid:575649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpropertyenclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpropertyenclosures.com"; sid:575650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpurpose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpurpose.com"; sid:575651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicslogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicslogistics.com"; sid:575652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalactivities.com"; sid:575653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalpack.com"; sid:575654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalpacks.com"; sid:575655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechportal.com"; sid:575656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthreats.com"; sid:575657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perucovidmapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perucovidmapa.com"; sid:575658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacoronavirustest.com"; sid:575659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacoronavirustesting.com"; sid:575660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacoronavirustests.com"; sid:575661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid-19test.com"; sid:575662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19test.com"; sid:575663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid-19testing.com"; sid:575664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19testing.com"; sid:575665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid-19tests.com"; sid:575666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19tests.com"; sid:575667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiafightingcovid.com"; sid:575668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playvscovid.com"; sid:575669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiglasscoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiglasscoronashield.com"; sid:575670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiglasscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiglasscovid.com"; sid:575671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for politics-of-pandemic-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"politics-of-pandemic-s.com"; sid:575672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for politicsofpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"politicsofpandemics.com"; sid:575673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona-economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona-economy.com"; sid:575674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaoffice.com"; sid:575675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicparenting.com"; sid:575676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpath.com"; sid:575677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid.life"; sid:575678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premierpandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premierpandemickits.com"; sid:575679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19today.com"; sid:575680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventioncovid.com"; sid:575681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecovidtesting.com"; sid:575682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for professionalsagainstcovid19everywhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"professionalsagainstcovid19everywhere.com"; sid:575683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prosepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prosepandemic.com"; sid:575684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovida.com"; sid:575685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionparaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionparaelcoronavirus.com"; sid:575686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for putacrossincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"putacrossincovid.com"; sid:575687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronavirustesting.com"; sid:575688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronavirustests.com"; sid:575689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid-19test.com"; sid:575690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19testing.com"; sid:575691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtesting.com"; sid:575692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rallycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rallycovid-19.com"; sid:575693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rallycovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rallycovid19recovery.com"; sid:575694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcityfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcityfightingcovid.com"; sid:575695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19screen.com"; sid:575696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19vaccine.com"; sid:575697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtestafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtestafrica.com"; sid:575698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidfightingcovid.com"; sid:575699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapid-test-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapid-test-covid.com"; sid:575700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recessioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recessioncoronavirus.com"; sid:575701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionescovid19.com"; sid:575702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcoronavirus-19.com"; sid:575703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcoronavirus19.com"; sid:575704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoverfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoverfromcovid-19.com"; sid:575705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinventyourbusinesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinventyourbusinesscovid19.com"; sid:575706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reisen-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reisen-nach-corona.com"; sid:575707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reisennachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reisennachcorona.com"; sid:575708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingvictimsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingvictimsofcovid19.com"; sid:575709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restorecovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restorecovid-19recovery.com"; sid:575710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restorecovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restorecovid19recovery.com"; sid:575711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rexburgfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rexburgfightingcovid.com"; sid:575712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riseupagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riseupagainstcovid.com"; sid:575713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rncovidcouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rncovidcouch.com"; sid:575714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rocfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rocfightingcovid.com"; sid:575715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rosiequeenofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rosiequeenofcorona.com"; sid:575716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rosiethequeenofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rosiethequeenofcorona.com"; sid:575717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtwaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtwaftercovid19.com"; sid:575718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtwcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtwcovid19.com"; sid:575719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safelysellyourhomeduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safelysellyourhomeduringcorona.com"; sid:575720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe-travel-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe-travel-after-corona.com"; sid:575721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetravelaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetravelaftercorona.com"; sid:575722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetravelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetravelcorona.com"; sid:575723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safety-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safety-coronavirus.com"; sid:575724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sajencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sajencorona.com"; sid:575725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocoronavirustest.com"; sid:575726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocoronavirustesting.com"; sid:575727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocoronavirustests.com"; sid:575728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid-19test.com"; sid:575729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid19test.com"; sid:575730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid-19testing.com"; sid:575731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid19testing.com"; sid:575732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid-19tests.com"; sid:575733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanantoniocovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanantoniocovid19tests.com"; sid:575734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocoronavirustest.com"; sid:575735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocoronavirustests.com"; sid:575736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid-19test.com"; sid:575737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid19test.com"; sid:575738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid-19testing.com"; sid:575739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid19testing.com"; sid:575740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid-19tests.com"; sid:575741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanfranciscocovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanfranciscocovid19tests.com"; sid:575742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificacoronavirus.com"; sid:575743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjosefightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjosefightingcovid19.com"; sid:575744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanjosefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanjosefightingcovid.com"; sid:575745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for satgascovidnumalangraya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"satgascovidnumalangraya.com"; sid:575746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for satsuki-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"satsuki-corona.com"; sid:575747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savechildcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savechildcorona.com"; sid:575748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savecoronadopark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savecoronadopark.com"; sid:575749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scienceversuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scienceversuscorona.com"; sid:575750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdfightingcovid.com"; sid:575751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronavirustest.com"; sid:575752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronavirustesting.com"; sid:575753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecoronavirustests.com"; sid:575754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19test.com"; sid:575755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19test.com"; sid:575756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19testing.com"; sid:575757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19testing.com"; sid:575758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid-19tests.com"; sid:575759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovid19tests.com"; sid:575760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingaftercovid19.com"; sid:575761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellyourhomeaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellyourhomeaftercovid19.com"; sid:575762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seltestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seltestforcovid19.com"; sid:575763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semuabisacovidasulah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semuabisacovidasulah.com"; sid:575764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorcoronavirus.com"; sid:575765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorcovid-19.com"; sid:575766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorcovid19.com"; sid:575767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementcoronavirus.com"; sid:575768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementscoronavirus.com"; sid:575769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementscovid19.com"; sid:575770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sewawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sewawaycorona.com"; sid:575771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shimane-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shimane-covid19.com"; sid:575772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopansercovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopansercovidppe.com"; sid:575773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicher-reisen-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicher-reisen-nach-corona.com"; sid:575774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicherreisennachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicherreisennachcorona.com"; sid:575775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-mask-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-mask-covid19.com"; sid:575776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-masque-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-masque-covid19.com"; sid:575777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-vaccin-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-vaccin-covid19.com"; sid:575778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stacyouthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stacyouthcorona.com"; sid:575779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsvcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsvcovid19.com"; sid:575780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupvcovid.com"; sid:575781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupvscovid19.com"; sid:575782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronacash.com"; sid:575783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19spread.com"; sid:575784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidcash.com"; sid:575785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.club"; sid:575786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidlights.com"; sid:575787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiescovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiescovid19.cloud"; sid:575788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strategiesversuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strategiesversuscorona.com"; sid:575789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strengthencovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strengthencovid-19recovery.com"; sid:575790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strengthencovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strengthencovid19recovery.com"; sid:575791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suitecovid19.com"; sid:575792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suitecovid.com"; sid:575793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suivi-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suivi-covid.com"; sid:575794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supercovid.com"; sid:575795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivor2020-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivor2020-coronavirus.com"; sid:575796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivor-corona-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivor-corona-covid19.com"; sid:575797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorcoronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorcoronacovid19.com"; sid:575798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tacklecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tacklecovid19.com"; sid:575799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talesofcovid19.com"; sid:575800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronavirustest.com"; sid:575801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronavirustesting.com"; sid:575802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacoronavirustests.com"; sid:575803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid-19test.com"; sid:575804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid19test.com"; sid:575805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid-19testing.com"; sid:575806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid19testing.com"; sid:575807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid-19tests.com"; sid:575808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tampacovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tampacovid19tests.com"; sid:575809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid-20.com"; sid:575810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetcovid20.com"; sid:575811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetpandemic19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetpandemic19.com"; sid:575812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetpandemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetpandemic2019.com"; sid:575813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetpandemic2020.com"; sid:575814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetpandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetpandemic20.com"; sid:575815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for targetpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"targetpandemic.com"; sid:575816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecoronas.com"; sid:575817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingforcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingforcovid2019.com"; sid:575818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirustest.com"; sid:575819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirustests.com"; sid:575820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19test.com"; sid:575821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19test.com"; sid:575822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19testing.com"; sid:575823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19testing.com"; sid:575824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19tests.com"; sid:575825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19tests.com"; sid:575826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacarolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacarolers.com"; sid:575827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronagames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronagames.com"; sid:575828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatales.com"; sid:575829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusquiz.com"; sid:575830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19chronicles.com"; sid:575831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19heroes.com"; sid:575832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19heroesmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19heroesmuseum.com"; sid:575833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19hub.com"; sid:575834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19journal.com"; sid:575835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19lab.com"; sid:575836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lab.com"; sid:575837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19museum.com"; sid:575838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19news.com"; sid:575839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19resourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19resourcecenter.com"; sid:575840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcard.com"; sid:575841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhustle.com"; sid:575842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlab.com"; sid:575843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtesting.com"; sid:575844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacesofcovid.com"; sid:575845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehiddentruthaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehiddentruthaboutcoronavirus.com"; sid:575846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themuseumofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themuseumofcovid19.com"; sid:575847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themuseumofcovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themuseumofcovid-19heroes.com"; sid:575848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenextcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenextcovid.com"; sid:575849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivingthepandemic.com"; sid:575850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thwartcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thwartcovid-19.com"; sid:575851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thwartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thwartcovid19.com"; sid:575852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timelinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timelinecovid19.com"; sid:575853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforsellingyourhomeduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforsellingyourhomeduringcorona.com"; sid:575854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topekafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topekafightingcovid.com"; sid:575855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toptipscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toptipscoronavirus.com"; sid:575856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocoronaviruscleaning.com"; sid:575857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for touchme-coronaover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"touchme-coronaover.com"; sid:575858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourism-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourism-after-corona.com"; sid:575859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismaftercorona.com"; sid:575860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourism-after-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourism-after-covid-19.com"; sid:575861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismaftercovid19.com"; sid:575862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackercovid-19.com"; sid:575863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travel-safe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travel-safe-corona.com"; sid:575864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelsafecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelsafecorona.com"; sid:575865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-vs-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-vs-covid.com"; sid:575866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidtest.com"; sid:575867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidtesting.com"; sid:575868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uhgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uhgcovid.com"; sid:575869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uniquepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uniquepandemic.com"; sid:575870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urlaub-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urlaub-nach-corona.com"; sid:575871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urlaubnachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urlaubnachcorona.com"; sid:575872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirustest.com"; sid:575873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19claim.com"; sid:575874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19claims.com"; sid:575875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19test.com"; sid:575876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19testing.com"; sid:575877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19testing.com"; sid:575878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid-19tests.com"; sid:575879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidstrong.com"; sid:575880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidtesting.com"; sid:575881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronatesting.com"; sid:575882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19claim.com"; sid:575883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19claims.com"; sid:575884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usecovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usecovid-19recovery.com"; sid:575885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usecovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usecovid19recovery.com"; sid:575886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usefulcovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usefulcovid-19recovery.com"; sid:575887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usefulcovid-19recoverytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usefulcovid-19recoverytips.com"; sid:575888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemictracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemictracker.com"; sid:575889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccoronakiller.com"; sid:575890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccin-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccin-covid19.com"; sid:575891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimsofcovid19.com"; sid:575892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronaviruscelebration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronaviruscelebration.com"; sid:575893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronaviruscelebrations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronaviruscelebrations.com"; sid:575894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronavirusevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronavirusevent.com"; sid:575895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcoronavirusevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcoronavirusevents.com"; sid:575896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusesandepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusesandepidemics.com"; sid:575897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voluntarisjorbacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voluntarisjorbacovid19.com"; sid:575898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for volusiacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"volusiacovidtesting.com"; sid:575899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for votre-test-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"votre-test-covid19.com"; sid:575900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vrush-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vrush-covid.com"; sid:575901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vuonlancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vuonlancovid19.com"; sid:575902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcoronavirus19.com"; sid:575903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weddingchangesbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weddingchangesbycovid.com"; sid:575904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weddingsbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weddingsbycovid.com"; sid:575905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronavirus19.com"; sid:575906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscovid2019.com"; sid:575907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscovidlaw.com"; sid:575908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldbeyondcovid.com"; sid:575909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrongfuldeathcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrongfuldeathcoronavirus.com"; sid:575910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrongfuldeathcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrongfuldeathcovid19.com"; sid:575911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandiseases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandiseases.com"; sid:575912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlawsuitlawyer.com"; sid:575913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlawsuits.com"; sid:575914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansoupcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansoupcompany.com"; sid:575915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantshirts.com"; sid:575916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusattorney.com"; sid:575917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruscures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruscures.com"; sid:575918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--plataformaafectadoscoronavirusespaa-hmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--plataformaafectadoscoronavirusespaa-hmd.com"; sid:575919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xrcovid.com"; sid:575920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcanbeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcanbeatcovid-19.com"; sid:575921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcanbeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcanbeatcovid19.com"; sid:575922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19lawfirm.com"; sid:575923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-covid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-covid19-test.com"; sid:575924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19test.com"; sid:575925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-checkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-checkcovid.com"; sid:575926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaviruscovid19.com"; sid:575927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dfaceshieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dfaceshieldcovid19.com"; sid:575928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acgpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acgpandemicrelief.com"; sid:575929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acgpandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acgpandemicresponse.com"; sid:575930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronachristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronachristmas.com"; sid:575931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aeminecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aeminecovid.com"; sid:575932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscovid19madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscovid19madrid.com"; sid:575933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agressivecovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agressivecovid19lawyer.com"; sid:575934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agressivecovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agressivecovidlawyer.com"; sid:575935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovidtracker.com"; sid:575936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-covid19-gouv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-covid19-gouv.com"; sid:575937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert-covid.com"; sid:575938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliencoronavirus.com"; sid:575939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allinagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allinagainstcovid19.com"; sid:575940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanpandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanpandemicmasks.com"; sid:575941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americastopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americastopcovid-19.net"; sid:575942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycoronado.com"; sid:575943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anewpostcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anewpostcovidworld.com"; sid:575944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angrycorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angrycorona19.com"; sid:575945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpositive.com"; sid:575946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpositive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpositive.net"; sid:575947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtea.com"; sid:575948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anycoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anycoronaviruscure.com"; sid:575949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askmeaboutcovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askmeaboutcovid19care.com"; sid:575950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacioncovid19.com"; sid:575951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assocovid-19.com"; sid:575952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackingcorona.com"; sid:575953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackingcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackingcorona.net"; sid:575954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestation-covid-19.com"; sid:575955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atty-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atty-corona.com"; sid:575956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auacovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auacovid19survey.com"; sid:575957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiastopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiastopcovid-19.net"; sid:575958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiastopcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiastopcovid19.net"; sid:575959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avengersstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avengersstopcovid-19.com"; sid:575960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avengersstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avengersstopcovid19.com"; sid:575961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-covid19.net"; sid:575962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaporelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaporelcorona.com"; sid:575963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid19.net"; sid:575964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bccovidbase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bccovidbase.com"; sid:575965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19usa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19usa.net"; sid:575966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-corona-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-corona-attorney.com"; sid:575967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaattorney.com"; sid:575968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biharcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biharcovidresponse.com"; sid:575969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchain4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchain4covid19.com"; sid:575970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for block-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"block-covid.com"; sid:575971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bread-in-the-time-ofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bread-in-the-time-ofcovid19.net"; sid:575972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brunswickcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brunswickcovid-19.com"; sid:575973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafightingcovid.com"; sid:575974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campingcorona.com"; sid:575975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcovidawakenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcovidawakenings.com"; sid:575976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturingcovid19.com"; sid:575977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturingcovid.com"; sid:575978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsvcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsvcorona.com"; sid:575979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cffw-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cffw-covid.com"; sid:575980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronanow.com"; sid:575981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19lie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19lie.com"; sid:575982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovidlie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovidlie.com"; sid:575983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinareleasedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinareleasedcovid19.com"; sid:575984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinareleasedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinareleasedcovid.com"; sid:575985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloroquinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloroquinecovid.com"; sid:575986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chronicalsofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chronicalsofcovid-19.com"; sid:575987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chronicalsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chronicalsofcovid19.com"; sid:575988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chronicalsofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chronicalsofcovid19.net"; sid:575989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chruchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chruchcovid19.com"; sid:575990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimforcovid-19.com"; sid:575991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimforcovid19.com"; sid:575992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classroomcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classroomcovid.com"; sid:575993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothcovid19masks.com"; sid:575994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothcovidmasks.com"; sid:575995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combat-covid19.com"; sid:575996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comfycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comfycovid.com"; sid:575997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectagainstcovid.com"; sid:575998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contacttracecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contacttracecovid19.com"; sid:575999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contacttracingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contacttracingcovid19.com"; sid:576000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cop26stopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cop26stopcovid-19.com"; sid:576001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cop26stopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cop26stopcovid-19.net"; sid:576002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corecovidtest.com"; sid:576003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-019.com"; sid:576004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona10000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona10000.com"; sid:576005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona12.com"; sid:576006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19sba.com"; sid:576007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19.today"; sid:576008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1point3acres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1point3acres.com"; sid:576009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona757.com"; sid:576010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatwork.com"; sid:576011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabarometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabarometer.com"; sid:576012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabars.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabars.biz"; sid:576013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeschermingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeschermingonline.com"; sid:576014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabypass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabypass.net"; sid:576015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashin30days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashin30days.com"; sid:576016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachasers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachasers.com"; sid:576017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chronik.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chronik.net"; sid:576018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacids.com"; sid:576019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanair.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanair.mobi"; sid:576020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningtips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningtips.com"; sid:576021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.mobi"; sid:576022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansalon.com"; sid:576023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupproject.com"; sid:576024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosingparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosingparty.com"; sid:576025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cocktail.com"; sid:576026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoin.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoin.center"; sid:576027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedychallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedychallenge.net"; sid:576028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommandcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommandcenter.com"; sid:576029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconscious.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconscious.net"; sid:576030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstruction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstruction.net"; sid:576031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorvid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorvid.com"; sid:576032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovery.com"; sid:576033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrafted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrafted.com"; sid:576034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreation.com"; sid:576035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrossfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrossfit.com"; sid:576036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuk.com"; sid:576037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureshop.com"; sid:576038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacustomstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacustomstore.com"; sid:576039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadayparade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadayparade.com"; sid:576040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestekkazan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestekkazan.com"; sid:576041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-beach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-beach.com"; sid:576042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-beach-condo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-beach-condo.com"; sid:576043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobeachcondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobeachcondo.com"; sid:576044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-beach-condos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-beach-condos.com"; sid:576045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-beach-rental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-beach-rental.com"; sid:576046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-beach-rentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-beach-rentals.com"; sid:576047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocdl.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocdl.net"; sid:576048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-condo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-condo.com"; sid:576049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-condos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-condos.com"; sid:576050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocouncelingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocouncelingca.com"; sid:576051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoislandshoresrealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoislandshoresrealty.com"; sid:576052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadorealestateagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadorealestateagent.com"; sid:576053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-shores-condos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-shores-condos.com"; sid:576054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoshores-condos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoshores-condos.com"; sid:576055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexclusive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexclusive.com"; sid:576056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-faust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-faust.com"; sid:576057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaust.com"; sid:576058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefund.com"; sid:576059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeme.com"; sid:576060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagezond.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagezond.net"; sid:576061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunlukleri.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunlukleri.net"; sid:576062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagyaan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagyaan.com"; sid:576063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelden24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelden24.com"; sid:576064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-help-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-help-now.com"; sid:576065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelp-plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelp-plus.com"; sid:576066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-holiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-holiday.com"; sid:576067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahw.net"; sid:576068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainiusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainiusa.com"; sid:576069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainwsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainwsa.com"; sid:576070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisa.com"; sid:576071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaius.com"; sid:576072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jia.com"; sid:576073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaji.com"; sid:576074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise-europa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise-europa.net"; sid:576075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalandscapingdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalandscapingdfw.com"; sid:576076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyerusa.com"; sid:576077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliars.com"; sid:576078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloja.com"; sid:576079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloser.com"; sid:576080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamania2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamania2020.com"; sid:576081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-necklace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-necklace.com"; sid:576082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-note.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-note.net"; sid:576083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanv.com"; sid:576084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoefenen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoefenen.com"; sid:576085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofsorts2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofsorts2020.com"; sid:576086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonthejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonthejob.com"; sid:576087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaor.com"; sid:576088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemic19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemic19.com"; sid:576089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapass.net"; sid:576090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphob.com"; sid:576091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapillow.com"; sid:576092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapivot.com"; sid:576093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapivots.com"; sid:576094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapollos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapollos.com"; sid:576095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappesouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappesouthafrica.com"; sid:576096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-preneurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-preneurs.com"; sid:576097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprobiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprobiotics.com"; sid:576098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofoffice.com"; sid:576099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prtv.com"; sid:576100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarn.com"; sid:576101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarock.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarock.net"; sid:576102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarona.com"; sid:576103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe.business"; sid:576104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafebusiness.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafebusiness.directory"; sid:576105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeoffice.com"; sid:576106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafesports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafesports.com"; sid:576107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaway.com"; sid:576108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascame.com"; sid:576109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermen.com"; sid:576110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermonline.com"; sid:576111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashite.com"; sid:576112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sougi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sougi.net"; sid:576113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasougi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasougi.net"; sid:576114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopping.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopping.net"; sid:576115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresshelp.com"; sid:576116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasusa.com"; sid:576117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-talks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-talks.com"; sid:576118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateened.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateened.com"; sid:576119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestla.com"; sid:576120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.mobi"; sid:576121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnearme.com"; sid:576122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnv.com"; sid:576123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.pro"; sid:576124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsf.com"; sid:576125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testy.com"; sid:576126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathenewhandshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathenewhandshake.com"; sid:576127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapists247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapists247.com"; sid:576128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatm.com"; sid:576129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracer.com"; sid:576130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerph.com"; sid:576131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatwats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatwats.com"; sid:576132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatekurigram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatekurigram.com"; sid:576133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir.fund"; sid:576134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirs.net"; sid:576135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtualmarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtualmarathon.com"; sid:576136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.care"; sid:576137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19now.com"; sid:576138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyadvisor.com"; sid:576139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyadvisors.com"; sid:576140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcysolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcysolution.com"; sid:576141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcysolutions.com"; sid:576142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbilgimerkezi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbilgimerkezi.com"; sid:576143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessclosure.com"; sid:576144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter11bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter11bankruptcy.com"; sid:576145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7bankruptcy.com"; sid:576146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningjanitorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningjanitorial.com"; sid:576147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpa.com"; sid:576148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothingllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothingllc.com"; sid:576149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministration.com"; sid:576150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcy.com"; sid:576151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidation.com"; sid:576152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19.support"; sid:576153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscv19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscv19.com"; sid:576154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdead.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdead.net"; sid:576155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtsettlement.com"; sid:576156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtsettlements.com"; sid:576157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiabetes.com"; sid:576158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiabetes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiabetes.net"; sid:576159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disease19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disease19.com"; sid:576160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disease.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disease.net"; sid:576161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease.world"; sid:576162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorceattorney.com"; sid:576163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdivorcelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdivorcelawyer.com"; sid:576164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrains.com"; sid:576165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancegroup.com"; sid:576166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcedclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcedclosure.com"; sid:576167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforeclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforeclosures.com"; sid:576168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforlaypeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforlaypeople.com"; sid:576169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitycard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitycard.com"; sid:576170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitycard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitycard.net"; sid:576171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitycards.com"; sid:576172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancelawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancelawgroup.com"; sid:576173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-investigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-investigations.com"; sid:576174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatino.com"; sid:576175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslevelcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslevelcrazy.com"; sid:576176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliquidation.com"; sid:576177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-livestats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-livestats.com"; sid:576178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.guru"; sid:576179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-masque-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-masque-protection.com"; sid:576180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeters.com"; sid:576181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneedhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneedhelp.com"; sid:576182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnaw.com"; sid:576183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsss.com"; sid:576184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparade5thave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparade5thave.com"; sid:576185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparade.com"; sid:576186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparadenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparadenyc.com"; sid:576187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplasmacanada.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplasmacanada.net"; sid:576188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoetry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoetry.com"; sid:576189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppemasks.com"; sid:576190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprestamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprestamos.com"; sid:576191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspro.net"; sid:576192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquilt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquilt.net"; sid:576193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrankings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrankings.com"; sid:576194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrespones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrespones.com"; sid:576195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolved.com"; sid:576196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsf.com"; sid:576197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingstations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingstations.com"; sid:576198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.mobi"; sid:576199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsf.com"; sid:576200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreated.com"; sid:576201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustributes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustributes.com"; sid:576202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustruenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustruenews.com"; sid:576203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusus-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusus-sd.com"; sid:576204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvapor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvapor.com"; sid:576205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaporizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaporizer.com"; sid:576206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisusinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisusinusa.com"; sid:576207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitis.com"; sid:576208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vorsorge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vorsorge.net"; sid:576209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawide.com"; sid:576210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworlddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworlddiary.com"; sid:576211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corvid19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corvid19corona.com"; sid:576212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countyemscovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countyemscovidresults.com"; sid:576213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid11.com"; sid:576214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19africanamericanrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19africanamericanrelieffund.com"; sid:576215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19africanamericanrelieffund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19africanamericanrelieffund.net"; sid:576216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andlinkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andlinkhealth.com"; sid:576217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andup.com"; sid:576218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andup.com"; sid:576219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodies.com"; sid:576220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistancemorgtagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistancemorgtagefamily.com"; sid:576221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19awakening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19awakening.com"; sid:576222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenesstraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenesstraining.com"; sid:576223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyadvisor.com"; sid:576224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyadvisors.com"; sid:576225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcysolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcysolution.com"; sid:576226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcysolutions.com"; sid:576227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bharat.com"; sid:576228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blooddonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blooddonor.com"; sid:576229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsuranceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsuranceattorney.com"; sid:576230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsuranceattorneys.com"; sid:576231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurancelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurancelaw.com"; sid:576232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurancelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurancelawfirm.com"; sid:576233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurancelawyers.com"; sid:576234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurnaceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurnaceclaim.com"; sid:576235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurnaceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurnaceclaims.com"; sid:576236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlaw.com"; sid:576237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlawers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlawers.com"; sid:576238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlawfirm.com"; sid:576239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlawgroup.com"; sid:576240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessshutdown.com"; sid:576241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cares.com"; sid:576242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caresupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caresupplies.com"; sid:576243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkpoint.com"; sid:576244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cids.com"; sid:576245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsconsultants.net"; sid:576246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimshelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimshelp.net"; sid:576247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.life"; sid:576248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clean.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clean.mobi"; sid:576249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothingllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothingllc.com"; sid:576250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collaboration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collaboration.com"; sid:576251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationaustralia.com"; sid:576252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministration.com"; sid:576253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationaustralia.com"; sid:576254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidation.com"; sid:576255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complaints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complaints.com"; sid:576256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concierge.com"; sid:576257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contact.com"; sid:576258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contact.com"; sid:576259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona-news.com"; sid:576260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coronavirusbusinessshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coronavirusbusinessshutdown.com"; sid:576261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.tools"; sid:576262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseline.com"; sid:576263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseship.com"; sid:576264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damagesexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damagesexpert.com"; sid:576265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datacenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datacenter.com"; sid:576266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtdefense.com"; sid:576267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtsettlement.com"; sid:576268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtsettlements.com"; sid:576269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtsolution.com"; sid:576270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19delhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19delhi.com"; sid:576271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designchallenge.com"; sid:576272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dfw.com"; sid:576273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disenfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disenfecting.com"; sid:576274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disenfecting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disenfecting.net"; sid:576275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingservices.net"; sid:576276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19divorceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19divorceattorney.com"; sid:576277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19divorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19divorce.com"; sid:576278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19divorcelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19divorcelawyer.com"; sid:576279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doesnotdiscriminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doesnotdiscriminate.com"; sid:576280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19draincleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19draincleaning.com"; sid:576281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drainclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drainclearance.com"; sid:576282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drains.com"; sid:576283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ds.com"; sid:576284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economicloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economicloss.com"; sid:576285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economics.net"; sid:576286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economies.com"; sid:576287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-elsavlador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-elsavlador.com"; sid:576288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19embryyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19embryyo.com"; sid:576289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employerguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employerguide.com"; sid:576290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerguide.com"; sid:576291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerloans.com"; sid:576292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentdischarge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentdischarge.com"; sid:576293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-europe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-europe.net"; sid:576294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eyewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eyewear.com"; sid:576295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fda.com"; sid:576296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialeconomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialeconomist.com"; sid:576297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialplanner.com"; sid:576298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialplanner.com"; sid:576299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forensicfinancialanalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forensicfinancialanalyst.com"; sid:576300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19foundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19foundations.com"; sid:576301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freefund.com"; sid:576302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeme.com"; sid:576303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeus.com"; sid:576304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fronterasur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fronterasur.com"; sid:576305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19geomodeller.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19geomodeller.net"; sid:576306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gm.net"; sid:576307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goodtotravelgoodtoworkregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goodtotravelgoodtoworkregistration.com"; sid:576308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goodtoworkgoodtotravelregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goodtoworkgoodtotravelregistration.com"; sid:576309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haiti.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haiti.net"; sid:576310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hcf.com"; sid:576311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthscreening.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthscreening.today"; sid:576312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hell.com"; sid:576313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hell.com"; sid:576314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroes.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroes.world"; sid:576315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hero.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hero.fund"; sid:576316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herofund.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herofund.fund"; sid:576317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herofund.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herofund.support"; sid:576318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hizliiadebasvurulari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hizliiadebasvurulari.com"; sid:576319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-homes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-homes.com"; sid:576320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingupdate.com"; sid:576321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hugs.com"; sid:576322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hydro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hydro.com"; sid:576323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19idconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19idconsultant.com"; sid:576324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimlaw.com"; sid:576325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimlawfirm.com"; sid:576326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimlawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimlawgroup.com"; sid:576327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimlawyer.com"; sid:576328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimlawyers.com"; sid:576329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaim.net"; sid:576330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawer.com"; sid:576331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawers.com"; sid:576332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawfirm.com"; sid:576333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelawgroup.com"; sid:576334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurance-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurance-lawsuit.com"; sid:576335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurnaceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurnaceclaims.com"; sid:576336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investigation.com"; sid:576337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ipconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ipconsultant.com"; sid:576338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-japan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-japan.net"; sid:576339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jm.com"; sid:576340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jo.com"; sid:576341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kktc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kktc.com"; sid:576342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kuw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kuw.com"; sid:576343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalupdates.com"; sid:576344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-letest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-letest.com"; sid:576345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lifeplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lifeplan.com"; sid:576346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lighting.com"; sid:576347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19linkhealthandyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19linkhealthandyou.com"; sid:576348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-linkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-linkhealth.com"; sid:576349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19linkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19linkhealth.com"; sid:576350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livereports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livereports.com"; sid:576351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveworld.com"; sid:576352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lostwages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lostwages.com"; sid:576353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makerchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makerchallenge.com"; sid:576354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskforce.com"; sid:576355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masksarl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masksarl.com"; sid:576356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskwarehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskwarehouse.com"; sid:576357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masque-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masque-france.com"; sid:576358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19m.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19m.com"; sid:576359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mediation.com"; sid:576360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mediation.com"; sid:576361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mediators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mediators.com"; sid:576362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medx.com"; sid:576363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mexico.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mexico.net"; sid:576364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miles.com"; sid:576365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mind.com"; sid:576366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobileclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobileclinic.com"; sid:576367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19motivation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19motivation.com"; sid:576368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nagpur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nagpur.com"; sid:576369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19naturaltreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19naturaltreatment.com"; sid:576370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19naturaltreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19naturaltreatments.com"; sid:576371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19navigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19navigator.com"; sid:576372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19needhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19needhelp.com"; sid:576373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-needs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-needs.com"; sid:576374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19negligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19negligence.com"; sid:576375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19networktracker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19networktracker.net"; sid:576376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neverforget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neverforget.com"; sid:576377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsblog.com"; sid:576378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsupdate.net"; sid:576379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nu.com"; sid:576380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19number.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19number.com"; sid:576381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19number.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19number.net"; sid:576382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghome.com"; sid:576383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ny.com"; sid:576384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nycomplaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nycomplaw.net"; sid:576385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obesity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obesity.com"; sid:576386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19observatory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19observatory.com"; sid:576387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineshop.com"; sid:576388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parade.com"; sid:576389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payrollloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payrollloans.com"; sid:576390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19peek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19peek.com"; sid:576391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pillow.com"; sid:576392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pipeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pipeline.com"; sid:576393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plasmaalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plasmaalliance.com"; sid:576394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmaalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmaalliance.com"; sid:576395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pnp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pnp.com"; sid:576396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeq.com"; sid:576397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19predictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19predictor.com"; sid:576398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19procurement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19procurement.com"; sid:576399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19promos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19promos.com"; sid:576400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiveshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiveshield.com"; sid:576401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiveshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiveshields.com"; sid:576402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protect.net"; sid:576403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psychhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psychhelp.com"; sid:576404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ptsd.com"; sid:576405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-realtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-realtor.com"; sid:576406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reboot.com"; sid:576407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reboot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reboot.net"; sid:576408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefservices.com"; sid:576409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reopenplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reopenplan.com"; sid:576410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resort.com"; sid:576411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resorts.com"; sid:576412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resources4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resources4you.com"; sid:576413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcesforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcesforyou.com"; sid:576414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-resources.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-resources.net"; sid:576415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsegroup.com"; sid:576416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restartplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restartplan.com"; sid:576417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revenu3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revenu3.com"; sid:576418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskanalizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskanalizi.com"; sid:576419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roofer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roofer.com"; sid:576420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roofing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roofing.com"; sid:576421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sba.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sba.net"; sid:576422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scene.com"; sid:576423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessaid.com"; sid:576424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneezeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneezeguards.com"; sid:576425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s.net"; sid:576426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19space.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19space.com"; sid:576427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spy.com"; sid:576428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistics.net"; sid:576429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayhomestaysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayhomestaysafe.com"; sid:576430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19summit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19summit.net"; sid:576431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplydirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplydirect.com"; sid:576432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surivalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surivalcalculator.com"; sid:576433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19surv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19surv.com"; sid:576434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivalcalculator.com"; sid:576435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorcalculator.com"; sid:576436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomtest.com"; sid:576437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxandfinancialaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxandfinancialaid.com"; sid:576438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tentroutine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tentroutine.com"; sid:576439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-dz.com"; sid:576440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingpro.com"; sid:576441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingstations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingstations.com"; sid:576442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitfda.com"; sid:576443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19theory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19theory.com"; sid:576444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-todaysdanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-todaysdanger.com"; sid:576445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracingsdk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracingsdk.com"; sid:576446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tributes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tributes.com"; sid:576447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tributes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tributes.net"; sid:576448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tshirts.net"; sid:576449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19txt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19txt.com"; sid:576450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19txt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19txt.net"; sid:576451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-uk.com"; sid:576452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unicef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unicef.com"; sid:576453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19universe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19universe.com"; sid:576454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccin.com"; sid:576455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinechina.com"; sid:576456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineindia.com"; sid:576457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetruth.com"; sid:576458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vac.com"; sid:576459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacination.com"; sid:576460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusnewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusnewsupdate.com"; sid:576461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusnewsupdate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusnewsupdate.net"; sid:576462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wages.com"; sid:576463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wages.com"; sid:576464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19watchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19watchdog.com"; sid:576465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19watcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19watcher.com"; sid:576466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.center"; sid:576467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.company"; sid:576468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.group"; sid:576469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.solutions"; sid:576470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19word.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19word.com"; sid:576471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19works.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19works.com"; sid:576472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldstats.com"; sid:576473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathlawsuit.com"; sid:576474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xperience.com"; sid:576475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019forecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019forecast.com"; sid:576476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020credit.com"; sid:576477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3day.com"; sid:576478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3dayholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3dayholiday.com"; sid:576479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid95facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid95facemask.com"; sid:576480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid95shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid95shield.com"; sid:576481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabtest.com"; sid:576482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacious.com"; sid:576483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionhumboldt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionhumboldt.com"; sid:576484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionteam.com"; sid:576485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aidegouv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aidegouv.com"; sid:576486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidainsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidainsurance.com"; sid:576487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertph.com"; sid:576488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamid.com"; sid:576489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcancer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcancer.net"; sid:576490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaro.com"; sid:576491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartbbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartbbs.com"; sid:576492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartve.com"; sid:576493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarberfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarberfund.com"; sid:576494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarberfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarberfund.net"; sid:576495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefits.net"; sid:576496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbigballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbigballs.com"; sid:576497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiobank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiobank.com"; sid:576498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooking.com"; sid:576499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbounce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbounce.com"; sid:576500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakups.com"; sid:576501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbritain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbritain.com"; sid:576502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptioninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptioninsurance.com"; sid:576503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampaigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampaigns.com"; sid:576504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.solutions"; sid:576505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarolers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarolers.net"; sid:576506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckers.com"; sid:576507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckers.net"; sid:576508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchkd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchkd.com"; sid:576509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsattorney.com"; sid:576510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsattorneys.com"; sid:576511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-claw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-claw.com"; sid:576512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanair.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanair.mobi"; sid:576513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanco.net"; sid:576514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerservice.com"; sid:576515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanfree.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanfree.mobi"; sid:576516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanfree.net"; sid:576517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansalon.com"; sid:576518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean-up.com"; sid:576519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupcrews.com"; sid:576520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearmask.com"; sid:576521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearmasks.com"; sid:576522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearppe.com"; sid:576523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosingparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosingparty.com"; sid:576524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktaileur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktaileur.com"; sid:576525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoinbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoinbank.com"; sid:576526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomingout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomingout.com"; sid:576527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommons.com"; sid:576528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfirmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfirmed.com"; sid:576529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcons.com"; sid:576530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsiderate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsiderate.com"; sid:576531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorpus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorpus.com"; sid:576532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostmemoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostmemoney.net"; sid:576533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcover.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcover.net"; sid:576534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrm.com"; sid:576535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidculinary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidculinary.com"; sid:576536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cup.com"; sid:576537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure19vaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure19vaccine.net"; sid:576538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurt.com"; sid:576539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutchallenge.com"; sid:576540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dance.com"; sid:576541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddanceoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddanceoff.com"; sid:576542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtdefense.com"; sid:576543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddictionary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddictionary.com"; sid:576544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfecting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfecting.net"; sid:576545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddomainnames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddomainnames.com"; sid:576546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddraincleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddraincleaning.com"; sid:576547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrainclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrainclearance.com"; sid:576548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrains.com"; sid:576549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidealsg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidealsg.com"; sid:576550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideja2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideja2020.com"; sid:576551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidem.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidem.net"; sid:576552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidence19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidence19.cat"; sid:576553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidence19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidence19.com"; sid:576554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidence19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidence19.net"; sid:576555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentification.com"; sid:576556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoz.com"; sid:576557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexamcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexamcenter.com"; sid:576558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinds.com"; sid:576559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstaction.com"; sid:576560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstattack.com"; sid:576561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstcontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstcontact.com"; sid:576562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-france.com"; sid:576563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.fitness"; sid:576564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeland.com"; sid:576565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenanny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenanny.com"; sid:576566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevegas.com"; sid:576567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevegas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevegas.net"; sid:576568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreezones.com"; sid:576569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgabon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgabon.com"; sid:576570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgear.net"; sid:576571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgift.com"; sid:576572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguesstimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguesstimate.com"; sid:576573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hacks.com"; sid:576574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhacks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhacks.net"; sid:576575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandyclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandyclean.com"; sid:576576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandyclean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandyclean-up.com"; sid:576577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandycleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandycleanup.com"; sid:576578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help.world"; sid:576579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhgua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhgua.com"; sid:576580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholiday.com"; sid:576581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholidayweekends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholidayweekends.com"; sid:576582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoy.net"; sid:576583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidies.com"; sid:576584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinclass.com"; sid:576585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info-japan.com"; sid:576586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformer.com"; sid:576587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfos.net"; sid:576588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.today"; sid:576589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceclaimattorney.com"; sid:576590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancedenied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancedenied.com"; sid:576591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawers.com"; sid:576592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawfirm.com"; sid:576593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawgroup.com"; sid:576594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorce.net"; sid:576595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidization.com"; sid:576596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobreaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobreaction.com"; sid:576597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleenhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleenhandsanitizer.com"; sid:576598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkn95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkn95masks.com"; sid:576599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkrypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkrypto.com"; sid:576600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawpartners.com"; sid:576601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawteam.com"; sid:576602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleap.com"; sid:576603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliberationday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliberationday.com"; sid:576604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliberationday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliberationday.net"; sid:576605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlighting.com"; sid:576606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-linkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-linkhealth.com"; sid:576607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinkhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinkhealth.com"; sid:576608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlostrevenueinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlostrevenueinsurance.com"; sid:576609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloveforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloveforsale.com"; sid:576610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmampara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmampara.com"; sid:576611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanager.com"; sid:576612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasktech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasktech.com"; sid:576613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasktechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasktechnologies.com"; sid:576614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasktechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasktechnology.com"; sid:576615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskwarehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskwarehouse.com"; sid:576616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.biz"; sid:576617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalmasks.com"; sid:576618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedx.com"; sid:576619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-model.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-model.net"; sid:576620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodel.net"; sid:576621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurders.com"; sid:576622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmva.com"; sid:576623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnatural411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnatural411.com"; sid:576624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn.com"; sid:576625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoticias.com"; sid:576626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghome.com"; sid:576627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnwi.com"; sid:576628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidol.net"; sid:576629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopirin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopirin.net"; sid:576630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorce.com"; sid:576631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoscope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoscope.com"; sid:576632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoscope.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoscope.net"; sid:576633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoumedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoumedicine.com"; sid:576634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-panama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-panama.com"; sid:576635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphobia.com"; sid:576636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpillow.com"; sid:576637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpipeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpipeline.com"; sid:576638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpivots.com"; sid:576639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppe.net"; sid:576640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpt.net"; sid:576641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpurify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpurify.com"; sid:576642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquilt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquilt.net"; sid:576643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidracialimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidracialimpact.com"; sid:576644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradar.net"; sid:576645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresponseteam.com"; sid:576646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebirth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebirth.com"; sid:576647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreconstruction.com"; sid:576648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredemption.com"; sid:576649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-redi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-redi.com"; sid:576650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefi.com"; sid:576651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreleif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreleif.com"; sid:576652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreleiffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreleiffund.com"; sid:576653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefrefund.com"; sid:576654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenewal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenewal.com"; sid:576655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrent.com"; sid:576656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesforyou.com"; sid:576657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrip.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrip.net"; sid:576658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafekit.com"; sid:576659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafekits.com"; sid:576660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafephonecase.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafephonecase.net"; sid:576661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepractice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepractice.net"; sid:576662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetymasks.com"; sid:576663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyproducts.com"; sid:576664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationguide.com"; sid:576665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscentstester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscentstester.com"; sid:576666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscenttester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscenttester.com"; sid:576667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensing.com"; sid:576668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-services.com"; sid:576669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsgear.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsgear.biz"; sid:576670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sklep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sklep.com"; sid:576671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmellstester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmellstester.com"; sid:576672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmelltester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmelltester.com"; sid:576673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsonora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsonora.com"; sid:576674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedtest.com"; sid:576675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stat.net"; sid:576676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stats.net"; sid:576677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories.life"; sid:576678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoryproject.com"; sid:576679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrongbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrongbracelets.com"; sid:576680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyapp.com"; sid:576681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyauction.com"; sid:576682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplydirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplydirect.com"; sid:576683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyillinois.com"; sid:576684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplymart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplymart.com"; sid:576685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtadamon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtadamon.com"; sid:576686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtecture.com"; sid:576687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcoalition.com"; sid:576688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcoalition.com"; sid:576689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnegative.com"; sid:576690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-online.com"; sid:576691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpositive.com"; sid:576692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthebarbarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthebarbarian.com"; sid:576693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthedestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthedestroyer.com"; sid:576694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtm.com"; sid:576695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracjing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracjing.com"; sid:576696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackkng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackkng.com"; sid:576697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrooper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrooper.com"; sid:576698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-visualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-visualizer.com"; sid:576699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviusalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviusalizer.com"; sid:576700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebsitedomainnames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebsitedomainnames.com"; sid:576701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweekend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweekend.com"; sid:576702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweekends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweekends.com"; sid:576703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldsupply.com"; sid:576704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzerotunnel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzerotunnel.com"; sid:576705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzoom.com"; sid:576706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cowtowncoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cowtowncoronatesting.com"; sid:576707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cowtowncovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cowtowncovidtesting.com"; sid:576708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazystupidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazystupidcovid.com"; sid:576709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiseaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiseaftercovid19.com"; sid:576710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisesaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisesaftercoronavirus.com"; sid:576711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcorona5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcorona5k.com"; sid:576712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushincovid.com"; sid:576713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushthecorona5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushthecorona5k.com"; sid:576714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuarentenacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuarentenacovid.com"; sid:576715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curb-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curb-covid19.com"; sid:576716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbingcovid-19.com"; sid:576717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curbsidecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curbsidecovid-19testing.com"; sid:576718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for david-covid.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"david-covid.mobi"; sid:576719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcfightingcovid.com"; sid:576720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealcovid19.com"; sid:576721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealcovid.com"; sid:576722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-covidization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-covidization.com"; sid:576723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidization.com"; sid:576724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-covidized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-covidized.com"; sid:576725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidized.com"; sid:576726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatthecovid.com"; sid:576727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatthecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatthecovid.net"; sid:576728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depoisdocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depoisdocorona.com"; sid:576729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirusmadrid.com"; sid:576730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid.com"; sid:576731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectorcovid.com"; sid:576732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidhelp.com"; sid:576733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecorona.com"; sid:576734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discosycoronasdediamante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discosycoronasdediamante.com"; sid:576735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfect-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfect-corona.com"; sid:576736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugsforcovid19.com"; sid:576737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugsforcovid.com"; sid:576738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebookcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebookcovid19.com"; sid:576739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-coronavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-coronavir.com"; sid:576740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edgarcoronamx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edgarcoronamx.com"; sid:576741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronavirusmanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronavirusmanual.com"; sid:576742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcovidnosune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcovidnosune.com"; sid:576743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eldoracovid19solidarite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eldoracovid19solidarite.com"; sid:576744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminate-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminate-covid19.com"; sid:576745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail10.com"; sid:576746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail1.com"; sid:576747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail2.com"; sid:576748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail3.com"; sid:576749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail4.com"; sid:576750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail5.com"; sid:576751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail6.com"; sid:576752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail7.com"; sid:576753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail8.com"; sid:576754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail9.com"; sid:576755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicartfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicartfest.com"; sid:576756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmedicalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmedicalequipment.com"; sid:576757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsurvivalkit.com"; sid:576758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecovid-19.com"; sid:576759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eritreafightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eritreafightscovid19.com"; sid:576760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escudocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escudocorona.com"; sid:576761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estudiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estudiocovid.com"; sid:576762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurostopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurostopcovid-19.net"; sid:576763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exquisitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exquisitecovid.com"; sid:576764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcoronavirus.net"; sid:576765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcovid19.net"; sid:576766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshieldsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshieldsforcovid.com"; sid:576767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid19.net"; sid:576768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fauxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fauxcovid.com"; sid:576769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f-ckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f-ckcorona.com"; sid:576770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovid19testkit.com"; sid:576771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmcovidprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmcovidprotocol.com"; sid:576772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmcovidprotocol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmcovidprotocol.net"; sid:576773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstactioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstactioncovid.com"; sid:576774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstattackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstattackcovid.com"; sid:576775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcontactcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcontactcovid.com"; sid:576776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcovidsupply.com"; sid:576777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitwithcorona.com"; sid:576778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidinsuranceclaims.com"; sid:576779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthcovidtesting.com"; sid:576780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortworthfightingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortworthfightingcovid.net"; sid:576781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francestopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francestopcovid-19.com"; sid:576782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid.clinic"; sid:576783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freefromcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freefromcovid19.net"; sid:576784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frompandemic2purpose.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frompandemic2purpose.net"; sid:576785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frompandemictopurpose.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frompandemictopurpose.net"; sid:576786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fthecorona.com"; sid:576787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.net"; sid:576788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckedbycovid19.com"; sid:576789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukcovid-19.com"; sid:576790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19law.com"; sid:576791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovidlawyer.com"; sid:576792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gegen-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gegen-corona.net"; sid:576793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generoycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generoycovid.com"; sid:576794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gerocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gerocovid.com"; sid:576795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gerocovid.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gerocovid.foundation"; sid:576796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getpaidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getpaidcovid19.com"; sid:576797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreversepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreversepandemic.com"; sid:576798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghcovid19.com"; sid:576799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gincovid.com"; sid:576800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gincovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gincovid.net"; sid:576801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcorona5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcorona5k.com"; sid:576802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicaid.com"; sid:576803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godstopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godstopcovid-19.net"; sid:576804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gofundme-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gofundme-covid19.com"; sid:576805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gretastopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gretastopcovid-19.com"; sid:576806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hancockfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hancockfightingcovid.com"; sid:576807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingfromthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingfromthepandemic.com"; sid:576808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingthepandemic.com"; sid:576809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthy-after-corona-jewelry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthy-after-corona-jewelry.com"; sid:576810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hockeyfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hockeyfightscovid19.com"; sid:576811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidaycorona.com"; sid:576812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidayscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidayscorona.com"; sid:576813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostingcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostingcorona.net"; sid:576814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howibeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howibeatcovid19.com"; sid:576815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howibeatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howibeatcovid19.net"; sid:576816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydrocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydrocovid19.com"; sid:576817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydrocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydrocovid19.net"; sid:576818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronavirusfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronavirusfree.net"; sid:576819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovid19free.net"; sid:576820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidnineteenfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidnineteenfree.com"; sid:576821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ianticovid.com"; sid:576822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconqueredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconqueredcovid19.com"; sid:576823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotcoronaatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotcoronaatwork.com"; sid:576824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid19masks.com"; sid:576825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incaseofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incaseofpandemic.com"; sid:576826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incormacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incormacioncovid19.com"; sid:576827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacovid.com"; sid:576828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indigenascovid19.red - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indigenascovid19.red"; sid:576829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid-19.net"; sid:576830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovate4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovate4covid.com"; sid:576831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovateforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovateforcovid.com"; sid:576832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronachecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronachecker.com"; sid:576833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ironmanstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ironmanstopcovid-19.com"; sid:576834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ironmanstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ironmanstopcovid19.com"; sid:576835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for islandshoresrealtycoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"islandshoresrealtycoronado.com"; sid:576836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronavirus.world"; sid:576837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirushats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirushats.com"; sid:576838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirusllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirusllc.com"; sid:576839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid19.net"; sid:576840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italystopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italystopcovid-19.com"; sid:576841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecorona2020.com"; sid:576842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecoronavirus2020.com"; sid:576843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwillsurvivecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwillsurvivecovid2020.com"; sid:576844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for japanstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"japanstopcovid-19.com"; sid:576845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for johnshopkinsuniversitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"johnshopkinsuniversitycoronavirus.com"; sid:576846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcalmandwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcalmandwuhan.com"; sid:576847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepsafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepsafecovid19.com"; sid:576848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenoshafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenoshafightingcovid.com"; sid:576849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovidmask.com"; sid:576850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusfast.com"; sid:576851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitforcovid19.com"; sid:576852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for komikcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"komikcovid.com"; sid:576853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kpmgcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kpmgcovidresponse.com"; sid:576854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laredoagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laredoagainstcovid19.com"; sid:576855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laredoagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laredoagainstcovid.com"; sid:576856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laredocontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laredocontracovid19.com"; sid:576857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laredocontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laredocontracovid.com"; sid:576858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laughinatimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laughinatimeofcorona.com"; sid:576859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcovid.com"; sid:576860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyer-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyer-corona.com"; sid:576861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersdefendingcovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersdefendingcovid19victims.com"; sid:576862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcovid19.biz"; sid:576863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcovid.com"; sid:576864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesherosducorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesherosducorona.com"; sid:576865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofthecorona.com"; sid:576866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilcovid19.com"; sid:576867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for linkhealthandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"linkhealthandcovid19.com"; sid:576868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for linkhealth-covid19-andyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"linkhealth-covid19-andyou.com"; sid:576869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for linkhealth-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"linkhealth-covid19.com"; sid:576870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwellduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwellduringcovid.com"; sid:576871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lojadocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lojadocorona.com"; sid:576872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lookupcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lookupcovid.com"; sid:576873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lotuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lotuscovid19.com"; sid:576874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macoronadiploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macoronadiploma.com"; sid:576875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macoronadiploma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macoronadiploma.net"; sid:576876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeincovid.com"; sid:576877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marimfra-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marimfra-covid.com"; sid:576878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid.net"; sid:576879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascovid19.com"; sid:576880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcorona19.com"; sid:576881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque19-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque19-covid.com"; sid:576882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-anti-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-anti-covid.com"; sid:576883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticovid.com"; sid:576884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-covid19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-covid19-france.com"; sid:576885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matacorona.com"; sid:576886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamifightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamifightingcovid.com"; sid:576887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mikindnesspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mikindnesspandemic.com"; sid:576888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigationcovid19.com"; sid:576889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mmmmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mmmmycorona.com"; sid:576890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monclovafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monclovafightingcovid.com"; sid:576891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitor-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitor-covid.com"; sid:576892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montest-covid19.com"; sid:576893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montrealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montrealcovid19.com"; sid:576894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mortgagehelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mortgagehelpcoronavirus.com"; sid:576895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mortgagehelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mortgagehelpcovid19.com"; sid:576896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mouthmask-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mouthmask-covid.com"; sid:576897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrdoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrdoscovid19.com"; sid:576898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrdoscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrdoscovid19.net"; sid:576899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiccovidrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiccovidrelease.com"; sid:576900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musiccovidreleif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musiccovidreleif.com"; sid:576901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakitchen.com"; sid:576902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaletter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaletter.com"; sid:576903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasolutions.com"; sid:576904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19baby.com"; sid:576905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.care"; sid:576906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19sba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19sba.com"; sid:576907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhometeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhometeat.com"; sid:576908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhometes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhometes.com"; sid:576909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydocovid.com"; sid:576910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhomecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhomecovidtest.com"; sid:576911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95maskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95maskscovid19.com"; sid:576912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcoronaviruslaw.com"; sid:576913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcovid19law.com"; sid:576914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negativecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negativecovid.com"; sid:576915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19testingkit.com"; sid:576916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpostcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpostcovidworld.com"; sid:576917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextdayofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextdayofcorona.com"; sid:576918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcovid19help.com"; sid:576919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for night-of-the-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"night-of-the-covid.com"; sid:576920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nightofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nightofthecovid.com"; sid:576921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid2019.com"; sid:576922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novocorona.com"; sid:576923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwicovid.com"; sid:576924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidaction.com"; sid:576925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidhometest.com"; sid:576926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nystopcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nystopcovid-19.net"; sid:576927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oddballspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oddballspandemic.com"; sid:576928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcovid-19.com"; sid:576929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestkitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestkitcovid-19.com"; sid:576930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestkitcovid19.com"; sid:576931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for optumandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"optumandcovid19.com"; sid:576932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronababy.com"; sid:576933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic19.net"; sid:576934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2purpose.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2purpose.net"; sid:576935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapartments.com"; sid:576936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapparel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapparel.net"; sid:576937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicats.com"; sid:576938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbbq.com"; sid:576939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbooths.com"; sid:576940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuilding.com"; sid:576941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconstruction.com"; sid:576942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccount.com"; sid:576943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccount.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccount.net"; sid:576944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomicrecoveryplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomicrecoveryplan.com"; sid:576945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceconomicrecoveryplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceconomicrecoveryplan.net"; sid:576946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-etiquette.com"; sid:576947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfacts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfacts.net"; sid:576948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfiction.com"; sid:576949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfog.net"; sid:576950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfriend.com"; sid:576951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfuel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfuel.com"; sid:576952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgratitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgratitude.com"; sid:576953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgrief.com"; sid:576954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsider.com"; sid:576955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinstock.com"; sid:576956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicitems.com"; sid:576957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmadeinchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmadeinchina.com"; sid:576958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmadeinchina.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmadeinchina.net"; sid:576959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofloveboulder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofloveboulder.com"; sid:576960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpatriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpatriots.com"; sid:576961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpete.com"; sid:576962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphonecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphonecase.com"; sid:576963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprevention.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprevention.biz"; sid:576964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.business"; sid:576965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.business"; sid:576966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooffamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooffamily.com"; sid:576967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofit.net"; sid:576968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.life"; sid:576969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.life"; sid:576970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.net"; sid:576971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.team"; sid:576972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.team"; sid:576973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooftech.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooftech.net"; sid:576974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.world"; sid:576975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionpackage.com"; sid:576976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrpttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrpttracker.com"; sid:576977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsecrects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsecrects.com"; sid:576978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstash.com"; sid:576979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstorage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstorage.com"; sid:576980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwithfriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwithfriends.com"; sid:576981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pccovid.com"; sid:576982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexcovid19.com"; sid:576983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexcovid.com"; sid:576984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexcovid-sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexcovid-sars.com"; sid:576985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivecovid.com"; sid:576986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.club"; sid:576987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastressrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastressrelief.com"; sid:576988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastresssyndrome.com"; sid:576989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19reboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19reboot.com"; sid:576990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidimpact.com"; sid:576991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.services"; sid:576992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.world"; sid:576993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicjobs.com"; sid:576994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicwork.com"; sid:576995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicworld.net"; sid:576996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnancycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnancycovid-19.com"; sid:576997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prep4epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prep4epidemic.com"; sid:576998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princetoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princetoncovid19.com"; sid:576999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promociones-covid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promociones-covid19mexico.com"; sid:577000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovids19.com"; sid:577001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegersedelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegersedelcovid-19.com"; sid:577002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegersedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegersedelcovid19.com"; sid:577003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocollocinemacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocollocinemacovid.com"; sid:577004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prueba-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prueba-covid-19.com"; sid:577005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinepandemic.com"; sid:577006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raisecovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raisecovidfunds.com"; sid:577007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapicovid.com"; sid:577008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest-covid-19.com"; sid:577009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest-covid-19.net"; sid:577010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdccoronavirus.com"; sid:577011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19abogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19abogado.com"; sid:577012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovid19lawyer.com"; sid:577013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatevcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatevcovid19.com"; sid:577014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recessioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recessioncovid19.com"; sid:577015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtcorona.com"; sid:577016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovid-192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovid-192020.com"; sid:577017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportacovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportacovidiot.com"; sid:577018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retex-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retex-covid19.com"; sid:577019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retexcovid19.com"; sid:577020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitisecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitisecovid19.com"; sid:577021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santabarbarafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santabarbarafightingcovid.com"; sid:577022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid-19.com"; sid:577023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbfightingcovid.com"; sid:577024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shattercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shattercovid19.com"; sid:577025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shingatacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shingatacorona.com"; sid:577026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19express.com"; sid:577027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siaplawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siaplawancorona.com"; sid:577028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sidneystopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sidneystopcovid-19.com"; sid:577029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simpandemic.com"; sid:577030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecoronavirussolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecoronavirussolution.com"; sid:577031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecoronavirussolution.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecoronavirussolution.net"; sid:577032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soapcovid19.com"; sid:577033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobrevivicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobrevivicovid19.com"; sid:577034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcovidresponse.com"; sid:577035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutions-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutions-covid19.com"; sid:577036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecovid.com"; sid:577037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvingcorona.com"; sid:577038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvingcovid-19.com"; sid:577039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvingcovid19.com"; sid:577040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somethingotherthancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somethingotherthancoronavirus.com"; sid:577041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soulsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soulsofcorona.com"; sid:577042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sounds-of-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sounds-of-corona.com"; sid:577043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soundsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soundsofcorona.com"; sid:577044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadfactsnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadfactsnotcovid.com"; sid:577045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startupsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startupsforcovid19.com"; sid:577046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomestaysafecovid19doesnotdiscriminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomestaysafecovid19doesnotdiscriminate.com"; sid:577047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayhomestaysafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayhomestaysafecovid.com"; sid:577048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stonehamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stonehamcovid19.com"; sid:577049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-magasin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-magasin.com"; sid:577050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthepandemic.net"; sid:577051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthepandemiconline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthepandemiconline.com"; sid:577052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthepandemicweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthepandemicweb.com"; sid:577053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiescovid19.net"; sid:577054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strategieversuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strategieversuscorona.com"; sid:577055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for support-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"support-covid19.com"; sid:577056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona-virus.com"; sid:577057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivor2020-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivor2020-coronavirus.net"; sid:577058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivorscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivorscovid19.com"; sid:577059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiss-covid-19.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiss-covid-19.group"; sid:577060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamancovid.com"; sid:577061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamincovid.com"; sid:577062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamocovid.com"; sid:577063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamoncorona.com"; sid:577064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamoncovid19.com"; sid:577065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamoncovid.com"; sid:577066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamonecovid.com"; sid:577067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamouncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamouncovid.com"; sid:577068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadmoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadmoncovid.com"; sid:577069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tarrantcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tarrantcoronatesting.com"; sid:577070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tarrantcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tarrantcovidtesting.com"; sid:577071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tdamoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tdamoncovid.com"; sid:577072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19lowcost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19lowcost.com"; sid:577073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitonlinecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitonlinecovid-19.com"; sid:577074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitonlinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitonlinecovid19.com"; sid:577075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacult.com"; sid:577076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaglass.com"; sid:577077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19baby.com"; sid:577078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19-chronicles.com"; sid:577079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid19-chronicles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid19-chronicles.net"; sid:577080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19files.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19files.com"; sid:577081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19journal.com"; sid:577082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19journal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19journal.net"; sid:577083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcoin.com"; sid:577084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddefender.com"; sid:577085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovider.com"; sid:577086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviders.com"; sid:577087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrecovery.com"; sid:577088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstoryproject.com"; sid:577089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtrade.com"; sid:577090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedoscovid19.com"; sid:577091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegoodpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegoodpandemic.com"; sid:577092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicchefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicchefs.com"; sid:577093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicroomadm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicroomadm.com"; sid:577094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovid19numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovid19numbers.com"; sid:577095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovid19stats.com"; sid:577096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiemposdelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiemposdelcovid-19.com"; sid:577097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timeofcorona.net"; sid:577098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentsforcovid19.com"; sid:577099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentsforcovid.com"; sid:577100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovidiots.com"; sid:577101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trueofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trueofcovid19.com"; sid:577102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trueofcovide19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trueofcovide19.com"; sid:577103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscovid19.com"; sid:577104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t-shirtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t-shirtcovid.com"; sid:577105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidtesting.net"; sid:577106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uhcandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uhcandcovid19.com"; sid:577107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uhgandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uhgandcovid19.com"; sid:577108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updateoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updateoncovid19.com"; sid:577109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacorona20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacorona20.com"; sid:577110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicflu.com"; sid:577111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utcccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utcccovid19.com"; sid:577112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vbfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vbfightingcovid.com"; sid:577113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegasfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegasfightingcovid.com"; sid:577114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venicovidivici.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venicovidivici.com"; sid:577115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-corona-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-corona-live.com"; sid:577116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-covid.net"; sid:577117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualize-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualize-covid19.com"; sid:577118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitalcoronavirus.com"; sid:577119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voiceofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voiceofpandemic.com"; sid:577120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicesofapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicesofapandemic.com"; sid:577121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warrennjcovid-19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warrennjcovid-19info.com"; sid:577122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotcorona.com"; sid:577123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westernmillingcovid19resoures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westernmillingcovid19resoures.com"; sid:577124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatididonmycoronavirusvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatididonmycoronavirusvacation.com"; sid:577125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whodiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whodiedfromcovid-19.com"; sid:577126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whodiedfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whodiedfromcovid19.com"; sid:577127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcovidgetme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcovidgetme.com"; sid:577128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winningthewarcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winningthewarcovid-19.com"; sid:577129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winnipegfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winnipegfightingcovid.com"; sid:577130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthewarcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthewarcovid-19.com"; sid:577131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthewaroncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthewaroncovid-19.com"; sid:577132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthewaroncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthewaroncovid19.com"; sid:577133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wnyfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wnyfightingcovid.com"; sid:577134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for work-after-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"work-after-covid19.com"; sid:577135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcorona2020.com"; sid:577136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidupdates.com"; sid:577137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbioweaponthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbioweaponthemovie.com"; sid:577138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbt.net"; sid:577139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandaojian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandaojian.com"; sid:577140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhang19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhang19.com"; sid:577141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangeles.com"; sid:577142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanluoqixuedianzishangwuyouxiangongshi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanluoqixuedianzishangwuyouxiangongshi.com"; sid:577143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanql.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanql.com"; sid:577144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantailai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantailai.com"; sid:577145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxinwangtong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxinwangtong.com"; sid:577146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyuntongyibao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyuntongyibao.com"; sid:577147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcoronavurusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcoronavurusnow.com"; sid:577148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwpvdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwpvdcovid19.com"; sid:577149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwtadamoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwtadamoncovid.com"; sid:577150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xiwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xiwuhanvirus.com"; sid:577151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomecorona.com"; sid:577152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yougotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yougotcorona.com"; sid:577153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidclaim.com"; sid:577154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourhomevcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourhomevcovid19.com"; sid:577155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidfree.com"; sid:577156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19nola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19nola.com"; sid:577157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19usa.com"; sid:577158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020postcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020postcovid.com"; sid:577159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcausescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcausescovid.com"; sid:577160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovidvirus.com"; sid:577161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adicovid19.com"; sid:577162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancedcoronavirus.com"; sid:577163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africa-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africa-covid19.net"; sid:577164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.world"; sid:577165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbornecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbornecovid-19.com"; sid:577166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajhamadencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajhamadencoronavirus.com"; sid:577167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all4covid.com"; sid:577168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleviatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleviatecovid.com"; sid:577169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for almafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"almafightingcovid.com"; sid:577170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatscoronavirus.com"; sid:577171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcoronavirus.com"; sid:577172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestcovid.com"; sid:577173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirus-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirus-usa.com"; sid:577174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19products.com"; sid:577175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronavirus.com"; sid:577176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescovid-19.com"; sid:577177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescovid-19.net"; sid:577178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprescovid.com"; sid:577179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arboristsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arboristsagainstcovid19.com"; sid:577180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcoanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcoanticovid.com"; sid:577181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arewedonewithcoronayet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arewedonewithcoronayet.com"; sid:577182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for articolicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"articolicovid.com"; sid:577183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artisclinicadental-sin-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artisclinicadental-sin-coronavirus.com"; sid:577184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistancecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistancecovid.com"; sid:577185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcovid-19.com"; sid:577186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronavirusscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronavirusscams.com"; sid:577187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankofamericacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankofamericacovid-19.com"; sid:577188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19festival.com"; sid:577189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.biz"; sid:577190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beathecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beathecoronavirus.com"; sid:577191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronas.com"; sid:577192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19.com"; sid:577193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19litigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19litigators.com"; sid:577194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid19.com"; sid:577195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodtestcovid19.com"; sid:577196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodtestcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodtestcovid19.net"; sid:577197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodtestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodtestforcovid19.com"; sid:577198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for borgoanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"borgoanticovid.com"; sid:577199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for borgoanticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"borgoanticovid.net"; sid:577200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncovid19claim.com"; sid:577201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncovid19claims.com"; sid:577202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncovidclaim.com"; sid:577203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncovidclaims.com"; sid:577204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptioncovidhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptioncovidhelpline.com"; sid:577205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessinterruptionpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessinterruptionpandemic.com"; sid:577206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19supplies.com"; sid:577207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadagouvcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadagouvcovid-19.com"; sid:577208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canfieldrotarycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canfieldrotarycovid.com"; sid:577209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardcorona.com"; sid:577210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardcovid.com"; sid:577211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casadematerialescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casadematerialescorona.com"; sid:577212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cedarhillfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cedarhillfightingcovid.com"; sid:577213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19.com"; sid:577214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinascovid-19worlddomination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinascovid-19worlddomination.com"; sid:577215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciaocovid.com"; sid:577216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cignacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cignacovid19.com"; sid:577217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciudadanosvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciudadanosvscovid.com"; sid:577218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciudadanovscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciudadanovscovid.com"; sid:577219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim4corona.com"; sid:577220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimforcovid.com"; sid:577221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid19-20.com"; sid:577222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid19-20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid19-20.net"; sid:577223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cobolforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cobolforcovid.com"; sid:577224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cockblockcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cockblockcorona.com"; sid:577225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codevscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codevscovid.com"; sid:577226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contactcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contactcovid.com"; sid:577227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingandcorona.com"; sid:577228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19heroes.com"; sid:577229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19map.com"; sid:577230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19masks.net"; sid:577231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19memorial.com"; sid:577232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19memorialsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19memorialsite.com"; sid:577233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19project.com"; sid:577234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona3dmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona3dmap.com"; sid:577235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadjusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadjusters.com"; sid:577236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamor.com"; sid:577237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytests.com"; sid:577238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaavaible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaavaible.com"; sid:577239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioplan.com"; sid:577240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizclaim.com"; sid:577241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrightnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrightnews.com"; sid:577242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuffs.com"; sid:577243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardprogram.com"; sid:577244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareteam.com"; sid:577245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarprotectionkit.com"; sid:577246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck-up.com"; sid:577247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-clues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-clues.com"; sid:577248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollarco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollarco.com"; sid:577249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-collar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-collar.com"; sid:577250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollar.net"; sid:577251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contact-trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contact-trace.com"; sid:577252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacttrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacttrace.com"; sid:577253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacttracingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacttracingapp.com"; sid:577254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contact-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contact-tracing.com"; sid:577255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacttracing.com"; sid:577256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrole.com"; sid:577257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorecare.com"; sid:577258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacort.com"; sid:577259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrashindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrashindex.com"; sid:577260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreatures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreatures.com"; sid:577261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadancesong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadancesong.com"; sid:577262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatadonation.com"; sid:577263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeflect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeflect.com"; sid:577264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiva.com"; sid:577265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohg.com"; sid:577266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-donate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-donate.com"; sid:577267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadovirtualrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadovirtualrealtor.com"; sid:577268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessentialworkersfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessentialworkersfund.com"; sid:577269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemaskonline.com"; sid:577270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinancehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinancehelp.com"; sid:577271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehug.com"; sid:577272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoaway.com"; sid:577273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagum.com"; sid:577274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealingnow.com"; sid:577275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthmasks.com"; sid:577276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroescompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroescompensationfund.com"; sid:577277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesfund.com"; sid:577278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesfund.net"; sid:577279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesvictimfund.com"; sid:577280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesvictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesvictimsfund.com"; sid:577281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroesvictmfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroesvictmfund.com"; sid:577282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherosvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherosvictimfund.com"; sid:577283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-foerderung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-foerderung.com"; sid:577284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-foerderung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-foerderung.net"; sid:577285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeaid.com"; sid:577286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeprotectionkit.com"; sid:577287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectiontracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectiontracker.com"; sid:577288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruptioncases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruptioncases.com"; sid:577289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainterruptionclaims.com"; sid:577290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainturkeyprisons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainturkeyprisons.com"; sid:577291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainyemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainyemen.com"; sid:577292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajukebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajukebox.com"; sid:577293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajunkie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajunkie.com"; sid:577294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajunkies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajunkies.com"; sid:577295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9collar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9collar.com"; sid:577296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9collar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9collar.net"; sid:577297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9collars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9collars.com"; sid:577298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-k9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-k9.com"; sid:577299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9.com"; sid:577300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9.net"; sid:577301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak9s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak9s.com"; sid:577302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsclub.com"; sid:577303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-laboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-laboratory.com"; sid:577304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabor.com"; sid:577305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalesson.com"; sid:577306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifedoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifedoc.com"; sid:577307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifedocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifedocumentary.com"; sid:577308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveindia.com"; sid:577309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasks.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasks.club"; sid:577310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasq.com"; sid:577311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalresearch.com"; sid:577312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedical.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedical.today"; sid:577313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-news.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-news.mobi"; sid:577314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonalprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonalprotectionkit.com"; sid:577315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapinata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapinata.com"; sid:577316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplayers.com"; sid:577317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplug.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplug.mobi"; sid:577318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprestiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprestiti.com"; sid:577319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofevents.com"; sid:577320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofusa.com"; sid:577321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rabatt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rabatt.com"; sid:577322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rabatte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rabatte.com"; sid:577323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarader.com"; sid:577324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapture.com"; sid:577325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rdm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rdm.com"; sid:577326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-recht.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-recht.net"; sid:577327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareduit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareduit.com"; sid:577328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistration.com"; sid:577329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresistence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresistence.com"; sid:577330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-revolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-revolution.com"; sid:577331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarwanda-staging-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarwanda-staging-api.com"; sid:577332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarwanda-staging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarwanda-staging.com"; sid:577333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarxplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarxplan.com"; sid:577334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetea.com"; sid:577335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasahaayta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasahaayta.com"; sid:577336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascamcreeps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascamcreeps.com"; sid:577337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreeningtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreeningtests.com"; sid:577338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdisinfection.com"; sid:577339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseniorliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseniorliving.com"; sid:577340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasensor.com"; sid:577341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaserologytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaserologytest.com"; sid:577342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashaped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashaped.com"; sid:577343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasicknesstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasicknesstracker.com"; sid:577344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe-deutschland.com"; sid:577345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soforthilfe-einspruch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soforthilfe-einspruch.com"; sid:577346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouvenirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouvenirs.com"; sid:577347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoryshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoryshare.com"; sid:577348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorskit.com"; sid:577349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatarckers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatarckers.world"; sid:577350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathots.com"; sid:577351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tlv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tlv.com"; sid:577352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoegang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoegang.com"; sid:577353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerlebanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerlebanon.com"; sid:577354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingcontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingcontact.com"; sid:577355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingsolutions.com"; sid:577356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavairus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavairus.net"; sid:577357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimcompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimcompensationfund.com"; sid:577358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavictimscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavictimscompensationfund.com"; sid:577359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigation.com"; sid:577360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvanced.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvanced.com"; sid:577361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftereffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftereffect.com"; sid:577362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodybracelet.com"; sid:577363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ayuda.com"; sid:577364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-basics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-basics.com"; sid:577365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodkits.com"; sid:577366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtestingkit.com"; sid:577367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtestingkits.com"; sid:577368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtestkit.com"; sid:577369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtestkits.com"; sid:577370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbookclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbookclub.com"; sid:577371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-books.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-books.com"; sid:577372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusborders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusborders.com"; sid:577373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscameras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscameras.com"; sid:577374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscelebration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscelebration.com"; sid:577375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheckin.com"; sid:577376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheck-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheck-up.com"; sid:577377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollaboration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollaboration.com"; sid:577378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoloringbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoloringbook.com"; sid:577379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnections.com"; sid:577380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscorner.com"; sid:577381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19ca.com"; sid:577382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cr.com"; sid:577383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-creditrepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-creditrepair.com"; sid:577384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscustomshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscustomshields.com"; sid:577385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-datadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-datadonation.com"; sid:577386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatadonation.com"; sid:577387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-day.com"; sid:577388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtattorneys.com"; sid:577389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtlawyer.com"; sid:577390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtlawyers.com"; sid:577391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtreliefservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtreliefservice.com"; sid:577392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensegear.com"; sid:577393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdentist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdentist.net"; sid:577394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrive.com"; sid:577395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessentialworkerscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessentialworkerscompensationfund.com"; sid:577396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessentialworkersfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessentialworkersfund.com"; sid:577397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-etiquette.com"; sid:577398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfurlough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfurlough.com"; sid:577399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushcq.com"; sid:577400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebloodkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebloodkit.com"; sid:577401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomebloodkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomebloodkits.com"; sid:577402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitycertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitycertificates.com"; sid:577403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindia.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindia.today"; sid:577404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjury.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjury.net"; sid:577405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancegroup.com"; sid:577406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancehelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancehelpers.com"; sid:577407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsure.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsure.world"; sid:577408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatinousa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatinousa.com"; sid:577409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleanforward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleanforward.com"; sid:577410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleanin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleanin.com"; sid:577411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslost.com"; sid:577412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmzansi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmzansi.com"; sid:577413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsnow.net"; sid:577414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnight.com"; sid:577415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnsw.com"; sid:577416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnv.net"; sid:577417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspen.com"; sid:577418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproductivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproductivity.com"; sid:577419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquiz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquiz.net"; sid:577420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecruitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecruitment.com"; sid:577421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreportsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreportsonline.com"; sid:577422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresilence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresilence.com"; sid:577423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresilency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresilency.com"; sid:577424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestorationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestorationservices.com"; sid:577425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreward.com"; sid:577426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safetyequipment.com"; sid:577427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizationspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizationspecialists.com"; sid:577428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscammer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscammer.com"; sid:577429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserologytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserologytest.com"; sid:577430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstandard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstandard.com"; sid:577431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstandards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstandards.com"; sid:577432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatsusa.com"; sid:577433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussterilizationteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussterilizationteam.com"; sid:577434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimulus4infrastructureplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimulus4infrastructureplan.com"; sid:577435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stimuluscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stimuluscheck.com"; sid:577436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuperstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuperstar.com"; sid:577437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivorstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivorstories.com"; sid:577438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxreliefservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxreliefservice.com"; sid:577439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxreliefservices.com"; sid:577440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechsolutions.com"; sid:577441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustermination.com"; sid:577442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcentersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcentersusa.com"; sid:577443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestcentre.com"; sid:577444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingoc.com"; sid:577445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheculprit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheculprit.com"; sid:577446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheplay.com"; sid:577447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackermap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackermap.com"; sid:577448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracks.com"; sid:577449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentandprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentandprevention.com"; sid:577450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusturkey.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusturkey.club"; sid:577451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.media"; sid:577452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vacuna.com"; sid:577453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvcf.com"; sid:577454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimcompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimcompensationfund.com"; sid:577455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictory.com"; sid:577456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitimscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitimscompensationfund.com"; sid:577457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswageloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswageloss.com"; sid:577458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszinc.com"; sid:577459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebcam.com"; sid:577460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawreath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawreath.com"; sid:577461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoddha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoddha.com"; sid:577462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazinc.com"; sid:577463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corsicanafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corsicanafightingcovid.com"; sid:577464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid123test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid123test.com"; sid:577465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-168.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-168.com"; sid:577466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18s.com"; sid:577467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19americanheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19americanheroes.com"; sid:577468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ammo.com"; sid:577469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ammo.com"; sid:577470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ammo.com"; sid:577471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andminorities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andminorities.com"; sid:577472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodybracelet.com"; sid:577473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyrapidtest.com"; sid:577474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytesting.com"; sid:577475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyusa.com"; sid:577476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bd.net"; sid:577477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizclaims.com"; sid:577478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blockchainfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blockchainfund.com"; sid:577479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodkit.com"; sid:577480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtestingkits.com"; sid:577481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtestkits.com"; sid:577482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bounceback.com"; sid:577483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bracelets.com"; sid:577484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsuranceclaim.com"; sid:577485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsuranceclaims.com"; sid:577486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businesspractices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businesspractices.com"; sid:577487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessrestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessrestart.com"; sid:577488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrestart.com"; sid:577489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cams.com"; sid:577490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cardcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cardcheck.com"; sid:577491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cards.com"; sid:577492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carprotectionkit.com"; sid:577493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centroamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centroamerica.com"; sid:577494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-certificate.com"; sid:577495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-checklist.com"; sid:577496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chinasworlddomination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chinasworlddomination.com"; sid:577497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19christmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19christmas.com"; sid:577498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcompany.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcompany.net"; sid:577499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cle.com"; sid:577500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coding.com"; sid:577501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coloringbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coloringbook.com"; sid:577502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consortium.com"; sid:577503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contactless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contactless.com"; sid:577504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cookie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cookie.com"; sid:577505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus-nv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus-nv.com"; sid:577506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counselingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counselingca.com"; sid:577507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19count.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19count.club"; sid:577508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coverups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coverups.com"; sid:577509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cream.com"; sid:577510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisisleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisisleadership.com"; sid:577511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisisleadershiptips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisisleadershiptips.com"; sid:577512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cuisine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cuisine.com"; sid:577513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cured.com"; sid:577514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19customfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19customfacemasks.com"; sid:577515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19custommask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19custommask.com"; sid:577516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19custommasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19custommasks.com"; sid:577517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19customshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19customshield.com"; sid:577518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19customshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19customshields.com"; sid:577519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datacurve.com"; sid:577520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-datadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-datadonation.com"; sid:577521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-datadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-datadonation.com"; sid:577522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datadonation.com"; sid:577523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datastore.com"; sid:577524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtattorney.com"; sid:577525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtattorneys.com"; sid:577526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtlawyer.com"; sid:577527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtlawyers.com"; sid:577528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtreliefservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtreliefservice.com"; sid:577529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtreliefservices.com"; sid:577530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dentist.com"; sid:577531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dentist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dentist.net"; sid:577532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentist.net"; sid:577533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.discount - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.discount"; sid:577534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectant.net"; sid:577535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectingteam.com"; sid:577536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dnatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dnatest.com"; sid:577537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dnschangerserver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dnschangerserver.com"; sid:577538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donaldtrump.com"; sid:577539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donar.com"; sid:577540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donar.com"; sid:577541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donar.net"; sid:577542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drugtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drugtest.com"; sid:577543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eastcoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eastcoast.com"; sid:577544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ehealth.com"; sid:577545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employeehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employeehealth.com"; sid:577546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeehealth.com"; sid:577547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employeescreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employeescreening.com"; sid:577548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeescreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeescreening.com"; sid:577549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-employment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-employment.com"; sid:577550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentalworkersvictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentalworkersvictimsfund.com"; sid:577551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialworkersfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialworkersfund.com"; sid:577552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialworkersvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialworkersvictimfund.com"; sid:577553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19etiquette.com"; sid:577554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstresponse.com"; sid:577555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forbearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forbearance.com"; sid:577556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freelegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freelegalhelp.com"; sid:577557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-future-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-future-uk.com"; sid:577558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gcc.com"; sid:577559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaldisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaldisaster.com"; sid:577560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalrecovery.com"; sid:577561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalrecovery.com"; sid:577562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalvirus.com"; sid:577563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hauntedhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hauntedhouse.com"; sid:577564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hcf.com"; sid:577565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hcf.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hcf.net"; sid:577566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hcq.com"; sid:577567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healingprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healingprayer.com"; sid:577568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthassessment.com"; sid:577569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthform.com"; sid:577570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthfund.com"; sid:577571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthrecovery.com"; sid:577572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthscreening.com"; sid:577573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthscreening.com"; sid:577574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthscreening.net"; sid:577575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthscreening.net"; sid:577576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpforbusinesses.com"; sid:577577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herocompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herocompensationfund.com"; sid:577578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herocompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herocompensationfund.com"; sid:577579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herocompensationfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herocompensationfund.net"; sid:577580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfund.com"; sid:577581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroescompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroescompensationfund.com"; sid:577582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfund.net"; sid:577583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesvictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesvictimfund.com"; sid:577584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesvictimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesvictimsfund.com"; sid:577585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herofund.com"; sid:577586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19herofund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19herofund.net"; sid:577587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herofunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herofunds.com"; sid:577588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herofundusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herofundusa.com"; sid:577589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herofundusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herofundusa.net"; sid:577590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herohelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herohelp.com"; sid:577591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herosfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herosfund.com"; sid:577592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herovictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herovictimfund.com"; sid:577593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hoax.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hoax.world"; sid:577594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.holiday"; sid:577595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeprotectionkit.com"; sid:577596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housetestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housetestkits.com"; sid:577597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-iadeleraliniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-iadeleraliniz.com"; sid:577598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-id.com"; sid:577599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-id.com"; sid:577600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitycard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitycard.com"; sid:577601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitycards.com"; sid:577602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitycertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitycertificates.com"; sid:577603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitypassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitypassports.com"; sid:577604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19in.com"; sid:577605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-infovirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-infovirus.com"; sid:577606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19injuryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19injuryclaim.com"; sid:577607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injuryclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injuryclaim.com"; sid:577608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injuryclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injuryclaims.com"; sid:577609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurylawfirm.com"; sid:577610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurysettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurysettlement.com"; sid:577611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insruance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insruance.com"; sid:577612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancegroup.com"; sid:577613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19int.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19int.com"; sid:577614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interruptioncases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interruptioncases.com"; sid:577615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interruptioninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interruptioninsurance.com"; sid:577616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-investing.com"; sid:577617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keywords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keywords.com"; sid:577618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kuzeykibris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kuzeykibris.com"; sid:577619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latino.com"; sid:577620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latinousa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latinousa.com"; sid:577621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvisory.com"; sid:577622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalclaimhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalclaimhelpline.com"; sid:577623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalclaimshelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalclaimshelpline.com"; sid:577624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalteam.net"; sid:577625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalturkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalturkey.com"; sid:577626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifeinsruance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifeinsruance.com"; sid:577627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livemap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livemap.net"; sid:577628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19localattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19localattorney.com"; sid:577629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lookback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lookback.com"; sid:577630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marijuana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marijuana.com"; sid:577631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskcoverups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskcoverups.com"; sid:577632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mem.com"; sid:577633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mg.com"; sid:577634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19minuteworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19minuteworkout.com"; sid:577635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miracle.com"; sid:577636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miracles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miracles.com"; sid:577637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19models.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19models.com"; sid:577638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19molecular.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19molecular.com"; sid:577639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moleculartest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moleculartest.com"; sid:577640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moleculartesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moleculartesting.com"; sid:577641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moleculartest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moleculartest.net"; sid:577642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moleculartests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moleculartests.com"; sid:577643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19n.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19n.com"; sid:577644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newskenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newskenya.com"; sid:577645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr.com"; sid:577646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr.net"; sid:577647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalprotectionkit.com"; sid:577648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19polls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19polls.com"; sid:577649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portrait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portrait.com"; sid:577650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pricktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pricktest.com"; sid:577651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiongroup.com"; sid:577652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivegears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivegears.com"; sid:577653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quiz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quiz.net"; sid:577654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidimmunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidimmunitytest.com"; sid:577655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19react.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19react.com"; sid:577656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19real.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19real.com"; sid:577657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverytest.com"; sid:577658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recruiting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recruiting.com"; sid:577659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recruitment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recruitment.com"; sid:577660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reply.com"; sid:577661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reportcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reportcards.com"; sid:577662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseteams.com"; sid:577663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restart.com"; sid:577664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19return.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19return.com"; sid:577665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revalidatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revalidatie.com"; sid:577666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reward.com"; sid:577667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskcalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskcalc.com"; sid:577668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ro.com"; sid:577669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rt.com"; sid:577670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeshop.com"; sid:577671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyequipment.com"; sid:577672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safetyequipment.com"; sid:577673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyequipment.com"; sid:577674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyform.com"; sid:577675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safetyproducts.com"; sid:577676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizationresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizationresponseteam.com"; sid:577677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scammer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scammer.com"; sid:577678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scammer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scammer.com"; sid:577679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scammers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scammers.com"; sid:577680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serologyrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serologyrapidtest.com"; sid:577681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shieldusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shieldusa.com"; sid:577682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sidehustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sidehustle.com"; sid:577683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sidehustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sidehustle.com"; sid:577684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19s.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19s.net"; sid:577685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solidarity.com"; sid:577686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statusreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statusreport.com"; sid:577687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilizationresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilizationresponseteam.com"; sid:577688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulus.net"; sid:577689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superhero.com"; sid:577690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomscreening.com"; sid:577691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomscreening.com"; sid:577692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomscreening.net"; sid:577693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomscreening.net"; sid:577694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxreliefservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxreliefservice.com"; sid:577695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testclinic.com"; sid:577696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcentersnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcentersnc.com"; sid:577697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcentersofamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcentersofamerica.com"; sid:577698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcentersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcentersusa.com"; sid:577699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testkit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testkit.biz"; sid:577700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker247.com"; sid:577701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackinglive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackinglive.com"; sid:577702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ulvsterilizationspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ulvsterilizationspecialists.com"; sid:577703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ulvteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ulvteam.com"; sid:577704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-unemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-unemployment.com"; sid:577705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19urbanlegend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19urbanlegend.com"; sid:577706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usaattorney.com"; sid:577707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvcleaning.com"; sid:577708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinated.com"; sid:577709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccineid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccineid.com"; sid:577710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vax.com"; sid:577711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vc.com"; sid:577712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimsfund.com"; sid:577713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusinfo.com"; sid:577714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusinfo.net"; sid:577715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusproducts.com"; sid:577716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusprotectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusprotectionmasks.com"; sid:577717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warrior.com"; sid:577718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.com"; sid:577719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wellnessscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wellnessscreening.net"; sid:577720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workscreening.com"; sid:577721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workscreening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workscreening.net"; sid:577722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worktest.com"; sid:577723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldleaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldleaders.com"; sid:577724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1day100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1day100.com"; sid:577725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1stresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1stresponse.com"; sid:577726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020cure.com"; sid:577727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20serv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20serv.com"; sid:577728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid36.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid36.com"; sid:577729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-404.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-404.com"; sid:577730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid404.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid404.com"; sid:577731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-404.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-404.life"; sid:577732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-404.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-404.net"; sid:577733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-404.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-404.world"; sid:577734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid8ball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid8ball.com"; sid:577735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaba.com"; sid:577736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalleviate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalleviate.com"; sid:577737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamerica2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamerica2020.com"; sid:577738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidammo.com"; sid:577739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidammohealthcareheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidammohealthcareheroes.com"; sid:577740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandrogenproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandrogenproject.com"; sid:577741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandrogens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandrogens.com"; sid:577742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandsmell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandsmell.com"; sid:577743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyrapidtest.com"; sid:577744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestusa.com"; sid:577745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaproject.com"; sid:577746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarts.com"; sid:577747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattacks.com"; sid:577748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawg.com"; sid:577749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidballrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidballrun.com"; sid:577750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandarqq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandarqq.com"; sid:577751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandarqq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandarqq.net"; sid:577752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarber.com"; sid:577753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbasics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbasics.com"; sid:577754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioplan.com"; sid:577755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbookclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbookclub.com"; sid:577756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-book.com"; sid:577757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelet.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelet.company"; sid:577758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bracelets.com"; sid:577759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrella.com"; sid:577760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrightnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrightnews.com"; sid:577761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrightside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrightside.com"; sid:577762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-businessclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-businessclaim.com"; sid:577763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaller.com"; sid:577764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcallouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcallouts.com"; sid:577765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardprogram.com"; sid:577766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecouture.com"; sid:577767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepak.com"; sid:577768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareproducts.com"; sid:577769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarerapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarerapidtest.com"; sid:577770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarpetcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarpetcleaning.com"; sid:577771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchangeseverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchangeseverything.com"; sid:577772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchapter13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchapter13.com"; sid:577773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchapter7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchapter7.com"; sid:577774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcincog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcincog.com"; sid:577775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmd.com"; sid:577776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanjoyofmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanjoyofmom.com"; sid:577777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanups.com"; sid:577778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.wales"; sid:577779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicjobs.com"; sid:577780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcms.com"; sid:577781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcola.com"; sid:577782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoloradocontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoloradocontacttracing.com"; sid:577783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensationfund.com"; sid:577784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensationfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensationfundinfo.com"; sid:577785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensationfundinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensationfundinfo.net"; sid:577786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsortium.com"; sid:577787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontactapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontactapp.com"; sid:577788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-contact-trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-contact-trace.com"; sid:577789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttrace.com"; sid:577790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracingapp.com"; sid:577791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttrackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttrackingapp.com"; sid:577792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracking.com"; sid:577793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolph.com"; sid:577794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolservices.com"; sid:577795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooperate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooperate.com"; sid:577796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooperation.com"; sid:577797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcops902.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcops902.com"; sid:577798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronatestkit.com"; sid:577799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronavirustest.com"; sid:577800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorrect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorrect.com"; sid:577801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouldhavebeenavoided.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouldhavebeenavoided.com"; sid:577802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreatures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreatures.com"; sid:577803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure19.com"; sid:577804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutz.com"; sid:577805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddashboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddashboard.net"; sid:577806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideasytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideasytest.com"; sid:577807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemic19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemic19.com"; sid:577808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19investing.com"; sid:577809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevolution.com"; sid:577810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaq.net"; sid:577811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightergear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightergear.com"; sid:577812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmprotocol.com"; sid:577813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmprotocol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmprotocol.net"; sid:577814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfin.com"; sid:577815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-apartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-apartments.com"; sid:577816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.net"; sid:577817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesingles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesingles.com"; sid:577818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreespace.com"; sid:577819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundinfo.com"; sid:577820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundinfo.net"; sid:577821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundingfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundingfast.com"; sid:577822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-girls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-girls.com"; sid:577823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgirlz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgirlz.com"; sid:577824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgobalpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgobalpledge.com"; sid:577825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gone.com"; sid:577826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreener.com"; sid:577827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaircutchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaircutchallenge.com"; sid:577828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaircuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaircuts.com"; sid:577829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhcf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhcf.com"; sid:577830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthform.com"; sid:577831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthfund.com"; sid:577832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthprogram.com"; sid:577833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthprogram.net"; sid:577834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherocompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherocompensationfund.com"; sid:577835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherocompensationfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherocompensationfund.net"; sid:577836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroescompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroescompensationfund.com"; sid:577837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroescompensationfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroescompensationfund.net"; sid:577838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesfund.com"; sid:577839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherofund.com"; sid:577840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.net"; sid:577841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherosfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherosfund.com"; sid:577842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidibt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidibt.com"; sid:577843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitycard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitycard.com"; sid:577844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitycertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitycertificates.com"; sid:577845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityclub.com"; sid:577846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincident.com"; sid:577847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancedenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancedenial.com"; sid:577848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptioncases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptioncases.com"; sid:577849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotquarantine.com"; sid:577850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisfake.com"; sid:577851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9collar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9collar.com"; sid:577852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9collar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9collar.net"; sid:577853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9collars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9collars.com"; sid:577854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk-9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk-9.com"; sid:577855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9.com"; sid:577856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9.net"; sid:577857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknine.com"; sid:577858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifereset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifereset.com"; sid:577859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlive.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlive.today"; sid:577860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansusa.com"; sid:577861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlookback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlookback.com"; sid:577862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlooks.com"; sid:577863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lottery.com"; sid:577864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask2020.com"; sid:577865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskesi.com"; sid:577866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskstore.com"; sid:577867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalresearch.com"; sid:577868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmexico.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmexico.net"; sid:577869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilelab.com"; sid:577870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmolecular.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmolecular.com"; sid:577871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneytracker.com"; sid:577872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmu.com"; sid:577873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnator19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnator19.com"; sid:577874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnator.com"; sid:577875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-news.net"; sid:577876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnova.com"; sid:577877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidodortest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidodortest.com"; sid:577878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoggie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoggie.com"; sid:577879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoggy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoggy.com"; sid:577880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpath.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpath.net"; sid:577881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidph-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidph-donation.com"; sid:577882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpinata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpinata.com"; sid:577883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidportrait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidportrait.com"; sid:577884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppedirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppedirect.com"; sid:577885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayerstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayerstudy.com"; sid:577886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprisonrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprisonrelief.com"; sid:577887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofjob.com"; sid:577888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotech.com"; sid:577889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectivegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectivegear.com"; sid:577890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsychosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsychosis.com"; sid:577891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpurged.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpurged.com"; sid:577892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquiz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquiz.net"; sid:577893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidr3set.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidr3set.com"; sid:577894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ran.com"; sid:577895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rea.com"; sid:577896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrea.com"; sid:577897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecommendation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecommendation.com"; sid:577898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverytest.com"; sid:577899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcheckus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcheckus.com"; sid:577900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreply.com"; sid:577901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rescue.com"; sid:577902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistence.com"; sid:577903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreturntowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreturntowork.com"; sid:577904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe19.com"; sid:577905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.biz"; sid:577906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertified.contractors - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertified.contractors"; sid:577907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertified.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertified.education"; sid:577908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertified.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertified.training"; sid:577909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepaths.com"; sid:577910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferealestate.com"; sid:577911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetesting.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetesting.today"; sid:577912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetraining.com"; sid:577913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetypack.com"; sid:577914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysign.com"; sid:577915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalon.com"; sid:577916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsclinic.com"; sid:577917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidse19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidse19blog.com"; sid:577918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidse19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidse19.com"; sid:577919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidse19media.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidse19media.com"; sid:577920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserologyrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserologyrapidtest.com"; sid:577921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserologytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserologytest.com"; sid:577922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserumrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserumrapidtest.com"; sid:577923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shield.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shield.net"; sid:577924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsidehustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsidehustle.com"; sid:577925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsprotection.com"; sid:577926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatsfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatsfacts.com"; sid:577927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstockfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstockfinder.com"; sid:577928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalskills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalskills.com"; sid:577929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswifttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswifttest.com"; sid:577930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechsolutions.com"; sid:577931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteesamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteesamerica.com"; sid:577932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestclinic.com"; sid:577933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.express"; sid:577934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestgroup.com"; sid:577935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestguide.com"; sid:577936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingoc.com"; sid:577937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testsite.com"; sid:577938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsites.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsites.today"; sid:577939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtip.com"; sid:577940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoll.com"; sid:577941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtomyparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtomyparty.com"; sid:577942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingapps.com"; sid:577943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingcontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingcontact.com"; sid:577944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransportrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransportrelief.com"; sid:577945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduphold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduphold.com"; sid:577946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusmask.com"; sid:577947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventuregroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventuregroup.com"; sid:577948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdata.com"; sid:577949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusproduct.com"; sid:577950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusproducts.com"; sid:577951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusrapidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusrapidantibody.com"; sid:577952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaves.com"; sid:577953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebcam.com"; sid:577954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzapbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzapbot.com"; sid:577955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craftsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craftsagainstcorona.com"; sid:577956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currentepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currentepidemic.com"; sid:577957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dating-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dating-covid.com"; sid:577958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitvscovid.com"; sid:577959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitvscovidmusicfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitvscovidmusicfest.com"; sid:577960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dewacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dewacorona.com"; sid:577961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosiscovidpsychosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosiscovidpsychosis.com"; sid:577962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariesofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariesofthepandemic.com"; sid:577963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dicovid.com"; sid:577964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donarcovid19.com"; sid:577965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for downgoescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"downgoescovid19.com"; sid:577966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for downgoescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"downgoescovid.com"; sid:577967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovidmd.com"; sid:577968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edgcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edgcovidresponse.com"; sid:577969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edmondfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edmondfightingcovid.com"; sid:577970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elbitvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elbitvscovid19.com"; sid:577971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidsolutions.com"; sid:577972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcorona.today"; sid:577973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcovid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcovid19party.com"; sid:577974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-2020.com"; sid:577975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic911.com"; sid:577976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic911.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic911.net"; sid:577977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicfund.com"; sid:577978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmeasures.com"; sid:577979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-today.com"; sid:577980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ero-covid1919.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ero-covid1919.com"; sid:577981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ex-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ex-covid.com"; sid:577982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ex-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ex-covid.net"; sid:577983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask-corona.com"; sid:577984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshieldcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshieldcorona.com"; sid:577985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckucorona.com"; sid:577986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdbycovid.com"; sid:577987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcovidcontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcovidcontacttracing.com"; sid:577988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ferrisfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ferrisfightingcovid.com"; sid:577989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronausa.com"; sid:577990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronawithlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronawithlove.com"; sid:577991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid.net"; sid:577992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustestkit.com"; sid:577993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustestkits.com"; sid:577994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19testkit.com"; sid:577995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovid19testkits.com"; sid:577996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiscalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiscalpandemic.com"; sid:577997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesspostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesspostcorona.com"; sid:577998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fockcovid19.com"; sid:577999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frackcovid.com"; sid:578000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francevscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francevscoronavirus.com"; sid:578001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidclinic.com"; sid:578002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidclinic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidclinic.net"; sid:578003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronasucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronasucks.com"; sid:578004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronasucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronasucks.net"; sid:578005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronavacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronavacation.com"; sid:578006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19festival.com"; sid:578007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19sucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19sucks.com"; sid:578008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19sucks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19sucks.net"; sid:578009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundforcovid.com"; sid:578010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fysiotherapiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fysiotherapiecovid19.com"; sid:578011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmoneycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmoneycovid-19.com"; sid:578012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmoneycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmoneycovid19.com"; sid:578013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-coronavirus.com"; sid:578014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19recovery.com"; sid:578015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19recovery.com"; sid:578016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidhackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidhackathon.com"; sid:578017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidrecovery.com"; sid:578018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalrecoverycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalrecoverycovid-19.com"; sid:578019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalrecoverycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalrecoverycovid19.com"; sid:578020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gmhcapitalpartnerscovid19reliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gmhcapitalpartnerscovid19reliefprogram.com"; sid:578021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gmhuniversityhousingcovid19reliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gmhuniversityhousingcovid19reliefprogram.com"; sid:578022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goocorona.com"; sid:578023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotmycovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotmycovidcheck.com"; sid:578024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govcacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govcacovid.com"; sid:578025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grandprairiefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grandprairiefightingcovid.com"; sid:578026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graphitti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graphitti-covid19.com"; sid:578027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for growyourbusinesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"growyourbusinesscovid19.com"; sid:578028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcqcovid19.com"; sid:578029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hemerotecacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hemerotecacovid19.com"; sid:578030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroescovid-19.com"; sid:578031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmhcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmhcovid.com"; sid:578032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtracker.com"; sid:578033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homelesscovidresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homelesscovidresource.com"; sid:578034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howaftercorona.com"; sid:578035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howispentmycovidcash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howispentmycovidcash.com"; sid:578036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivepandemics.com"; sid:578037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydro4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydro4covid.com"; sid:578038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronavirusimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronavirusimmune.com"; sid:578039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovid19immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovid19immune.com"; sid:578040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotovercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotovercovid19.net"; sid:578041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcoronavirusimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcoronavirusimmune.com"; sid:578042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19clean.com"; sid:578043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovid19immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovid19immune.com"; sid:578044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidclean.com"; sid:578045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidimmune.com"; sid:578046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immigrantcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immigrantcovid19resources.com"; sid:578047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indinacovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indinacovid19response.com"; sid:578048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infertilityduringcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infertilityduringcoronavirus.com"; sid:578049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isrcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isrcoronado.com"; sid:578050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iuscorona.com"; sid:578051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobspostcovid.com"; sid:578052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jpcovid.com"; sid:578053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juscorona.com"; sid:578054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcovidit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcovidit.com"; sid:578055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k-coronamall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k-coronamall.com"; sid:578056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keystonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keystonecovid.com"; sid:578057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidofcovid19.com"; sid:578058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockcovid.com"; sid:578059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lancasterfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lancasterfightingcovid.com"; sid:578060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnedfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnedfromcorona.com"; sid:578061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafter-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafter-corona.com"; sid:578062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-postcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-postcorona.com"; sid:578063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostcovid.com"; sid:578064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for litigationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"litigationcovid19.com"; sid:578065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lividaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lividaboutcovid.com"; sid:578066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for living-aftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"living-aftercorona.com"; sid:578067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid19support.com"; sid:578068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid19support.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid19support.net"; sid:578069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncoronavirus.com"; sid:578070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makerscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makerscovid.net"; sid:578071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingaftercovid19.com"; sid:578072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingduringcovid19.com"; sid:578073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks4pandemic.com"; sid:578074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforsalecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforsalecoronavirus.com"; sid:578075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescoronaviruspourtous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescoronaviruspourtous.com"; sid:578076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescovid.biz"; sid:578077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-coronavirus.com"; sid:578078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalequipmentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalequipmentcoronavirus.com"; sid:578079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medisuncovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medisuncovidresearch.com"; sid:578080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medisuncovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medisuncovidsolutions.com"; sid:578081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetaftercorona.com"; sid:578082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for melbourneendofcovid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"melbourneendofcovid19party.com"; sid:578083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microscovid19.com"; sid:578084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for middleeastcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"middleeastcoronavirus.com"; sid:578085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigatecovid.com"; sid:578086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for munciecovidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"munciecovidhub.com"; sid:578087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahometesting.com"; sid:578088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahometestkit.com"; sid:578089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushometestkit.com"; sid:578090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19hometest.com"; sid:578091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19hometestkit.com"; sid:578092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19immunity.com"; sid:578093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.solutions"; sid:578094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid.club"; sid:578095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcompensation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcompensation.net"; sid:578096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhaircut.com"; sid:578097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemichaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemichaircut.com"; sid:578098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicproofbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicproofbusiness.com"; sid:578099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacuecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacuecovid19.com"; sid:578100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusbracelet.com"; sid:578101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19antibodybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19antibodybracelet.com"; sid:578102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19bracelet.com"; sid:578103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19heroes.com"; sid:578104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netlfix-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netlfix-covid19.com"; sid:578105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neumocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neumocovid19.com"; sid:578106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaworld.com"; sid:578107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19stats.com"; sid:578108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemicstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemicstats.com"; sid:578109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyork-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyork-coronavirus.com"; sid:578110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid4me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid4me.com"; sid:578111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomore-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomore-covid19.net"; sid:578112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nopecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nopecorona.com"; sid:578113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for now-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"now-coronavirus.com"; sid:578114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcovid.com"; sid:578115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcovid.net"; sid:578116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesfightingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesfightingcorona.com"; sid:578117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursesfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursesfightingcovid.com"; sid:578118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid-19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid-19claim.com"; sid:578119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid19claim.com"; sid:578120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid-19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid-19claims.com"; sid:578121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid19claims.com"; sid:578122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid-19.com"; sid:578123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid19.com"; sid:578124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyscovid19grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyscovid19grants.com"; sid:578125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for observatoriocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"observatoriocovid.com"; sid:578126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occoronavirustesting.com"; sid:578127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovidtesting.com"; sid:578128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcfightingcovid.com"; sid:578129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomafightingcovid.com"; sid:578130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oranges4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oranges4covid.com"; sid:578131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for our-corona-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"our-corona-chronicles.com"; sid:578132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonekillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonekillscovid19.com"; sid:578133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for palmerfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"palmerfightingcovid.com"; sid:578134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020survival.com"; sid:578135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic911.com"; sid:578136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic911.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic911.net"; sid:578137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicabatement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicabatement.com"; sid:578138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicafterparty.com"; sid:578139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessinterruption.com"; sid:578140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccash.com"; sid:578141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicco.com"; sid:578142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdamages.com"; sid:578143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdanceparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdanceparty.com"; sid:578144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeal.com"; sid:578145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-deals.com"; sid:578146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdealz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdealz.com"; sid:578147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiscounts.com"; sid:578148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicebt.com"; sid:578149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgrooves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgrooves.com"; sid:578150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichorserescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichorserescue.com"; sid:578151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinterruptioncases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinterruptioncases.com"; sid:578152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinterruptionclaims.com"; sid:578153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinterruption.com"; sid:578154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicisover.com"; sid:578155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawgroup.com"; sid:578156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclayoffs.com"; sid:578157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmusictour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmusictour.com"; sid:578158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmutual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmutual.com"; sid:578159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpal.net"; sid:578160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpandaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpandaproducts.com"; sid:578161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperformers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperformers.com"; sid:578162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpipes.com"; sid:578163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanninggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanninggroup.com"; sid:578164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpostcardproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpostcardproject.com"; sid:578165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-press.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-press.com"; sid:578166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpress.net"; sid:578167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.pro"; sid:578168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotections.com"; sid:578169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicraft.com"; sid:578170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrealestate-investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrealestate-investing.com"; sid:578171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrealestateinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrealestateinvesting.com"; sid:578172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriskinsuranceactclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriskinsuranceactclaims.com"; sid:578173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriskinsuranceactof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriskinsuranceactof2020.com"; sid:578174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetyprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetyprogram.com"; sid:578175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsheilds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsheilds.com"; sid:578176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspc.com"; sid:578177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstars.com"; sid:578178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteam.net"; sid:578179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicteevee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicteevee.com"; sid:578180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictour.com"; sid:578181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrend.com"; sid:578182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusprotections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusprotections.com"; sid:578183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicy.net"; sid:578184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallascovid19.com"; sid:578185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parealcovid.com"; sid:578186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingpostcorona.com"; sid:578187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentsupportduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentsupportduringcovid19.com"; sid:578188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peluangusahapascacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peluangusahapascacorona.com"; sid:578189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennypandemic.com"; sid:578190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pgxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pgxcovid.com"; sid:578191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pgxcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pgxcovid.net"; sid:578192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phoenixfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phoenixfightingcovid.com"; sid:578193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pleasestaysafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pleasestaysafecovid19.com"; sid:578194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirusworldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirusworldorder.com"; sid:578195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaworldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaworldorder.com"; sid:578196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronayourlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronayourlife.com"; sid:578197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19economy.com"; sid:578198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19norm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19norm.com"; sid:578199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19worldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19worldorder.com"; sid:578200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidbusiness.com"; sid:578201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcelebration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcelebration.com"; sid:578202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidconcert.com"; sid:578203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidconsulting.com"; sid:578204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddata.com"; sid:578205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddrug.com"; sid:578206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddrugs.com"; sid:578207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidevents.com"; sid:578208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfoundation.com"; sid:578209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfoundations.com"; sid:578210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhealth.com"; sid:578211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhelp.com"; sid:578212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidinsurance.com"; sid:578213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlaw.com"; sid:578214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmedia.com"; sid:578215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmedical.com"; sid:578216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnorm.com"; sid:578217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidparties.com"; sid:578218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpharma.com"; sid:578219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidplanet.com"; sid:578220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpro.com"; sid:578221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrelief.com"; sid:578222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidresearch.com"; sid:578223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidservices.com"; sid:578224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidspending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidspending.com"; sid:578225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsports.com"; sid:578226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsupplies.com"; sid:578227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidteam.com"; sid:578228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtech.com"; sid:578229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidvaccine.com"; sid:578230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworldorder.com"; sid:578231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicgroup.com"; sid:578232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic-investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic-investing.com"; sid:578233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemico.com"; sid:578234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicreality.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicreality.net"; sid:578235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemictech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemictech.com"; sid:578236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayersforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayersforcorona.com"; sid:578237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestiticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestiticovid.com"; sid:578238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencioncovid.com"; sid:578239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionesparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionesparacovid19.com"; sid:578240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovid.net"; sid:578241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovid19.net"; sid:578242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychversuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychversuscovid.com"; sid:578243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psychvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psychvscovid.com"; sid:578244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publichealthcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publichealthcovid-19.com"; sid:578245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qatarcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qatarcovid.today"; sid:578246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redoakfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redoakfightingcovid.com"; sid:578247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rehabilitationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rehabilitationcorona.com"; sid:578248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rehabrpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rehabrpcovid19.com"; sid:578249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcovid.com"; sid:578250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remaxwasagacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remaxwasagacovid19.com"; sid:578251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecoronatesting.com"; sid:578252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecoronavirustest.com"; sid:578253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecoronavirustesting.com"; sid:578254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remotecovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remotecovid19hometestkit.com"; sid:578255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportscovid19.com"; sid:578256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rescuecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rescuecovid.com"; sid:578257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resourcescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resourcescovid.com"; sid:578258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restartaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restartaftercovid19.com"; sid:578259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for revalidatiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"revalidatiecovid19.com"; sid:578260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reysincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reysincorona.com"; sid:578261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ribbonforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ribbonforcovid19.com"; sid:578262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riskmanagementpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riskmanagementpandemic.com"; sid:578263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubanbleucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubanbleucovid19.com"; sid:578264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovidaction.com"; sid:578265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safe-coronavirus.com"; sid:578266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetysuppliescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetysuppliescovid19.com"; sid:578267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samenincoronatijden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samenincoronatijden.com"; sid:578268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanicovid.com"; sid:578269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwyoucorona.com"; sid:578270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwyoucovid19.com"; sid:578271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seekpastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seekpastcovid.com"; sid:578272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovidantibodytest.com"; sid:578273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shapecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shapecovid.com"; sid:578274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessduringcovid19.com"; sid:578275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smellandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smellandcovid.com"; sid:578276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soko-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soko-corona.com"; sid:578277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spfacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spfacovid19.com"; sid:578278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadthewordnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadthewordnotcovid.com"; sid:578279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecovidcontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecovidcontacttracing.com"; sid:578280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilcovid.com"; sid:578281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopspreadncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopspreadncovid.com"; sid:578282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suckthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suckthecorona.com"; sid:578283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suitecovidsst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suitecovidsst.com"; sid:578284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for superherocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"superherocovid19.com"; sid:578285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suppliesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suppliesforcorona.com"; sid:578286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sydneyendofcovid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sydneyendofcovid19party.com"; sid:578287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamncovid.com"; sid:578288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellyourstorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellyourstorycovid19.com"; sid:578289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19domestico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19domestico.com"; sid:578290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testeur-temperature-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testeur-temperature-coronavirus.com"; sid:578291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testme-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testme-covid19.com"; sid:578292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texasfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texasfightingcovid.com"; sid:578293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronals.com"; sid:578294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronationblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronationblog.com"; sid:578295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19immunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19immunitytest.com"; sid:578296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19litigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19litigators.com"; sid:578297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19rapidtest.com"; sid:578298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19us.com"; sid:578299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19wall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19wall.com"; sid:578300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclub.com"; sid:578301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcon.com"; sid:578302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidimmunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidimmunitytest.com"; sid:578303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidproject.com"; sid:578304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrapidtest.com"; sid:578305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidyears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidyears.com"; sid:578306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidzone.com"; sid:578307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemictimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemictimes.com"; sid:578308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thermomethercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thermomethercorona.com"; sid:578309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivecovid.com"; sid:578310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timesofcovid-19.com"; sid:578311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tncovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tncovidsurvey.com"; sid:578312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todocovid.com"; sid:578313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoscontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoscontracovid.com"; sid:578314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tpkingofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tpkingofcovid.com"; sid:578315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traccoronavirus.com"; sid:578316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecoronavirus.com"; sid:578317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpbeatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpbeatscoronavirus.com"; sid:578318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpbeatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpbeatscovid19.com"; sid:578319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpbeatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpbeatscovid.com"; sid:578320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpedbycorona.com"; sid:578321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tutorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tutorcovid.com"; sid:578322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for two-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"two-corona.com"; sid:578323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twocorona.com"; sid:578324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twocorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twocorona.net"; sid:578325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uastopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uastopcovid19.com"; sid:578326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uescovid.com"; sid:578327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatscoronavirus.com"; sid:578328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatscovid19.com"; sid:578329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19settlement.com"; sid:578330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcontacttracing.com"; sid:578331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcontacttracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcontacttracking.com"; sid:578332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronaviruses.com"; sid:578333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watchcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watchcovid-19.com"; sid:578334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waxahachiefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waxahachiefightingcovid.com"; sid:578335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wc-covid19group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wc-covid19group.com"; sid:578336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovidtest.com"; sid:578337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westcoastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westcoastcovid.com"; sid:578338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wildlifepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wildlifepandemic.com"; sid:578339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wilmingtoncovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wilmingtoncovid19recovery.com"; sid:578340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercovid-19.com"; sid:578341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercovid19.com"; sid:578342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worksafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worksafecovid.com"; sid:578343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldecoaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldecoaftercovid.com"; sid:578344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandemocratvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandemocratvirus.com"; sid:578345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfree.com"; sid:578346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankicks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankicks.com"; sid:578347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmiracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmiracle.com"; sid:578348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantuozhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantuozhan.net"; sid:578349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusnyc.com"; sid:578350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyanxuan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyanxuan.com"; sid:578351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirusenespaol-c4b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirusenespaol-c4b.com"; sid:578352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19enespaol-brb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19enespaol-brb.com"; sid:578353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosupereelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosupereelcovid19.com"; sid:578354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosupereelcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosupereelcovid19.net"; sid:578355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcovid.com"; sid:578356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcovid.net"; sid:578357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zinccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zinccorona.com"; sid:578358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zinccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zinccoronavirus.com"; sid:578359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiecorona.com"; sid:578360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 147covid20.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"147covid20.email"; sid:578361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3254covid19.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3254covid19.email"; sid:578362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 419covid-19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"419covid-19disinfecting.com"; sid:578363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for achetermasquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"achetermasquecovid.com"; sid:578364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acorona-hancurdunia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acorona-hancurdunia.com"; sid:578365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronamask.com"; sid:578366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidmask.com"; sid:578367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid19shop.com"; sid:578368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19life.com"; sid:578369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliancefunding-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliancefunding-covid19.com"; sid:578370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaaftercovid.com"; sid:578371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ampun-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ampun-corona.com"; sid:578372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ampun-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ampun-covid19.com"; sid:578373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ancurkarna-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ancurkarna-corona.com"; sid:578374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ancurkarna-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ancurkarna-covid19.com"; sid:578375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angkacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angkacovid19.com"; sid:578376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angkara-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angkara-covid19.com"; sid:578377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angker-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angker-corona.com"; sid:578378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angker-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angker-covid19.com"; sid:578379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona.com"; sid:578380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronagear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronagear.com"; sid:578381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19-info.com"; sid:578382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19.tips"; sid:578383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.tips"; sid:578384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcovid.com"; sid:578385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidgate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidgate.com"; sid:578386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidwarfarecommand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidwarfarecommand.com"; sid:578387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antisarscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antisarscovid-19.com"; sid:578388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid-19.com"; sid:578389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attackcovid.com"; sid:578390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avcovid.com"; sid:578391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoid-covid.com"; sid:578392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayordev-covidestimator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayordev-covidestimator.com"; sid:578393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoworkaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoworkaftercovid.com"; sid:578394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for believecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"believecovid19.com"; sid:578395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for believeitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"believeitcovid19.com"; sid:578396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcureforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcureforcorona.com"; sid:578397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bewareofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bewareofcorona.com"; sid:578398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid-19news.com"; sid:578399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid19news.com"; sid:578400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for br-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"br-corona.com"; sid:578401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirus19protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirus19protection.com"; sid:578402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusppe.com"; sid:578403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidprotection.com"; sid:578404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancovid.net"; sid:578405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for candidcovidconfessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"candidcovidconfessions.com"; sid:578406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for candlesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"candlesforcovid.com"; sid:578407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for care4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"care4covid19.com"; sid:578408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casescovid-19.com"; sid:578409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciberseguridadentiemposdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciberseguridadentiemposdecoronavirus.com"; sid:578410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciberseguridadentiemposdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciberseguridadentiemposdelcoronavirus.com"; sid:578411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizencovid19.com"; sid:578412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizenscovid-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizenscovid-19support.com"; sid:578413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcorona.com"; sid:578414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimcovidnow.com"; sid:578415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanthecorona.com"; sid:578416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityforcovid.com"; sid:578417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concertsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concertsforcovid.com"; sid:578418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectforcovid19.com"; sid:578419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulentecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulentecovid.com"; sid:578420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulenticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulenticovid.com"; sid:578421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19hm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19hm.com"; sid:578422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19hmr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19hmr.com"; sid:578423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona24h.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona24h.com"; sid:578424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-adadimanaaja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-adadimanaaja.com"; sid:578425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandemotions.com"; sid:578426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandyouremotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandyouremotions.com"; sid:578427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabahrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabahrain.com"; sid:578428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.biz"; sid:578429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclamp.com"; sid:578430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacodex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacodex.com"; sid:578431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19news.com"; sid:578432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrackers.com"; sid:578433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreature.com"; sid:578434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureindia.com"; sid:578435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-data.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-data.net"; sid:578436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiscrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiscrimination.com"; sid:578437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosrockband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosrockband.com"; sid:578438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaduck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaduck.com"; sid:578439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelbow.com"; sid:578440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemotionschool.com"; sid:578441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemotions.com"; sid:578442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessentialworkerlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessentialworkerlawfirm.com"; sid:578443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafabicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafabicmask.com"; sid:578444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacecovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacecovers.com"; sid:578445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemask.club"; sid:578446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacilitymanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacilitymanagement.com"; sid:578447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecruise.com"; sid:578448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreerentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreerentals.com"; sid:578449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeresort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeresort.com"; sid:578450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafundlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafundlawyer.com"; sid:578451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafused.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafused.com"; sid:578452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagame.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagame.life"; sid:578453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronago.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronago.club"; sid:578454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagranola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagranola.com"; sid:578455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gum.com"; sid:578456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaircut.com"; sid:578457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsani.com"; sid:578458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsanitiser.com"; sid:578459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaharitasicanli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaharitasicanli.com"; sid:578460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaze.com"; sid:578461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahighway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahighway.com"; sid:578462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotelpac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotelpac.com"; sid:578463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immunizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immunizer.com"; sid:578464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunizer.com"; sid:578465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajordan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajordan.com"; sid:578466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajusticenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajusticenow.com"; sid:578467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakee.com"; sid:578468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ksa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ksa.com"; sid:578469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakuwait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakuwait.com"; sid:578470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-logy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-logy.com"; sid:578471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.club"; sid:578472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamed.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamed.supply"; sid:578473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedsupply.com"; sid:578474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminder.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminder.club"; sid:578475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoonshine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoonshine.com"; sid:578476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneutralizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneutralizer.com"; sid:578477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanimakenai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanimakenai.com"; sid:578478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanimakenai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanimakenai.net"; sid:578479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanomapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanomapa.com"; sid:578480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanovelties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanovelties.com"; sid:578481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonearth.com"; sid:578482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapac.com"; sid:578483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapies.com"; sid:578484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplug.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplug.net"; sid:578485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaportals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaportals.com"; sid:578486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqatar.com"; sid:578487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareusablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareusablemask.com"; sid:578488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarisk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarisk.net"; sid:578489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasabbatical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasabbatical.com"; sid:578490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafecertified.com"; sid:578491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasatta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasatta.com"; sid:578492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasattamatka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasattamatka.com"; sid:578493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavestheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavestheworld.com"; sid:578494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-serembray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-serembray.com"; sid:578495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldlabs.com"; sid:578496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldlabs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldlabs.net"; sid:578497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashine.com"; sid:578498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shock-sigotojutu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shock-sigotojutu.com"; sid:578499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soli.com"; sid:578500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoli.com"; sid:578501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-soli.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-soli.net"; sid:578502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoli.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoli.net"; sid:578503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronason.com"; sid:578504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatslive.com"; sid:578505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilized.com"; sid:578506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastories.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastories.world"; sid:578507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrology.com"; sid:578508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-studie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-studie.com"; sid:578509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunset.com"; sid:578510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurveillance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurveillance.com"; sid:578511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvaccine.com"; sid:578512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasvaccines.com"; sid:578513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatime.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatime.media"; sid:578514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoast.com"; sid:578515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruthtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruthtracker.com"; sid:578516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturkiyeharitasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturkiyeharitasi.com"; sid:578517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccination.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccination.club"; sid:578518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveg.com"; sid:578519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviricos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviricos.com"; sid:578520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19money.com"; sid:578521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19nhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19nhl.hockey"; sid:578522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19nhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19nhl.hockey"; sid:578523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19pga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19pga.golf"; sid:578524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19pga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19pga.golf"; sid:578525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safecruise.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safecruise.voyage"; sid:578526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safecruise.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safecruise.voyage"; sid:578527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safegoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safegoldenknights.gold"; sid:578528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safegoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safegoldenknights.gold"; sid:578529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safegoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safegoldenknights.hockey"; sid:578530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safegoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safegoldenknights.hockey"; sid:578531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.golf"; sid:578532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.golf"; sid:578533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.hockey"; sid:578534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.hockey"; sid:578535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safelasvegasraiders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safelasvegasraiders.com"; sid:578536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safemlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safemlb.com"; sid:578537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safenba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safenba.com"; sid:578538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safenhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safenhl.hockey"; sid:578539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safenhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safenhl.hockey"; sid:578540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safepga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safepga.com"; sid:578541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safepga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safepga.golf"; sid:578542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safepga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safepga.golf"; sid:578543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safeufc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safeufc.com"; sid:578544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safevegasgoldenknights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safevegasgoldenknights.com"; sid:578545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safevegasgoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safevegasgoldenknights.gold"; sid:578546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safevegasgoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safevegasgoldenknights.gold"; sid:578547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safevegasgoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safevegasgoldenknights.hockey"; sid:578548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safevegasgoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safevegasgoldenknights.hockey"; sid:578549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safevegasknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safevegasknights.gold"; sid:578550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safevegasknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safevegasknights.gold"; sid:578551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safevegasknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safevegasknights.hockey"; sid:578552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safevegasknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safevegasknights.hockey"; sid:578553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019.biz"; sid:578554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020productions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020productions.com"; sid:578555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandchrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandchrist.com"; sid:578556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandemotions.com"; sid:578557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandyouremotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandyouremotions.com"; sid:578558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarevolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarevolunteers.com"; sid:578559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarnage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarnage.com"; sid:578560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclass-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclass-action.com"; sid:578561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerservice.com"; sid:578562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-colds-flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-colds-flu.com"; sid:578563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoldsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoldsflu.com"; sid:578564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollegeprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollegeprep.com"; sid:578565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensation.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensation.biz"; sid:578566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationclaims.com"; sid:578567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfinement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfinement.com"; sid:578568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontroltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontroltest.com"; sid:578569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19vaccines.com"; sid:578570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-database.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-database.com"; sid:578571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfecting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfecting.net"; sid:578572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemotionschool.com"; sid:578573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemotions.com"; sid:578574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemotionsschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemotionsschool.com"; sid:578575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesfamilyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesfamilyprotection.com"; sid:578576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesprotection.com"; sid:578577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfm.com"; sid:578578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundattorney.com"; sid:578579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundinfo.com"; sid:578580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundinformation.com"; sid:578581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundlaw.com"; sid:578582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundlawfirm.com"; sid:578583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcertificate.com"; sid:578584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpamerica.com"; sid:578585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpme.com"; sid:578586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoupdate.com"; sid:578587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisaziopigvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisaziopigvirus.com"; sid:578588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatestupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatestupdate.com"; sid:578589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitlawyers.com"; sid:578590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslo.com"; sid:578591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusltd.com"; sid:578592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaps.net"; sid:578593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.club"; sid:578594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalmalpractice.com"; sid:578595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalresearch.com"; sid:578596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneymatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneymatters.com"; sid:578597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusical.com"; sid:578598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsgroup.com"; sid:578599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusnyc.com"; sid:578600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnowdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnowdallas.com"; sid:578601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustwo.com"; sid:578602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususastats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususastats.com"; sid:578603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususefullinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususefullinks.com"; sid:578604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususstats.com"; sid:578605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccination.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccination.club"; sid:578606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelocations.com"; sid:578607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarrior.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarrior.world"; sid:578608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld2020.com"; sid:578609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-map.net"; sid:578610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldwidenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldwidenews.com"; sid:578611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavision.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavision.net"; sid:578612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavizor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavizor.com"; sid:578613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaarschuwing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaarschuwing.com"; sid:578614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawashablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawashablemask.com"; sid:578615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhileblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhileblack.com"; sid:578616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhileblack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhileblack.net"; sid:578617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhiskey.com"; sid:578618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkforce.com"; sid:578619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaye.com"; sid:578620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov19epidemic.com"; sid:578621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covepidemic.com"; sid:578622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1911172019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1911172019.com"; sid:578623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192112020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192112020.com"; sid:578624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ado.com"; sid:578625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-after.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-after.com"; sid:578626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19age.com"; sid:578627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19americans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19americans.com"; sid:578628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andemotions.com"; sid:578629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andyouremotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andyouremotions.com"; sid:578630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodys.com"; sid:578631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19arabi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19arabi.com"; sid:578632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ask.com"; sid:578633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyanswers.com"; sid:578634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyhelpcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyhelpcom.com"; sid:578635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bat.com"; sid:578636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19believe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19believe.com"; sid:578637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19believeit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19believeit.com"; sid:578638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bireyseliadeler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bireyseliadeler.com"; sid:578639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizconsulting.com"; sid:578640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blacklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blacklist.com"; sid:578641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19booth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19booth.com"; sid:578642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19booths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19booths.com"; sid:578643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19booths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19booths.com"; sid:578644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brands.com"; sid:578645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carevolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carevolunteer.com"; sid:578646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carevolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carevolunteers.com"; sid:578647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carnage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carnage.com"; sid:578648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cashloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cashloans.com"; sid:578649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbn.com"; sid:578650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certs.com"; sid:578651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinasfault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinasfault.com"; sid:578652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claimsprofessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claimsprofessionals.com"; sid:578653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19class-action.com"; sid:578654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleannow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleannow.com"; sid:578655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleantech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleantech.com"; sid:578656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupdc.com"; sid:578657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupfl.com"; sid:578658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupga.com"; sid:578659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanupmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanupmi.com"; sid:578660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cologne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cologne.com"; sid:578661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companies.com"; sid:578662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-compass.com"; sid:578663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-compass.com"; sid:578664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compass.com"; sid:578665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19conspirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19conspirators.com"; sid:578666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-corona-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-corona-virus.net"; sid:578667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corps.com"; sid:578668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19courier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19courier.com"; sid:578669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creatives.com"; sid:578670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dat.com"; sid:578671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathregistry.com"; sid:578672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathtally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathtally.com"; sid:578673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-decon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-decon.com"; sid:578674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19depo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19depo.com"; sid:578675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destruction.com"; sid:578676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disease2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disease2019.com"; sid:578677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dlt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dlt.com"; sid:578678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donaciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donaciones.com"; sid:578679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donaciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donaciones.com"; sid:578680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drs.com"; sid:578681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19educated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19educated.com"; sid:578682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emotionschool.com"; sid:578683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emotions.com"; sid:578684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emotionsschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emotionsschool.com"; sid:578685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epicdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epicdesign.com"; sid:578686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epicrainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epicrainbow.com"; sid:578687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19espana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19espana.com"; sid:578688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialworkerslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialworkerslawfirm.com"; sid:578689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-etiquette.com"; sid:578690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19events.com"; sid:578691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemask.club"; sid:578692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familiesprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familiesprotection.com"; sid:578693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19figures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19figures.net"; sid:578694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fm.com"; sid:578695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forecast.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forecast.net"; sid:578696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemeds.com"; sid:578697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundlawyer.com"; sid:578698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gh.com"; sid:578699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gilabro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gilabro.com"; sid:578700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalshift.com"; sid:578701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalshift.com"; sid:578702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goldrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goldrush.com"; sid:578703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19government.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19government.com"; sid:578704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graphqlapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graphqlapi.com"; sid:578705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grimreaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grimreaper.com"; sid:578706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grip.com"; sid:578707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guard.net"; sid:578708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19haircutchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19haircutchallenge.com"; sid:578709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haircutchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haircutchallenge.com"; sid:578710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19haircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19haircut.com"; sid:578711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hancurdunia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hancurdunia.com"; sid:578712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handsanitiser.com"; sid:578713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hats.com"; sid:578714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcertificate.com"; sid:578715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcertification.com"; sid:578716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hollywood.com"; sid:578717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hometests.com"; sid:578718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitalizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitalizations.com"; sid:578719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-huffserem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-huffserem.com"; sid:578720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunitycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunitycards.com"; sid:578721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-immunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-immunization.com"; sid:578722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infection2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infection2019.com"; sid:578723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info247.com"; sid:578724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infoupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infoupdate.com"; sid:578725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infoupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infoupdates.com"; sid:578726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19istanbul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19istanbul.com"; sid:578727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19justicenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19justicenow.com"; sid:578728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killercleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killercleaningservice.com"; sid:578729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kn95masks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kn95masks.biz"; sid:578730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19layoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19layoff.com"; sid:578731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ledger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ledger.com"; sid:578732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19license.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19license.com"; sid:578733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19localnewsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19localnewsupdate.com"; sid:578734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19luasbanget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19luasbanget.com"; sid:578735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-magazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-magazine.com"; sid:578736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maps.com"; sid:578737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mascaras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mascaras.com"; sid:578738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mask2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mask2020.com"; sid:578739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mask.club"; sid:578740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19massacre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19massacre.com"; sid:578741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19massage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19massage.com"; sid:578742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-matome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-matome.com"; sid:578743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mdx.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mdx.solutions"; sid:578744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.memorial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.memorial"; sid:578745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mendunia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mendunia.com"; sid:578746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mingle.com"; sid:578747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortality.com"; sid:578748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19necessity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19necessity.com"; sid:578749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nhl.hockey"; sid:578750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nhl.hockey"; sid:578751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19niosh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19niosh.com"; sid:578752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19novel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19novel.com"; sid:578753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-now.com"; sid:578754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19odr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19odr.com"; sid:578755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19odr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19odr.net"; sid:578756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offer.com"; sid:578757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pac.com"; sid:578758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19parenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19parenting.com"; sid:578759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr.business"; sid:578760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr.solutions"; sid:578761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pga.golf"; sid:578762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pga.golf"; sid:578763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19physio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19physio.com"; sid:578764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19physiotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19physiotherapy.com"; sid:578765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-physiotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-physiotherapy.com"; sid:578766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physiotherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physiotherapy.com"; sid:578767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19precheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19precheck.com"; sid:578768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19precheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19precheck.com"; sid:578769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19predictions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19predictions.net"; sid:578770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privatefitclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privatefitclub.com"; sid:578771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19productions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19productions.com"; sid:578772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projectllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projectllc.com"; sid:578773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19qanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19qanda.com"; sid:578774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rainbow.com"; sid:578775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reaper.com"; sid:578776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverylawyer.com"; sid:578777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19register.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19register.com"; sid:578778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rehabosteo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rehabosteo.com"; sid:578779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reminderstech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reminderstech.com"; sid:578780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsepackage.com"; sid:578781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reusablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reusablemask.com"; sid:578782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rip.com"; sid:578783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-risk-scan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-risk-scan.com"; sid:578784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.business"; sid:578785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.services"; sid:578786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.solutions"; sid:578787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.support"; sid:578788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecruise.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecruise.voyage"; sid:578789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecruise.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecruise.voyage"; sid:578790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safegoldenknights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safegoldenknights.com"; sid:578791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safegoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safegoldenknights.gold"; sid:578792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safegoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safegoldenknights.gold"; sid:578793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safegoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safegoldenknights.hockey"; sid:578794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safegoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safegoldenknights.hockey"; sid:578795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.golf"; sid:578796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.golf"; sid:578797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.hockey"; sid:578798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.hockey"; sid:578799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjury.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjury.care"; sid:578800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjury.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjury.clinic"; sid:578801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjuryrehab.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjuryrehab.care"; sid:578802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjuryrehab.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjuryrehab.clinic"; sid:578803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjury.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjury.solutions"; sid:578804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjurysolutions.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjurysolutions.care"; sid:578805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjurysolutions.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjurysolutions.clinic"; sid:578806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjurysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjurysolutions.com"; sid:578807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeinjurysolutions.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeinjurysolutions.healthcare"; sid:578808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safelasvegasraiders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safelasvegasraiders.com"; sid:578809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safenfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safenfl.com"; sid:578810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safenhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safenhl.hockey"; sid:578811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safenhl.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safenhl.hockey"; sid:578812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safepga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safepga.com"; sid:578813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safepga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safepga.golf"; sid:578814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safepga.golf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safepga.golf"; sid:578815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19saferadiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19saferadiers.com"; sid:578816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safevegasgoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safevegasgoldenknights.gold"; sid:578817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevegasgoldenknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevegasgoldenknights.gold"; sid:578818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safevegasgoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safevegasgoldenknights.hockey"; sid:578819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevegasgoldenknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevegasgoldenknights.hockey"; sid:578820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safevegasknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safevegasknights.gold"; sid:578821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevegasknights.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevegasknights.gold"; sid:578822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safevegasknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safevegasknights.hockey"; sid:578823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevegasknights.hockey - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevegasknights.hockey"; sid:578824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfcertification.com"; sid:578825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shtf.com"; sid:578826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spassport.com"; sid:578827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statupdate.com"; sid:578828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statupdates.com"; sid:578829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stipend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stipend.com"; sid:578830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stipend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stipend.com"; sid:578831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strokeupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strokeupdate.com"; sid:578832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19style.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19style.com"; sid:578833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplydepot.com"; sid:578834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surge.com"; sid:578835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivortshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivortshirts.com"; sid:578836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swabbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swabbooth.com"; sid:578837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabbooth.com"; sid:578838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swabbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swabbooths.com"; sid:578839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabbooths.com"; sid:578840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomsandtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomsandtreatments.com"; sid:578841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19szczepionka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19szczepionka.com"; sid:578842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxhelpline.com"; sid:578843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemeddoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemeddoctor.com"; sid:578844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemeddoctor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemeddoctor.net"; sid:578845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemeddoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemeddoctors.com"; sid:578846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemeddoctors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemeddoctors.net"; sid:578847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test.center"; sid:578848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test.expert"; sid:578849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingclinics.com"; sid:578850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingkit.net"; sid:578851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-kit.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-kit.center"; sid:578852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnowdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnowdallas.com"; sid:578853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test.solutions"; sid:578854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test.tips"; sid:578855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tiger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tiger.com"; sid:578856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-timeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-timeline.com"; sid:578857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tkn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tkn.com"; sid:578858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tkn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tkn.com"; sid:578859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topas.com"; sid:578860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19topos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19topos.com"; sid:578861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topos.com"; sid:578862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveling.com"; sid:578863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentadvice.com"; sid:578864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-treatmenttrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-treatmenttrends.com"; sid:578865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trends.net"; sid:578866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-turkiye.com"; sid:578867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uk.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uk.today"; sid:578868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ushometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ushometest.com"; sid:578869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccination.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccination.club"; sid:578870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.club"; sid:578871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viroxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viroxx.com"; sid:578872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus2019.com"; sid:578873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscases.com"; sid:578874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscrisis2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscrisis2020.com"; sid:578875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19volunteercorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19volunteercorps.com"; sid:578876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vte.com"; sid:578877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washablemask.com"; sid:578878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whileblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whileblack.com"; sid:578879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whileblack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whileblack.net"; sid:578880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wontwin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wontwin.com"; sid:578881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-world-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-world-news.com"; sid:578882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xpress.com"; sid:578883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2025.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2025.com"; sid:578884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3dmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3dmaps.com"; sid:578885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvisorysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvisorysystem.com"; sid:578886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvisorysystem.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvisorysystem.net"; sid:578887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandemotions.com"; sid:578888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandyouremotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandyouremotions.com"; sid:578889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidant.com"; sid:578890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestandhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestandhelp.com"; sid:578891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytester.com"; sid:578892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytesting2u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytesting2u.com"; sid:578893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestinglabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestinglabs.com"; sid:578894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingnow.com"; sid:578895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingonthego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingonthego.com"; sid:578896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidant.net"; sid:578897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbat.com"; sid:578898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbigroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbigroup.com"; sid:578899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbilawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbilawyers.com"; sid:578900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooths.com"; sid:578901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboston.com"; sid:578902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreaks.com"; sid:578903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalc.net"; sid:578904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanopy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanopy.com"; sid:578905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantsurf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantsurf.com"; sid:578906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcase.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcase.today"; sid:578907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashsolutions.com"; sid:578908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-center.com"; sid:578909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcerts.com"; sid:578910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharities.com"; sid:578911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchats.com"; sid:578912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchoad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchoad.com"; sid:578913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchoid.com"; sid:578914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclamp.com"; sid:578915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantech.com"; sid:578916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleartesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleartesting.com"; sid:578917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclimax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclimax.com"; sid:578918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinic.net"; sid:578919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclubs.com"; sid:578920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoasters.com"; sid:578921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcologne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcologne.com"; sid:578922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoloringbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoloringbook.com"; sid:578923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolour.com"; sid:578924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplaining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplaining.com"; sid:578925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant.biz"; sid:578926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnected.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnected.net"; sid:578927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcore.com"; sid:578928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronaviruses.com"; sid:578929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountytracker.com"; sid:578930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovered.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovered.net"; sid:578931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredentialsinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredentialsinitiative.com"; sid:578932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreds.com"; sid:578933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcubicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcubicle.com"; sid:578934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurtain.com"; sid:578935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurtains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurtains.com"; sid:578936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddc.com"; sid:578937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenders.com"; sid:578938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscrimination.com"; sid:578939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddogcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddogcare.com"; sid:578940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddontsnowboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddontsnowboard.com"; sid:578941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrive.com"; sid:578942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemotions.com"; sid:578943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendfight.com"; sid:578944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendfight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendfight.net"; sid:578945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenemy.com"; sid:578946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentertainment.com"; sid:578947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covident.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covident.net"; sid:578948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideradication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideradication.com"; sid:578949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexperiment.com"; sid:578950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideyewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideyewear.com"; sid:578951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfabicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfabicmask.com"; sid:578952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemask.club"; sid:578953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforums.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforums.net"; sid:578954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecruise.com"; sid:578955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehotel.com"; sid:578956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeresort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeresort.com"; sid:578957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetour.com"; sid:578958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetourism.com"; sid:578959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gate.com"; sid:578960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgate.net"; sid:578961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphed.com"; sid:578962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraph.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraph.world"; sid:578963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhairchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhairchallenge.com"; sid:578964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhairdochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhairdochallenge.com"; sid:578965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsani.com"; sid:578966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthpass.com"; sid:578967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthpass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthpass.net"; sid:578968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpandtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpandtest.com"; sid:578969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-helpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-helpers.com"; sid:578970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.fund"; sid:578971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.team"; sid:578972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheros.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheros.net"; sid:578973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholyday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholyday.com"; sid:578974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeantigentest.com"; sid:578975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehealth.com"; sid:578976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-home-test.com"; sid:578977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-home-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-home-test.net"; sid:578978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotelpac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotelpac.com"; sid:578979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididentify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididentify.com"; sid:578980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitycards.com"; sid:578981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunity-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunity-test.com"; sid:578982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-in-diabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-in-diabetes.com"; sid:578983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformed.com"; sid:578984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinindia.com"; sid:578985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.world"; sid:578986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjusticenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjusticenow.com"; sid:578987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkafasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkafasi.com"; sid:578988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-key.com"; sid:578989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidko.com"; sid:578990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkvetching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkvetching.com"; sid:578991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlife2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlife2019.com"; sid:578992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.club"; sid:578993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdiy.com"; sid:578994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskhq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskhq.com"; sid:578995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmax.net"; sid:578996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedtweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedtweets.com"; sid:578997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeme.com"; sid:578998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemes.co - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemes.co"; sid:578999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnarratives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnarratives.com"; sid:579000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnarratives.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnarratives.net"; sid:579001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneutralizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneutralizer.com"; sid:579002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-no.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-no.com"; sid:579003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nurse.com"; sid:579004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nyc.com"; sid:579005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocitin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocitin.com"; sid:579006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocitin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocitin.net"; sid:579007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomax.com"; sid:579008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomax.net"; sid:579009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomol.com"; sid:579010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomol.net"; sid:579011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomycin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomycin.com"; sid:579012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomycin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomycin.net"; sid:579013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopiravir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopiravir.com"; sid:579014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopiravir.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopiravir.net"; sid:579015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pac.com"; sid:579016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpacnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpacnow.com"; sid:579017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpacpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpacpro.com"; sid:579018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemi.com"; sid:579019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpause.com"; sid:579020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pcr.com"; sid:579021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpercapita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpercapita.com"; sid:579022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.pet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.pet"; sid:579023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpet.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpet.care"; sid:579024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpetcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpetcare.net"; sid:579025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanningtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanningtools.com"; sid:579026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpostcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpostcode.com"; sid:579027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionteam.com"; sid:579028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectmasks.com"; sid:579029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinecurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinecurtain.com"; sid:579030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremdesivir.com"; sid:579031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchquestions.com"; sid:579032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistant.com"; sid:579033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepackage.com"; sid:579034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepackage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepackage.net"; sid:579035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreuseablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreuseablemask.com"; sid:579036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepath.com"; sid:579037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetestdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetestdrive.com"; sid:579038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetesting.com"; sid:579039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetestsite.com"; sid:579040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetestsites.com"; sid:579041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetytesting.com"; sid:579042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalessurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalessurvival.com"; sid:579043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalessurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalessurvivalguide.com"; sid:579044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscanme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscanme.com"; sid:579045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscanpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscanpoint.com"; sid:579046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentiment.com"; sid:579047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshtf.com"; sid:579048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilence.com"; sid:579049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouls.com"; sid:579050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedometer.com"; sid:579051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstipend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstipend.com"; sid:579052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstockmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstockmarket.com"; sid:579053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoppers.com"; sid:579054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstriptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstriptest.com"; sid:579055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplymarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplymarket.com"; sid:579056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplystation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplystation.com"; sid:579057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurveil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurveil.com"; sid:579058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalgame.com"; sid:579059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabbooth.com"; sid:579060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabbooths.com"; sid:579061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestandhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestandhelp.com"; sid:579062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.center"; sid:579063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.company"; sid:579064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.expert"; sid:579065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingproject.com"; sid:579066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-kit.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-kit.center"; sid:579067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.support"; sid:579068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttent.com"; sid:579069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheend.com"; sid:579070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthirst.com"; sid:579071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtopos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtopos.com"; sid:579072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerr.com"; sid:579073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveling.com"; sid:579074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-treatment-trends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-treatment-trends.com"; sid:579075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmenttrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmenttrends.com"; sid:579076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtriumph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtriumph.com"; sid:579077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtriumphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtriumphs.com"; sid:579078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccination.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccination.club"; sid:579079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccine.club"; sid:579080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.club"; sid:579081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventurecapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventurecapital.com"; sid:579082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarvet.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarvet.us"; sid:579083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashablemask.com"; sid:579084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwill.com"; sid:579085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworlddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworlddata.com"; sid:579086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldmap.com"; sid:579087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldonline.com"; sid:579088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldtest.com"; sid:579089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xmasks.com"; sid:579090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxmasks.com"; sid:579091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxxi.com"; sid:579092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditcoronavirus.com"; sid:579093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cry4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cry4corona.com"; sid:579094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csra-covid19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csra-covid19facts.com"; sid:579095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvecoronavirus.com"; sid:579096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid19mask.com"; sid:579097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dancethecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dancethecorona.com"; sid:579098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysaftercoronavirus.com"; sid:579099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysaftercovid19.com"; sid:579100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daysbeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daysbeforecovid19.com"; sid:579101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demolishcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demolishcovid.com"; sid:579102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desafiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desafiocovid.com"; sid:579103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descovid-19.com"; sid:579104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionscoronavirus.com"; sid:579105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionscovid19.com"; sid:579106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacionescoronavirus.com"; sid:579107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacionescovid19.com"; sid:579108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacionscoronavirus.com"; sid:579109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacionscovid19.com"; sid:579110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroythecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroythecovid.com"; sid:579111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dharwadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dharwadcovid19.com"; sid:579112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difficultcoronaemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difficultcoronaemotions.com"; sid:579113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difficultcovid19emotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difficultcovid19emotions.com"; sid:579114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difficultcovidemotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difficultcovidemotions.com"; sid:579115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmvfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmvfightingcovid.com"; sid:579116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donationcorona.com"; sid:579117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontcatchacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontcatchacovid.com"; sid:579118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontpandemicuv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontpandemicuv.com"; sid:579119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebonyicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebonyicovid19.com"; sid:579120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecocorona.com"; sid:579121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for education-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"education-covid19.com"; sid:579122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ekiticovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ekiticovid19response.com"; sid:579123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elginfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elginfightingcovid.com"; sid:579124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emanuelfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emanuelfightingcovid.com"; sid:579125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionalliteracyforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionalliteracyforcorona.com"; sid:579126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionalliteracyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionalliteracyforcoronavirus.com"; sid:579127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionalliteracyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionalliteracyforcovid19.com"; sid:579128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionalliteracyforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionalliteracyforcovid.com"; sid:579129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionsandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionsandcorona.com"; sid:579130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionsandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionsandcoronavirus.com"; sid:579131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionsandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionsandcovid19.com"; sid:579132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emotionsandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emotionsandcovid.com"; sid:579133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcovideo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcovideo19.com"; sid:579134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiohealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiohealthcovid.com"; sid:579135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eytool-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eytool-covid19.com"; sid:579136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceofcovid19.net"; sid:579137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceofcovid.net"; sid:579138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for falsepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"falsepandemics.com"; sid:579139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familyfirstcoronavirusresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familyfirstcoronavirusresponseact.com"; sid:579140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscovid19deaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscovid19deaths.com"; sid:579141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalcovid19testing.com"; sid:579142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronashop.com"; sid:579143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.life"; sid:579144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthecovid-19.com"; sid:579145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fit4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fit4covid.com"; sid:579146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidinsuranceclaim.com"; sid:579147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromwuhanwithlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromwuhanwithlove.com"; sid:579148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-corona.net"; sid:579149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.club"; sid:579150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid19ecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid19ecuador.com"; sid:579151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacovidmask.com"; sid:579152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronajustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronajustice.com"; sid:579153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusimmunitycard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusimmunitycard.com"; sid:579154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19clean.com"; sid:579155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19justice.com"; sid:579156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidjustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidjustice.com"; sid:579157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gincovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gincovid.biz"; sid:579158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givecovidplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givecovidplasma.com"; sid:579159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronapendemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronapendemic.com"; sid:579160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19heros.com"; sid:579161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19shift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19shift.com"; sid:579162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19shift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19shift.com"; sid:579163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicrecovery.com"; sid:579164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalshiftcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalshiftcovid-19.com"; sid:579165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalshiftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalshiftcovid19.com"; sid:579166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalshiftcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalshiftcovid.com"; sid:579167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackathoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackathoncovid19.com"; sid:579168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltoncovid19.com"; sid:579169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid19peoples.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid19peoples.life"; sid:579170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovidlegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovidlegal.com"; sid:579171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofthecoronavirus.com"; sid:579172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronakit.com"; sid:579173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidkit.com"; sid:579174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houseofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houseofcovid.com"; sid:579175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcovid19changedtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcovid19changedtheworld.com"; sid:579176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoyoucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoyoucorona.com"; sid:579177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconcovid19.com"; sid:579178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid.com"; sid:579179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imagingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imagingcovid.com"; sid:579180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indexcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indexcorona.com"; sid:579181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacoronavirus.net"; sid:579182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiavscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiavscorona.com"; sid:579183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informasicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informasicovid19.com"; sid:579184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instockcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instockcoronamask.com"; sid:579185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instockcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instockcovid19mask.com"; sid:579186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instockcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instockcovidmask.com"; sid:579187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irsgovcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irsgovcoronavirus.com"; sid:579188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcovid.com"; sid:579189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jakicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jakicovid19.com"; sid:579190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jakicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jakicovid19.net"; sid:579191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jkcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jkcovid19tracker.com"; sid:579192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joburgfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joburgfightingcovid.com"; sid:579193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justicecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justicecorona.com"; sid:579194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karmacorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karmacorona19.com"; sid:579195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karmacoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karmacoronakit.com"; sid:579196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karmacovid19.com"; sid:579197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kbcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kbcovidtesting.com"; sid:579198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kckscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kckscoronavirus.com"; sid:579199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kmhstykcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kmhstykcovid-19.com"; sid:579200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuchcorona.com"; sid:579201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidtest.com"; sid:579202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancovid19.net"; sid:579203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcovid19.world"; sid:579204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for licovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"licovidlaw.com"; sid:579205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liilycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liilycovid19testing.com"; sid:579206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillyccovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillyccovid19testing.com"; sid:579207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid119testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid119testing.com"; sid:579208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid199testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid199testing.com"; sid:579209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19tedting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19tedting.com"; sid:579210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19teesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19teesting.com"; sid:579211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testiing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testiing.com"; sid:579212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testting.com"; sid:579213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19testung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19testung.com"; sid:579214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovid19ttesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovid19ttesting.com"; sid:579215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lillycovidd19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lillycovidd19testing.com"; sid:579216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilyycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilyycovid19testing.com"; sid:579217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for literatecovid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"literatecovid.team"; sid:579218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid19today.com"; sid:579219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for llillycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"llillycovid19testing.com"; sid:579220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lullycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lullycovid19testing.com"; sid:579221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masker-pencegahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masker-pencegahcorona.com"; sid:579222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdicovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdicovidfund.com"; sid:579223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdicovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdicovidfunds.com"; sid:579224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meantalhealthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meantalhealthcorona.com"; sid:579225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medisunhealth-covidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medisunhealth-covidresearch.com"; sid:579226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegah-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegah-corona.com"; sid:579227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegah-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegah-covid19.com"; sid:579228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mengganjal-viruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mengganjal-viruscorona.com"; sid:579229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mengganjal-viruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mengganjal-viruscovid19.com"; sid:579230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcorona.com"; sid:579231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metalagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metalagainstcoronavirus.com"; sid:579232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for midad-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"midad-covid.com"; sid:579233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miedoporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miedoporcoronavirus.com"; sid:579234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidantibodytesting.com"; sid:579235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelscorona.com"; sid:579236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monolaurincovidexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monolaurincovidexperiment.com"; sid:579237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muerecoronavirusmuere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muerecoronavirusmuere.com"; sid:579238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mupandemic.com"; sid:579239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musibah-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musibah-corona.com"; sid:579240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musibah-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musibah-covid19.com"; sid:579241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19rehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19rehab.com"; sid:579242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19stimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19stimulus.com"; sid:579243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfirstcoronavirusresponseact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfirstcoronavirusresponseact.com"; sid:579244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19update.com"; sid:579245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmommylivinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmommylivinginapandemic.com"; sid:579246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-about-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-about-covid19.com"; sid:579247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newworldaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newworldaftercovid19.com"; sid:579248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscovid19-heroesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscovid19-heroesfund.com"; sid:579249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-coronas.com"; sid:579250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidme.com"; sid:579251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidme.net"; sid:579252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidus.com"; sid:579253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for numberofcoronavirusdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"numberofcoronavirusdeaths.com"; sid:579254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nutrizionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nutrizionecovid19.com"; sid:579255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid-19.com"; sid:579256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohaicorona.com"; sid:579257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakistancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakistancovid.com"; sid:579258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbar.com"; sid:579259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbeads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbeads.com"; sid:579260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchaos.com"; sid:579261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccosmetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccosmetics.com"; sid:579262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceyedrops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceyedrops.com"; sid:579263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfashions.com"; sid:579264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirstaidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirstaidbox.com"; sid:579265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirstaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirstaidkit.com"; sid:579266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichairspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichairspray.com"; sid:579267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichandcream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichandcream.com"; sid:579268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmanners.com"; sid:579269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmatters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmatters.com"; sid:579270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemories.com"; sid:579271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemory.com"; sid:579272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-nineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-nineteen.com"; sid:579273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnineteen.com"; sid:579274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnosespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnosespray.com"; sid:579275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofcompassion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofcompassion.com"; sid:579276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofinequality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofinequality.com"; sid:579277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconlinesite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconlinesite.com"; sid:579278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpandemic.com"; sid:579279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpassport.com"; sid:579280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpharmaceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpharmaceuticals.com"; sid:579281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreppermomma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreppermomma.com"; sid:579282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpresident.com"; sid:579283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpsychiatry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpsychiatry.com"; sid:579284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-punditry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-punditry.com"; sid:579285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpunditry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpunditry.com"; sid:579286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicquarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicquarantine2020.com"; sid:579287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.foundation"; sid:579288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskincream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskincream.com"; sid:579289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stories.com"; sid:579290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplyhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplyhouse.com"; sid:579291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-survivors.com"; sid:579292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-trace.com"; sid:579293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrace.com"; sid:579294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictracing.com"; sid:579295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworry.com"; sid:579296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partylikeitscovid1999.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partylikeitscovid1999.com"; sid:579297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasacorona.com"; sid:579298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasien-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasien-corona.com"; sid:579299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pasien-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pasien-covid19.com"; sid:579300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcr-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcr-covid.com"; sid:579301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peelcovid19.com"; sid:579302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofpandemic.com"; sid:579303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plague-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plague-covid-19.com"; sid:579304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plaintecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plaintecovid.com"; sid:579305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plannedpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plannedpandemic.com"; sid:579306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronanation.com"; sid:579307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidamerica.com"; sid:579308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnation.com"; sid:579309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postepidemicpandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postepidemicpandemonium.com"; sid:579310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postepidemicpandemonium.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postepidemicpandemonium.mobi"; sid:579311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postepidemicpandemonium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postepidemicpandemonium.net"; sid:579312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpandemonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpandemonium.com"; sid:579313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpandemonium.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpandemonium.mobi"; sid:579314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpandemonium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpandemonium.net"; sid:579315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicszn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicszn.com"; sid:579316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicszn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicszn.net"; sid:579317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemicworld.com"; sid:579318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovidspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovidspread.com"; sid:579319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prisoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prisoncovid.com"; sid:579320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prueba-de-riesgo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prueba-de-riesgo-covid19.com"; sid:579321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebascovid19.com"; sid:579322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for python-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"python-covid.com"; sid:579323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for python-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"python-covid.net"; sid:579324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quotescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quotescoronavirus.com"; sid:579325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid-19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid-19screen.com"; sid:579326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid-19vaccine.com"; sid:579327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapid-covid.com"; sid:579328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest4covid-19.com"; sid:579329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtest4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtest4covid19.com"; sid:579330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdcovid.net"; sid:579331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcoronavirusnews.com"; sid:579332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for region6covidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"region6covidhub.com"; sid:579333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovidusa.com"; sid:579334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcovid19.com"; sid:579335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionicovid19.com"; sid:579336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazioniromacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazioniromacovid19.com"; sid:579337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savannahfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savannahfightingcovid.com"; sid:579338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secundaria77villacorona.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secundaria77villacorona.education"; sid:579339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sn-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sn-covid19.com"; sid:579340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southafricafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southafricafightingcovid.com"; sid:579341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speakingmoistlycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speakingmoistlycovid.com"; sid:579342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stemcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stemcovid19.com"; sid:579343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronanow.co - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronanow.co"; sid:579344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronas.com"; sid:579345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19lockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19lockdowns.com"; sid:579346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covids.com"; sid:579347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightoutofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightoutofcovid.com"; sid:579348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suechinaforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suechinaforcovid.com"; sid:579349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplies-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplies-covid-19.com"; sid:579350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcorona.net"; sid:579351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tadamoncovide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tadamoncovide.com"; sid:579352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankstacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankstacoronavirus.com"; sid:579353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankstocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankstocoronavirus.com"; sid:579354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theageofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theageofcovid-19.com"; sid:579355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theageofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theageofcovid19.com"; sid:579356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theageofcovid.com"; sid:579357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theageofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theageofthecoronavirus.com"; sid:579358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacup.com"; sid:579359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadoc.com"; sid:579360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaemotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaemotionschool.com"; sid:579361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafactor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafactor.com"; sid:579362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronalive.com"; sid:579363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusage.com"; sid:579364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusemotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusemotionschool.com"; sid:579365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusemotionsschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusemotionsschool.com"; sid:579366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruslive.com"; sid:579367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaway.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaway.life"; sid:579368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19age.com"; sid:579369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19age.com"; sid:579370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19emotionschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19emotionschool.com"; sid:579371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19emotionsschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19emotionsschool.com"; sid:579372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19oeteopath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19oeteopath.com"; sid:579373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19osteo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19osteo.com"; sid:579374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19osteopath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19osteopath.com"; sid:579375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pause.com"; sid:579376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19physio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19physio.com"; sid:579377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidantibodytest.com"; sid:579378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleaning.com"; sid:579379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcounselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcounselor.com"; sid:579380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidexperiment.com"; sid:579381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkey.com"; sid:579382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlive.com"; sid:579383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmask19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmask19.com"; sid:579384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmonolaurinexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmonolaurinexperiment.com"; sid:579385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnineteen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnineteen.net"; sid:579386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpros.com"; sid:579387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtribunal.com"; sid:579388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedayaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedayaftercovid19.com"; sid:579389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedaybeforecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedaybeforecoronavirus.com"; sid:579390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thedaybeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thedaybeforecovid19.com"; sid:579391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelifebeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelifebeforecovid19.com"; sid:579392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themonolaurincovidexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themonolaurincovidexperiment.com"; sid:579393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpresident.com"; sid:579394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealtruthaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealtruthaboutcovid19.com"; sid:579395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimebeforecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimebeforecoronavirus.com"; sid:579396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcoronastaycation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcoronastaycation.com"; sid:579397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipscorona.com"; sid:579398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocovid-19.com"; sid:579399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todaycorona.com"; sid:579400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todosganamoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todosganamoscovid19.com"; sid:579401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toposcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toposcovid-19.com"; sid:579402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toposcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toposcovid19.com"; sid:579403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toposcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toposcovid.com"; sid:579404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toronto-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toronto-covid19.com"; sid:579405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trcovid.com"; sid:579406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpthepandemicpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpthepandemicpresident.com"; sid:579407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedfightagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedfightagainstcoronavirus.com"; sid:579408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovid-19testing.com"; sid:579409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovid19testing.com"; sid:579410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovidtesting.com"; sid:579411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaepidemic.com"; sid:579412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19testing.com"; sid:579413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usofcovid.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usofcovid.mobi"; sid:579414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinateagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinateagainstcorona.com"; sid:579415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineagainstcorona.com"; sid:579416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacovid19.com.co - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacovid19.com.co"; sid:579417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid19reminders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid19reminders.com"; sid:579418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecontaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecontaincovid.com"; sid:579419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehavecovid19.com"; sid:579420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wiki-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wiki-covid19.com"; sid:579421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerwell-beingaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerwell-beingaftercovid-19.com"; sid:579422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerwellbeingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerwellbeingaftercovid19.com"; sid:579423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workingoutaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workingoutaftercorona.com"; sid:579424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronameter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronameter.com"; sid:579425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhuoyun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhuoyun.com"; sid:579426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirs-iebb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirs-iebb.net"; sid:579427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--lacoronadelseorvirus-g7b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--lacoronadelseorvirus-g7b.com"; sid:579428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mein-corona-mnchen-y6b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mein-corona-mnchen-y6b.com"; sid:579429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zamancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zamancorona.com"; sid:579430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100proofcovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100proofcovidkiller.com"; sid:579431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24coronavirus.com"; sid:579432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3covid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3covid19stories.com"; sid:579433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411beforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411beforecovid19.com"; sid:579434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoconcursoacreedorescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoconcursoacreedorescovid19.com"; sid:579435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoerecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoerecovid19.com"; sid:579436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesscovid19.com"; sid:579437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for act2020covid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"act2020covid19testing.com"; sid:579438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adaptduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adaptduringcovid19.com"; sid:579439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adaptingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adaptingduringcovid19.com"; sid:579440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adaptyourlifeduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adaptyourlifeduringapandemic.com"; sid:579441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adobecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adobecoronavirus.com"; sid:579442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adrianacoronamakeup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adrianacoronamakeup.com"; sid:579443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afropandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afropandemic.com"; sid:579444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronacinema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronacinema.com"; sid:579445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaevents.com"; sid:579446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaideas.com"; sid:579447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavacation.com"; sid:579448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirustravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirustravel.com"; sid:579449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19tours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19tours.com"; sid:579450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19travel.com"; sid:579451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19travel.com"; sid:579452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19travels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19travels.com"; sid:579453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.city"; sid:579454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidstore.com"; sid:579455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.today"; sid:579456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftermathcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftermathcovid19.com"; sid:579457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterpandemicvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterpandemicvacation.com"; sid:579458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agrifoodbeatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agrifoodbeatscoronavirus.com"; sid:579459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akerscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akerscovid.com"; sid:579460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alibabacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alibabacoronavirus.com"; sid:579461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alibabacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alibabacovid19.com"; sid:579462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronavirussurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronavirussurvival.com"; sid:579463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allergysinuscoldflucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allergysinuscoldflucoronavirus.com"; sid:579464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allergysinuscoldflucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allergysinuscoldflucovid-19.com"; sid:579465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allergysinuscoldflucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allergysinuscoldflucovid19.com"; sid:579466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allergysinuscoldflucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allergysinuscoldflucovid.com"; sid:579467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronamask.com"; sid:579468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americorona.com"; sid:579469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analysecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analysecovid19.com"; sid:579470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for androidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"androidcoronavirus.com"; sid:579471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angocorona.com"; sid:579472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies-covid-19.com"; sid:579473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiescovid-19.com"; sid:579474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.club"; sid:579475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19ec.com"; sid:579476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidaction.com"; sid:579477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsoft.com"; sid:579478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecorona.com"; sid:579479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronavirus.net"; sid:579480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovid19.net"; sid:579481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for armycovid19statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"armycovid19statistics.com"; sid:579482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attcoronavirus.com"; sid:579483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attcovid19.com"; sid:579484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b4covid19.com"; sid:579485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankcovid19.com"; sid:579486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankofcovid19.com"; sid:579487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barriere-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barriere-covid.com"; sid:579488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrieres-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrieres-covid.com"; sid:579489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedrijfscoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedrijfscoronatest.com"; sid:579490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforethecoronavirus.com"; sid:579491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for behappyduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"behappyduringcorona.com"; sid:579492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusmedicine.com"; sid:579493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusvaccine.com"; sid:579494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.world"; sid:579495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencorona.com"; sid:579496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigkidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigkidcovid.com"; sid:579497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigkidcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigkidcovids.com"; sid:579498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitacoradeuncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitacoradeuncovid.com"; sid:579499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid19handbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid19handbook.com"; sid:579500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspandemicrecovery.com"; sid:579501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspostcovid19.com"; sid:579502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buypandemic.com"; sid:579503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecovid-19.com"; sid:579504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinasdesinfeccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinasdesinfeccioncovid.com"; sid:579505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calculatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calculatecorona.com"; sid:579506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcovid.com"; sid:579507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbscoronavirus.com"; sid:579508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronainsta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronainsta.com"; sid:579509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkifcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkifcovid.com"; sid:579510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmatecoronavirus.com"; sid:579511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cncovid19.com"; sid:579512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnncoronavirus.com"; sid:579513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnncovid19.com"; sid:579514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovidhelp.com"; sid:579515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid.equipment"; sid:579516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comedycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comedycovid.com"; sid:579517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityagainstcovid19.com"; sid:579518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conseils-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conseils-covid.com"; sid:579519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conseilsjuridiquescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conseilsjuridiquescorona.com"; sid:579520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consejolegalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consejolegalcorona.com"; sid:579521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulat-corona.com"; sid:579522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulat-covid19.com"; sid:579523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulat-trialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulat-trialcorona.com"; sid:579524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consulat-trialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consulat-trialcovid.com"; sid:579525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-101-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-101-tips.com"; sid:579526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona101tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona101tips.com"; sid:579527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19bracelet.com"; sid:579528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona500.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona500.com"; sid:579529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanwalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanwalt.com"; sid:579530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaards.com"; sid:579531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaavoidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaavoidance.com"; sid:579532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-best-practice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-best-practice.com"; sid:579533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-best-practice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-best-practice.net"; sid:579534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiohazard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiohazard.com"; sid:579535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrother.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrother.com"; sid:579536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-burger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-burger.com"; sid:579537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachangestheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachangestheworld.com"; sid:579538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckyourself.com"; sid:579539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimcalculator.com"; sid:579540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearpass.com"; sid:579541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-clown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-clown.com"; sid:579542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclown.com"; sid:579543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-clowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-clowns.com"; sid:579544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclowns.com"; sid:579545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cockpit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cockpit.com"; sid:579546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacockpit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacockpit.com"; sid:579547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cockpit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cockpit.net"; sid:579548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacockpit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacockpit.net"; sid:579549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconnection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconnection.net"; sid:579550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covered.com"; sid:579551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crash.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crash.net"; sid:579552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacronicles.com"; sid:579553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurebewarm11mins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurebewarm11mins.com"; sid:579554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacya.com"; sid:579555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatarama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatarama.com"; sid:579556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatingstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatingstories.com"; sid:579557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensekit.com"; sid:579558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfectie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfectie.com"; sid:579559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnostics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnostics.net"; sid:579560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonorcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonorcard.com"; sid:579561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoonlineopenhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoonlineopenhouse.com"; sid:579562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadovirtualopenhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadovirtualopenhouse.com"; sid:579563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeasy.com"; sid:579564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-effekt-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-effekt-hilfe.com"; sid:579565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeffekthilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeffekthilfe.com"; sid:579566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-emotions.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-emotions.club"; sid:579567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemployerdefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemployerdefender.com"; sid:579568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-evolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-evolution.com"; sid:579569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafox.com"; sid:579570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-industries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-industries.com"; sid:579571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfant.com"; sid:579572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info-101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info-101.com"; sid:579573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo101.com"; sid:579574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfoedan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfoedan.com"; sid:579575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krach.com"; sid:579576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawer.com"; sid:579577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalms.com"; sid:579578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalms.net"; sid:579579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdownexit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdownexit.com"; sid:579580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalsupplier.com"; sid:579581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicaltest.com"; sid:579582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminder.com"; sid:579583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanisme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanisme.com"; sid:579584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanisme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanisme.net"; sid:579585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-numbers.com"; sid:579586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapapa.com"; sid:579587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-passport.com"; sid:579588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoly.com"; sid:579589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofdentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofdentistry.com"; sid:579590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiongroup.com"; sid:579591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protect-pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protect-pro.com"; sid:579592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquences.com"; sid:579593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-resolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-resolution.com"; sid:579594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-risk-manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-risk-manager.com"; sid:579595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-risk-manager.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-risk-manager.net"; sid:579596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaruminations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaruminations.com"; sid:579597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasauber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasauber.com"; sid:579598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashopusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashopusa.com"; sid:579599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnelgetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnelgetest.com"; sid:579600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasokuho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasokuho.com"; sid:579601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurgicalmask.com"; sid:579602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalbox.com"; sid:579603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataken.com"; sid:579604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatapes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatapes.com"; sid:579605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataps.com"; sid:579606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterpantau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterpantau.com"; sid:579607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testing-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testing-kit.com"; sid:579608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingmvy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingmvy.com"; sid:579609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestvoorbedrijven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestvoorbedrijven.com"; sid:579610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoolbox.com"; sid:579611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoolbox.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoolbox.net"; sid:579612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tours.com"; sid:579613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackar.com"; sid:579614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerapp.net"; sid:579615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatv.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatv.life"; sid:579616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateindia.com"; sid:579617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvlights.com"; sid:579618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-101-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-101-tips.com"; sid:579619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus101tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus101tips.com"; sid:579620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19mlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19mlb.com"; sid:579621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19mlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19mlb.com"; sid:579622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19nba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19nba.com"; sid:579623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19nhl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19nhl.com"; sid:579624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19pga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19pga.com"; sid:579625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safecruise.com"; sid:579626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safeflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safeflight.com"; sid:579627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19ufc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19ufc.com"; sid:579628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-actions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-actions.com"; sid:579629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbbc.com"; sid:579630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionattorneys.com"; sid:579631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawfirm.com"; sid:579632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawsuitsettlement.com"; sid:579633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionlawsuitsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionlawsuitsettlements.com"; sid:579634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassactionsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassactionsettlements.com"; sid:579635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglady.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglady.com"; sid:579636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearpass.com"; sid:579637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconferences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconferences.com"; sid:579638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontacttracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontacttracking.com"; sid:579639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscork.com"; sid:579640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathupdate.com"; sid:579641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebtnomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebtnomore.com"; sid:579642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomainname.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomainname.com"; sid:579643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-domains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-domains.com"; sid:579644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdownunder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdownunder.com"; sid:579645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdownunder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdownunder.net"; sid:579646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdublin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdublin.com"; sid:579647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdumpster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdumpster.com"; sid:579648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseg.com"; sid:579649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectrostaticcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectrostaticcleaning.com"; sid:579650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselimination.com"; sid:579651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusequipment4sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusequipment4sale.com"; sid:579652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-experience.com"; sid:579653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilylaw.com"; sid:579654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree.madrid"; sid:579655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfundhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfundhelp.com"; sid:579656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfurloughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfurloughs.com"; sid:579657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobal2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobal2020.com"; sid:579658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguide.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguide.club"; sid:579659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguidelines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguidelines.net"; sid:579660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazardpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazardpay.com"; sid:579661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomedisinfecting.com"; sid:579662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestus.com"; sid:579663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hygiene.com"; sid:579664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimplements.com"; sid:579665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-info-101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-info-101.com"; sid:579666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo101.com"; sid:579667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-info-4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-info-4u.com"; sid:579668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo4u.com"; sid:579669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancesettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancesettlement.com"; sid:579670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancesettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancesettlements.com"; sid:579671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusireland.com"; sid:579672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusirs.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusirs.expert"; sid:579673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-latest.com"; sid:579674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslighthouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslighthouse.com"; sid:579675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivetrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivetrack.com"; sid:579676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockdownworkfromhomejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockdownworkfromhomejobs.com"; sid:579677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockdownworkfromhomejobs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockdownworkfromhomejobs.net"; sid:579678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmicrosoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmicrosoft.com"; sid:579679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneedajob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneedajob.com"; sid:579680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnormal.com"; sid:579681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsworld.com"; sid:579682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficedisinfecting.com"; sid:579683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinememorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinememorial.com"; sid:579684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayroll.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayroll.tax"; sid:579685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjuryattorney.com"; sid:579686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjuryattorneys.com"; sid:579687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjurylawfirm.com"; sid:579688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjurylawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjurylawfirms.com"; sid:579689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjurylawyer.com"; sid:579690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjurylawyers.com"; sid:579691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublicrelations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublicrelations.com"; sid:579692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrainbow.com"; sid:579693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreboot.com"; sid:579694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretrospective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretrospective.com"; sid:579695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrna.com"; sid:579696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserologytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserologytesting.com"; sid:579697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocialmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocialmedia.com"; sid:579698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-store-anc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-store-anc.com"; sid:579699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesla.com"; sid:579700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-thetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-thetruth.com"; sid:579701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimeedan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimeedan.com"; sid:579702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdating.com"; sid:579703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhileblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhileblack.com"; sid:579704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswhileblack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswhileblack.net"; sid:579705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitals.com"; sid:579706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vs-new-york.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vs-new-york.com"; sid:579707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayiyendim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayiyendim.com"; sid:579708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zuiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zuiver.com"; sid:579709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countycovid.com"; sid:579710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-18firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-18firstresponder.com"; sid:579711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18firstresponder.com"; sid:579712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18firstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18firstresponders.com"; sid:579713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18responder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18responder.com"; sid:579714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afar.com"; sid:579715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-analytics.com"; sid:579716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibod.com"; sid:579717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodycheck.com"; sid:579718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antibody-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antibody-test.com"; sid:579719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneyreferral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneyreferral.com"; sid:579720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-balkan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-balkan.com"; sid:579721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bbs.com"; sid:579722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bd.com"; sid:579723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19billrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19billrecovery.com"; sid:579724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bodyfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bodyfit.com"; sid:579725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-building-sterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-building-sterilization.com"; sid:579726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslosses.com"; sid:579727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerplan.com"; sid:579728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyersplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyersplan.com"; sid:579729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19camptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19camptest.com"; sid:579730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-careshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-careshop.com"; sid:579731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cart.com"; sid:579732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.world"; sid:579733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cenotaph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cenotaph.com"; sid:579734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cerb-applicati0n.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cerb-applicati0n.com"; sid:579735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19changes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19changes.com"; sid:579736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chase.com"; sid:579737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawfirm.com"; sid:579738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlawsuitsettlement.com"; sid:579739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionsettlement.com"; sid:579740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionsettlements.com"; sid:579741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningandprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningandprevention.com"; sid:579742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearpass.com"; sid:579743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-compare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-compare.com"; sid:579744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contacttracing.com"; sid:579745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contacttracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contacttracking.com"; sid:579746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracking.com"; sid:579747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19daily.com"; sid:579748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debt.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debt.tax"; sid:579749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divorceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divorceattorneys.com"; sid:579750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donarchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donarchallenge.com"; sid:579751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donatechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donatechallenge.com"; sid:579752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19easyresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19easyresults.com"; sid:579753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19electrostaticcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19electrostaticcleaning.com"; sid:579754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19electrostaticcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19electrostaticcleaning.com"; sid:579755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elimination.com"; sid:579756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elixor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elixor.com"; sid:579757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-etiquette.com"; sid:579758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19expressloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19expressloans.com"; sid:579759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.farm - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.farm"; sid:579760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fastloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fastloans.com"; sid:579761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19filelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19filelawsuit.com"; sid:579762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filtermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filtermask.com"; sid:579763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filtermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filtermasks.com"; sid:579764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstaidkit.com"; sid:579765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstresponders.com"; sid:579766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fraud.com"; sid:579767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fraud.net"; sid:579768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundattorney.com"; sid:579769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fund.com"; sid:579770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundinfo.com"; sid:579771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundinfo.com"; sid:579772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fundinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fundinformation.com"; sid:579773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundlaw.com"; sid:579774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundlawfirm.com"; sid:579775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundtrack.com"; sid:579776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19furloughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19furloughs.com"; sid:579777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gb.com"; sid:579778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaldashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaldashboard.com"; sid:579779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalresponse.com"; sid:579780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalresponse.com"; sid:579781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19griefsupport.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19griefsupport.life"; sid:579782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.gripe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.gripe"; sid:579783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-guide.com"; sid:579784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazardpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazardpay.com"; sid:579785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helmet.com"; sid:579786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help2020.com"; sid:579787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-help4all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-help4all.com"; sid:579788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hemohim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hemohim.com"; sid:579789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundattorney.com"; sid:579790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundinfo.com"; sid:579791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundinformation.com"; sid:579792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundlaw.com"; sid:579793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundlawfirm.com"; sid:579794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heroescompensationfundlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heroescompensationfundlawyer.com"; sid:579795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homedisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homedisinfecting.com"; sid:579796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hood.com"; sid:579797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hurt.com"; sid:579798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icrc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icrc.com"; sid:579799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiahelp.com"; sid:579800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-india.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-india.net"; sid:579801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancesettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancesettlement.com"; sid:579802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancesettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancesettlements.com"; sid:579803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19itau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19itau.com"; sid:579804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-justice.com"; sid:579805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawcenter.com"; sid:579806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawcenter.com"; sid:579807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19limits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19limits.com"; sid:579808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-linough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-linough.com"; sid:579809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liquor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liquor.com"; sid:579810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lms.com"; sid:579811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lms.com"; sid:579812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lms.net"; sid:579813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lms.net"; sid:579814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loanforgiveness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loanforgiveness.com"; sid:579815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanforgiveness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanforgiveness.com"; sid:579816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19luv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19luv.com"; sid:579817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskarade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskarade.com"; sid:579818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskdirect.com"; sid:579819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksupplier.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksupplier.net"; sid:579820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksupply.net"; sid:579821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mdx.com"; sid:579822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mdx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mdx.net"; sid:579823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalhelp.com"; sid:579824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmask.com"; sid:579825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmask.net"; sid:579826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalmasks.net"; sid:579827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalresearch.com"; sid:579828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicaltest.com"; sid:579829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meld.com"; sid:579830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mlb.com"; sid:579831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mlb.com"; sid:579832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-model.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-model.com"; sid:579833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgageforbearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgageforbearance.com"; sid:579834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nba.com"; sid:579835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19needajob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19needajob.com"; sid:579836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nfl.com"; sid:579837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nhl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nhl.com"; sid:579838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19njlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19njlawyers.com"; sid:579839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19normallife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19normallife.com"; sid:579840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nyclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nyclaw.com"; sid:579841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinecenotaph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinecenotaph.com"; sid:579842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicmemorial.com"; sid:579843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr.net"; sid:579844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjuryattorney.com"; sid:579845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjuryattorneys.com"; sid:579846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjurylawfirm.com"; sid:579847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjurylawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjurylawfirms.com"; sid:579848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjurylawyer.com"; sid:579849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalinjurylawyers.com"; sid:579850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pga.com"; sid:579851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pin.com"; sid:579852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonorlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonorlist.com"; sid:579853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonorregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonorregistry.com"; sid:579854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonors.com"; sid:579855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonorservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonorservices.com"; sid:579856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plasmatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plasmatherapy.com"; sid:579857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pos.com"; sid:579858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19positive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19positive.net"; sid:579859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19price.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19price.com"; sid:579860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19radar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19radar.com"; sid:579861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radiologyprimer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radiologyprimer.com"; sid:579862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapid-test-kit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapid-test-kit.net"; sid:579863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefsba.com"; sid:579864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reliefsba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reliefsba.com"; sid:579865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.tax - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.tax"; sid:579866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19requirements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19requirements.com"; sid:579867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchdatabase.com"; sid:579868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchdatabase.com"; sid:579869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retrofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retrofit.com"; sid:579870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retrofit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retrofit.net"; sid:579871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.com"; sid:579872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.net"; sid:579873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rxdoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rxdoctors.com"; sid:579874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rxprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rxprescriptions.com"; sid:579875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecasino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecasino.com"; sid:579876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecruise.com"; sid:579877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecruise.com"; sid:579878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safeflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safeflight.com"; sid:579879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saftey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saftey.com"; sid:579880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sani.com"; sid:579881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schooltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schooltest.com"; sid:579882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellerplan.com"; sid:579883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellersplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellersplan.com"; sid:579884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19serologytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19serologytest.com"; sid:579885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serologytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serologytest.com"; sid:579886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-shield.com"; sid:579887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shieldtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shieldtech.com"; sid:579888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simpletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simpletest.com"; sid:579889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skincare.com"; sid:579890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19specialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19specialist.com"; sid:579891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statsinfo.com"; sid:579892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statstrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statstrack.com"; sid:579893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stayfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stayfree.com"; sid:579894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19students.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19students.com"; sid:579895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesusa.com"; sid:579896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplyexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplyexpress.com"; sid:579897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportbahamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportbahamas.com"; sid:579898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportca.com"; sid:579899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.club"; sid:579900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportengland.com"; sid:579901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supporteurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supporteurope.com"; sid:579902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfamily.com"; sid:579903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfl.com"; sid:579904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfrance.com"; sid:579905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportga.com"; sid:579906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportindia.com"; sid:579907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportitaly.com"; sid:579908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportny.com"; sid:579909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportspain.com"; sid:579910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.tips"; sid:579911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportusa.com"; sid:579912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportus.com"; sid:579913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sv.com"; sid:579914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syrup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syrup.com"; sid:579915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxrelief.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxrelief.expert"; sid:579916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testforhome.com"; sid:579917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testforschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testforschool.com"; sid:579918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testforwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testforwork.com"; sid:579919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testforworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testforworkers.com"; sid:579920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkits.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkits.sydney"; sid:579921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlocator.com"; sid:579922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testtruck.com"; sid:579923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtruck.com"; sid:579924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testtrucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testtrucks.com"; sid:579925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtrucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtrucks.com"; sid:579926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travelclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travelclaims.com"; sid:579927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trialattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trialattorneys.com"; sid:579928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ufc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ufc.com"; sid:579929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ufc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ufc.com"; sid:579930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatesnow.com"; sid:579931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19update.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19update.world"; sid:579932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ustour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ustour.com"; sid:579933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccins.com"; sid:579934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vacine.com"; sid:579935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vacine.com"; sid:579936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacetest.com"; sid:579937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldpandemic.net"; sid:579938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-world-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-world-tracker.com"; sid:579939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1daytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1daytest.com"; sid:579940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020babies.com"; sid:579941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20book.com"; sid:579942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2day.com"; sid:579943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2govid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2govid.com"; sid:579944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid66.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid66.com"; sid:579945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-95.com"; sid:579946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionforum.com"; sid:579947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaffairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaffairs.com"; sid:579948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagora.com"; sid:579949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalert.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalert.blue"; sid:579950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertnyc.com"; sid:579951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibody.com"; sid:579952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibodytest.com"; sid:579953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-app.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-app.blue"; sid:579954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.blue"; sid:579955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidards.com"; sid:579956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneyus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneyus.com"; sid:579957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavir.com"; sid:579958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavir.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavir.net"; sid:579959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcylawyers.com"; sid:579960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbbq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbbq.com"; sid:579961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefitconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefitconcert.com"; sid:579962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-blues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-blues.com"; sid:579963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuildchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuildchallenge.com"; sid:579964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslawyers.com"; sid:579965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesslosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesslosses.com"; sid:579966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuyerprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuyerprotectionplan.com"; sid:579967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamera.com"; sid:579968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareersnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareersnetwork.com"; sid:579969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashhelp.com"; sid:579970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcations.com"; sid:579971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcations.net"; sid:579972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcellmates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcellmates.com"; sid:579973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifications.com"; sid:579974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionattorney.com"; sid:579975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionattorneys.com"; sid:579976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-classaction.com"; sid:579977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawfirm.com"; sid:579978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuits.com"; sid:579979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuitsettlement.com"; sid:579980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuitsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuitsettlements.com"; sid:579981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawyers.com"; sid:579982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionsettlements.com"; sid:579983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersusa.com"; sid:579984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanout.com"; sid:579985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleanse.com"; sid:579986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanwater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanwater.com"; sid:579987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearpass.com"; sid:579988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clowns.com"; sid:579989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcobras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcobras.com"; sid:579990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cockpit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cockpit.com"; sid:579991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcockpit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcockpit.net"; sid:579992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombatboots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombatboots.com"; sid:579993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommandcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommandcenter.com"; sid:579994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommandment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommandment.com"; sid:579995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommands.com"; sid:579996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommittee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommittee.com"; sid:579997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontroller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontroller.com"; sid:579998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona2019.com"; sid:579999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-covid.com"; sid:580000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cruises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cruises"; sid:580001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathtracker.com"; sid:580002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsettlement.com"; sid:580003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtsettlements.com"; sid:580004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidde.com"; sid:580005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddemands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddemands.com"; sid:580006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentalkit.com"; sid:580007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentaltest.com"; sid:580008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesigns.com"; sid:580009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidea19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidea19.com"; sid:580010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideagle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideagle.com"; sid:580011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-edd-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-edd-ca.com"; sid:580012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialkits.com"; sid:580013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestateplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestateplan.com"; sid:580014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideurope.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideurope.net"; sid:580015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpectations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpectations.com"; sid:580016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeedback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeedback.com"; sid:580017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfife.com"; sid:580018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fighter.com"; sid:580019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstaid.com"; sid:580020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstaidkit.com"; sid:580021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfitsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfitsupply.com"; sid:580022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecountry.com"; sid:580023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedental.com"; sid:580024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedentaloffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedentaloffice.com"; sid:580025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehome.com"; sid:580026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenews.com"; sid:580027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeoffices.com"; sid:580028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.solutions"; sid:580029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuckery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuckery.com"; sid:580030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalhealth.com"; sid:580031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoals.com"; sid:580032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-graph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-graph.com"; sid:580033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraph.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraph.life"; sid:580034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgw.com"; sid:580035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaze.com"; sid:580036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help-france.com"; sid:580037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroeslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroeslaw.com"; sid:580038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecleaning.com"; sid:580039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhood.com"; sid:580040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hurt.com"; sid:580041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhurt.com"; sid:580042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hyclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hyclean.com"; sid:580043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhyclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhyclean.com"; sid:580044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidick.com"; sid:580045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiggtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiggtest.com"; sid:580046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinmuebles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinmuebles.com"; sid:580047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancelawsuits.com"; sid:580048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterruptionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterruptionlaw.com"; sid:580049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotslap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotslap.com"; sid:580050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscash.com"; sid:580051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidism.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidism.fail"; sid:580052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobxchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobxchange.com"; sid:580053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-justice.com"; sid:580054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiosk.com"; sid:580055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitbox.com"; sid:580056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkuwait.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkuwait.net"; sid:580057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitfunding.com"; sid:580058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuithelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuithelp.com"; sid:580059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitsettlement.com"; sid:580060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitsettlements.com"; sid:580061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerus.com"; sid:580062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalfunding.com"; sid:580063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalsettlement.com"; sid:580064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalsettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalsettlements.com"; sid:580065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloader.com"; sid:580066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlook.com"; sid:580067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlose.com"; sid:580068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloveseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloveseries.com"; sid:580069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlr.com"; sid:580070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpracticelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpracticelaw.com"; sid:580071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskapparel.com"; sid:580072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdirect.com"; sid:580073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmdx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmdx.com"; sid:580074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalconcierge.com"; sid:580075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeld.com"; sid:580076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouth.com"; sid:580077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearhere.com"; sid:580078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteam.com"; sid:580079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nyc-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nyc-justice.com"; sid:580080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nyclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nyclaw.com"; sid:580081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ny-justice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ny-justice.com"; sid:580082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ny-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ny-law.com"; sid:580083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonedaytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonedaytest.com"; sid:580084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoraltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoraltest.com"; sid:580085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatches.com"; sid:580086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjuryattorney.com"; sid:580087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjuryattorneys.com"; sid:580088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjurylawfirm.com"; sid:580089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjurylawyer.com"; sid:580090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjurylawyers.com"; sid:580091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpm.com"; sid:580092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicytracker.com"; sid:580093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesupply4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesupply4u.com"; sid:580094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpricktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpricktest.com"; sid:580095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprison.com"; sid:580096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprisondata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprisondata.com"; sid:580097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprisoners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprisoners.com"; sid:580098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivileges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivileges.com"; sid:580099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprokit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprokit.com"; sid:580100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofdentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofdentistry.com"; sid:580101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protections.com"; sid:580102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protections.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protections.net"; sid:580103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionwear.com"; sid:580104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protect-pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protect-pro.com"; sid:580105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pv.com"; sid:580106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpv.com"; sid:580107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovherd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovherd.com"; sid:580108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefsomaliland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefsomaliland.com"; sid:580109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotecare.com"; sid:580110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-reopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-reopen.com"; sid:580111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreopen.com"; sid:580112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrequirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrequirement.com"; sid:580113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resolution.com"; sid:580114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskmanagment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskmanagment.com"; sid:580115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroommates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroommates.com"; sid:580116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidru.com"; sid:580117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevideo.com"; sid:580118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevideos.com"; sid:580119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalivatest.com"; sid:580120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalivatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalivatests.com"; sid:580121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsani.com"; sid:580122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sanitized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sanitized.com"; sid:580123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidself.com"; sid:580124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfswab.com"; sid:580125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementfunding.com"; sid:580126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignup.com"; sid:580127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimpletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimpletest.com"; sid:580128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmallbusinessrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmallbusinessrecover.com"; sid:580129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sneltest.com"; sid:580130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoftware.com"; sid:580131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stopper.com"; sid:580132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuctions.com"; sid:580133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplydepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplydepot.com"; sid:580134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyexpress.com"; sid:580135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgicalmask.com"; sid:580136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurplus.com"; sid:580137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabkit.com"; sid:580138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabkits.com"; sid:580139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabtest.com"; sid:580140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyrup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyrup.com"; sid:580141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteam6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteam6.com"; sid:580142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteamsix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteamsix.com"; sid:580143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtec.com"; sid:580144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsite.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsite.net"; sid:580145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtogovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtogovid.com"; sid:580146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduae.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduae.net"; sid:580147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvlights.com"; sid:580148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vacine.com"; sid:580149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwearclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwearclothing.com"; sid:580150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wish.com"; sid:580151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wishes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wishes.com"; sid:580152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwishes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwishes.com"; sid:580153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldstat.com"; sid:580154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxtestkit.com"; sid:580155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crypto-pandemic.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crypto-pandemic.ltd"; sid:580156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid.com"; sid:580157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cukmah-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cukmah-corona.com"; sid:580158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforpandemic.com"; sid:580159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidfacemasks.com"; sid:580160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidmask.com"; sid:580161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidnews.com"; sid:580162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidlawyer.com"; sid:580163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepinthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepinthecorona.com"; sid:580164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for definecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"definecovid19.com"; sid:580165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djkidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djkidcovid.com"; sid:580166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogrubilgicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogrubilgicovid19.com"; sid:580167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcoronacauses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcoronacauses.com"; sid:580168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebaycoronavirus.com"; sid:580169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eff-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eff-covid.com"; sid:580170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpasofightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpasofightingcovid.com"; sid:580171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencymedicalsuppliescovid19c0m.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencymedicalsuppliescovid19c0m.com"; sid:580172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencymedicalsuppliescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencymedicalsuppliescovid19.com"; sid:580173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercoronadefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercoronadefender.com"; sid:580174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercoviddefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercoviddefender.com"; sid:580175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresascovid.com"; sid:580176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.services"; sid:580177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsprevention.com"; sid:580178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esratrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esratrackcovid.com"; sid:580179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estatecorona.com"; sid:580180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firecovid-19.com"; sid:580181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flipkartcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flipkartcoronavirus.com"; sid:580182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flipkartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flipkartcovid19.com"; sid:580183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusdisinfecting.com"; sid:580184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19disinfecting.com"; sid:580185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free-covid19.com"; sid:580186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for free-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"free-covid.com"; sid:580187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeforcovid.com"; sid:580188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeverizonwirelesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeverizonwirelesscovid19.com"; sid:580189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukkcovid19.com"; sid:580190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurecovid19.com"; sid:580191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for games4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"games4covid19.com"; sid:580192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearcovid.com"; sid:580193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencovid-19.com"; sid:580194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gescovid.com"; sid:580195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19updates.com"; sid:580196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidnews.com"; sid:580197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreadyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreadyforcovid19.com"; sid:580198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gigantescontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gigantescontraelcovid.com"; sid:580199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirus.net"; sid:580200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19response.com"; sid:580201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalresponsecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalresponsecovid-19.com"; sid:580202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalresponsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalresponsecovid19.com"; sid:580203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalresponsecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalresponsecovid.com"; sid:580204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gouv-subventioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gouv-subventioncovid19.com"; sid:580205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grassrootscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grassrootscovid.com"; sid:580206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grassrootscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grassrootscovid.net"; sid:580207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gratefulduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gratefulduringcovid19.com"; sid:580208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbsccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbsccovid19.com"; sid:580209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthnewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthnewscovid19.com"; sid:580210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthyaftercovid19.com"; sid:580211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellocovid.com"; sid:580212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpconquercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpconquercovid19.com"; sid:580213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higheredpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higheredpostcovid.com"; sid:580214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higienizacion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higienizacion-covid19.com"; sid:580215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidlawyer.com"; sid:580216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hpcoronavirus.com"; sid:580217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hurtbycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hurtbycoronavirus.com"; sid:580218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikwilcoronatesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikwilcoronatesten.com"; sid:580219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imaginedduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imaginedduringcovid19.com"; sid:580220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imcovidcured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imcovidcured.com"; sid:580221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunecovid19.com"; sid:580222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunefromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunefromcovid-19.com"; sid:580223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunefromcovid19.com"; sid:580224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunefromcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunefromcovid-19.net"; sid:580225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunefromcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunefromcovid19.net"; sid:580226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunity-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunity-corona.com"; sid:580227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacoronacases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacoronacases.com"; sid:580228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indofightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indofightcorona.com"; sid:580229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for industryvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"industryvscovid.com"; sid:580230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovidtesting.com"; sid:580231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmueblesrematecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmueblesrematecovid.com"; sid:580232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmunecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmunecoronavirus.com"; sid:580233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmunecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmunecovid19.com"; sid:580234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspirationalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspirationalpandemic.com"; sid:580235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspiredbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspiredbycovid19.com"; sid:580236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacheckcorona.com"; sid:580237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intelcoronavirus.com"; sid:580238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ioutlivedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ioutlivedcoronavirus.com"; sid:580239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ioutlivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ioutlivedcovid.com"; sid:580240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iphonecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iphonecoronavirus.com"; sid:580241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irecovid.com"; sid:580242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ireportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ireportcovid19.com"; sid:580243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isocovid19.com"; sid:580244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isocovid19.net"; sid:580245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isocovid.com"; sid:580246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19pandemic.com"; sid:580247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.today"; sid:580248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsthecoronavirusstupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsthecoronavirusstupid.com"; sid:580249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsthecovid-19stupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsthecovid-19stupid.com"; sid:580250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaicoronababa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaicoronababa.com"; sid:580251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesusbloodcurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesusbloodcurecovid19.com"; sid:580252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesusbloodhealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesusbloodhealcovid19.com"; sid:580253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juridischadviescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juridischadviescorona.com"; sid:580254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidcovids.com"; sid:580255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovid19.com"; sid:580256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovid19.net"; sid:580257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsforcovid19.com"; sid:580258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidaloca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidaloca.com"; sid:580259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovid19.com"; sid:580260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcovid.com"; sid:580261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadershippandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadershippandemic.com"; sid:580262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lecovid.com"; sid:580263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legaladvicecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legaladvicecorona.com"; sid:580264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leganealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leganealcoronavirus.com"; sid:580265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lejourdaprescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lejourdaprescorona.com"; sid:580266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcorona.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcorona.photography"; sid:580267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for linkedincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"linkedincoronavirus.com"; sid:580268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19.world"; sid:580269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loseyourcovid15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loseyourcovid15.com"; sid:580270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriageduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriageduringcorona.com"; sid:580271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasprocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasprocovid.com"; sid:580272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcovidrelief.com"; sid:580273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksprocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksprocovid.com"; sid:580274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-protection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-protection-covid19.com"; sid:580275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovidtest.com"; sid:580276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medigasescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medigasescorona.com"; sid:580277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memoriacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memoriacovid19.com"; sid:580278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microsoftcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microsoftcovid19.com"; sid:580279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minsa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minsa-covid19.com"; sid:580280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouripandemiclawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouripandemiclawyers.com"; sid:580281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montrealcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montrealcoronavirus.com"; sid:580282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumofcorona.com"; sid:580283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mxncovid1-netflixcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mxncovid1-netflixcovid-19.com"; sid:580284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusstories.com"; sid:580285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycountry-vs-covid-19.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycountry-vs-covid-19.media"; sid:580286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19immunity.com"; sid:580287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19imunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19imunity.com"; sid:580288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19screen.com"; sid:580289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19status.com"; sid:580290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcellmates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcellmates.com"; sid:580291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfight.com"; sid:580292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlovestory.com"; sid:580293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynumbercovid19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynumbercovid19tip.com"; sid:580294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysatuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysatuscovid19.com"; sid:580295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myverizonwirelesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myverizonwirelesscovid19.com"; sid:580296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n2covid19.com"; sid:580297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalecoronasneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalecoronasneltest.com"; sid:580298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflixcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflixcoronavirus.com"; sid:580299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflixcovid19.com"; sid:580300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflixcovid.com"; sid:580301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for non-au-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"non-au-covid.com"; sid:580302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nortoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nortoncoronavirus.com"; sid:580303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notfallcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notfallcovid19.com"; sid:580304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronadefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronadefense.com"; sid:580305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirusonlinelibarywiley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirusonlinelibarywiley.com"; sid:580306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustax.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustax.expert"; sid:580307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirustax.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirustax.solutions"; sid:580308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovidcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovidcanada.com"; sid:580309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovid19.net"; sid:580310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for p2pcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"p2pcovid19.com"; sid:580311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicb.com"; sid:580312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicblocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicblocker.com"; sid:580313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusters.com"; sid:580314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccarecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccarecommunity.com"; sid:580315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-couture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-couture.com"; sid:580316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccouture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccouture.net"; sid:580317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicequipped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicequipped.com"; sid:580318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicide.com"; sid:580319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-income.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-income.com"; sid:580320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicleads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicleads.com"; sid:580321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicleads.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicleads.net"; sid:580322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpills.com"; sid:580323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof.biz"; sid:580324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.biz"; sid:580325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofprofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofprofit.com"; sid:580326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofprofits.com"; sid:580327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionpack.com"; sid:580328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecoverylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecoverylaw.com"; sid:580329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-rock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-rock.com"; sid:580330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsdata.com"; sid:580331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-insurance.com"; sid:580332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solutions.com"; sid:580333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarehouseclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarehouseclub.com"; sid:580334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-warehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-warehouse.com"; sid:580335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwears.com"; sid:580336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwithasideofcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwithasideofcancer.com"; sid:580337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingduringthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingduringthepandemic.com"; sid:580338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pdcovid19.com"; sid:580339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perusincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perusincovid.com"; sid:580340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillycoronavirus.com"; sid:580341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pimcovid.com"; sid:580342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for placerhealthcovidorderapr102020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"placerhealthcovidorderapr102020.com"; sid:580343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetaftercovid.com"; sid:580344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for porncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"porncovid19.com"; sid:580345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portugalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portugalcovid.com"; sid:580346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscovid-19.com"; sid:580347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscovid-19.net"; sid:580348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalifestyle.com"; sid:580349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19-world.com"; sid:580350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcity.com"; sid:580351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidian.com"; sid:580352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidleadership.com"; sid:580353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlifestyle.com"; sid:580354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidliving.com"; sid:580355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpsychology.com"; sid:580356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppekitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppekitcovid19.com"; sid:580357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pppcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pppcovid19.com"; sid:580358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precheckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precheckcorona.com"; sid:580359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventing-coronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventing-coronaviruses.com"; sid:580360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventingcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventingcoronaviruses.com"; sid:580361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteksicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteksicovid19.com"; sid:580362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pvdcovid1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pvdcovid1.com"; sid:580363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktest-covid19.com"; sid:580364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rakutencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rakutencoronavirus.com"; sid:580365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecovid.com"; sid:580366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rechtsberatungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rechtsberatungcorona.com"; sid:580367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redcovida.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redcovida.net"; sid:580368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantescovidfree.com"; sid:580369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rippcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rippcovid19.com"; sid:580370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salivatestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salivatestcovid.com"; sid:580371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salivatestscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salivatestscovid.com"; sid:580372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samsungcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samsungcoronavirus.com"; sid:580373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionicovid19toscana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionicovid19toscana.com"; sid:580374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionicovid19veneto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionicovid19veneto.com"; sid:580375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionitoscanacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionitoscanacovid19.com"; sid:580376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionivenetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionivenetocovid19.com"; sid:580377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sapandemicrelief.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sapandemicrelief.fund"; sid:580378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemybusinessfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemybusinessfromcorona.com"; sid:580379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemybusinessfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemybusinessfromcoronavirus.com"; sid:580380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scaletestscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scaletestscovid19.com"; sid:580381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scandinaviacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scandinaviacorona.com"; sid:580382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securecovid19.net"; sid:580383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securecovid.net"; sid:580384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitycovid.com"; sid:580385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitycovid.net"; sid:580386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguridadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguridadcovid19.com"; sid:580387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementcovid.com"; sid:580388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for settlementscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"settlementscovid.com"; sid:580389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shekastecoronabatobeh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shekastecoronabatobeh.com"; sid:580390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shekastecoronabatobeh.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shekastecoronabatobeh.net"; sid:580391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sickofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sickofcovid19.com"; sid:580392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for softbankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"softbankcoronavirus.com"; sid:580393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for splitbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"splitbycovid19.com"; sid:580394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.biz"; sid:580395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid1984.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid1984.com"; sid:580396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stupidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stupidcovid.com"; sid:580397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedapandemic.com"; sid:580398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teslacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teslacoronavirus.com"; sid:580399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teslacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teslacovid19.com"; sid:580400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidcovid19.com"; sid:580401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidlaw.com"; sid:580402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidlawfirm.com"; sid:580403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticoronacompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticoronacompany.com"; sid:580404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebankofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebankofcovid19.com"; sid:580405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacounter.com"; sid:580406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakey.com"; sid:580407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaporn.com"; sid:580408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronart.com"; sid:580409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusadvisor.com"; sid:580410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusadvisors.com"; sid:580411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusguard.com"; sid:580412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspersonalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspersonalinjuryattorney.com"; sid:580413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspersonalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspersonalinjuryattorneys.com"; sid:580414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspersonalinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspersonalinjurylawfirm.com"; sid:580415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspersonalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspersonalinjurylawyer.com"; sid:580416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspersonalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspersonalinjurylawyers.com"; sid:580417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronawoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronawoman.com"; sid:580418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19firstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19firstresponder.com"; sid:580419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19personalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19personalinjuryattorney.com"; sid:580420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19personalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19personalinjuryattorneys.com"; sid:580421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19personalinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19personalinjurylawfirm.com"; sid:580422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19personalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19personalinjurylawyer.com"; sid:580423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19personalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19personalinjurylawyers.com"; sid:580424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19quiz.com"; sid:580425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid1stresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid1stresponder.com"; sid:580426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcommander.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcommander.com"; sid:580427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddemand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddemand.com"; sid:580428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddemands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddemands.com"; sid:580429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidessential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidessential.com"; sid:580430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidessentials.com"; sid:580431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidessentials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidessentials.net"; sid:580432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfirstresponder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfirstresponder.com"; sid:580433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidindia.com"; sid:580434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpersonalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpersonalinjuryattorney.com"; sid:580435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpersonalinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpersonalinjuryattorneys.com"; sid:580436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpersonalinjurylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpersonalinjurylawyer.com"; sid:580437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpersonalinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpersonalinjurylawyers.com"; sid:580438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrecession.com"; sid:580439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrequirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrequirement.com"; sid:580440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidvolunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidvolunteer.com"; sid:580441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidvolunteers.com"; sid:580442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutpandemics.com"; sid:580443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanwetmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanwetmarket.com"; sid:580444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thriveaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thriveaftercovid19.com"; sid:580445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiktokcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiktokcoronavirus.com"; sid:580446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top3covidtips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top3covidtips.com"; sid:580447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top3covidtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top3covidtools.com"; sid:580448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovid19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovid19tip.com"; sid:580449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidattorney.com"; sid:580450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidplan.com"; sid:580451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidtip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidtip.com"; sid:580452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidtool.com"; sid:580453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocoronavirus.com"; sid:580454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourofcorona.com"; sid:580455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tr-coronaverimerkezi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tr-coronaverimerkezi.com"; sid:580456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid2020.com"; sid:580457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trustcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trustcovid19.com"; sid:580458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twittercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twittercovid19.com"; sid:580459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronavirus.com"; sid:580460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgencecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgencecovid19.com"; sid:580461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaacoronavirus.com"; sid:580462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid.net"; sid:580463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscleaner.com"; sid:580464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronaviruscleaners.com"; sid:580465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usgovcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usgovcorona.com"; sid:580466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usgovcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usgovcovid19.com"; sid:580467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usofcovid.com"; sid:580468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usofcovid.net"; sid:580469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacationaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacationaftercovid-19.com"; sid:580470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacationaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacationaftercovid19.com"; sid:580471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunadelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunadelcoronavirus.com"; sid:580472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunadelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunadelcovid19.com"; sid:580473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncoronavirus.com"; sid:580474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizonwireless-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizonwireless-covid-19.com"; sid:580475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizonwireless-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizonwireless-covid-19.net"; sid:580476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronapp.com"; sid:580477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vosdroits-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vosdroits-coronavirus.com"; sid:580478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vzcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vzcovid.com"; sid:580479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watchcovid.com"; sid:580480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefuckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefuckcorona.com"; sid:580481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whataftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whataftercorona.net"; sid:580482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worcesterfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worcesterfightingcovid.com"; sid:580483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workaftercovid19.net"; sid:580484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldaftercorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldaftercorona.life"; sid:580485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemicoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemicoutbreak.com"; sid:580486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanchangxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanchangxin.com"; sid:580487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanepicenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanepicenter.com"; sid:580488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhcw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhcw.com"; sid:580489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanthevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanthevirus.com"; sid:580490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusclaims.com"; sid:580491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwaddle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwaddle.com"; sid:580492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwali.com"; sid:580493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwalli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwalli.com"; sid:580494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwally.com"; sid:580495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwaly.com"; sid:580496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyingxiong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyingxiong.com"; sid:580497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidespaa-19a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidespaa-19a.com"; sid:580498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youngmakersagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youngmakersagainstcovid19.com"; sid:580499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youngmakersagainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youngmakersagainstcovid19.net"; sid:580500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zoomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zoomcoronavirus.com"; sid:580501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-minute-covid-conversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-minute-covid-conversations.com"; sid:580502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidquarantine.com"; sid:580503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemictruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemictruth.com"; sid:580504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 335covidsanjivaniapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"335covidsanjivaniapi.com"; sid:580505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcoronavirus.com"; sid:580506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 658covidsanjivaniapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"658covidsanjivaniapi.com"; sid:580507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abobecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abobecoronavirus.com"; sid:580508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accreditedcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accreditedcoronatest.com"; sid:580509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accreditedcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accreditedcoronatesting.com"; sid:580510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accreditedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accreditedcovidtest.com"; sid:580511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accreditedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accreditedcovidtesting.com"; sid:580512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africa-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africa-covid19.com"; sid:580513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid19.life"; sid:580514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-partyon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-partyon.com"; sid:580515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ah-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ah-corona.com"; sid:580516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahcorona.com"; sid:580517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahh-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahh-corona.com"; sid:580518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahhcorona.com"; sid:580519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahicovid19.com"; sid:580520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahicovid.com"; sid:580521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbnb4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbnb4covid.com"; sid:580522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alipaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alipaycoronavirus.com"; sid:580523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaaftercoronavirus.com"; sid:580524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanpandemicsolutions.com"; sid:580525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analiticacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analiticacovid.com"; sid:580526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for androidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"androidcorona.com"; sid:580527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for androidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"androidcovid.com"; sid:580528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibacterialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibacterialcoronavirus.com"; sid:580529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodyforcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodyforcoronavirustest.com"; sid:580530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestforcoronavirus.com"; sid:580531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestforcovid19.com"; sid:580532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafarm.com"; sid:580533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronascherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronascherm.com"; sid:580534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronascreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronascreen.com"; sid:580535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.today"; sid:580536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbodies.com"; sid:580537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivir-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivir-covid19.com"; sid:580538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antwerpcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antwerpcorona.life"; sid:580539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apdcorona.com"; sid:580540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aplecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aplecoronavirus.com"; sid:580541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appealmycovid19denial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appealmycovid19denial.com"; sid:580542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applcoronavirus.com"; sid:580543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronairus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronairus.com"; sid:580544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronatracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronatracking.com"; sid:580545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apple-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apple-coronavirus.com"; sid:580546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronaviruses.com"; sid:580547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecoronaviruss.com"; sid:580548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applegooglecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applegooglecoronavirus.com"; sid:580549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for application-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"application-coronavirus.com"; sid:580550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptoticcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptoticcorona.com"; sid:580551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atwarwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atwarwithcovid.com"; sid:580552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auxiliocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auxiliocoronavirus.com"; sid:580553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for averapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"averapandemic.com"; sid:580554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for balisiagacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"balisiagacorona.com"; sid:580555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangalorefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangalorefightingcovid.com"; sid:580556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforethecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforethecorona.com"; sid:580557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bengalurufightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bengalurufightingcovid.com"; sid:580558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bersatulawancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bersatulawancorona.com"; sid:580559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19creditcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19creditcards.com"; sid:580560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcreditcardsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcreditcardsforcovid19.com"; sid:580561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoronavirus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoronavirus.mobi"; sid:580562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.life"; sid:580563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatfightscorona.com"; sid:580564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biharcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biharcorona.com"; sid:580565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bingcoronavirus.com"; sid:580566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcoronavirus.com"; sid:580567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcovid19.com"; sid:580568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bronxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bronxcovid.com"; sid:580569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckheadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckheadcovid.com"; sid:580570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buselcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buselcovid19.com"; sid:580571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessolutionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessolutionscovid19.com"; sid:580572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecoronavirusadministration.com"; sid:580573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecoronavirusliquidation.com"; sid:580574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafescoronavirus.com"; sid:580575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcoronavirus.com"; sid:580576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringthroughcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringthroughcoronavirus.com"; sid:580577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringthroughcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringthroughcovid-19.com"; sid:580578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringthroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringthroughcovid19.com"; sid:580579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringthroughcovid.com"; sid:580580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casquette-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casquette-coronavirus.com"; sid:580581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrocoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrocoronavirus.club"; sid:580582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrocoronavirus.com"; sid:580583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronatest.com"; sid:580584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronatesting.com"; sid:580585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidcleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidcleans.com"; sid:580586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidtest.com"; sid:580587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidtesting.com"; sid:580588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chapeau-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chapeau-coronavirus.com"; sid:580589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chapeaucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chapeaucoronavirus.com"; sid:580590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartscovid.com"; sid:580591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chemistcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chemistcoronavirusadministration.com"; sid:580592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chemistcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chemistcoronavirus.com"; sid:580593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chemistcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chemistcoronavirusliquidation.com"; sid:580594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china-covid19.com"; sid:580595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cholloscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cholloscoronavirus.com"; sid:580596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimscorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimscorona.net"; sid:580597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnnandcovid19siouxfallssd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnnandcovid19siouxfallssd.com"; sid:580598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronavirusuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronavirusuk.com"; sid:580599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityundercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityundercovid.com"; sid:580600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companyb-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companyb-covid19.com"; sid:580601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conteo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conteo-covid19.com"; sid:580602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for convalescentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"convalescentcovid19.com"; sid:580603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for convalescentplasmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"convalescentplasmacovid19.com"; sid:580604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conversationwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conversationwithcovid.com"; sid:580605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cooking4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cooking4covid.com"; sid:580606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornerstorecoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornerstorecoronavirusadministration.com"; sid:580607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornerstorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornerstorecoronavirus.com"; sid:580608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornerstorecoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornerstorecoronavirusliquidation.com"; sid:580609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaammo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaammo.com"; sid:580610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandroid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandroid.com"; sid:580611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytestkits.com"; sid:580612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-armor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-armor.com"; sid:580613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-baby-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-baby-clothing.com"; sid:580614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyclothing.com"; sid:580615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyshower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyshower.com"; sid:580616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabelly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabelly.com"; sid:580617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabodies.com"; sid:580618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabogado.com"; sid:580619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreakdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreakdown.com"; sid:580620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddies.com"; sid:580621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulk.com"; sid:580622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabulk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabulk.net"; sid:580623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacine.com"; sid:580624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningla.com"; sid:580625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningnola.com"; sid:580626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningus.com"; sid:580627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleantech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleantech.com"; sid:580628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconvo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconvo.com"; sid:580629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookingandcocktailclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookingandcocktailclub.com"; sid:580630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19supplies.com"; sid:580631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacracy.com"; sid:580632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuvee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuvee.com"; sid:580633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfecteren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfecteren.com"; sid:580634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetective.com"; sid:580635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasetreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasetreatment.com"; sid:580636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasetreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasetreatments.com"; sid:580637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadventuregame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadventuregame.com"; sid:580638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelections.com"; sid:580639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenlightenment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenlightenment.com"; sid:580640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepidemia.com"; sid:580641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepidemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepidemicnews.com"; sid:580642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaethics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaethics.com"; sid:580643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexcuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexcuses.com"; sid:580644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaffp2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaffp2.com"; sid:580645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflubye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflubye.com"; sid:580646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflubye.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflubye.net"; sid:580647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflueye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflueye.com"; sid:580648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflueye.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflueye.net"; sid:580649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehomes.com"; sid:580650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagamenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagamenight.com"; sid:580651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalheroes.com"; sid:580652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionrelief.com"; sid:580653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfusion.com"; sid:580654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvention.com"; sid:580655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-labo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-labo.com"; sid:580656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaatregel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaatregel.com"; sid:580657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask24.com"; sid:580658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskitaly.com"; sid:580659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksales.com"; sid:580660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamed.net"; sid:580661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametrix.com"; sid:580662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoverit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoverit.com"; sid:580663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapages.com"; sid:580664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobiacoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobiacoach.com"; sid:580665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplug.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplug.biz"; sid:580666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecheck.com"; sid:580667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecheck.net"; sid:580668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurchase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurchase.com"; sid:580669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinechronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinechronicles.com"; sid:580670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraswitch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraswitch.net"; sid:580671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reisen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reisen.net"; sid:580672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchreview.com"; sid:580673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchreview.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchreview.net"; sid:580674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsekits.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsekits.mobi"; sid:580675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ro.com"; sid:580676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeliving.com"; sid:580677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeonline.com"; sid:580678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasahayta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasahayta.com"; sid:580679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz-shop.com"; sid:580680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreen.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreen.cloud"; sid:580681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspacer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspacer.com"; sid:580682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspriracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspriracy.com"; sid:580683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasrapidtest.com"; sid:580684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatz.com"; sid:580685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastonewall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastonewall.com"; sid:580686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorstogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorstogether.com"; sid:580687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaszelfsneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaszelfsneltest.com"; sid:580688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelemedtelethon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelemedtelethon.com"; sid:580689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterrace.com"; sid:580690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcenters.com"; sid:580691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglab.com"; sid:580692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglabs.com"; sid:580693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testing.net"; sid:580694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkorea.com"; sid:580695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestkorea.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestkorea.net"; sid:580696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestvoordezorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestvoordezorg.com"; sid:580697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheegarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheegarden.com"; sid:580698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoknow.com"; sid:580699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatombola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatombola.com"; sid:580700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturkey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturkey.net"; sid:580701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-urlaub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-urlaub.net"; sid:580702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.life"; sid:580703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.today"; sid:580704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19hub.com"; sid:580705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.university"; sid:580706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.university"; sid:580707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.university"; sid:580708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.university"; sid:580709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2020-2021.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2020-2021.cloud"; sid:580710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2020awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2020awareness.com"; sid:580711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020survey.com"; sid:580712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus4.com"; sid:580713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus4kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus4kid.com"; sid:580714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaides.com"; sid:580715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhousing.com"; sid:580716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodiestestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodiestestkit.com"; sid:580717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodiestestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodiestestkits.com"; sid:580718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodylab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodylab.com"; sid:580719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-boom.com"; sid:580720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-boomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-boomer.com"; sid:580721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboomer.com"; sid:580722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscd.com"; sid:580723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontractandinsuranceclaimslegalconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontractandinsuranceclaimslegalconsultants.com"; sid:580724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoughringtones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoughringtones.com"; sid:580725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoughs.com"; sid:580726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnosticlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnosticlab.com"; sid:580727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiagnosticpanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiagnosticpanel.com"; sid:580728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseliminated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseliminated.com"; sid:580729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseliminato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseliminato.com"; sid:580730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusextension.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusextension.com"; sid:580731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactvsfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactvsfiction.com"; sid:580732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree.cloud"; sid:580733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenetherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenetherapy.com"; sid:580734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushighrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushighrisk.com"; sid:580735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoard.com"; sid:580736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusii.com"; sid:580737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunebracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunebracelet.com"; sid:580738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancedenial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancedenial.com"; sid:580739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawcenter.com"; sid:580740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliars.com"; sid:580741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lies.com"; sid:580742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslovedones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslovedones.com"; sid:580743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemesonline.com"; sid:580744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeterindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeterindia.com"; sid:580745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnightmares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnightmares.com"; sid:580746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspart2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspart2.com"; sid:580747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspin.com"; sid:580748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppesale.com"; sid:580749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprecheck.com"; sid:580750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprecheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprecheck.net"; sid:580751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionwholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionwholesale.com"; sid:580752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrations.com"; sid:580753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreserve.com"; sid:580754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafe.net"; sid:580755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaide.com"; sid:580756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatest.com"; sid:580757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatesting.com"; sid:580758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sars.com"; sid:580759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserology.com"; sid:580760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstimuluschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstimuluschallenge.com"; sid:580761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliesplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliesplus.com"; sid:580762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustake2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustake2.com"; sid:580763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-team.com"; sid:580764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlakehavasu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlakehavasu.com"; sid:580765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestwristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestwristband.com"; sid:580766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthebaselab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthebaselab.com"; sid:580767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustotalcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustotalcases.com"; sid:580768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustownhallmeetings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustownhallmeetings.com"; sid:580769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrail.com"; sid:580770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentoptions.com"; sid:580771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustribute.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustribute.net"; sid:580772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusviolation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusviolation.com"; sid:580773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoorzorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoorzorg.com"; sid:580774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-20.net"; sid:580775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acc.com"; sid:580776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actualidad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actualidad.com"; sid:580777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19addictionrecoverynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19addictionrecoverynetwork.com"; sid:580778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adidas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adidas.com"; sid:580779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-afarafat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-afarafat.com"; sid:580780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-afar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-afar.com"; sid:580781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhousing.com"; sid:580782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anitbodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anitbodytest.com"; sid:580783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibacteriallmodule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibacteriallmodule.com"; sid:580784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiestest.com"; sid:580785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiestestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiestestkit.com"; sid:580786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiestestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiestestkits.com"; sid:580787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodylab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodylab.com"; sid:580788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytest.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytest.life"; sid:580789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestskit.com"; sid:580790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytests.net"; sid:580791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antiviraldrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antiviraldrug.com"; sid:580792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anti-viralenvironmentalmodule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anti-viralenvironmentalmodule.com"; sid:580793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appeals.com"; sid:580794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19appeals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19appeals.net"; sid:580795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistnow.com"; sid:580796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athletes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athletes.com"; sid:580797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19at.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19at.net"; sid:580798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19averahospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19averahospital.com"; sid:580799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aws.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aws.cloud"; sid:580800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19baltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19baltimore.com"; sid:580801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19basketball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19basketball.com"; sid:580802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beater.com"; sid:580803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bestcreditcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bestcreditcards.com"; sid:580804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19biowarfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19biowarfare.com"; sid:580805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19box.com"; sid:580806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19broward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19broward.com"; sid:580807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buddysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buddysystem.com"; sid:580808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bugoutbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bugoutbag.com"; sid:580809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cameroun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cameroun.com"; sid:580810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cemetery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cemetery.com"; sid:580811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challengeidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challengeidea.com"; sid:580812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chart.com"; sid:580813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimattorneys.com"; sid:580814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsattorney.com"; sid:580815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsattorneys.com"; sid:580816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsfl.com"; sid:580817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimslawyers.com"; sid:580818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningla.com"; sid:580819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningla.com"; sid:580820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningnola.com"; sid:580821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnola.com"; sid:580822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningus.com"; sid:580823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningus.com"; sid:580824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clia.com"; sid:580825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clippers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clippers.com"; sid:580826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comix.com"; sid:580827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19construction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19construction.com"; sid:580828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultnow.com"; sid:580829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttest.com"; sid:580830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coughchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coughchecker.com"; sid:580831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditcase.com"; sid:580832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19criticalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19criticalcare.com"; sid:580833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cut.com"; sid:580834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailybrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailybrief.com"; sid:580835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallascowboys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallascowboys.com"; sid:580836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dcon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dcon.com"; sid:580837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dcon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dcon.net"; sid:580838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ddc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ddc.com"; sid:580839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dds.com"; sid:580840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deals.net"; sid:580841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19death.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19death.claims"; sid:580842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19death.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19death.claims"; sid:580843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathknell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathknell.com"; sid:580844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deconsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deconsolutions.com"; sid:580845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnostic.com"; sid:580846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosticlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosticlab.com"; sid:580847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosticpanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosticpanel.com"; sid:580848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discrimination.com"; sid:580849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discrimination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discrimination.net"; sid:580850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dog.com"; sid:580851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donatebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donatebox.com"; sid:580852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ebay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ebay.com"; sid:580853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeetestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeetestkit.com"; sid:580854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eurasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eurasia.com"; sid:580855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exams.com"; sid:580856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemasksupply.com"; sid:580857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fact-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fact-check.com"; sid:580858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factory.com"; sid:580859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstkits.com"; sid:580860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flashback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flashback.com"; sid:580861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-foodsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-foodsafety.com"; sid:580862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19football.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19football.com"; sid:580863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forfun.com"; sid:580864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeoffice.com"; sid:580865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundng.com"; sid:580866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19futbol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19futbol.com"; sid:580867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genetherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genetherapy.com"; sid:580868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gettested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gettested.com"; sid:580869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gettested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gettested.com"; sid:580870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grp.com"; sid:580871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19guidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19guidance.com"; sid:580872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthexperts.com"; sid:580873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herd.com"; sid:580874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hereos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hereos.com"; sid:580875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroawards.com"; sid:580876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoard.com"; sid:580877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homestimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homestimuluspackage.com"; sid:580878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housecare.com"; sid:580879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iggantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iggantibody.com"; sid:580880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19igottested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19igottested.com"; sid:580881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igottested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igottested.com"; sid:580882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunebracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunebracelet.com"; sid:580883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitybracelet.com"; sid:580884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inspections.com"; sid:580885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurance-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurance-lawsuits.com"; sid:580886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intelligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intelligence.com"; sid:580887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-iq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-iq.com"; sid:580888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ireland.com"; sid:580889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19key.com"; sid:580890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killchart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killchart.com"; sid:580891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killerlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killerlight.com"; sid:580892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killerlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killerlight.com"; sid:580893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kit-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kit-test.com"; sid:580894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lacounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lacounty.com"; sid:580895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lakers.com"; sid:580896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19law-suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19law-suits.com"; sid:580897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leadershiptimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leadershiptimeline.com"; sid:580898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalnow.com"; sid:580899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lies.com"; sid:580900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loantracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loantracker.com"; sid:580901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manutd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manutd.com"; sid:580902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marriagesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marriagesupport.com"; sid:580903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialhomepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialhomepage.com"; sid:580904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19metrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19metrix.com"; sid:580905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19midatlantic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19midatlantic.com"; sid:580906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nasa.com"; sid:580907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newsgroup.com"; sid:580908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsy.com"; sid:580909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkyankees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkyankees.com"; sid:580910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nightmare.com"; sid:580911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nike.com"; sid:580912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19not.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19not.com"; sid:580913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr.biz"; sid:580914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr-hk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr-hk.com"; sid:580915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odrhk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odrhk.com"; sid:580916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr-hk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr-hk.net"; sid:580917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odrhk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odrhk.net"; sid:580918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outdoors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outdoors.com"; sid:580919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.mobi"; sid:580920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicsupplies.com"; sid:580921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parents.com"; sid:580922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passport.com"; sid:580923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmadonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmadonations.com"; sid:580924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19professions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19professions.com"; sid:580925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proofoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proofoffice.com"; sid:580926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19psychiatrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19psychiatrist.com"; sid:580927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pt.com"; sid:580928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicksearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicksearch.com"; sid:580929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raiders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raiders.com"; sid:580930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidrecovery.com"; sid:580931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidrecovery.com"; sid:580932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19re-entrytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19re-entrytestkit.com"; sid:580933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-register.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-register.com"; sid:580934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regularity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regularity.com"; sid:580935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19religion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19religion.com"; sid:580936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resourses.com"; sid:580937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehotel.com"; sid:580938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeproduct.com"; sid:580939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safespace.com"; sid:580940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.university"; sid:580941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.university - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.university"; sid:580942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatest.com"; sid:580943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatesting.com"; sid:580944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatests.com"; sid:580945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanford.com"; sid:580946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-security.com"; sid:580947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shortsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shortsales.com"; sid:580948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signlanguage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signlanguage.com"; sid:580949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19siouxfalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19siouxfalls.com"; sid:580950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19siouxfallssd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19siouxfallssd.com"; sid:580951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutions.net"; sid:580952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soundtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soundtrack.com"; sid:580953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialolympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialolympics.com"; sid:580954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stats.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stats.world"; sid:580955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stimulusandrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stimulusandrecovery.com"; sid:580956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-store.com"; sid:580957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strong.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strong.net"; sid:580958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strong.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strong.world"; sid:580959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivor.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivor.digital"; sid:580960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorscommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorscommunity.com"; sid:580961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsstore.com"; sid:580962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxes.com"; sid:580963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tenders.com"; sid:580964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tenders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tenders.net"; sid:580965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testcentre.com"; sid:580966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcentre.com"; sid:580967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcerts.com"; sid:580968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdocs.com"; sid:580969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingindfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingindfw.com"; sid:580970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinginhonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinginhonolulu.com"; sid:580971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testms.com"; sid:580972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testnow.com"; sid:580973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnowdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnowdfw.com"; sid:580974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testwristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testwristband.com"; sid:580975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thailand.com"; sid:580976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19townhall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19townhall.com"; sid:580977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracetest.com"; sid:580978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracingtest.com"; sid:580979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trauma.com"; sid:580980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelalerts.com"; sid:580981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelsafe.com"; sid:580982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelzones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelzones.com"; sid:580983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tripalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tripalert.com"; sid:580984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tripalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tripalerts.com"; sid:580985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa.today"; sid:580986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecard.com"; sid:580987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecards.com"; sid:580988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecert.com"; sid:580989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedocs.com"; sid:580990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineid.com"; sid:580991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinepatent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinepatent.com"; sid:580992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccines.net"; sid:580993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vancouver.com"; sid:580994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19violation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19violation.com"; sid:580995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdisinfecting.com"; sid:580996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virusfreewristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virusfreewristband.com"; sid:580997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virushub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virushub.com"; sid:580998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vons.com"; sid:580999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wb.com"; sid:581000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19witness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19witness.com"; sid:581001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19witness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19witness.net"; sid:581002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19words.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19words.com"; sid:581003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcert.com"; sid:581004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workdocs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workdocs.com"; sid:581005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workpapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workpapers.com"; sid:581006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldcure.com"; sid:581007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeath.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeath.claims"; sid:581008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeath.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeath.claims"; sid:581009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yankees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yankees.com"; sid:581010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19yemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19yemen.com"; sid:581011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019-2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019-2020.cloud"; sid:581012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020-2021.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020-2021.cloud"; sid:581013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-iq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-iq.com"; sid:581014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid22vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid22vaccine.com"; sid:581015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid23vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid23vaccine.com"; sid:581016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafter.com"; sid:581017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaintshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaintshit.com"; sid:581018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandus.com"; sid:581019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-annhiliator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-annhiliator.com"; sid:581020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-answers.com"; sid:581021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyband.com"; sid:581022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodybracelet.com"; sid:581023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestkit.com"; sid:581024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestkits.com"; sid:581025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodywristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodywristband.com"; sid:581026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaorg.com"; sid:581027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarity.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarity.life"; sid:581028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarity.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarity.world"; sid:581029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarnost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarnost.com"; sid:581030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarnost.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarnost.net"; sid:581031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarnst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarnst.com"; sid:581032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidart.net"; sid:581033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatlanta.com"; sid:581034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatwork.com"; sid:581035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aws.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aws.cloud"; sid:581036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbacktowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbacktowork.com"; sid:581037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidband.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidband.biz"; sid:581038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbattlefield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbattlefield.com"; sid:581039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeaters.com"; sid:581040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizinterruption.com"; sid:581041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblog.net"; sid:581042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboardgame.com"; sid:581043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbs.com"; sid:581044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbtw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbtw.com"; sid:581045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbugoutbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbugoutbag.com"; sid:581046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesspivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesspivot.com"; sid:581047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesspivots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesspivots.com"; sid:581048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessregs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessregs.com"; sid:581049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcallforprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcallforprayer.com"; sid:581050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcartkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcartkit.com"; sid:581051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcation.net"; sid:581052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchangemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchangemanagement.com"; sid:581053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharts.net"; sid:581054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chex.com"; sid:581055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimlaw.com"; sid:581056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsfl.com"; sid:581057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimslawyers.com"; sid:581058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsny.com"; sid:581059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningexperts.com"; sid:581060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningla.com"; sid:581061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnola.com"; sid:581062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningus.com"; sid:581063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear19.com"; sid:581064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear19.net"; sid:581065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearid.com"; sid:581066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearid.net"; sid:581067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearsolutions.com"; sid:581068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommit.com"; sid:581069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcondocuisine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcondocuisine.com"; sid:581070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-conference-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-conference-2020.com"; sid:581071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-conference2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-conference2020.com"; sid:581072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconference-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconference-2020.com"; sid:581073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconference2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconference2020.com"; sid:581074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consultants.com"; sid:581075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttest.com"; sid:581076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopingskills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopingskills.com"; sid:581077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopingskills.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopingskills.net"; sid:581078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorazon.com"; sid:581079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorazon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorazon.net"; sid:581080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorridor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorridor.com"; sid:581081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrew19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrew19.com"; sid:581082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddanger.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddanger.net"; sid:581083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-destroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-destroyer.com"; sid:581084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-disclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-disclosure.com"; sid:581085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisclosure.com"; sid:581086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddispatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddispatch.com"; sid:581087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddles.com"; sid:581088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidease.com"; sid:581089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelections.com"; sid:581090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenlightenment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenlightenment.com"; sid:581091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocreative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocreative.com"; sid:581092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidespues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidespues.com"; sid:581093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialz.com"; sid:581094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideval.com"; sid:581095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexams.com"; sid:581096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexhibit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexhibit.com"; sid:581097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactfinder.com"; sid:581098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsmatter.com"; sid:581099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfast.com"; sid:581100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeet.com"; sid:581101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingers.com"; sid:581102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fraud-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fraud-lawyer.com"; sid:581103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeoffice.com"; sid:581104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeonline.com"; sid:581105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeonline.net"; sid:581106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestore.com"; sid:581107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetx.com"; sid:581108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworksite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworksite.com"; sid:581109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkspace.com"; sid:581110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.world"; sid:581111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreezone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreezone.net"; sid:581112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenotyper.tools - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenotyper.tools"; sid:581113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcarefraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcarefraud.com"; sid:581114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheartwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheartwall.com"; sid:581115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhedge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhedge.com"; sid:581116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhopesoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhopesoap.com"; sid:581117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhorizon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhorizon.com"; sid:581118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhours.com"; sid:581119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidi19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidi19.com"; sid:581120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiab-algerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiab-algerie.com"; sid:581121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicianove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicianove.com"; sid:581122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitywristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitywristband.com"; sid:581123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincolor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincolor.com"; sid:581124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotics.com"; sid:581125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillaz.com"; sid:581126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledmyconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledmyconstitution.com"; sid:581127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerfoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerfoil.com"; sid:581128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller.life"; sid:581129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillertape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillertape.com"; sid:581130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits.club"; sid:581131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits.company"; sid:581132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits.direct"; sid:581133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersgroup.com"; sid:581134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanstracker.com"; sid:581135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-logic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-logic.com"; sid:581136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarker.com"; sid:581137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialhomepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialhomepage.com"; sid:581138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.movie"; sid:581139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnightmare.com"; sid:581140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnums.com"; sid:581141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidog-formation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidog-formation.com"; sid:581142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidog.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidog.net"; sid:581143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomani.com"; sid:581144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoptics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoptics.com"; sid:581145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverkill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverkill.com"; sid:581146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpichincha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpichincha.com"; sid:581147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasma.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasma.life"; sid:581148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpov.com"; sid:581149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppe2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppe2020.com"; sid:581150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppewholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppewholesale.com"; sid:581151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecautions.com"; sid:581152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-precheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-precheck.com"; sid:581153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecker.com"; sid:581154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckme.com"; sid:581155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheck.net"; sid:581156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecks.com"; sid:581157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecks.net"; sid:581158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprint.com"; sid:581159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprogear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprogear.com"; sid:581160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-projections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-projections.com"; sid:581161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-proofed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-proofed.com"; sid:581162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofoffice.com"; sid:581163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuzzles.com"; sid:581164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradius.com"; sid:581165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidrecovery.com"; sid:581166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrash.com"; sid:581167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadycrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadycrate.com"; sid:581168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrona.com"; sid:581169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroofing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroofing.com"; sid:581170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecountry.com"; sid:581171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafefacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafefacility.com"; sid:581172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeflight.com"; sid:581173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeflights.com"; sid:581174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeholiday.com"; sid:581175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeliving.com"; sid:581176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafelyft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafelyft.com"; sid:581177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemap.com"; sid:581178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeproduct.com"; sid:581179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeproducts.com"; sid:581180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferestaurant.com"; sid:581181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeshops.com"; sid:581182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetaxi.com"; sid:581183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetravel.com"; sid:581184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeuber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeuber.com"; sid:581185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevacation.com"; sid:581186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitization.com"; sid:581187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscoop.com"; sid:581188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscoop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscoop.net"; sid:581189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserologies.com"; sid:581190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortsale.com"; sid:581191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimple.com"; sid:581192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitrep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitrep.com"; sid:581193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsix.com"; sid:581194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslayer.com"; sid:581195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspacing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspacing.com"; sid:581196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaffingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaffingnow.com"; sid:581197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatus.world"; sid:581198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidst.com"; sid:581199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies911.com"; sid:581200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurge.com"; sid:581201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvail.com"; sid:581202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurv.com"; sid:581203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurviel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurviel.com"; sid:581204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-swab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-swab.com"; sid:581205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxinfo.com"; sid:581206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-terminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-terminator.com"; sid:581207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestal.com"; sid:581208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.care"; sid:581209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingservice.com"; sid:581210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingusa.com"; sid:581211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitphilippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitphilippines.com"; sid:581212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestms.com"; sid:581213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestregistry.com"; sid:581214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.care"; sid:581215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoes.com"; sid:581216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracetest.com"; sid:581217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracing.com"; sid:581218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingtest.com"; sid:581219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker.today"; sid:581220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracknow.com"; sid:581221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tshirt.com"; sid:581222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidt-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidt-shirt.com"; sid:581223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunite.com"; sid:581224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilation.com"; sid:581225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviraltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviraltest.com"; sid:581226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushub.com"; sid:581227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizador.com"; sid:581228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwekill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwekill.com"; sid:581229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwirelessrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwirelessrelief.com"; sid:581230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxcoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxcoop.com"; sid:581231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxprotect.com"; sid:581232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxray.com"; sid:581233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxr.com"; sid:581234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createcovid19.com"; sid:581235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for createcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"createcovid.com"; sid:581236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crosscountrytrekduringthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crosscountrytrekduringthepandemic.com"; sid:581237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crossfitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crossfitcovid.com"; sid:581238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crying-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crying-covid.com"; sid:581239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocovid.com"; sid:581240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culcovid19.com"; sid:581241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadecovid-19.com"; sid:581242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadecovid.com"; sid:581243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona.life"; sid:581244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curemycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curemycorona.net"; sid:581245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curemycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curemycovid19.net"; sid:581246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursocoronavirus.com"; sid:581247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursoscoronavirus.com"; sid:581248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailylifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailylifeaftercovid.com"; sid:581249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataoncovid19.com"; sid:581250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datetestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datetestcovid19.com"; sid:581251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daumcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daumcoronavirus.com"; sid:581252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathcoronavirus.com"; sid:581253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathscovid19.com"; sid:581254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathscovid.com"; sid:581255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepcovid19.com"; sid:581256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliveroocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliveroocoronavirus.com"; sid:581257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designatedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designatedcovid.com"; sid:581258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionycontrolcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionycontrolcovid19.com"; sid:581259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectioncoronavirus.com"; sid:581260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectioncovid19.com"; sid:581261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectmycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectmycorona.com"; sid:581262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectmycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectmycovid19.com"; sid:581263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digital-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digital-corona.com"; sid:581264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digtialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digtialcorona.com"; sid:581265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doordashcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doordashcoronavirus.com"; sid:581266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpicovid.com"; sid:581267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethroughcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethroughcovidtesting.com"; sid:581268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcoronavirusadministration.com"; sid:581269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcoronavirus.com"; sid:581270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcoronavirusiquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcoronavirusiquidation.com"; sid:581271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecovidtest.com"; sid:581272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovidtest.com"; sid:581273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encountercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encountercovid19.com"; sid:581274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic24.com"; sid:581275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ergocare-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ergocare-covid.com"; sid:581276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciolibredecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciolibredecovid.com"; sid:581277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evidencecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evidencecovid19.com"; sid:581278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evidencecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evidencecovid19.net"; sid:581279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evitarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evitarcovid19.com"; sid:581280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exposecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exposecovid.com"; sid:581281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastfoodcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastfoodcoronavirusadministration.com"; sid:581282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastfoodcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastfoodcoronavirus.com"; sid:581283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastfoodcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastfoodcoronavirusliquidation.com"; sid:581284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight4coronavirus.com"; sid:581285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.study"; sid:581286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-the-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-the-covid19.com"; sid:581287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-thecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-thecovid19.com"; sid:581288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findthecovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findthecovidfacts.com"; sid:581289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscoronavirusadministration.com"; sid:581290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscoronavirus.com"; sid:581291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscoronavirusliquidation.com"; sid:581292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19administration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19administration.com"; sid:581293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19.com"; sid:581294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19coronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19coronavirusadministration.com"; sid:581295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19coronavirus.com"; sid:581296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19coronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19coronavirusliquidation.com"; sid:581297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitnesscovid-19liquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitnesscovid-19liquidation.com"; sid:581298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frappelacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frappelacovid.com"; sid:581299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frappelecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frappelecovid.com"; sid:581300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncoronavirusperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncoronavirusperu.com"; sid:581301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid19lima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid19lima.com"; sid:581302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid19peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid19peru.com"; sid:581303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid19peru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid19peru.net"; sid:581304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamblingcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamblingcoronavirusadministration.com"; sid:581305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamblingcoronavirusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamblingcoronavirusbankruptcy.com"; sid:581306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamblingcoronavirusbankruptcy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamblingcoronavirusbankruptcy.net"; sid:581307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamblingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamblingcoronavirus.com"; sid:581308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamblingcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamblingcoronavirusliquidation.com"; sid:581309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for garde-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"garde-covid.net"; sid:581310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronamasksnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronamasksnow.com"; sid:581311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testtoday.com"; sid:581312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testtoday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testtoday.net"; sid:581313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtesttoday.com"; sid:581314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtesttoday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtesttoday.net"; sid:581315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getridcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getridcovid.com"; sid:581316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghcovid-19.com"; sid:581317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giveafingertocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giveafingertocoronavirus.com"; sid:581318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giveafingertocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giveafingertocovid19.com"; sid:581319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giveafingertocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giveafingertocovid.com"; sid:581320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givecoronavirusthefinger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givecoronavirusthefinger.com"; sid:581321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givecovidthefinger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givecovidthefinger.com"; sid:581322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givethefingertocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givethefingertocoronavirus.com"; sid:581323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givethefingertocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givethefingertocovid.com"; sid:581324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalmedicalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalmedicalcovid19.com"; sid:581325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalmedicalcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalmedicalcovid19.net"; sid:581326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalmedicalmarketing-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalmedicalmarketing-covid19.com"; sid:581327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalmedicalmarketing-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalmedicalmarketing-covid19.net"; sid:581328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gogocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gogocorona.com"; sid:581329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronatracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronatracking.com"; sid:581330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlecoronavirus2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlecoronavirus2.com"; sid:581331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graphscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graphscovid.com"; sid:581332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatamericancoronasurvery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatamericancoronasurvery.com"; sid:581333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatamericancoronasurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatamericancoronasurvey.com"; sid:581334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatamericancovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatamericancovid19survey.com"; sid:581335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greenfirecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greenfirecorona.com"; sid:581336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcoronavirusadministration.com"; sid:581337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcoronavirus.com"; sid:581338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcoronavirusliquidation.com"; sid:581339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcovid-19.com"; sid:581340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcovid-19coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcovid-19coronavirus.com"; sid:581341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hack-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hack-covid19.com"; sid:581342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcovid2020.com"; sid:581343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid.net"; sid:581344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingoutcovid19.com"; sid:581345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirecovidstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirecovidstaff.com"; sid:581346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hollisterfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hollisterfightingcovid.com"; sid:581347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomakemoneyduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomakemoneyduringapandemic.com"; sid:581348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoworkoutaftercoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoworkoutaftercoronaquarantine.com"; sid:581349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huaweicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huaweicovid.com"; sid:581350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntingcovid.com"; sid:581351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygiaphonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygiaphonecovid.com"; sid:581352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icanhelpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icanhelpcovid.com"; sid:581353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcovid.com"; sid:581354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilandpandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilandpandemickit.com"; sid:581355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilostmyjobtocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilostmyjobtocoronavirus.com"; sid:581356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitacovid.com"; sid:581357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-coronahilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-coronahilfe.com"; sid:581358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-corona-virus.com"; sid:581359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insursol-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insursol-covid19.com"; sid:581360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intuitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intuitcoronavirus.com"; sid:581361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidbiggerthanmycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidbiggerthanmycountry.com"; sid:581362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthereacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthereacovidvaccine.com"; sid:581363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvive-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvive-coronavirus.com"; sid:581364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronavirus.world"; sid:581365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itfightingcovid19.com"; sid:581366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jdcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jdcoronavirus.com"; sid:581367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsduringthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsduringthepandemic.com"; sid:581368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kakaocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kakaocoronavirus.com"; sid:581369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepcovid19away.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepcovid19away.com"; sid:581370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keincovid.com"; sid:581371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kennyscovidcocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kennyscovidcocktails.com"; sid:581372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentcovid.com"; sid:581373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovidbook.com"; sid:581374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusin48hours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusin48hours.com"; sid:581375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidtogether.com"; sid:581376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kills-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kills-covid.com"; sid:581377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kisahpakcikcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kisahpakcikcovid19.com"; sid:581378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockoutcoronavirus.com"; sid:581379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockoutcovid19.com"; sid:581380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockoutcovid.com"; sid:581381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koninkrijkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koninkrijkcovid19.com"; sid:581382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kusutduniaperang-duniaamulaikust-akibatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kusutduniaperang-duniaamulaikust-akibatcovid19.com"; sid:581383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacuracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacuracovid.com"; sid:581384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalshieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalshieldcovid19.com"; sid:581385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letstalkaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letstalkaboutcorona.com"; sid:581386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lgcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lgcoronavirus.com"; sid:581387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for librecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"librecoronavirus.com"; sid:581388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for librecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"librecovid19.com"; sid:581389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithoutcorona.com"; sid:581390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19stat.com"; sid:581391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovidcleaning.com"; sid:581392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronajournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronajournal.com"; sid:581393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lowriskcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lowriskcovidmask.com"; sid:581394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lyftcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lyftcoronavirus.com"; sid:581395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincoronaantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincoronaantibodytest.com"; sid:581396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincoronatest.com"; sid:581397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincoronavirustest.com"; sid:581398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovid19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovid19antibodytest.com"; sid:581399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovid19antibodytestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovid19antibodytestkit.com"; sid:581400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovid19test.com"; sid:581401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovidantibodytest.com"; sid:581402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovidantibodytestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovidantibodytestkits.com"; sid:581403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailincovidtest.com"; sid:581404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manosunidascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manosunidascovid-19.com"; sid:581405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescorona.com"; sid:581406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescovid19pourtous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescovid19pourtous.com"; sid:581407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mimascaracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mimascaracovid.com"; sid:581408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-baby.com"; sid:581409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-baby.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-baby.net"; sid:581410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalessons.com"; sid:581411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaphobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaphobia.com"; sid:581412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusmemes.com"; sid:581413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhealth-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhealth-corona.com"; sid:581414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicaidkit.com"; sid:581415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemickit.com"; sid:581416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemickits.com"; sid:581417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myycorona.com"; sid:581418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myyycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myyycorona.com"; sid:581419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nasapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nasapandemic.com"; sid:581420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navercoronavirus.com"; sid:581421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncoronaviruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncoronaviruslive.com"; sid:581422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neuro-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neuro-covid-19.com"; sid:581423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusbook.com"; sid:581424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsycovid19.com"; sid:581425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronavaccine.com"; sid:581426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcovidstudy.com"; sid:581427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njstandsuptocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njstandsuptocovid.com"; sid:581428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronas.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronas.world"; sid:581429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirushere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirushere.com"; sid:581430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirushere.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirushere.net"; sid:581431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidvaccine.com"; sid:581432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcovid19.com"; sid:581433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for numberscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"numberscovid.com"; sid:581434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid19help.com"; sid:581435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid19tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid19tips.com"; sid:581436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvidiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvidiacoronavirus.com"; sid:581437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavaccine.com"; sid:581438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occasionicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occasionicoronavirus.com"; sid:581439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohhcorona.com"; sid:581440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohhhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohhhcorona.com"; sid:581441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid-19test.com"; sid:581442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid-19testing.com"; sid:581443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinetestcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinetestcovid19.net"; sid:581444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencoronavirus.com"; sid:581445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for originalwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"originalwuhan.com"; sid:581446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for otosocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"otosocovid19.com"; sid:581447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronachronicles.com"; sid:581448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocovid19.com"; sid:581449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronaviruslaw.com"; sid:581450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronaviruslawfirm.com"; sid:581451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronaviruslaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronaviruslaw.net"; sid:581452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pancovid-19.com"; sid:581453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic3d.com"; sid:581454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemication.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemication.net"; sid:581455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-babies.com"; sid:581456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbabyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbabyboom.com"; sid:581457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-baby.com"; sid:581458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-boom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-boom.com"; sid:581459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboom.com"; sid:581460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-boomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-boomer.com"; sid:581461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboomer.com"; sid:581462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclassactionlawsuit.com"; sid:581463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-iq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-iq.com"; sid:581464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicit.com"; sid:581465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicit.net"; sid:581466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicked.com"; sid:581467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-panda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-panda.com"; sid:581468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuppy.com"; sid:581469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecon.com"; sid:581470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecovery.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecovery.fund"; sid:581471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicroster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicroster.com"; sid:581472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsongs.com"; sid:581473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstartups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstartups.com"; sid:581474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsucks.com"; sid:581475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechalliance.com"; sid:581476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-tech.com"; sid:581477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechexpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechexpo.com"; sid:581478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechnews.com"; sid:581479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechreport.com"; sid:581480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechworld.com"; sid:581481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrauma.com"; sid:581482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrivia.com"; sid:581483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paypalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paypalcoronavirus.com"; sid:581484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalcovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalcovidprotection.com"; sid:581485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaciescoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaciescoronavirusadministration.com"; sid:581486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaciescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaciescoronavirus.com"; sid:581487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaciescoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaciescoronavirusliquidation.com"; sid:581488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philippinescovid19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philippinescovid19update.com"; sid:581489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivotfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivotfromcovid.com"; sid:581490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivotsfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivotsfromcovid.com"; sid:581491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmadonationscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmadonationscovid19.com"; sid:581492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmadonorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmadonorcovid19.com"; sid:581493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiglasscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiglasscoronavirus.com"; sid:581494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pornatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pornatcorona.com"; sid:581495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pornatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pornatcovid19.com"; sid:581496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona19.com"; sid:581497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaus.com"; sid:581498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid21.com"; sid:581499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidconnecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidconnecting.com"; sid:581500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidiq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidiq.com"; sid:581501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmeetings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmeetings.com"; sid:581502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidusa.com"; sid:581503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemichelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemichelp.com"; sid:581504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for powerpakd-covid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"powerpakd-covid19testkit.com"; sid:581505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-forcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-forcovid.com"; sid:581506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praetoriancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praetoriancovid.com"; sid:581507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prcompracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prcompracovid19.com"; sid:581508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precheckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precheckcovid.com"; sid:581509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precheckcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precheckcovid.net"; sid:581510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovidlife.com"; sid:581511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previnasecontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previnasecontracovid19.com"; sid:581512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidbrand.com"; sid:581513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productosanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productosanticovid.com"; sid:581514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionscovid19.com"; sid:581515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmefromcovid.com"; sid:581516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qqcoronavirus.com"; sid:581517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qualitesecuritecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qualitesecuritecovid19.com"; sid:581518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qualitysecuritycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qualitysecuritycovid19.com"; sid:581519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioningcovid.com"; sid:581520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceforcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceforcovidcure.com"; sid:581521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceforthecovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceforthecovidcure.com"; sid:581522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursomultascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursomultascovid19.com"; sid:581523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redditcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redditcoronavirus.com"; sid:581524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for regalosantiicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"regalosantiicovid-19.com"; sid:581525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircoronavirustreatment.com"; sid:581526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircovid-19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircovid-19treatment.com"; sid:581527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircovid19treatment.com"; sid:581528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resetbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resetbycorona.com"; sid:581529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resolvedcasescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resolvedcasescovid19.com"; sid:581530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcoronavirusadministration.com"; sid:581531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcoronavirus.com"; sid:581532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcoronavirusliquidation.com"; sid:581533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcoronavirusadministration.com"; sid:581534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcoronavirusliquidation.com"; sid:581535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridesharecoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridesharecoronavirusadministration.com"; sid:581536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridesharecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridesharecoronavirus.com"; sid:581537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridesharecoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridesharecoronavirusliquidation.com"; sid:581538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridesharingcoronavirussafetypartition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridesharingcoronavirussafetypartition.com"; sid:581539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for robinhoodcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"robinhoodcoronavirus.com"; sid:581540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefrompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefrompandemic.com"; sid:581541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salesforcecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salesforcecoronavirus.com"; sid:581542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schermi-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schermi-covid.com"; sid:581543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schermicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schermicovid.com"; sid:581544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexycovid.com"; sid:581545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shitoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shitoncoronavirus.com"; sid:581546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shizuoka-east-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shizuoka-east-covid-19.com"; sid:581547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidnineteen.com"; sid:581548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurcovid.com"; sid:581549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurcovid.net"; sid:581550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siouxfallscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siouxfallscovid19.com"; sid:581551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snapchatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snapchatcoronavirus.com"; sid:581552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snapcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snapcoronavirus.com"; sid:581553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soyjesuscoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soyjesuscoronado.com"; sid:581554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standupforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standupforcoronavirus.com"; sid:581555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standupforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standupforcovid.com"; sid:581556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayaheadofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayaheadofcovid.com"; sid:581557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid2020.com"; sid:581558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-desinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-desinfection.com"; sid:581559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiecovid19.com"; sid:581560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiedicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiedicovid19.com"; sid:581561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightouttacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightouttacovid.com"; sid:581562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suningcoronavirus.com"; sid:581563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplycorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplycorona-virus.com"; sid:581564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivepandemic.net"; sid:581565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tabs4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tabs4covid.com"; sid:581566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tabsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tabsforcovid.com"; sid:581567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkaboutcovid.com"; sid:581568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taobaocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taobaocoronavirus.com"; sid:581569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxicoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxicoronavirusadministration.com"; sid:581570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxicoronavirus.com"; sid:581571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taxicoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taxicoronavirusliquidation.com"; sid:581572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecommunicationscoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecommunicationscoronavirusadministration.com"; sid:581573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecommunicationscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecommunicationscoronavirus.com"; sid:581574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecommunicationscoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecommunicationscoronavirusliquidation.com"; sid:581575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.life"; sid:581576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid.net"; sid:581577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-for-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-for-corona.net"; sid:581578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcoronavirusantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcoronavirusantibody.com"; sid:581579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingforcovid-19.com"; sid:581580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnow-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnow-covid-19.com"; sid:581581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnow-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnow-covid19.com"; sid:581582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsforcovid.com"; sid:581583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testyourcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testyourcoronavirus.com"; sid:581584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testyourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testyourcovid19.com"; sid:581585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texaspandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texaspandemicsupply.com"; sid:581586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebookofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebookofcoronavirus.com"; sid:581587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebookofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebookofcovid19.com"; sid:581588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecarerandthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecarerandthecovid.com"; sid:581589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacard.com"; sid:581590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadashboard.com"; sid:581591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmemes.com"; sid:581592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaworlddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaworlddiary.com"; sid:581593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.world"; sid:581594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidarity.com"; sid:581595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclearinghouse.com"; sid:581596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclearinghouse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclearinghouse.net"; sid:581597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidquaranteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidquaranteam.com"; sid:581598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsupplies.com"; sid:581599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimeishereforthecoronavirustodisappear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimeishereforthecoronavirustodisappear.com"; sid:581600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetimeishereforthecoronavirustodisappear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetimeishereforthecoronavirustodisappear.net"; sid:581601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thongtincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thongtincovid.com"; sid:581602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timesofcoronavirus.com"; sid:581603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforpandemics.com"; sid:581604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tkdkickscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tkdkickscorona.com"; sid:581605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tmallcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tmallcoronavirus.com"; sid:581606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for togetheragainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"togetheragainstcovid19.net"; sid:581607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tongacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tongacovid19.com"; sid:581608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torturecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torturecorona.com"; sid:581609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trace-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trace-coronavirus.com"; sid:581610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trace-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trace-covid19.com"; sid:581611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcovid.com"; sid:581612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcorona.world"; sid:581613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcoronavirusadministration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcoronavirusadministration.com"; sid:581614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcoronavirusliquidation.com"; sid:581615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid19virus.com"; sid:581616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumps-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumps-corona.com"; sid:581617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubercoronavirus.com"; sid:581618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubereatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubereatscoronavirus.com"; sid:581619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for understandingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"understandingcovid.com"; sid:581620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updates-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updates-covid-19.com"; sid:581621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upliftingpandemicstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upliftingpandemicstories.com"; sid:581622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upsidedownrepeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upsidedownrepeatcovid19.com"; sid:581623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidtest.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidtest.care"; sid:581624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidtests.com"; sid:581625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtest.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtest.care"; sid:581626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtest.com"; sid:581627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtests.com"; sid:581628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usvaccinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usvaccinecovid19.com"; sid:581629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine4covid.com"; sid:581630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoadventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoadventcoronavirus.com"; sid:581631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoadventcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoadventcoronavirus.net"; sid:581632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoadventcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoadventcovid19.com"; sid:581633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocorona19.com"; sid:581634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid19.net"; sid:581635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venmocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venmocoronavirus.com"; sid:581636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcoronatest.com"; sid:581637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcoronatesting.com"; sid:581638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcovidtest.com"; sid:581639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifiedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifiedcovidtesting.com"; sid:581640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncovid19.net"; sid:581641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vhc-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vhc-covid-19.com"; sid:581642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vhc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vhc-covid19.com"; sid:581643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimcorona.com"; sid:581644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimscorona.com"; sid:581645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidcovid.com"; sid:581646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for videocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"videocovid.com"; sid:581647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viecovid2020.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viecovid2020.care"; sid:581648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viecovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viecovid.care"; sid:581649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19disinfecting.com"; sid:581650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid2019.com"; sid:581651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid2020.com"; sid:581652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovid-19.com"; sid:581653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weibocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weibocoronavirus.com"; sid:581654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weixincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weixincoronavirus.com"; sid:581655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westboroughcovid19communityfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westboroughcovid19communityfund.com"; sid:581656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatcovidtaughtme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatcovidtaughtme.com"; sid:581657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid.net"; sid:581658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winthecorona.com"; sid:581659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcovid19.com"; sid:581660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbatkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbatkillers.com"; sid:581661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbioweapon.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbioweapon.net"; sid:581662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhiv.com"; sid:581663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankelin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankelin.com"; sid:581664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankillerbats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankillerbats.com"; sid:581665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlu.com"; sid:581666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--abogadoscoronavirusespaa-nlc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--abogadoscoronavirusespaa-nlc.com"; sid:581667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavakasays-igcb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavakasays-igcb.com"; sid:581668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--sensibilisation-hygine-covid-0qc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--sensibilisation-hygine-covid-0qc.net"; sid:581669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yahoocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yahoocoronavirus.com"; sid:581670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yandexcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yandexcoronavirus.com"; sid:581671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidiots.com"; sid:581672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-stopcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-stopcovid19cleaning.com"; sid:581673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019-ncov-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019-ncov-pandemic.com"; sid:581674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2ndcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2ndcoronavirus.com"; sid:581675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2ndcoronaviruswawe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2ndcoronaviruswawe.com"; sid:581676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 901covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"901covid.com"; sid:581677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1covidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1covidsupply.com"; sid:581678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovid-19.com"; sid:581679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovid19.net"; sid:581680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actagainstcorona.com"; sid:581681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventcovid19.com"; sid:581682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afgcovid19.com"; sid:581683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afgcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afgcovid19.net"; sid:581684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronawellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronawellness.com"; sid:581685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoviddesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoviddesign.com"; sid:581686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidoffice.com"; sid:581687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidoffices.com"; sid:581688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidworkspace.com"; sid:581689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidworkspaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidworkspaces.com"; sid:581690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovidfestival.com"; sid:581691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ai-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ai-covid.com"; sid:581692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamafightingcovid.com"; sid:581693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alicovid.com"; sid:581694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovid19.com"; sid:581695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angolastopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angolastopcovid.com"; sid:581696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid19simpletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid19simpletest.com"; sid:581697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.guru"; sid:581698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.services"; sid:581699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.support"; sid:581700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspanama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspanama.com"; sid:581701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid1.com"; sid:581702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid2019.com"; sid:581703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidarchitecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidarchitecture.com"; sid:581704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcity.net"; sid:581705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidperu.com"; sid:581706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidwholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidwholesale.com"; sid:581707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apresleviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apresleviruscorona.com"; sid:581708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areacovidfree.com"; sid:581709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovid.com"; sid:581710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtesting.com"; sid:581711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baiducovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baiducovid.com"; sid:581712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcoronavirus.com"; sid:581713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcovid.com"; sid:581714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcovid.com"; sid:581715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidbiz.com"; sid:581716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bebascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bebascovid.com"; sid:581717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becausecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becausecovid.com"; sid:581718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellcovid-19.com"; sid:581719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellcovid.com"; sid:581720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bemrenovandoplanoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bemrenovandoplanoscovid.com"; sid:581721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billofrightspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billofrightspandemic.com"; sid:581722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bisniscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bisniscorona.com"; sid:581723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcovidnow.com"; sid:581724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bronxcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bronxcoronavirusattorney.com"; sid:581725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulkcovid19.com"; sid:581726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bustcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bustcovid.com"; sid:581727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid-19test.com"; sid:581728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidclean.com"; sid:581729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidlaws.com"; sid:581730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidlawyers.com"; sid:581731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecovid.com"; sid:581732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcoviddoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcoviddoctor.com"; sid:581733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camisetascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camisetascovid.com"; sid:581734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canigetcovid19ifihaditbefore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canigetcovid19ifihaditbefore.com"; sid:581735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcovidupdates.com"; sid:581736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid-19socialdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid-19socialdistancing.com"; sid:581737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdphcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdphcovid19testing.com"; sid:581738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cekcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cekcovid.com"; sid:581739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadocoronavirus.net"; sid:581740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadocovid19.com"; sid:581741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedrecoveredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedrecoveredcovid.com"; sid:581742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartcovid19.com"; sid:581743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesenovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesenovelcoronavirus.com"; sid:581744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chloecrushescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chloecrushescoronavirus.com"; sid:581745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chokeoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chokeoutcovid.com"; sid:581746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidnow.com"; sid:581747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanteamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanteamcovid19.com"; sid:581748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closewuhanmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closewuhanmarket.com"; sid:581749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collagesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collagesforcovid.com"; sid:581750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovidtesting.com"; sid:581751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comcovid.com"; sid:581752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companycovid19test.com"; sid:581753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companycovidtest.com"; sid:581754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for complaintcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"complaintcovid.com"; sid:581755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovid19.com"; sid:581756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectedbycovid.com"; sid:581757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constitutionpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constitutionpandemic.com"; sid:581758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid-19.net"; sid:581759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corecovid.com"; sid:581760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona17.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona17.com"; sid:581761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona369.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona369.com"; sid:581762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadjuvant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadjuvant.com"; sid:581763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afschermfolie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afschermfolie.com"; sid:581764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afscherming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afscherming.com"; sid:581765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaake.com"; sid:581766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-audit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-audit.com"; sid:581767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabagisistemi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabagisistemi.com"; sid:581768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyclaims.com"; sid:581769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beschermfolie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beschermfolie.com"; sid:581770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabizsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabizsolutions.com"; sid:581771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboredommedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboredommedia.com"; sid:581772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrainbreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrainbreaks.com"; sid:581773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-c19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-c19.com"; sid:581774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalender.com"; sid:581775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarerx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarerx.com"; sid:581776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacession.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacession.net"; sid:581777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-challenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-challenge.net"; sid:581778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidesanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidesanitizer.com"; sid:581779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-claim-gb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-claim-gb.com"; sid:581780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.cat"; sid:581781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningpros.com"; sid:581782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacute.com"; sid:581783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacute.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacute.net"; sid:581784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadampot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadampot.com"; sid:581785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadayss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadayss.com"; sid:581786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-design.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-design.pro"; sid:581787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-drama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-drama.com"; sid:581788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaencasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaencasa.com"; sid:581789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-equip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-equip.com"; sid:581790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-escape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-escape.com"; sid:581791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessentialsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessentialsonline.com"; sid:581792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeairbnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeairbnb.com"; sid:581793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedom.net"; sid:581794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeevent.com"; sid:581795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesingles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesingles.com"; sid:581796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fuck-yourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fuck-yourself.com"; sid:581797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gesichtsschutz-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gesichtsschutz-online.com"; sid:581798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthscare.com"; sid:581799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahiv.com"; sid:581800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoaxed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoaxed.com"; sid:581801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygiene-automat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygiene-automat.com"; sid:581802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygienemassnahmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygienemassnahmen.com"; sid:581803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygienevorschrift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygienevorschrift.com"; sid:581804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hygienevorschrift-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hygienevorschrift-online.com"; sid:581805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaibusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaibusa.com"; sid:581806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaid757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaid757.com"; sid:581807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaiinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaiinusa.com"; sid:581808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjapan.com"; sid:581809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsa.com"; sid:581810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsuranceattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsuranceattorneys.com"; sid:581811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainysa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainysa.com"; sid:581812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-job-control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-job-control.com"; sid:581813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajustice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajustice.net"; sid:581814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kammerjaeger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kammerjaeger.com"; sid:581815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kammerjaeger.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kammerjaeger.net"; sid:581816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitnow.com"; sid:581817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakit.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakit.today"; sid:581818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakunst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakunst.com"; sid:581819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalations.com"; sid:581820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalnusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalnusa.com"; sid:581821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameron.com"; sid:581822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamess.com"; sid:581823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundmaske.com"; sid:581824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaniusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaniusa.com"; sid:581825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapals.com"; sid:581826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicvaccine.com"; sid:581827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoker.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoker.net"; sid:581828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproducten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproducten.com"; sid:581829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ratten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ratten.com"; sid:581830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ratten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ratten.net"; sid:581831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rechtsrat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rechtsrat.com"; sid:581832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsekits.com"; sid:581833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsekits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsekits.net"; sid:581834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartbalance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartbalance.com"; sid:581835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafehome.com"; sid:581836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasinglesmeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasinglesmeet.com"; sid:581837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spatscherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spatscherm.com"; sid:581838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sterilizer.com"; sid:581839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stopp.com"; sid:581840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalcookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalcookbook.com"; sid:581841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerlive.com"; sid:581842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineadjuvant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineadjuvant.com"; sid:581843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronava.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronava.cloud"; sid:581844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverse.net"; sid:581845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavest.com"; sid:581846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirs-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirs-sd.com"; sid:581847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtualtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtualtour.com"; sid:581848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtualtours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtualtours.com"; sid:581849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19movie.com"; sid:581850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-2d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-2d.com"; sid:581851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbabyboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbabyboomers.com"; sid:581852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarristers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarristers.com"; sid:581853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbioweapon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbioweapon.com"; sid:581854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesssolutions.com"; sid:581855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalender.com"; sid:581856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscandor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscandor.com"; sid:581857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarfree.com"; sid:581858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscartoons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscartoons.com"; sid:581859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusclaim.com"; sid:581860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscolutions.com"; sid:581861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomp.com"; sid:581862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconvos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconvos.com"; sid:581863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19.cloud"; sid:581864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19pandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19pandemic2020.com"; sid:581865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-donations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-donations.com"; sid:581866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomicchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomicchaos.com"; sid:581867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectionplan.com"; sid:581868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacial-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacial-masks.com"; sid:581869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fahrschule-hygienemassnahmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fahrschule-hygienemassnahmen.com"; sid:581870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fahrschule-schutzmassnahmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fahrschule-schutzmassnahmen.com"; sid:581871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighterapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighterapp.com"; sid:581872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialrecovery.com"; sid:581873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforms.com"; sid:581874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglossary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglossary.com"; sid:581875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusgloves.com"; sid:581876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-job.com"; sid:581877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborattorney.com"; sid:581878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborattorneys.com"; sid:581879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborlaws.com"; sid:581880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaborlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaborlawyers.com"; sid:581881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalresourcecenter.com"; sid:581882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveinformation.com"; sid:581883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslockdownstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslockdownstories.com"; sid:581884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanufacturing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanufacturing.com"; sid:581885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapusa.com"; sid:581886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmascarillas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmascarillas.net"; sid:581887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnationalregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnationalregistry.com"; sid:581888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoverview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoverview.com"; sid:581889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanic.net"; sid:581890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolicy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolicy.net"; sid:581891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqrcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqrcode.com"; sid:581892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqr.com"; sid:581893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanificazioneitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanificazioneitalia.com"; sid:581894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-se.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-se.com"; sid:581895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecondwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecondwave.com"; sid:581896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftestingkit.com"; sid:581897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmackdown.com"; sid:581898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussocialstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussocialstory.com"; sid:581899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurveillance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurveillance.com"; sid:581900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaxi.com"; sid:581901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglondon.com"; sid:581902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmaps.com"; sid:581903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapyonline.com"; sid:581904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthirdwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthirdwave.com"; sid:581905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentclinic.com"; sid:581906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvlights.com"; sid:581907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusventures.com"; sid:581908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswealthformula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswealthformula.com"; sid:581909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldcrisis.com"; sid:581910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusww3.com"; sid:581911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wars.com"; sid:581912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wears.com"; sid:581913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworrier.com"; sid:581914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawuhan19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawuhan19.com"; sid:581915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counsellingthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counsellingthroughcovid.com"; sid:581916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for courtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"courtcovid.com"; sid:581917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertedcovid.com"; sid:581918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertlycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertlycovid.com"; sid:581919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020strong.com"; sid:581920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19access.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19access.com"; sid:581921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actionguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actionguide.com"; sid:581922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andgrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andgrief.com"; sid:581923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andptsd.com"; sid:581924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andunder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andunder.com"; sid:581925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19asap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19asap.com"; sid:581926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistmortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistmortgagefamily.com"; sid:581927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autism.com"; sid:581928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babyboomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babyboomers.com"; sid:581929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barandgrill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barandgrill.com"; sid:581930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bbb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bbb.com"; sid:581931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bordercontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bordercontrol.com"; sid:581932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bordertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bordertest.com"; sid:581933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bordertesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bordertesting.com"; sid:581934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boys.com"; sid:581935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruption.com"; sid:581936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buyitused.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buyitused.com"; sid:581937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bycountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bycountry.com"; sid:581938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cal.com"; sid:581939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cardgame.com"; sid:581940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carecommunity.com"; sid:581941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careplan.com"; sid:581942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carnival.com"; sid:581943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cartoons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cartoons.com"; sid:581944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkpoints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkpoints.com"; sid:581945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checktest.com"; sid:581946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19childhooddiabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19childhooddiabetes.com"; sid:581947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classaction.net"; sid:581948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cleaningservice.com"; sid:581949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsolution.com"; sid:581950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companytest.com"; sid:581951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coronavirus2020.com"; sid:581952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coronaviruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coronaviruspandemic2020.com"; sid:581953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creativity.com"; sid:581954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditdisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditdisputes.com"; sid:581955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19credithelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19credithelp.com"; sid:581956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditservices.com"; sid:581957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crossovercleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crossovercleaning.com"; sid:581958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cures.com"; sid:581959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-data-tracking-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-data-tracking-dashboard.com"; sid:581960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ddsclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ddsclaims.com"; sid:581961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaims.com"; sid:581962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathpercentage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathpercentage.com"; sid:581963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathtolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathtolls.com"; sid:581964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19delta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19delta.com"; sid:581965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dmdclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dmdclaims.com"; sid:581966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dogs.com"; sid:581967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dvmclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dvmclaims.com"; sid:581968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elsalvsdor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elsalvsdor.com"; sid:581969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emoji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emoji.com"; sid:581970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employeereliefclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employeereliefclassaction.com"; sid:581971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employeereliefclassaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employeereliefclassaction.net"; sid:581972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeetest.com"; sid:581973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eos.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eos.fitness"; sid:581974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19esxperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19esxperts.com"; sid:581975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemaskspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemaskspecial.com"; sid:581976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flashtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flashtest.com"; sid:581977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flights.com"; sid:581978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flying.com"; sid:581979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forms.com"; sid:581980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontier.com"; sid:581981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19g.com"; sid:581982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genius.com"; sid:581983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19germ2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19germ2020.com"; sid:581984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glossary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glossary.com"; sid:581985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gps.com"; sid:581986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19grief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19grief.com"; sid:581987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19h2oscotlandsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19h2oscotlandsolutions.com"; sid:581988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthscare.com"; sid:581989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthstore.com"; sid:581990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-heatdeactivationbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-heatdeactivationbox.com"; sid:581991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpforfamilies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpforfamilies.com"; sid:581992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hindi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hindi.com"; sid:581993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hunt.com"; sid:581994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19identity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19identity.com"; sid:581995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intexasjails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intexasjails.com"; sid:581996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-janitorial.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-janitorial.pro"; sid:581997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-janitorial.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-janitorial.services"; sid:581998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jetblue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jetblue.com"; sid:581999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19k9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19k9.com"; sid:582000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kammerjaeger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kammerjaeger.com"; sid:582001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kammerjaeger.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kammerjaeger.net"; sid:582002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepitclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepitclean.com"; sid:582003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kindnesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kindnesschallenge.com"; sid:582004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kindness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kindness.com"; sid:582005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kits.net"; sid:582006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ksa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ksa.com"; sid:582007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborattorney.com"; sid:582008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborattorneys.com"; sid:582009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laborlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laborlawyer.com"; sid:582010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19la.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19la.fitness"; sid:582011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalbenefits.com"; sid:582012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19litigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19litigator.com"; sid:582013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveinformation.com"; sid:582014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19logistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19logistics.com"; sid:582015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lvac.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lvac.fitness"; sid:582016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketing.net"; sid:582017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketupdate.com"; sid:582018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maskprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maskprotection.com"; sid:582019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19max.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19max.com"; sid:582020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medlevensohn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medlevensohn.com"; sid:582021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medllevensohn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medllevensohn.com"; sid:582022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moonshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moonshot.com"; sid:582023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moonshot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moonshot.net"; sid:582024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortalityrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortalityrate.com"; sid:582025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19movie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19movie.net"; sid:582026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myrestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myrestart.com"; sid:582027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mywakeupcall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mywakeupcall.com"; sid:582028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19national.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19national.com"; sid:582029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nationalregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nationalregistry.com"; sid:582030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationwide.com"; sid:582031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19norwegian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19norwegian.com"; sid:582032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19norwegian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19norwegian.com"; sid:582033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obamas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obamas.com"; sid:582034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19odr.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19odr.biz"; sid:582035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overcomers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overcomers.com"; sid:582036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patiences.com"; sid:582037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoneapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoneapp.com"; sid:582038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19planet.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19planet.fitness"; sid:582039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policy.net"; sid:582040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-positive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-positive.com"; sid:582041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19principle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19principle.com"; sid:582042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prisons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prisons.com"; sid:582043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privacy.com"; sid:582044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19progress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19progress.com"; sid:582045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19projections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19projections.com"; sid:582046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectiongears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectiongears.com"; sid:582047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection.network"; sid:582048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-psicohelp.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-psicohelp.cloud"; sid:582049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-psicohelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-psicohelp.com"; sid:582050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19puzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19puzzle.com"; sid:582051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19qrcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19qrcode.com"; sid:582052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19qr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19qr.com"; sid:582053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rajkot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rajkot.com"; sid:582054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ratten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ratten.com"; sid:582055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ratten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ratten.net"; sid:582056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recruitingrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recruitingrelief.com"; sid:582057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19redclayschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19redclayschools.com"; sid:582058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refunds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refunds.net"; sid:582059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefcheck.com"; sid:582060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relieffundfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relieffundfraud.com"; sid:582061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefvoucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefvoucher.com"; sid:582062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefvoucher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefvoucher.com"; sid:582063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remove.com"; sid:582064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resistence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resistence.com"; sid:582065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsdrivenbusinesssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsdrivenbusinesssolutions.com"; sid:582066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsonline.com"; sid:582067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retrofit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retrofit.biz"; sid:582068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-return-home-schedules-sharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-return-home-schedules-sharing.com"; sid:582069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19royalcaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19royalcaribbean.com"; sid:582070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19royal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19royal.com"; sid:582071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19royal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19royal.com"; sid:582072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtpcr.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtpcr.biz"; sid:582073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sadc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sadc.com"; sid:582074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe24.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe24.fitness"; sid:582075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe24hour.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe24hour.fitness"; sid:582076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safealaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safealaska.com"; sid:582077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeandclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeandclean.com"; sid:582078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecarnival.com"; sid:582079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecarnival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecarnival.com"; sid:582080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeeos.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeeos.fitness"; sid:582081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehawaiian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehawaiian.com"; sid:582082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safela.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safela.fitness"; sid:582083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeliving.com"; sid:582084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safelvac.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safelvac.fitness"; sid:582085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safenorwegian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safenorwegian.com"; sid:582086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeplanet.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeplanet.fitness"; sid:582087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferoyalcaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferoyalcaribbean.com"; sid:582088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19saferoyal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19saferoyal.com"; sid:582089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferoyal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferoyal.com"; sid:582090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeymca.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeymca.fitness"; sid:582091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sd.com"; sid:582092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftestingkit.com"; sid:582093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smackdown.com"; sid:582094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19socialdistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19socialdistance.com"; sid:582095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19socialdistancing2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19socialdistancing2020.com"; sid:582096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions-scotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions-scotland.com"; sid:582097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsscotland.com"; sid:582098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spirit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spirit.com"; sid:582099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19startdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19startdate.com"; sid:582100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19startdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19startdates.com"; sid:582101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stateguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stateguidelines.com"; sid:582102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statetesting.com"; sid:582103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimuluspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimuluspackage.com"; sid:582104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sucksballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sucksballs.com"; sid:582105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19suicide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19suicide.com"; sid:582106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppression.com"; sid:582107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surfacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surfacetest.com"; sid:582108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surges.com"; sid:582109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxi.com"; sid:582110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19telerehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19telerehab.com"; sid:582111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telerehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telerehab.com"; sid:582112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testchecker.com"; sid:582113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingmaps.com"; sid:582114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmn.com"; sid:582115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testpacks.com"; sid:582116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testresult.com"; sid:582117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19texasresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19texasresponseteam.com"; sid:582118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thetrueheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thetrueheroes.com"; sid:582119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thrive.com"; sid:582120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tomos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tomos.com"; sid:582121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topis.com"; sid:582122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topo.com"; sid:582123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-topos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-topos.com"; sid:582124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-topos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-topos.com"; sid:582125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toposmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toposmap.com"; sid:582126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toposmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toposmap.com"; sid:582127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-topus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-topus.com"; sid:582128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19topus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19topus.com"; sid:582129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tragedy.com"; sid:582130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19underground.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19underground.com"; sid:582131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19underground.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19underground.net"; sid:582132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19urinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19urinetest.com"; sid:582133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa.solutions"; sid:582134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usasupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usasupply.com"; sid:582135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usasupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usasupply.net"; sid:582136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccino.com"; sid:582137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusintel.com"; sid:582138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wahala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wahala.com"; sid:582139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wedding.com"; sid:582140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wins.com"; sid:582141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscompil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscompil.com"; sid:582142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worktesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worktesting.com"; sid:582143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathclaims.com"; sid:582144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeaths.com"; sid:582145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wuhan2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wuhan2020.com"; sid:582146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ymca.fitness - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ymca.fitness"; sid:582147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019supershot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019supershot.com"; sid:582148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020medicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020medicals.com"; sid:582149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020ppe.com"; sid:582150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid901.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid901.com"; sid:582151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionlawsuits.com"; sid:582152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidada.com"; sid:582153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadjuvant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadjuvant.com"; sid:582154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidado.com"; sid:582155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidainsumos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidainsumos.com"; sid:582156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaldia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaldia.com"; sid:582157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamages.com"; sid:582158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamazon.com"; sid:582159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandbeyond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandbeyond.com"; sid:582160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandthekeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandthekeys.com"; sid:582161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodiestests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodiestests.com"; sid:582162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodypositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodypositive.com"; sid:582163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapple.com"; sid:582164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartgallery.com"; sid:582165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatanalytics.com"; sid:582166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbatshitcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbatshitcrazy.com"; sid:582167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbattles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbattles.com"; sid:582168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbbb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbbb.com"; sid:582169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefitconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefitconcerts.com"; sid:582170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiclaim.com"; sid:582171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbi.com"; sid:582172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblogs.com"; sid:582173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbond-italia.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbond-italia.cloud"; sid:582174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonditalia.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonditalia.cloud"; sid:582175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbond-italia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbond-italia.com"; sid:582176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bonds.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bonds.cloud"; sid:582177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bonds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bonds.net"; sid:582178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbordercontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbordercontrol.com"; sid:582179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbordertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbordertest.com"; sid:582180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbordertesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbordertesting.com"; sid:582181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbulkresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbulkresponse.com"; sid:582182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesskiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesskiosk.com"; sid:582183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusteritalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusteritalia.com"; sid:582184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cafe.com"; sid:582185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandor.com"; sid:582186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantbreakus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantbreakus.com"; sid:582187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaper.com"; sid:582188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarebox.com"; sid:582189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecafe.com"; sid:582190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecommunity.com"; sid:582191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarejc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarejc.com"; sid:582192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarfree.com"; sid:582193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarolina.com"; sid:582194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatcher.com"; sid:582195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcautiousmovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcautiousmovers.com"; sid:582196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedrecovered.com"; sid:582197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchanges.com"; sid:582198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckpoint.com"; sid:582199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckpoints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckpoints.com"; sid:582200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimslawfirm.com"; sid:582201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.cat"; sid:582202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancrews.com"; sid:582203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.today"; sid:582204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanions.com"; sid:582205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanytest.com"; sid:582206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomps.com"; sid:582207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompsforseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompsforseniors.com"; sid:582208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectcommunity.com"; sid:582209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstructioncrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstructioncrews.com"; sid:582210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconversationsproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconversationsproject.com"; sid:582211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookn.com"; sid:582212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrews.com"; sid:582213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcunt.com"; sid:582214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuresus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuresus.com"; sid:582215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidddsclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidddsclaims.com"; sid:582216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddmdclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddmdclaims.com"; sid:582217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddruglawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddruglawsuit.com"; sid:582218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddruglawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddruglawsuits.com"; sid:582219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemoji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemoji.com"; sid:582220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployeetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployeetest.com"; sid:582221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenterprises.com"; sid:582222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepshop.com"; sid:582223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexist.com"; sid:582224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacebook.com"; sid:582225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfastonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfastonline.com"; sid:582226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeethands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeethands.com"; sid:582227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeethandsregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeethandsregistry.com"; sid:582228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeetregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeetregistry.com"; sid:582229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfellowship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfellowship.com"; sid:582230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfence.com"; sid:582231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfighterapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfighterapp.com"; sid:582232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilternow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilternow.com"; sid:582233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflight.com"; sid:582234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflying.com"; sid:582235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-2020.com"; sid:582236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebar.com"; sid:582237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecert.com"; sid:582238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertified.com"; sid:582239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedallas.com"; sid:582240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerestaurantbars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerestaurantbars.com"; sid:582241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerestaurant.com"; sid:582242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerestaurantsbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerestaurantsbar.com"; sid:582243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetest.com"; sid:582244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetesting.com"; sid:582245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevenues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevenues.com"; sid:582246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreework.com"; sid:582247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkers.com"; sid:582248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidg.com"; sid:582249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoodwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoodwill.com"; sid:582250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-guardians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-guardians.com"; sid:582251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpbankofthewest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpbankofthewest.com"; sid:582252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhiv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhiv.com"; sid:582253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecure.com"; sid:582254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitallawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitallawsuits.com"; sid:582255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhuila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhuila.com"; sid:582256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo.cloud"; sid:582257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinitalia.com"; sid:582258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnepal.com"; sid:582259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancecomplaint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancecomplaint.com"; sid:582260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidit.net"; sid:582261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoox.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoox.express"; sid:582262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitnow.com"; sid:582263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsnow.com"; sid:582264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaborlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaborlaws.com"; sid:582265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabpack.com"; sid:582266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawhelp.net"; sid:582267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegal.net"; sid:582268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidles.com"; sid:582269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-less.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-less.com"; sid:582270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanaccounting.com"; sid:582271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogistics.com"; sid:582272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskbox.com"; sid:582273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskfilters.com"; sid:582274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.pro"; sid:582275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialbracelet.com"; sid:582276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialbracelets.com"; sid:582277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetrix.com"; sid:582278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicrosoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicrosoft.com"; sid:582279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoonshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoonshot.com"; sid:582280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoonshot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoonshot.net"; sid:582281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmusiccollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmusiccollective.com"; sid:582282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnecklace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnecklace.com"; sid:582283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegative19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegative19.com"; sid:582284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewamerica.com"; sid:582285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsamerica.com"; sid:582286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsusa.com"; sid:582287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewusa.com"; sid:582288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenvax.com"; sid:582289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocene.com"; sid:582290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomic.com"; sid:582291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-patent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-patent.com"; sid:582292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatiences.com"; sid:582293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpeoplemeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpeoplemeet.com"; sid:582294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharma.net"; sid:582295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpilaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpilaw.com"; sid:582296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoint.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoint.net"; sid:582297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreescreen.com"; sid:582298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprooflife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprooflife.com"; sid:582299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresult.com"; sid:582300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreclamaciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreclamaciones.com"; sid:582301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefvideo.com"; sid:582302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsekits.com"; sid:582303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantsolutions.com"; sid:582304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultprohealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultprohealth.com"; sid:582305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultsprohealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultsprohealthcare.com"; sid:582306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidride.com"; sid:582307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrides.com"; sid:582308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetrack.com"; sid:582309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetracker.com"; sid:582310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyguide.com"; sid:582311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyguides.com"; sid:582312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-saglikbakanligi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-saglikbakanligi.com"; sid:582313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsarsbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsarsbar.com"; sid:582314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscrub.com"; sid:582315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensor.com"; sid:582316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsexe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsexe.com"; sid:582317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsham.com"; sid:582318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshirts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshirts.biz"; sid:582319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshops.com"; sid:582320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignal.com"; sid:582321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignal.net"; sid:582322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignsonline.com"; sid:582323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignsusa.com"; sid:582324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.church"; sid:582325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsong.com"; sid:582326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoulsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoulsurvivor.com"; sid:582327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoulsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoulsurvivors.com"; sid:582328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecialistservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecialistservices.com"; sid:582329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstateguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstateguidelines.com"; sid:582330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstayathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstayathome.com"; sid:582331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudyhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudyhouston.com"; sid:582332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucksballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucksballs.com"; sid:582333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupply.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupply.biz"; sid:582334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurges.com"; sid:582335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswipe.com"; sid:582336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtap.com"; sid:582337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcenter.net"; sid:582338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdirect.com"; sid:582339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestexpress.com"; sid:582340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglasvegas.com"; sid:582341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingvegas.com"; sid:582342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlasvegas.com"; sid:582343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttraining.com"; sid:582344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvegas.com"; sid:582345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestxpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestxpress.com"; sid:582346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtok.com"; sid:582347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtok.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtok.net"; sid:582348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtolls.com"; sid:582349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtopis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtopis.com"; sid:582350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtr3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtr3.com"; sid:582351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerapps.com"; sid:582352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerct.com"; sid:582353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerworld.com"; sid:582354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracket.com"; sid:582355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelinsurance.com"; sid:582356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialhouston.com"; sid:582357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-true-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-true-info.com"; sid:582358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduniverse.com"; sid:582359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduso.com"; sid:582360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduso.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduso.net"; sid:582361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusonyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusonyc.com"; sid:582362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusonyc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusonyc.net"; sid:582363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineadjuvant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineadjuvant.com"; sid:582364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilatorlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilatorlawsuit.com"; sid:582365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilatorlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilatorlawsuits.com"; sid:582366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscleaning.com"; sid:582367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarvet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarvet.com"; sid:582368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwearabletracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwearabletracker.com"; sid:582369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-web.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-web.com"; sid:582370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwi.com"; sid:582371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacesolutions.com"; sid:582372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworktest.com"; sid:582373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworktesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworktesting.com"; sid:582374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldmonument.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldmonument.com"; sid:582375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwuhan2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwuhan2020.com"; sid:582376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwuhan-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwuhan-cure.com"; sid:582377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwuhancure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwuhancure.com"; sid:582378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxguard.com"; sid:582379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxist.com"; sid:582380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyo.com"; sid:582381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzerowhisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzerowhisky.com"; sid:582382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpepcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpepcovid19.com"; sid:582383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid-19.com"; sid:582384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datoscovid19.com"; sid:582385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcoronavirus.com"; sid:582386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeathecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeathecoronavirus.com"; sid:582387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarcoronavirus.net"; sid:582388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarcovid19.com"; sid:582389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhcdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhcdcovid19.com"; sid:582390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovid-19.com"; sid:582391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid-19vaccine.com"; sid:582392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgivemecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgivemecorona.com"; sid:582393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dopacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dopacovid19.com"; sid:582394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for douglasvillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"douglasvillecoronavirus.com"; sid:582395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovidtesting.com"; sid:582396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidclean.com"; sid:582397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elbafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elbafreecovid.com"; sid:582398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elbanocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elbanocovid.com"; sid:582399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for electricianincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"electricianincorona.com"; sid:582400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencypandemickits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencypandemickits.com"; sid:582401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecovid19test.com"; sid:582402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcovidlockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcovidlockdown.com"; sid:582403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicepidemicmultitool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicepidemicmultitool.com"; sid:582404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-prevention.net"; sid:582405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examecovid19.com"; sid:582406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitocovidiano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitocovidiano.com"; sid:582407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscoronatesting.com"; sid:582408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscovidtest.com"; sid:582409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscovidtesting.com"; sid:582410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyecovid-19.com"; sid:582411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ez2getcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ez2getcovid19test.com"; sid:582412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facing-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facing-corona.com"; sid:582413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facing-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facing-corona.net"; sid:582414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fackcoronavirus.com"; sid:582415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fahrschule-corona-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fahrschule-corona-online.com"; sid:582416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcoronaco.com"; sid:582417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckoffcovid19.com"; sid:582418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovids.com"; sid:582419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.today"; sid:582420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficovid-19.com"; sid:582421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findavaccineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findavaccineforcovid19.com"; sid:582422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitness-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitness-pandemic.com"; sid:582423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronaviruscleaningservice.com"; sid:582424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19cleaning.com"; sid:582425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19cleaningservice.com"; sid:582426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fold4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fold4covid.com"; sid:582427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foldforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foldforcovid.com"; sid:582428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for france-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"france-covid-19.com"; sid:582429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidhotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidhotel.com"; sid:582430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtest.net"; sid:582431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freedom-after-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freedom-after-corona.com"; sid:582432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gcoronavirus.com"; sid:582433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generacioncovid.com"; sid:582434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genosensorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genosensorcoronavirus.com"; sid:582435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidgame.com"; sid:582436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidcertified.com"; sid:582437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidpledge.com"; sid:582438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalhistorycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalhistorycoronavirus.com"; sid:582439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicintel.com"; sid:582440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicstories.com"; sid:582441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gouv-federalsubsidiescovid-19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gouv-federalsubsidiescovid-19crisis.com"; sid:582442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcovidlockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcovidlockdown.com"; sid:582443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatfakepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatfakepandemic.com"; sid:582444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for griefaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"griefaftercovid-19.com"; sid:582445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for griefafterlosingsomeonetocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"griefafterlosingsomeonetocovid-19.com"; sid:582446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for griefandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"griefandcovid-19.com"; sid:582447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for h2oscotland-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"h2oscotland-covid19.com"; sid:582448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for h2oscotland-covid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"h2oscotland-covid19solutions.com"; sid:582449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haterscovid19.com"; sid:582450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveyouseencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveyouseencovid19.com"; sid:582451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcoronavirus.com"; sid:582452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingtouch4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingtouch4covid19.com"; sid:582453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpflattenthecoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpflattenthecoronacurve.com"; sid:582454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hisd-mentalhealth-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hisd-mentalhealth-covid19.com"; sid:582455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homelessfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homelessfightingcovid19.com"; sid:582456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howisurvivedcoronavirus10essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howisurvivedcoronavirus10essentials.com"; sid:582457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocleancovid.com"; sid:582458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanresourcescoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanresourcescoronavirusfree.com"; sid:582459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanresourcescovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanresourcescovid19free.com"; sid:582460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygiene-corona-automat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygiene-corona-automat.com"; sid:582461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidcertified.com"; sid:582462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamhealedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamhealedcovid19.com"; sid:582463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icleancovid19.com"; sid:582464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecoronaantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecoronaantibodies.com"; sid:582465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infezionedacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infezionedacoronavirus.com"; sid:582466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infezionedacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infezionedacovid19.com"; sid:582467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiacoronavirussanificazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiacoronavirussanificazione.com"; sid:582468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiacovidbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiacovidbond.com"; sid:582469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italian-covid-bond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italian-covid-bond.com"; sid:582470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancovidbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancovidbond.com"; sid:582471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jcoronavirus.com"; sid:582472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kammerjaeger-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kammerjaeger-corona.com"; sid:582473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kammerjaeger-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kammerjaeger-corona.net"; sid:582474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kammerjaeger-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kammerjaeger-covid19.com"; sid:582475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kammerjaeger-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kammerjaeger-covid19.net"; sid:582476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kappaocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kappaocoronavirus.com"; sid:582477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kappaocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kappaocovid19.com"; sid:582478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcoronavirus.com"; sid:582479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcovid.com"; sid:582480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitigienecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitigienecoronavirus.com"; sid:582481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsicurezzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsicurezzacovid.com"; sid:582482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kleanteamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kleanteamcovid19.com"; sid:582483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knockoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knockoutcorona.com"; sid:582484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kocoronavirus.com"; sid:582485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacountycovid19api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacountycovid19api.com"; sid:582486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19tracker.com"; sid:582487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidtesting.com"; sid:582488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidtest.com"; sid:582489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidtesting.com"; sid:582490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcoronavirus.com"; sid:582491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterlosingsomeonetocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterlosingsomeonetocovid-19.com"; sid:582492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limbecovid19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limbecovid19taskforce.com"; sid:582493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaftercovid.com"; sid:582494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lnecovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lnecovid19help.com"; sid:582495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losingalovedonetosuicideaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losingalovedonetosuicideaftercovid-19.com"; sid:582496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losingsomeonetosuicideaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losingsomeonetosuicideaftercovid-19.com"; sid:582497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luchavscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luchavscovid19.com"; sid:582498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luqiao-wuhan56.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luqiao-wuhan56.com"; sid:582499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luzcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luzcoronavirus.com"; sid:582500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcoronavirus.com"; sid:582501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madisoncovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madisoncovidresources.com"; sid:582502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malukucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malukucovid19.com"; sid:582503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparas-anticontagios-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparas-anticontagios-covid19.com"; sid:582504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascoronavirus.net"; sid:582505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandmadecovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandmadecovid19supplies.com"; sid:582506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracoronabrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracoronabrasil.com"; sid:582507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovidfree.com"; sid:582508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mccovid.com"; sid:582509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcoronavirus.com"; sid:582510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaidandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaidandcovid-19.com"; sid:582511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaidandcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaidandcovid-19.net"; sid:582512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaidandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaidandcovid.com"; sid:582513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaidandcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaidandcovid.net"; sid:582514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mejoresmascarillascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mejoresmascarillascoronavirus.com"; sid:582515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialwallcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialwallcoronavirus.com"; sid:582516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialwallcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialwallcovid-19.com"; sid:582517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialwallofvictimsoftheworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialwallofvictimsoftheworldpandemic.com"; sid:582518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealth-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealth-covid-19.com"; sid:582519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealth-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealth-covid19.com"; sid:582520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metrocovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metrocovidinfo.com"; sid:582521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metrocovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metrocovidrecovery.com"; sid:582522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for middleboroughcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"middleboroughcovid19.com"; sid:582523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for middlesbroughfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"middlesbroughfightingcovid.com"; sid:582524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milanocoronavirussanificazione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milanocoronavirussanificazione.com"; sid:582525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milspincovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milspincovidkey.com"; sid:582526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minusthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minusthecoronavirus.com"; sid:582527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovid19testing.com"; sid:582528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtesting.net"; sid:582529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostradorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostradorcovid.com"; sid:582530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostradorescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostradorescovid.com"; sid:582531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasafety.com"; sid:582532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycousindiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycousindiedfromcovid-19.com"; sid:582533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19hometest.com"; sid:582534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19vaccine.com"; sid:582535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfreeid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfreeid.com"; sid:582536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhometedt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhometedt.com"; sid:582537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhometrst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhometrst.com"; sid:582538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidhonetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidhonetest.com"; sid:582539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtestathome.com"; sid:582540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydaddiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydaddiedfromcovid-19.com"; sid:582541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydaddiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydaddiedofcovid-19.com"; sid:582542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydaughterdiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydaughterdiedfromcovid-19.com"; sid:582543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mydaughterdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mydaughterdiedofcovid-19.com"; sid:582544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfatherdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfatherdiedofcovid-19.com"; sid:582545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfrienddiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfrienddiedfromcovid-19.com"; sid:582546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfrienddiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfrienddiedofcovid-19.com"; sid:582547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandfatherdiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandfatherdiedfromcovid-19.com"; sid:582548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandfatherdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandfatherdiedofcovid-19.com"; sid:582549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandmadiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandmadiedfromcovid-19.com"; sid:582550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandmadiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandmadiedofcovid-19.com"; sid:582551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandmotherdiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandmotherdiedfromcovid-19.com"; sid:582552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandmotherdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandmotherdiedofcovid-19.com"; sid:582553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandpadiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandpadiedfromcovid-19.com"; sid:582554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mygrandpadiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mygrandpadiedofcovid-19.com"; sid:582555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylovedonediedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylovedonediedfromcovid-19.com"; sid:582556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylovedonediedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylovedonediedofcovid-19.com"; sid:582557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymomdiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymomdiedfromcovid-19.com"; sid:582558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymomdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymomdiedofcovid-19.com"; sid:582559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymotherdiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymotherdiedfromcovid-19.com"; sid:582560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymotherdiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymotherdiedofcovid-19.com"; sid:582561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicexperience.com"; sid:582562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysondiedfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysondiedfromcovid-19.com"; sid:582563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysonofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysonofcovid-19.com"; sid:582564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid-19registry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid-19registry.com"; sid:582565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neuracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neuracovid.com"; sid:582566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newarkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newarkcovid19.com"; sid:582567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycovid19cleaning.com"; sid:582568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycovid19cleaningservice.com"; sid:582569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newnormalamidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newnormalamidcoronavirus.com"; sid:582570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruscleaningservice.com"; sid:582571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19cleaning.com"; sid:582572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovid19cleaningservice.com"; sid:582573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextpandemics.com"; sid:582574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocontactcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocontactcovidtesting.com"; sid:582575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronamasks.com"; sid:582576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolacovid19.com"; sid:582577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northeastcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northeastcovidtracker.com"; sid:582578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novocovid19.com"; sid:582579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyc-covid.com"; sid:582580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidlaw.com"; sid:582581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidlawyer.com"; sid:582582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidlawyers.com"; sid:582583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusattorney.com"; sid:582584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusattorneys.com"; sid:582585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidattorneys.com"; sid:582586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid.com"; sid:582587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19survey.com"; sid:582588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19survey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19survey.net"; sid:582589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidsurvey.com"; sid:582590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidsurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidsurvey.net"; sid:582591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid19cleaning.com"; sid:582592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid19training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid19training.com"; sid:582593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ontheothersideofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ontheothersideofcovid19.com"; sid:582594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidcomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidcomfort.com"; sid:582595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidcomfort.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidcomfort.net"; sid:582596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidvictory.com"; sid:582597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidvictory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidvictory.net"; sid:582598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oralcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oralcoronavirusvaccine.com"; sid:582599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oralcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oralcovid19vaccine.com"; sid:582600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oralcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oralcovidvaccine.com"; sid:582601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ospedalecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ospedalecovidfree.com"; sid:582602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidmask.com"; sid:582603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overtcovid.com"; sid:582604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for p2postpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"p2postpandemic.com"; sid:582605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic3d.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic3d.net"; sid:582606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-airlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-airlines.com"; sid:582607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandchill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandchill.com"; sid:582608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-art.com"; sid:582609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicartshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicartshow.com"; sid:582610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbeard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbeard.com"; sid:582611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbeards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbeards.com"; sid:582612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbride.com"; sid:582613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cabal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cabal.com"; sid:582614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccase.com"; sid:582615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccases.com"; sid:582616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccases.net"; sid:582617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cleaning.com"; sid:582618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-cleaningservice.com"; sid:582619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdash.com"; sid:582620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-depot.com"; sid:582621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicesthetic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicesthetic.com"; sid:582622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicesthetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicesthetics.com"; sid:582623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgardens.com"; sid:582624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgov.com"; sid:582625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancesolution.com"; sid:582626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicirishwhisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicirishwhisky.com"; sid:582627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickillers.com"; sid:582628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-map.com"; sid:582629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmasksupply.com"; sid:582630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpassport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpassport.net"; sid:582631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpath.com"; sid:582632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpickup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpickup.com"; sid:582633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pizza.com"; sid:582634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpower.com"; sid:582635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppedistributor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppedistributor.com"; sid:582636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppedistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppedistributors.com"; sid:582637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppesupplies.com"; sid:582638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-products.com"; sid:582639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofprofession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofprofession.com"; sid:582640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pros.com"; sid:582641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionessentials.com"; sid:582642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionmask.com"; sid:582643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionmasks.com"; sid:582644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrxbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrxbuster.com"; sid:582645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskillsets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskillsets.com"; sid:582646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsmackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsmackdown.com"; sid:582647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsoaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsoaps.com"; sid:582648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsoft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsoft.com"; sid:582649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolidarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolidarity.com"; sid:582650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictakedown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictakedown.com"; sid:582651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-tshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-tshirts.com"; sid:582652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvictory.com"; sid:582653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicww3.com"; sid:582654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paretianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paretianticovid.com"; sid:582655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcoronavirus.com"; sid:582656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcovid.com"; sid:582657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pdaanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pdaanticovid19.com"; sid:582658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovid19cleaning.com"; sid:582659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovid19cleaningservice.com"; sid:582660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perdidascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perdidascovid.com"; sid:582661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcorona.com"; sid:582662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcoronamask.com"; sid:582663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcovidmask.com"; sid:582664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsagainstcorona.com"; sid:582665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19cleaning.com"; sid:582666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philadelphiacovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philadelphiacovid19cleaningservice.com"; sid:582667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinchecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinchecorona.com"; sid:582668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinchecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinchecoronavirus.com"; sid:582669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivot2scovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivot2scovid.com"; sid:582670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plantsvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plantsvscovid.com"; sid:582671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformafectadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformafectadoscovid.com"; sid:582672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pleitoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pleitoscovid.com"; sid:582673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for polizascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"polizascovid.com"; sid:582674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positiveforcovidantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positiveforcovidantibodies.com"; sid:582675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidbusinessrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidbusinessrecovery.com"; sid:582676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidbusinessrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidbusinessrecovery.net"; sid:582677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcontingencyplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcontingencyplanning.com"; sid:582678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcontingencyplanning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcontingencyplanning.net"; sid:582679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddesigns.com"; sid:582680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-era.com"; sid:582681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-era.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-era.net"; sid:582682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidgear.com"; sid:582683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidinteriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidinteriors.com"; sid:582684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidoffice.com"; sid:582685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidoffices.com"; sid:582686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshocksyndrome.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshocksyndrome.solutions"; sid:582687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidspace.com"; sid:582688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstrategicplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstrategicplanning.com"; sid:582689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstrategicplanning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstrategicplanning.net"; sid:582690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-summit.com"; sid:582691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-summit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-summit.net"; sid:582692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.today"; sid:582693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtalk.com"; sid:582694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtalk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtalk.net"; sid:582695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtravel.com"; sid:582696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidwear.com"; sid:582697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworking.com"; sid:582698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworkplace.com"; sid:582699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworkspace.com"; sid:582700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworkspaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworkspaces.com"; sid:582701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postepidemicpandemonium.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postepidemicpandemonium.biz"; sid:582702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiceconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiceconomy.com"; sid:582703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicgeneration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicgeneration.com"; sid:582704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpandemonium.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpandemonium.biz"; sid:582705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpeople.com"; sid:582706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicplanning.com"; sid:582707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicresponseteam.com"; sid:582708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicstory.com"; sid:582709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-covid-banchile.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-covid-banchile.net"; sid:582710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnantduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnantduringcovid19.com"; sid:582711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-covid.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-covid.solutions"; sid:582712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectioncovid.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectioncovid.solutions"; sid:582713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivemasksfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivemasksfromcorona.com"; sid:582714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegetedelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegetedelcovid.com"; sid:582715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionicovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionicovidfree.com"; sid:582716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protivcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protivcovid.com"; sid:582717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocoloscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocoloscovid19.com"; sid:582718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicologocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicologocoronavirus.com"; sid:582719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovideos.com"; sid:582720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdaftercovid-19.com"; sid:582721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdandcovid-19.com"; sid:582722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcovid-19.com"; sid:582723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puntocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puntocovid.com"; sid:582724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quest4covidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quest4covidcures.com"; sid:582725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questforcovidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questforcovidcures.com"; sid:582726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radarcovid19.com"; sid:582727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtestinglocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtestinglocations.com"; sid:582728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtest.net"; sid:582729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratten-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratten-corona.com"; sid:582730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratten-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratten-corona.net"; sid:582731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratten-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratten-covid19.com"; sid:582732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ratten-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ratten-covid19.net"; sid:582733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ready4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ready4pandemic.com"; sid:582734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realworldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realworldcovid.com"; sid:582735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamatusegurocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamatusegurocovid.com"; sid:582736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resultscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resultscovid19.com"; sid:582737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricovid19testing.com"; sid:582738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricovidresponse.com"; sid:582739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rip-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rip-covid-19.com"; sid:582740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rip-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rip-covid19.com"; sid:582741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rip-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rip-covid.com"; sid:582742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovids.com"; sid:582743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rutacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rutacovid.com"; sid:582744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidelivery.com"; sid:582745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safemaskcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safemaskcovid.com"; sid:582746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salivatestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salivatestcovid19.com"; sid:582747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saludcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saludcovid.com"; sid:582748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanycovid.com"; sid:582749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars2covid19.com"; sid:582750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveusfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveusfromcovid.com"; sid:582751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for say-no-to-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"say-no-to-covid.com"; sid:582752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scoronavirus.com"; sid:582753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningforcoronavirus.com"; sid:582754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screeningforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screeningforcovid19.com"; sid:582755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secureinfocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secureinfocovid.net"; sid:582756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguridadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguridadcovid.com"; sid:582757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguroscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguroscovid.com"; sid:582758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendacovidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendacovidcard.com"; sid:582759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-corona-gesichtsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-corona-gesichtsschutz.com"; sid:582760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-corona-hygienevorschrift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-corona-hygienevorschrift.com"; sid:582761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-fahrschule-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-fahrschule-corona.com"; sid:582762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shangcovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shangcovidstore.com"; sid:582763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shavetheworldfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shavetheworldfromcovid.com"; sid:582764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shootcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shootcovid19.com"; sid:582765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopwuhanmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopwuhanmarket.com"; sid:582766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecovidmask.com"; sid:582767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcovid19test.com"; sid:582768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcovidtest.com"; sid:582769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soforthilfe-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soforthilfe-corona.net"; sid:582770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutionscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutionscovid.com"; sid:582771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoronavirtualtour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoronavirtualtour.com"; sid:582772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoronavirtualtours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoronavirtualtours.com"; sid:582773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawaycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawaycovid-19.com"; sid:582774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.biz"; sid:582775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.cat"; sid:582776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidusa.com"; sid:582777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronacurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronacurve.com"; sid:582778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stupidcovidpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stupidcovidpeople.com"; sid:582779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suicideaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suicideaftercovid-19.com"; sid:582780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suicideandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suicideandcovid-19.com"; sid:582781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suicidecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suicidecovid-19.com"; sid:582782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportyourneighborcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportyourneighborcovid19.com"; sid:582783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surveillancecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surveillancecoronavirus.com"; sid:582784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surveillancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surveillancecovid19.com"; sid:582785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalpandemic.com"; sid:582786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.net"; sid:582787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcoronavirus.com"; sid:582788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcovid.com"; sid:582789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tencentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tencentcoronavirus.com"; sid:582790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tencentcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tencentcovid.com"; sid:582791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testeparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testeparacovid.com"; sid:582792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing4covid19.com"; sid:582793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19attorney.com"; sid:582794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid-19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid-19lawyer.com"; sid:582795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid19lawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid19lawyer.net"; sid:582796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidattorney.com"; sid:582797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidlawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidlawyer.net"; sid:582798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusshot.com"; sid:582799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19agenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19agenda.com"; sid:582800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19difference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19difference.com"; sid:582801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19newsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19newsroom.com"; sid:582802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19quiz.com"; sid:582803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19student.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19student.com"; sid:582804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidaffairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidaffairs.com"; sid:582805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidaffairs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidaffairs.net"; sid:582806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-id.com"; sid:582807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkits.com"; sid:582808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidless.com"; sid:582809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlist.com"; sid:582810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshields.com"; sid:582811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatamericancovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatamericancovid19survey.com"; sid:582812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcovidlockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcovidlockdown.com"; sid:582813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theheroesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theheroesofcovid.com"; sid:582814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theothersideofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theothersideofcorona.com"; sid:582815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiclive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiclive.com"; sid:582816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timelinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timelinecoronavirus.com"; sid:582817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tppandemic.com"; sid:582818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecorona.net"; sid:582819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for track-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"track-covid19.net"; sid:582820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traialcovid.com"; sid:582821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trepidemic.com"; sid:582822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trial-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trial-covid.com"; sid:582823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid-2020.com"; sid:582824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscoronavirusresponse.com"; sid:582825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscovid19response.com"; sid:582826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtsforcoronavirus.com"; sid:582827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tshirtsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tshirtsforcovid19.com"; sid:582828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronavirusattorney.com"; sid:582829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronavirusattorneys.com"; sid:582830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidlawyer.com"; sid:582831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidlawyers.com"; sid:582832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubeatcovid19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubeatcovid19in2020.com"; sid:582833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uktestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uktestcovid19.com"; sid:582834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undergroundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undergroundcovid19.com"; sid:582835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undergroundcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undergroundcovid19.net"; sid:582836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undergroundcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undergroundcovid.com"; sid:582837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undergroundcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undergroundcovid.net"; sid:582838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedbycovid.com"; sid:582839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unknownpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unknownpandemic.com"; sid:582840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcomfort.com"; sid:582841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcures.com"; sid:582842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidproducts.com"; sid:582843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usneedspandemicinsurancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usneedspandemicinsurancenow.com"; sid:582844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usocovidcomfort.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usocovidcomfort.net"; sid:582845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usocovidvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usocovidvictory.com"; sid:582846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usocovidvictory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usocovidvictory.net"; sid:582847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usofcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usofcovid.biz"; sid:582848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv-clightkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv-clightkillcoronavirus.com"; sid:582849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv-clightkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv-clightkillcovid19.com"; sid:582850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccini-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccini-covid19.com"; sid:582851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccino-sars-covid-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccino-sars-covid-2.com"; sid:582852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcoronavirus.com"; sid:582853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovidtest.com"; sid:582854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovidtesting.com"; sid:582855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventilatorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventilatorcovid.com"; sid:582856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vzwirelesscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vzwirelesscovidrelief.com"; sid:582857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wall-of-victims-of-the-world-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wall-of-victims-of-the-world-pandemic.com"; sid:582858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallofvictimsoftheworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallofvictimsoftheworldpandemic.com"; sid:582859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wcovid.com"; sid:582860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidcertified.com"; sid:582861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for welcomelifeaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"welcomelifeaftercovid-19.com"; sid:582862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whohascovidcardgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whohascovidcardgame.com"; sid:582863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wholesalingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wholesalingaftercovid.com"; sid:582864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for williamjenkinhasfullblownaidsandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"williamjenkinhasfullblownaidsandcoronavirus.com"; sid:582865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for williamjenkinhasfullblownaidsandprobablycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"williamjenkinhasfullblownaidsandprobablycoronavirus.com"; sid:582866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for with-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"with-corona.com"; sid:582867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcorona-virus.com"; sid:582868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldometercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldometercoronavirus.com"; sid:582869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecoronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecoronaviruscleaningservice.com"; sid:582870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19cleaningservice.com"; sid:582871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan987.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan987.com"; sid:582872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-at.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-at.com"; sid:582873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancisco.com"; sid:582874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoronatours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoronatours.com"; sid:582875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancovid192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancovid192020.com"; sid:582876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhaitian.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhaitian.net"; sid:582877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanp4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanp4.com"; sid:582878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansucks.com"; sid:582879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ww3coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ww3coronavirus.com"; sid:582880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ww3pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ww3pandemic.com"; sid:582881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwcovid-19elsalvador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwcovid-19elsalvador.com"; sid:582882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ycoronavirus.com"; sid:582883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ycovid.com"; sid:582884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidcare.com"; sid:582885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zcovid.com"; sid:582886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0covid.com"; sid:582887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 140scoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"140scoronado.com"; sid:582888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1sttipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1sttipcovid19.com"; sid:582889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19-survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19-survival.com"; sid:582890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19survival.com"; sid:582891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19-survival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19-survival.net"; sid:582892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19themovie.com"; sid:582893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020themoviecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020themoviecovid19.com"; sid:582894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2dcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2dcovid19test.com"; sid:582895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360coronavirus.com"; sid:582896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11-coronavirus.com"; sid:582897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11coronavirus.com"; sid:582898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11-covid-19.com"; sid:582899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11-covid19.com"; sid:582900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11covid-19.com"; sid:582901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-11covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-11covid19.com"; sid:582902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-eleven-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-eleven-coronavirus.com"; sid:582903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-elevencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-elevencoronavirus.com"; sid:582904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7eleven-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7eleven-coronavirus.com"; sid:582905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7elevencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7elevencoronavirus.com"; sid:582906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-eleven-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-eleven-covid-19.com"; sid:582907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-eleven-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-eleven-covid19.com"; sid:582908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-elevencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-elevencovid-19.com"; sid:582909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7-elevencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7-elevencovid19.com"; sid:582910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7eleven-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7eleven-covid-19.com"; sid:582911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7eleven-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7eleven-covid19.com"; sid:582912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7elevencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7elevencovid-19.com"; sid:582913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7elevencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7elevencovid19.com"; sid:582914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid19law.com"; sid:582915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid19lawyer.com"; sid:582916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid19loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid19loss.com"; sid:582917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abolishcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abolishcovid.com"; sid:582918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abolishingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abolishingcovid.com"; sid:582919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovid19.com"; sid:582920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovid.com"; sid:582921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adaptacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adaptacioncovid.com"; sid:582922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affectsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affectsofcovid.com"; sid:582923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afforablecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afforablecovidmasks.com"; sid:582924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afforablecovidmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afforablecovidmasks.net"; sid:582925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghancovid19.com"; sid:582926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghancovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghancovid19.net"; sid:582927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghanistancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghanistancovid19.com"; sid:582928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghanistancovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghanistancovid19.net"; sid:582929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afmcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afmcovid19claim.com"; sid:582930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afmcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afmcovid19claims.com"; sid:582931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afmcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afmcovidclaims.com"; sid:582932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronadiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronadiet.com"; sid:582933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronadiets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronadiets.com"; sid:582934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19.net"; sid:582935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19.today"; sid:582936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidecovid19.com"; sid:582937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajhammahrahcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajhammahrahcovid19.com"; sid:582938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajuicioporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajuicioporcoronavirus.com"; sid:582939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.email"; sid:582940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusperu.com"; sid:582941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-box.com"; sid:582942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfibers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfibers.com"; sid:582943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-kit.com"; sid:582944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-pack.com"; sid:582945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcovid-19.com"; sid:582946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcovid19.com"; sid:582947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ascoronavirus.com"; sid:582948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid19.com"; sid:582949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid.com"; sid:582950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtests.com"; sid:582951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athometestkitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athometestkitcovid.com"; sid:582952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athometestkitcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athometestkitcovid.net"; sid:582953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for az-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"az-covid19.com"; sid:582954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backontrack-postcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backontrack-postcovid.com"; sid:582955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banishcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banishcovid.com"; sid:582956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batakbersatumelawancovid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batakbersatumelawancovid19.center"; sid:582957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareacovid19cleaning.com"; sid:582958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellcovid19.com"; sid:582959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besthashtagcovid19doovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besthashtagcovid19doovers.com"; sid:582960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercovid.com"; sid:582961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackresourcesduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackresourcesduringcovid.com"; sid:582962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodybycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodybycovid.com"; sid:582963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostonscoronavirusexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostonscoronavirusexperts.com"; sid:582964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirustestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirustestingkits.com"; sid:582965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19antibodytest.com"; sid:582966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcovidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcovidbusters.com"; sid:582967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovid.net"; sid:582968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caniusecoronavirusinmydomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caniusecoronavirusinmydomain.com"; sid:582969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caniusecoronavirusinmygovdomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caniusecoronavirusinmygovdomain.com"; sid:582970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capecodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capecodcovid19.com"; sid:582971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capecodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capecodcovid.com"; sid:582972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caricovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caricovidmap.com"; sid:582973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caseincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caseincorona.com"; sid:582974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cci-france-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cci-france-covid19.com"; sid:582975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cepro-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cepro-covid.com"; sid:582976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cerrb-1covid9-applicati0n3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cerrb-1covid9-applicati0n3.com"; sid:582977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadocovid.com"; sid:582978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasecovid19.com"; sid:582979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid.today"; sid:582980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapandemic.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapandemic.fund"; sid:582981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapandemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapandemicfund.com"; sid:582982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapandemicfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapandemicfunds.com"; sid:582983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanthecoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanthecoronaviruses.com"; sid:582984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colcorona.net"; sid:582985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compliancewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compliancewithcovid.com"; sid:582986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confirmedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confirmedcoronavirus.com"; sid:582987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingmomsamidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingmomsamidcovid.com"; sid:582988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectionamongcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectionamongcovid.com"; sid:582989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqercovid-19.com"; sid:582990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqercovid19.com"; sid:582991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovid19together.com"; sid:582992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contrivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contrivedcovid.com"; sid:582993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coopcovid.com"; sid:582994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovidtt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovidtt.com"; sid:582995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coppercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coppercovid.com"; sid:582996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2023.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2023.com"; sid:582997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona389.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona389.com"; sid:582998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alltagsmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alltagsmasken.com"; sid:582999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandbiz.com"; sid:583000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-application.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-application.com"; sid:583001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-app.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-app.watch"; sid:583002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassistancefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassistancefund.com"; sid:583003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aufbau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aufbau.com"; sid:583004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabattleguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabattleguard.com"; sid:583005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeerrepeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeerrepeat.com"; sid:583006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathguard.com"; sid:583007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-buster2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-buster2020.com"; sid:583008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarebundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarebundle.com"; sid:583009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecase.com"; sid:583010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarscreen.com"; sid:583011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaw.com"; sid:583012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaning.net"; sid:583013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-climate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-climate.com"; sid:583014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliantoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliantoffice.com"; sid:583015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacttracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacttracer.com"; sid:583016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountertops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountertops.com"; sid:583017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovers.net"; sid:583018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19-rfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19-rfh.com"; sid:583019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraft2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraft2020.com"; sid:583020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.center"; sid:583021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaysfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaysfest.com"; sid:583022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivider.com"; sid:583023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadividers.com"; sid:583024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonationfund.com"; sid:583025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoww.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoww.com"; sid:583026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaerasers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaerasers.com"; sid:583027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fashion-items.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fashion-items.com"; sid:583028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafests.com"; sid:583029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafide.com"; sid:583030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafide.net"; sid:583031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafloorstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafloorstickers.com"; sid:583032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrigitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrigitz.com"; sid:583033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglasshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglasshield.com"; sid:583034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagogame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagogame.com"; sid:583035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronair-official.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronair-official.com"; sid:583036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajusticeteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajusticeteam.com"; sid:583037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jyokin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jyokin.com"; sid:583038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakapjeskopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakapjeskopen.com"; sid:583039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakill.net"; sid:583040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kindermasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kindermasken.com"; sid:583041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalive.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalive.world"; sid:583042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivio.com"; sid:583043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagazine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagazine.net"; sid:583044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-makeruna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-makeruna.net"; sid:583045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask95.com"; sid:583046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskexpress.com"; sid:583047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameternepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameternepal.com"; sid:583048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-monitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-monitor.net"; sid:583049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicsymptoms.com"; sid:583050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicvirusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicvirusimpact.com"; sid:583051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapieper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapieper.com"; sid:583052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapotcast420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapotcast420.com"; sid:583053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprint.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprint.cat"; sid:583054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofevent.com"; sid:583055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionscreen.com"; sid:583056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotocol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotocol.net"; sid:583057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaright.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaright.net"; sid:583058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeplace.com"; sid:583059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetypackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetypackage.com"; sid:583060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermopmaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermopmaat.com"; sid:583061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-deutschland.com"; sid:583062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz-sofort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz-sofort.com"; sid:583063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasigning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasigning.com"; sid:583064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastarsmaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastarsmaker.com"; sid:583065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxiscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxiscreen.com"; sid:583066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationparkcommunityassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationparkcommunityassociation.com"; sid:583067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerbeta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerbeta.com"; sid:583068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trigger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trigger.com"; sid:583069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatunisie.com"; sid:583070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavigie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavigie.com"; sid:583071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virenschutz24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virenschutz24.com"; sid:583072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirex.com"; sid:583073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirse.com"; sid:583074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirsis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirsis.com"; sid:583075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruinusa.com"; sid:583076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruinus.com"; sid:583077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus19fears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus19fears.com"; sid:583078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.flights"; sid:583079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.flights"; sid:583080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19injured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19injured.com"; sid:583081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19injured.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19injured.net"; sid:583082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.flights"; sid:583083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.flights"; sid:583084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.voyage"; sid:583085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.voyage"; sid:583086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019clean.com"; sid:583087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019cleaners.com"; sid:583088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus7-11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus7-11.com"; sid:583089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-7-eleven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-7-eleven.com"; sid:583090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-7eleven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-7eleven.com"; sid:583091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandfinancialsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandfinancialsurvival.com"; sid:583092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandfutureincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandfutureincome.com"; sid:583093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandyourfinancialfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandyourfinancialfuture.com"; sid:583094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessconsulting.com"; sid:583095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaliforniamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaliforniamap.com"; sid:583096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassof2020.com"; sid:583097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdamageattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdamageattorney.com"; sid:583098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdamagelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdamagelawyer.com"; sid:583099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathcount.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathcount.today"; sid:583100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathnumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathnumbers.com"; sid:583101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdepression2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdepression2020.com"; sid:583102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisabilityclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisabilityclaims.com"; sid:583103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseface.com"; sid:583104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusendgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusendgame.com"; sid:583105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-exam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-exam.com"; sid:583106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeabt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeabt.com"; sid:583107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuntips4boredomrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuntips4boredomrelief.com"; sid:583108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobaleffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobaleffects.com"; sid:583109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalspread.com"; sid:583110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjured.com"; sid:583111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinmydomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinmydomain.com"; sid:583112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliar.com"; sid:583113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapsonline.com"; sid:583114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskbuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskbuy.com"; sid:583115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusicrelief.com"; sid:583116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmygovdomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmygovdomain.com"; sid:583117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-oficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-oficial.com"; sid:583118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlineloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlineloans.com"; sid:583119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspollandstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspollandstatistics.com"; sid:583120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention.net"; sid:583121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectgear.com"; sid:583122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidsolution.com"; sid:583123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecession2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecession2020.com"; sid:583124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseisoutofcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseisoutofcontrol.com"; sid:583125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rfh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rfh.com"; sid:583126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriversidecountyca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriversidecountyca.com"; sid:583127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetygear.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetygear.world"; sid:583128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.world"; sid:583129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-status.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-status.world"; sid:583130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinghawaii.com"; sid:583131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingonline.com"; sid:583132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestutah.com"; sid:583133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-updated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-updated.com"; sid:583134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavloerkleed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavloerkleed.com"; sid:583135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavloersticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavloersticker.com"; sid:583136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavloerstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavloerstickers.com"; sid:583137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijmarkt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijmarkt.com"; sid:583138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweekfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweekfest.com"; sid:583139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-yardim-turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-yardim-turkiye.com"; sid:583140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countercovid19.com"; sid:583141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for courageovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"courageovercovid.com"; sid:583142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid007.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid007.com"; sid:583143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid12.com"; sid:583144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020.world"; sid:583145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984.net"; sid:583146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abuse.com"; sid:583147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19action.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19action.net"; sid:583148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actions.com"; sid:583149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19addictionhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19addictionhelpline.com"; sid:583150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alaska.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alaska.flights"; sid:583151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aliviodepago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aliviodepago.com"; sid:583152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allegiant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allegiant.flights"; sid:583153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19american.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19american.flights"; sid:583154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andmi.com"; sid:583155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andthefutureofwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andthefutureofwork.com"; sid:583156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andthefutureofwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andthefutureofwork.com"; sid:583157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anonymous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anonymous.com"; sid:583158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anthology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anthology.com"; sid:583159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atb.com"; sid:583160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19auction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19auction.com"; sid:583161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19auctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19auctions.com"; sid:583162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19award.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19award.com"; sid:583163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-basvuru-iade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-basvuru-iade.com"; sid:583164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bicoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bicoverage.com"; sid:583165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19biloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19biloss.com"; sid:583166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizsurvival.com"; sid:583167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodwork.com"; sid:583168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bo.com"; sid:583169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buckscounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buckscounty.com"; sid:583170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buckscountypa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buckscountypa.com"; sid:583171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssign.com"; sid:583172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssign.net"; sid:583173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssigns.com"; sid:583174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssigns.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssigns.net"; sid:583175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19californiamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19californiamap.com"; sid:583176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carnival.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carnival.voyage"; sid:583177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carnival.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carnival.voyage"; sid:583178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casesprediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casesprediction.com"; sid:583179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaner.net"; sid:583180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanerpro.com"; sid:583181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanerscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanerscanada.com"; sid:583182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanerstoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanerstoronto.com"; sid:583183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningservicechicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningservicechicago.com"; sid:583184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleardx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleardx.com"; sid:583185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleardx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleardx.net"; sid:583186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commodities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commodities.com"; sid:583187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commodities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commodities.com"; sid:583188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlprevention.com"; sid:583189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19corps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19corps.com"; sid:583190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corps.com"; sid:583191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damagelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damagelawyer.com"; sid:583192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19damagesattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19damagesattorney.com"; sid:583193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19damages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19damages.com"; sid:583194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19delta.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19delta.flights"; sid:583195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19desinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19desinfection.com"; sid:583196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disabilityclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disabilityclaims.com"; sid:583197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discrimination.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discrimination.biz"; sid:583198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingservice.com"; sid:583199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19do-over.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19do-over.com"; sid:583200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doover.com"; sid:583201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dryfog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dryfog.com"; sid:583202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-dx.com"; sid:583203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencymasks.com"; sid:583204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencysupplies.com"; sid:583205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emotionalwellbeing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emotionalwellbeing.net"; sid:583206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19equipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19equipments.com"; sid:583207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evdekalaidatinial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evdekalaidatinial.com"; sid:583208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictiondefenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictiondefenses.com"; sid:583209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-exam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-exam.com"; sid:583210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19examination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19examination.com"; sid:583211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemasksales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemasksales.com"; sid:583212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faqrepeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faqrepeat.com"; sid:583213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19farse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19farse.com"; sid:583214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fears.com"; sid:583215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialrecovery.com"; sid:583216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floorstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floorstickers.com"; sid:583217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19free.net"; sid:583218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freepass.com"; sid:583219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontier.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontier.flights"; sid:583220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinehero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinehero.com"; sid:583221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlineheroes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlineheroes.net"; sid:583222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinehero.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinehero.net"; sid:583223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlineheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlineheros.com"; sid:583224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fundraise-bogor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fundraise-bogor.com"; sid:583225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globaleffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globaleffects.com"; sid:583226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globaleffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globaleffects.com"; sid:583227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalfree.com"; sid:583228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalvirus.com"; sid:583229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guys.com"; sid:583230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hat.com"; sid:583231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hawaiian.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hawaiian.flights"; sid:583232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthhelp.com"; sid:583233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthhelp.net"; sid:583234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeownerloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeownerloans.com"; sid:583235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infectionreports.com"; sid:583236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innovationawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innovationawards.com"; sid:583237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurance.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurance.claims"; sid:583238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurance-denial-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurance-denial-lawsuits.com"; sid:583239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ishikawa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ishikawa.com"; sid:583240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jetblue.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jetblue.flights"; sid:583241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19justicelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19justicelawyers.com"; sid:583242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19klage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19klage.com"; sid:583243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-layoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-layoffs.com"; sid:583244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresourcecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresourcecenters.com"; sid:583245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaltaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaltaskforce.com"; sid:583246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liquidation.com"; sid:583247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liquidations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liquidations.com"; sid:583248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19locate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19locate.com"; sid:583249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19madrid.com"; sid:583250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19madrid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19madrid.net"; sid:583251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maids.com"; sid:583252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mascherina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mascherina.com"; sid:583253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskexpress.com"; sid:583254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskon.com"; sid:583255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19materialsanitario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19materialsanitario.com"; sid:583256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalproducts.com"; sid:583257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medsupplies.com"; sid:583258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialsculptures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialsculptures.com"; sid:583259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mjqc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mjqc.com"; sid:583260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19module.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19module.com"; sid:583261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mumbai.com"; sid:583262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mumbeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mumbeds.com"; sid:583263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsusa.com"; sid:583264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyork.net"; sid:583265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noriskmask4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noriskmask4u.com"; sid:583266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19norwegian.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19norwegian.voyage"; sid:583267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19norwegian.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19norwegian.voyage"; sid:583268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nurseconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nurseconsultants.com"; sid:583269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineloans.com"; sid:583270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandamonium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandamonium.com"; sid:583271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemic2020.com"; sid:583272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemy.com"; sid:583273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.care"; sid:583274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19past.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19past.com"; sid:583275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paymentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paymentrelief.com"; sid:583276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personaltest.com"; sid:583277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personaltestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personaltestkit.com"; sid:583278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policing.com"; sid:583279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ppe.net"; sid:583280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pps.com"; sid:583281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapidresponse.com"; sid:583282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidresponse.net"; sid:583283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidsolutions.com"; sid:583284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapidtesting.com"; sid:583285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rationalthinkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rationalthinkers.com"; sid:583286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realty.com"; sid:583287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefclaims.com"; sid:583288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefconcert.com"; sid:583289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefconcerts.com"; sid:583290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remembering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remembering.com"; sid:583291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rep.com"; sid:583292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repeat.com"; sid:583293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchgroup.com"; sid:583294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19royalcaribbean.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19royalcaribbean.voyage"; sid:583295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19royalcaribbean.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19royalcaribbean.voyage"; sid:583296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19royal.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19royal.voyage"; sid:583297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19royal.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19royal.voyage"; sid:583298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safealaska.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safealaska.flights"; sid:583299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeallegiant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeallegiant.flights"; sid:583300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeamerican.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeamerican.flights"; sid:583301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecarnival.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecarnival.voyage"; sid:583302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safecarnival.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safecarnival.voyage"; sid:583303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedelta.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedelta.flights"; sid:583304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.flights"; sid:583305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.flights"; sid:583306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safefrontier.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safefrontier.flights"; sid:583307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehawaiian.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehawaiian.flights"; sid:583308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safejetblue.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safejetblue.flights"; sid:583309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safemasks4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safemasks4u.com"; sid:583310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.net"; sid:583311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safenorwegian.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safenorwegian.voyage"; sid:583312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safenorwegian.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safenorwegian.voyage"; sid:583313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19saferoyalcaribbean.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19saferoyalcaribbean.voyage"; sid:583314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferoyalcaribbean.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferoyalcaribbean.voyage"; sid:583315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19saferoyal.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19saferoyal.voyage"; sid:583316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferoyal.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferoyal.voyage"; sid:583317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeskywest.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeskywest.flights"; sid:583318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safesouthwest.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safesouthwest.flights"; sid:583319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safespirit.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safespirit.flights"; sid:583320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetygear.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetygear.world"; sid:583321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeunited.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeunited.flights"; sid:583322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeworkplace.com"; sid:583323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-saitama-seibu-home-project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-saitama-seibu-home-project.com"; sid:583324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sammelklage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sammelklage.com"; sid:583325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitazation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitazation.com"; sid:583326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizationservices.com"; sid:583327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19search.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19search.net"; sid:583328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfreporting.com"; sid:583329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensor.com"; sid:583330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shieldus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shieldus.com"; sid:583331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skywest.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skywest.flights"; sid:583332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southwest.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southwest.flights"; sid:583333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spirit.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spirit.flights"; sid:583334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistics-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistics-cases.com"; sid:583335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19st.com"; sid:583336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supplies.net"; sid:583337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support.team"; sid:583338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsassociation.com"; sid:583339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsfoundation.com"; sid:583340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19takibi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19takibi.com"; sid:583341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19t.com"; sid:583342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testandtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testandtrace.com"; sid:583343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingresources.com"; sid:583344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtoday.com"; sid:583345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnews.com"; sid:583346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testrapido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testrapido.com"; sid:583347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tipjar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tipjar.com"; sid:583348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19titer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19titer.com"; sid:583349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracer.net"; sid:583350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trials.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trials.world"; sid:583351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19united.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19united.flights"; sid:583352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usamap.com"; sid:583353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usatoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usatoday.com"; sid:583354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacationdiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacationdiscount.com"; sid:583355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacationdiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacationdiscounts.com"; sid:583356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinelocations.com"; sid:583357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viraldecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viraldecontamination.com"; sid:583358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virenschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virenschutz.com"; sid:583359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfreemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfreemasks.com"; sid:583360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusimpact.com"; sid:583361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusimpact.com"; sid:583362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.voyage"; sid:583363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wait.com"; sid:583364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-watch.com"; sid:583365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldresults.com"; sid:583366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrap.com"; sid:583367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.world"; sid:583368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid311.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid311.com"; sid:583369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid389.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid389.com"; sid:583370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3d.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3d.world"; sid:583371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid401k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid401k.com"; sid:583372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid98.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid98.com"; sid:583373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenvirus.com"; sid:583374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionnetworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionnetworks.com"; sid:583375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidhackney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidhackney.com"; sid:583376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaml.com"; sid:583377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandfalafel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandfalafel.com"; sid:583378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandyourpatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandyourpatient.com"; sid:583379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytesting.net"; sid:583380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapoyoguate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapoyoguate.com"; sid:583381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessproject.com"; sid:583382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessproject.net"; sid:583383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyutah.com"; sid:583384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbharat.com"; sid:583385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiopharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiopharma.com"; sid:583386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiz-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiz-aid.com"; sid:583387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblack.com"; sid:583388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblack.net"; sid:583389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonditalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonditalia.com"; sid:583390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrothers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrothers.com"; sid:583391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinsurance.com"; sid:583392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapacity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapacity.com"; sid:583393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cards.com"; sid:583394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.zone"; sid:583395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchamps.com"; sid:583396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharitypoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharitypoker.com"; sid:583397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean-19.com"; sid:583398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersatl.com"; sid:583399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerscanada.com"; sid:583400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningco.com"; sid:583401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.team"; sid:583402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardiagnostics.com"; sid:583403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardiagnostics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardiagnostics.net"; sid:583404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardx.com"; sid:583405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleardx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleardx.net"; sid:583406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearpath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearpath.com"; sid:583407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackdeals.com"; sid:583408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommanders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommanders.com"; sid:583409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunism.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunism.net"; sid:583410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityrecovery.com"; sid:583411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance2020.com"; sid:583412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant2020.com"; sid:583413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantoffice.com"; sid:583414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsciousoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsciousoffice.com"; sid:583415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontracting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontracting.com"; sid:583416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolgroup.com"; sid:583417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornholer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornholer.com"; sid:583418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorral.com"; sid:583419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveragelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveragelawyers.com"; sid:583420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverage.net"; sid:583421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovers.net"; sid:583422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverups.com"; sid:583423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazy.net"; sid:583424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriminal.com"; sid:583425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-custom-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-custom-stats.com"; sid:583426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomstats.com"; sid:583427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenders.net"; sid:583428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddental.com"; sid:583429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-desinfeccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-desinfeccion.com"; sid:583430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddings-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddings-21.com"; sid:583431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-disinfection.com"; sid:583432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-docs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-docs.com"; sid:583433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-donation.com"; sid:583434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomicrecovery.com"; sid:583435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidel2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidel2.com"; sid:583436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentry.com"; sid:583437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideonation.com"; sid:583438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetalia.com"; sid:583439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictioncenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictioncenter.com"; sid:583440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictionlawyers.com"; sid:583441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-experts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-experts.com"; sid:583442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfake.com"; sid:583443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilymasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilymasksupply.com"; sid:583444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarse.com"; sid:583445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialbankruptcy.com"; sid:583446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialrecovery.com"; sid:583447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflip.com"; sid:583448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.cloud"; sid:583449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeporn.com"; sid:583450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerestaurants.com"; sid:583451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreewear.com"; sid:583452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfurniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfurniture.com"; sid:583453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgapyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgapyear.com"; sid:583454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeofence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeofence.com"; sid:583455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeofencewearable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeofencewearable.com"; sid:583456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardians.com"; sid:583457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguncontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguncontrol.com"; sid:583458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaiku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaiku.com"; sid:583459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelmets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelmets.com"; sid:583460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-home.com"; sid:583461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehealthcare.com"; sid:583462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomenurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomenurse.com"; sid:583463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomenursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomenursing.com"; sid:583464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalitycleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalitycleaners.com"; sid:583465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotelcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotelcleaners.com"; sid:583466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididlab.com"; sid:583467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitytesting.com"; sid:583468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfolive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfolive.net"; sid:583469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjured.com"; sid:583470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovationawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovationawards.com"; sid:583471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-innovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-innovation.com"; sid:583472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-innovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-innovations.com"; sid:583473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintubation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintubation.com"; sid:583474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirpr.com"; sid:583475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirstocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirstocks.com"; sid:583476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkarmachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkarmachallenge.com"; sid:583477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lake.com"; sid:583478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlake.com"; sid:583479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocate.com"; sid:583480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-marketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-marketplace.com"; sid:583481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdelivery.com"; sid:583482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskstores.com"; sid:583483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksupply.net"; sid:583484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmds.com"; sid:583485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsonline.com"; sid:583486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmenot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmenot.com"; sid:583487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-migration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-migration.com"; sid:583488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovit.com"; sid:583489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmusicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmusicrelief.com"; sid:583490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewnorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewnorm.com"; sid:583491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nineteen-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nineteen-vaccine.com"; sid:583492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-oneswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-oneswab.com"; sid:583493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoneswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoneswab.com"; sid:583494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic-19.com"; sid:583495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemic19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemic19.com"; sid:583496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphysicaltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphysicaltherapy.com"; sid:583497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppekit.com"; sid:583498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesupply.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesupply.net"; sid:583499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-promocion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-promocion.com"; sid:583500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpromos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpromos.com"; sid:583501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofedrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofedrestaurants.com"; sid:583502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofrestaurants.com"; sid:583503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionandsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionandsupply.com"; sid:583504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidptrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidptrecovery.com"; sid:583505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecipe.com"; sid:583506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverysupport.com"; sid:583507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremove.com"; sid:583508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreport19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreport19.com"; sid:583509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchcoalition.com"; sid:583510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrid.world"; sid:583511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrockford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrockford.com"; sid:583512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrsk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrsk.com"; sid:583513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19.world"; sid:583514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids2021.com"; sid:583515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafearizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafearizona.com"; sid:583516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.business"; sid:583517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecalifornia.com"; sid:583518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeflorida.com"; sid:583519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeillinois.com"; sid:583520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeindiana.com"; sid:583521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafenewyork.com"; sid:583522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetexas.com"; sid:583523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.zone"; sid:583524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsayfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsayfe.com"; sid:583525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscenes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscenes.com"; sid:583526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscurvy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscurvy.com"; sid:583527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignprinting.com"; sid:583528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsonline.com"; sid:583529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolver.com"; sid:583530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrongwoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrongwoman.com"; sid:583531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplynet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplynet.com"; sid:583532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplynet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplynet.net"; sid:583533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvival101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvival101.com"; sid:583534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteacherfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteacherfund.com"; sid:583535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtelecomrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtelecomrelief.com"; sid:583536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestandtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestandtrace.com"; sid:583537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinghawaii.com"; sid:583538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtoday.com"; sid:583539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiter.com"; sid:583540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtop.com"; sid:583541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracer.net"; sid:583542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracers.com"; sid:583543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrained2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrained2020.com"; sid:583544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrained.com"; sid:583545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraining2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraining2020.com"; sid:583546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.world"; sid:583547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtwentytwenty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtwentytwenty.com"; sid:583548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunitedwestand6feetapart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunitedwestand6feetapart.com"; sid:583549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurgent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurgent.com"; sid:583550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccino.com"; sid:583551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvault.com"; sid:583552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveterinarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveterinarian.com"; sid:583553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictory.net"; sid:583554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vid.com"; sid:583555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvid.com"; sid:583556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vids.com"; sid:583557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvidz.com"; sid:583558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19masks.com"; sid:583559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusalert.com"; sid:583560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruss.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruss.net"; sid:583561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwait.com"; sid:583562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-war.com"; sid:583563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidware.com"; sid:583564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarriors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarriors.net"; sid:583565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.today"; sid:583566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwater.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwater.net"; sid:583567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwestand6feetapart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwestand6feetapart.com"; sid:583568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrap.com"; sid:583569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxgerms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxgerms.com"; sid:583570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovid19stories.com"; sid:583571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisis-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisis-covid-19.com"; sid:583572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovids.com"; sid:583573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcovid.com"; sid:583574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvethecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvethecorona.com"; sid:583575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cwcovid.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cwcovid.support"; sid:583576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronacheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronacheck.com"; sid:583577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidize.com"; sid:583578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidize.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidize.net"; sid:583579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defenseforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defenseforcovid.com"; sid:583580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovid.com"; sid:583581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid.net"; sid:583582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacovid19.com"; sid:583583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantecovid19.com"; sid:583584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarcovid.com"; sid:583585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detallescoronareal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detallescoronareal.com"; sid:583586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detercovid.com"; sid:583587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diamundialcontraelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diamundialcontraelcovid-19.com"; sid:583588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diathevacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diathevacovid-19.com"; sid:583589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discoverycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discoverycovid.com"; sid:583590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcoronavirus19.com"; sid:583591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocoronavirus19.com"; sid:583592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donation-covid19.com"; sid:583593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dons-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dons-coronavirus.net"; sid:583594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpi-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpi-coronavirus.com"; sid:583595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovid19testing.com"; sid:583596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovidvirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovidvirustesting.com"; sid:583597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugforcovid.com"; sid:583598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earnwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earnwithcorona.com"; sid:583599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidacomunicacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidacomunicacion.com"; sid:583600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elkhartcountycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elkhartcountycovid19.com"; sid:583601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ephg-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ephg-covid-19.net"; sid:583602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic2021.com"; sid:583603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic2021.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic2021.world"; sid:583604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic2022.com"; sid:583605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic2023.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic2023.com"; sid:583606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for episcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"episcovid19.com"; sid:583607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipamientocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipamientocovid-19.com"; sid:583608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipo-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipo-covid.com"; sid:583609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esacovid.com"; sid:583610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estatus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estatus-covid-19.com"; sid:583611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for experiencingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"experiencingthepandemic.com"; sid:583612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscovid.com"; sid:583613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscovidtests.com"; sid:583614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovid.com"; sid:583615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskscoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskscoronaviruss.com"; sid:583616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasksforcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasksforcoronaviruss.com"; sid:583617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facevisorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facevisorcovid.com"; sid:583618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fase2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fase2covid.com"; sid:583619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19testingkits.com"; sid:583620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.agency"; sid:583621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.life"; sid:583622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.world"; sid:583623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcovid19.com"; sid:583624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstpandemic.com"; sid:583625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaposters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaposters.com"; sid:583626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-the-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-the-pandemic.com"; sid:583627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flashcorona.com"; sid:583628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronacountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronacountdown.com"; sid:583629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidevictiondefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidevictiondefense.com"; sid:583630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidevictionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidevictionlawyers.com"; sid:583631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fmglobalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fmglobalcovid19.com"; sid:583632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodforcovid19.com"; sid:583633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frcagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frcagainstcovid19.com"; sid:583634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19antibodytest.com"; sid:583635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freestorefoodbankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freestorefoodbankcovid19.com"; sid:583636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovidmasks.com"; sid:583637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgetownmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgetownmacovid19.com"; sid:583638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid2.com"; sid:583639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovidapp.com"; sid:583640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19exam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19exam.com"; sid:583641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19help.com"; sid:583642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid.care"; sid:583643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsuppliesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsuppliesnow.com"; sid:583644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtests.com"; sid:583645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giantcovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giantcovidsurvey.com"; sid:583646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidstudy.com"; sid:583647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemic-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemic-free.com"; sid:583648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicfree.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicfree.world"; sid:583649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbizcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbizcovid.com"; sid:583650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcoronation.com"; sid:583651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagnumber1tipcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagnumber1tipcovid-19.com"; sid:583652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagnumber1tipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagnumber1tipcovid19.com"; sid:583653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagonetipforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagonetipforcovid-19.com"; sid:583654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashtagtipsforcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashtagtipsforcovid-19virus.com"; sid:583655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcfcovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcfcovid19fund.com"; sid:583656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcorona-virus.com"; sid:583657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingthecoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingthecoronacure.com"; sid:583658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiscoxcoronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiscoxcoronaclaim.com"; sid:583659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiscoxcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiscoxcovid19claim.com"; sid:583660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hiscoxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hiscoxcovid19.com"; sid:583661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holisticcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holisticcovid.com"; sid:583662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horizonmedia-connecting-during-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horizonmedia-connecting-during-covid.com"; sid:583663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horizonmedia-connecting-during-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horizonmedia-connecting-during-covid.net"; sid:583664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygiene-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygiene-corona.com"; sid:583665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for id-agencia-corona-auxilio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"id-agencia-corona-auxilio.com"; sid:583666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideascovid.com"; sid:583667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideasvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideasvscovid.com"; sid:583668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ideasvscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ideasvscovid.net"; sid:583669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihealcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihealcovid-19.com"; sid:583670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunized-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunized-covid-19.com"; sid:583671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunizedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunizedcovid19.com"; sid:583672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactofcovid-19.com"; sid:583673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionescovid.com"; sid:583674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnizacionporcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnizacionporcovid19.com"; sid:583675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiabeatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiabeatscorona.com"; sid:583676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indicecoronavirus.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indicecoronavirus.digital"; sid:583677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indigenouscovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indigenouscovidresponse.com"; sid:583678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indocovid19.com"; sid:583679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovacionescovid.com"; sid:583680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumos-covid19.com"; sid:583681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irccoronavirus.com"; sid:583682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthecoronavirusover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthecoronavirusover.com"; sid:583683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ita-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ita-covid19.com"; sid:583684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italian-covidbond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italian-covidbond.com"; sid:583685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jatssavetheworld4mcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jatssavetheworld4mcorona.com"; sid:583686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jatssavetheworld4mcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jatssavetheworld4mcorona.net"; sid:583687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesustrumpscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesustrumpscoronavirus.com"; sid:583688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jumpstartpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jumpstartpostcovid.com"; sid:583689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontracovid19.com"; sid:583690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawalcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawalcorona19.com"; sid:583691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcovid19.com"; sid:583692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcovidmlb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcovidmlb.com"; sid:583693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepitrealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepitrealcovid.com"; sid:583694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronasanitizer.com"; sid:583695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid.club"; sid:583696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcoronavirus.net"; sid:583697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lastestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lastestcovid-19.com"; sid:583698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawofcoronavirus.com"; sid:583699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuits-refusal-to-pay-covid-19-biz-income-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuits-refusal-to-pay-covid-19-biz-income-claims.com"; sid:583700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesothocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesothocoronavirus.com"; sid:583701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letshealcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letshealcovid19.com"; sid:583702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letswincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letswincorona.com"; sid:583703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeafterhavingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeafterhavingcovid19.com"; sid:583704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforeduringaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforeduringaftercovid19.com"; sid:583705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeforethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeforethecovid19.com"; sid:583706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeduringthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeduringthecovid19.com"; sid:583707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilvdcoronaextras.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilvdcoronaextras.world"; sid:583708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilvdscoronaextras.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilvdscoronaextras.world"; sid:583709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacorona-virus.com"; sid:583710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid19.net"; sid:583711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid.net"; sid:583712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthelifetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthelifetimeofcovid.com"; sid:583713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintimeofcovid.com"; sid:583714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriageinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriageinthetimeofcorona.com"; sid:583715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascacoronavirus.net"; sid:583716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovid-19.com"; sid:583717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid19ffp2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid19ffp2.com"; sid:583718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid19.net"; sid:583719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasparacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasparacovid-19.com"; sid:583720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasparacovid19.com"; sid:583721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinaanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinaanticovid.com"; sid:583722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinacovid19.com"; sid:583723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masken-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masken-corona.com"; sid:583724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcoronaviruss.com"; sid:583725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscoronavirusforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscoronavirusforsale.com"; sid:583726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcoronavirussale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcoronavirussale.com"; sid:583727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcoronaviruss.com"; sid:583728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masktofightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masktofightcorona.com"; sid:583729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medsolutionscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medsolutionscovid19.com"; sid:583730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memecorona.com"; sid:583731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorycovid19.com"; sid:583732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mensonges-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mensonges-covid.com"; sid:583733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalhealthcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalhealthcovid-19.com"; sid:583734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalillnesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalillnesscovid19.com"; sid:583735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mesasincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mesasincorona.com"; sid:583736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mi-covid-diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mi-covid-diaries.com"; sid:583737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for midlifepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"midlifepandemic.com"; sid:583738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mohsenvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mohsenvscorona.com"; sid:583739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for motherhoodamidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"motherhoodamidcovid.com"; sid:583740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mpcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mpcovidtracker.com"; sid:583741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multascoronavirus.com"; sid:583742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicforcovid19.com"; sid:583743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mychartcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mychartcovid-19.com"; sid:583744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mychartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mychartcovid19.com"; sid:583745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachronicles.com"; sid:583746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalifestyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalifestyle.com"; sid:583747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-t.com"; sid:583748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19rapidtest.com"; sid:583749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19tests.com"; sid:583750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid20.com"; sid:583751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcompliance.com"; sid:583752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfinance.com"; sid:583753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrapidtest.com"; sid:583754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeandcovid-19.com"; sid:583755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestcovid-19.com"; sid:583756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytexascovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytexascovid19test.com"; sid:583757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytexascovid19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytexascovid19test.net"; sid:583758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytexascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytexascovidtest.com"; sid:583759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19mask.com"; sid:583760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95-covidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95-covidmasks.com"; sid:583761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcovidcure.com"; sid:583762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19.biz"; sid:583763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid2020.com"; sid:583764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negligenciascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negligenciascovid19.com"; sid:583765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmomsamidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmomsamidcovid.com"; sid:583766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextflupandemic.com"; sid:583767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona-virus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona-virus19.com"; sid:583768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidrestaurants.com"; sid:583769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidvenues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidvenues.com"; sid:583770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northamericancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northamericancovid19.com"; sid:583771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for number1tipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"number1tipcovid19.com"; sid:583772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for numberonehashtagcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"numberonehashtagcovid-19.com"; sid:583773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for numberonehashtagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"numberonehashtagcovid19.com"; sid:583774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19test.com"; sid:583775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19testing.com"; sid:583776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ok-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ok-corona.com"; sid:583777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olvg-corona-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olvg-corona-check.com"; sid:583778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onetipforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onetipforcovid-19.com"; sid:583779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidcompliance.com"; sid:583780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlifebeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlifebeforecovid19.com"; sid:583781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pack-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pack-covid19.com"; sid:583782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadventuregame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadventuregame.com"; sid:583783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaesthetic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaesthetic.com"; sid:583784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaftershock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaftershock.com"; sid:583785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicallycorrect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicallycorrect.com"; sid:583786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuzz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuzz.com"; sid:583787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccarekit.com"; sid:583788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-defense.com"; sid:583789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoodguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoodguru.com"; sid:583790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancegroup.com"; sid:583791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclycorrect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclycorrect.com"; sid:583792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmitigation.com"; sid:583793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicone.com"; sid:583794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpaks.com"; sid:583795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpapas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpapas.com"; sid:583796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparanoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparanoid.com"; sid:583797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpepperjelly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpepperjelly.com"; sid:583798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.club"; sid:583799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuppies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuppies.com"; sid:583800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrafts.com"; sid:583801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsmallbusinessmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsmallbusinessmarketing.com"; sid:583802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsmallbusinessmarketing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsmallbusinessmarketing.net"; sid:583803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstreets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstreets.com"; sid:583804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportcommunity.com"; sid:583805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoiletpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoiletpaper.com"; sid:583806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictp.com"; sid:583807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrackerproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrackerproject.com"; sid:583808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusoutbreak.com"; sid:583809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallasanticovid.com"; sid:583810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingthroughpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingthroughpandemic.com"; sid:583811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingthrupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingthrupandemic.com"; sid:583812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peacepandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peacepandemic.world"; sid:583813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofthepandemicgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofthepandemicgame.com"; sid:583814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perjudicadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perjudicadoscovid.com"; sid:583815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalfinancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalfinancecovid19.com"; sid:583816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portabletoiletscoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portabletoiletscoronavirusfree.com"; sid:583817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadiets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadiets.com"; sid:583818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirustravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirustravel.com"; sid:583819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirustravel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirustravel.net"; sid:583820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirustravels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirustravels.com"; sid:583821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19travel.com"; sid:583822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19travel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19travel.net"; sid:583823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovideoshocksyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovideoshocksyndrome.com"; sid:583824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfuture.com"; sid:583825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-ready.com"; sid:583826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshock.com"; sid:583827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshock.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshock.net"; sid:583828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshocks.com"; sid:583829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshock-syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshock-syndrome.com"; sid:583830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshocksyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshocksyndrome.com"; sid:583831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshocksyndrome.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshocksyndrome.mobi"; sid:583832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidshocksyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidshocksyndrome.net"; sid:583833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covidsyndrome.com"; sid:583834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.email"; sid:583835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.guru"; sid:583836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsyndrome.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsyndrome.technology"; sid:583837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworldreimagined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworldreimagined.com"; sid:583838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpartys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpartys.com"; sid:583839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpartys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpartys.net"; sid:583840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpinatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpinatas.com"; sid:583841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpinatas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpinatas.net"; sid:583842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpost.com"; sid:583843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicposts.com"; sid:583844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poultrycoronavirustraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poultrycoronavirustraining.com"; sid:583845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poursortirducovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poursortirducovid.com"; sid:583846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppeagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppeagainstcovid19.com"; sid:583847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaspecialist.com"; sid:583848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionsforcovid19.com"; sid:583849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocollocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocollocovid.com"; sid:583850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocovid19.com"; sid:583851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebascovid.com"; sid:583852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasparacovid19.com"; sid:583853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasparacovid.com"; sid:583854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for putastoptocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"putastoptocorona.com"; sid:583855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecovid19.net"; sid:583856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for race-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"race-against-corona.com"; sid:583857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronatests.com"; sid:583858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebootpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebootpostcovid.com"; sid:583859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recordingapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recordingapandemic.com"; sid:583860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidglobal.com"; sid:583861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovidsolutions.com"; sid:583862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursosmultascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursosmultascovid.com"; sid:583863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcoronadiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcoronadiscount.com"; sid:583864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistance-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistance-covid.com"; sid:583865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respectothers4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respectothers4covid.com"; sid:583866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimentocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimentocoronavirus.com"; sid:583867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ro-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ro-covid19.com"; sid:583868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for run4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"run4corona.com"; sid:583869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronatesting.com"; sid:583870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidtesting.com"; sid:583871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safefromcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safefromcovid.world"; sid:583872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyforcovid.com"; sid:583873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeworkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeworkcovid19.com"; sid:583874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovid19now.com"; sid:583875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savannahcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savannahcovidtesting.com"; sid:583876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savecovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savecovid.world"; sid:583877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scamdemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scamdemiccovid19.com"; sid:583878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schermiprotettivicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schermiprotettivicovid.com"; sid:583879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screenscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screenscorona.com"; sid:583880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecovid.com"; sid:583881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellinginapandemicworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellinginapandemicworld.net"; sid:583882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexcurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexcurecovid19.com"; sid:583883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop4covid-19.com"; sid:583884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop4covid19.com"; sid:583885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19masks.com"; sid:583886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smartpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smartpandemic.com"; sid:583887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sognialtempodelcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sognialtempodelcovid.net"; sid:583888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sorrybutthankscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sorrybutthankscorona.com"; sid:583889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soundsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soundsofcovid.com"; sid:583890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcorona19.com"; sid:583891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcorona.com"; sid:583892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovid.com"; sid:583893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuspostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuspostcovid19.com"; sid:583894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuspostcovid.com"; sid:583895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuspostcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuspostcovid.net"; sid:583896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidsafe.com"; sid:583897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona-virus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona-virus19.com"; sid:583898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusnm.com"; sid:583899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.biz"; sid:583900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-box.com"; sid:583901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidbox.com"; sid:583902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthespreadofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthespreadofcorona.com"; sid:583903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportaftercovid19.com"; sid:583904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportingmomsamidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportingmomsamidcovid.com"; sid:583905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techproductscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techproductscorona.com"; sid:583906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-coronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-coronavirus19.com"; sid:583907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovidantibody.com"; sid:583908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnowcovid.com"; sid:583909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatssocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatssocovid.com"; sid:583910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacoach.com"; sid:583911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavault.com"; sid:583912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusmanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusmanual.com"; sid:583913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswar.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswar.world"; sid:583914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19exam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19exam.com"; sid:583915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid20.com"; sid:583916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbounceback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbounceback.com"; sid:583917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbounce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbounce.com"; sid:583918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconsultants.com"; sid:583919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsolutions.com"; sid:583920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtrack.com"; sid:583921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thekeycovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thekeycovidkit.com"; sid:583922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoriginofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoriginofcovid19.com"; sid:583923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theothersideofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theothersideofcovid.com"; sid:583924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicexperience.com"; sid:583925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicoutbreak.com"; sid:583926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepeacepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepeacepandemic.com"; sid:583927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thereisnocoronavirusonthemoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thereisnocoronavirusonthemoon.com"; sid:583928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforcovid-19virus.com"; sid:583929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tipsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tipsforcovid.com"; sid:583930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tnscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tnscovid.com"; sid:583931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidnineteen.com"; sid:583932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelpostcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelpostcoronavirus.com"; sid:583933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelpostcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelpostcoronavirus.net"; sid:583934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelpostcovid19.com"; sid:583935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelpostcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelpostcovid19.net"; sid:583936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidtest.net"; sid:583937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidmeter.com"; sid:583938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usvscorona.com"; sid:583939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcoronavirustest.com"; sid:583940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovidbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovidbankruptcy.com"; sid:583941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovidbk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovidbk.com"; sid:583942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvclightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvclightcoronavirus.com"; sid:583943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vanagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vanagainstcorona.com"; sid:583944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencialcovid.com"; sid:583945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vilar-protection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vilar-protection-covid.com"; sid:583946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid19test.com"; sid:583947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidclear.com"; sid:583948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidcompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidcompliant.com"; sid:583949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecoronabusters.com"; sid:583950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecurecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecurecovid-19.com"; sid:583951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehealcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehealcovid-19.com"; sid:583952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wepandemickin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wepandemickin.com"; sid:583953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivedcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivedcoronavirus.net"; sid:583954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whysocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whysocovid.com"; sid:583955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcorona.net"; sid:583956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldreelingfromcovid-19crisisvulnerablesegments.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldreelingfromcovid-19crisisvulnerablesegments.fail"; sid:583957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwithoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwithoutcovid.com"; sid:583958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrgcovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrgcovid19sellerplan.com"; sid:583959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbaoji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbaoji.com"; sid:583960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancovid.net"; sid:583961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhuiguniang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhuiguniang.com"; sid:583962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankucunbaobao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankucunbaobao.com"; sid:583963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpandemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpandemicfund.com"; sid:583964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpospay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpospay.com"; sid:583965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansettlement.com"; sid:583966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansettlementprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansettlementprogram.com"; sid:583967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansettlements.com"; sid:583968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwansu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwansu.com"; sid:583969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxinqichen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxinqichen.com"; sid:583970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanziyu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanziyu.com"; sid:583971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--conqurircovid19-fnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--conqurircovid19-fnb.com"; sid:583972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--conqurircovid-19-fqb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--conqurircovid-19-fqb.com"; sid:583973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xpressmycovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xpressmycovid19mask.com"; sid:583974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidconcierge.com"; sid:583975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zmancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zmancorona.com"; sid:583976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zoomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zoomcovid19.com"; sid:583977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zoomcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zoomcovid.com"; sid:583978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert4covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert4covid.info"; sid:583979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backontrack-postcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backontrack-postcovid.info"; sid:583980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for britainaftercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"britainaftercovid.net"; sid:583981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusclassaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusclassaction.net"; sid:583982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovidclaim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovidclaim.net"; sid:583983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovidclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovidclaims.net"; sid:583984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.one"; sid:583985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.one"; sid:583986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.one"; sid:583987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbs.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbs.one"; sid:583988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-justice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-justice.net"; sid:583989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation.one"; sid:583990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-victimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-victimes.net"; sid:583991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassaction.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassaction.info"; sid:583992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassaction.net"; sid:583993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-live.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-live.net"; sid:583994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorial.net"; sid:583995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetygear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetygear.net"; sid:583996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxn.com"; sid:583997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19austria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19austria.com"; sid:583998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babyboom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babyboom.net"; sid:583999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcylawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcylawyer.net"; sid:584000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19congo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19congo.com"; sid:584001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coping.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coping.net"; sid:584002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19denmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19denmark.com"; sid:584003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19finland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19finland.com"; sid:584004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19frontliner.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19frontliner.net"; sid:584005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthysex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthysex.net"; sid:584006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthysex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthysex.net"; sid:584007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immune.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immune.one"; sid:584008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19norway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19norway.com"; sid:584009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sex.net"; sid:584010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shiva.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shiva.net"; sid:584011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shiva.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shiva.net"; sid:584012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19society.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19society.net"; sid:584013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19society.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19society.net"; sid:584014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stateserviceprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stateserviceprogram.net"; sid:584015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfund.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfund.net"; sid:584016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-support.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-support.legal"; sid:584017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusattorney.net"; sid:584018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusattorneys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusattorneys.net"; sid:584019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidi19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidi19.net"; sid:584020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsa.net"; sid:584021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsociety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsociety.net"; sid:584022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiocovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiocovid19.info"; sid:584023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmaceuticosfrentealcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmaceuticosfrentealcovid.net"; sid:584024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingagainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingagainstcovid19.net"; sid:584025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcoronasucks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcoronasucks.info"; sid:584026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19sucks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19sucks.info"; sid:584027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidclean.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidclean.net"; sid:584028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horizonmedia-connecting-during-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horizonmedia-connecting-during-covid.info"; sid:584029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid-19in2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid-19in2020.net"; sid:584030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marocovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marocovid.info"; sid:584031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minefcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minefcovid19.info"; sid:584032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2purpose.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2purpose.info"; sid:584033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccount.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccount.info"; sid:584034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpussy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpussy.club"; sid:584035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pgxcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pgxcovid.info"; sid:584036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightouttacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightouttacovid.info"; sid:584037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zotecfightscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zotecfightscovid.info"; sid:584038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 007wuhan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"007wuhan.info"; sid:584039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecoronatesting.com"; sid:584040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecovid19test.com"; sid:584041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidtest.com"; sid:584042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1aftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1aftercorona.com"; sid:584043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1coronakid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1coronakid.com"; sid:584044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcoronacare.com"; sid:584045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coviddefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coviddefence.com"; sid:584046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covid19support.com"; sid:584047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourcovid19kit.com"; sid:584048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourcovid19test.com"; sid:584049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourcovid19testkit.com"; sid:584050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911sfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911sfromcovid.com"; sid:584051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosreclamacionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosreclamacionescovid.com"; sid:584052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for absolutepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"absolutepandemics.com"; sid:584053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ackanticovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ackanticovidkit.com"; sid:584054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronaconundrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronaconundrum.com"; sid:584055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronadiary.com"; sid:584056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adacovid19.com"; sid:584057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affectsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affectsofcovid19.com"; sid:584058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidworkplace.com"; sid:584059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidcoronahand.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidcoronahand.club"; sid:584060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert4covid.com"; sid:584061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alert4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alert4covid.net"; sid:584062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidmeter.com"; sid:584063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatcoronavirus.com"; sid:584064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatcoronavirus.info"; sid:584065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americabeatcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americabeatcoronavirus.net"; sid:584066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafashion.com"; sid:584067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19cubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19cubicles.com"; sid:584068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19cubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19cubicles.com"; sid:584069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcare.com"; sid:584070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidcubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidcubicles.com"; sid:584071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcubicles.com"; sid:584072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovider.com"; sid:584073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidforce.com"; sid:584074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidlights.com"; sid:584075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidvaccine.com"; sid:584076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcorona.com"; sid:584077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aonvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aonvscovid.com"; sid:584078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid19test.com"; sid:584079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for articorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"articorona.com"; sid:584080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artinpandemic.com"; sid:584081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asesoreslegalescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asesoreslegalescovid.com"; sid:584082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asociacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asociacioncovid.com"; sid:584083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcorona.com"; sid:584084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcoronavirus.info"; sid:584085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asymptomaticcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asymptomaticcoronavirus.net"; sid:584086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomewithcovid.com"; sid:584087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-coronavirus.net"; sid:584088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awareness4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awareness4covid.com"; sid:584089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awarenessofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awarenessofcovid19.com"; sid:584090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid19web.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid19web.com"; sid:584091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtxt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtxt.com"; sid:584092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoworkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoworkcovid19.com"; sid:584093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptbycovid.com"; sid:584094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bariloche-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bariloche-coronavirus.com"; sid:584095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrerasdeproteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrerasdeproteccioncovid.com"; sid:584096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastacorona.com"; sid:584097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareacovidcleaning.com"; sid:584098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronavirus.biz"; sid:584099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthewuhan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthewuhan.info"; sid:584100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcovid-19.com"; sid:584101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedsidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedsidecovid19.com"; sid:584102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benidormcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benidormcovidfree.com"; sid:584103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19test.com"; sid:584104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestpandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestpandemiccookbook.com"; sid:584105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoronavirus.biz"; sid:584106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhagcoronabhag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhagcoronabhag.com"; sid:584107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioseguridad-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioseguridad-covid19.com"; sid:584108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birminghamfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birminghamfightingcovid.com"; sid:584109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizcovid-19.com"; sid:584110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid-19.com"; sid:584111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bncovid.com"; sid:584112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buscovid19testing.com"; sid:584113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid19.com"; sid:584114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidclaim.com"; sid:584115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidclaims.com"; sid:584116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesslossfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesslossfromcovid19.com"; sid:584117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19mask.com"; sid:584118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19ppe.com"; sid:584119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19testingkit.com"; sid:584120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingaftercovid19.com"; sid:584121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingaftercovid.com"; sid:584122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingpostcovid19.com"; sid:584123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingpostcovid.com"; sid:584124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-coronavirus.com"; sid:584125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovid19.com"; sid:584126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaigncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaigncovid.com"; sid:584127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaignforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaignforcoronavirus.com"; sid:584128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaignforcoronaviruscures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaignforcoronaviruscures.com"; sid:584129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campingcovidfree.com"; sid:584130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovid19stats.com"; sid:584131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancel-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancel-covid.com"; sid:584132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancel-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancel-covid.net"; sid:584133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancovid19plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancovid19plasma.com"; sid:584134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canttouchthiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canttouchthiscorona.com"; sid:584135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitalismisthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitalismisthepandemic.com"; sid:584136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for captain-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"captain-corona.com"; sid:584137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careactcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careactcovid19.com"; sid:584138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careersaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careersaftercovid.com"; sid:584139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carsandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carsandcorona.com"; sid:584140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashforcorona.com"; sid:584141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cccovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cccovideo.com"; sid:584142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccppandemiccure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccppandemiccure.com"; sid:584143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadocovidfree.com"; sid:584144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19realtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19realtor.com"; sid:584145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidbuyeragent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidbuyeragent.com"; sid:584146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidclean.com"; sid:584147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidlistingagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidlistingagent.com"; sid:584148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidrealestate.com"; sid:584149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidrealtor.com"; sid:584150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for change4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"change4corona.com"; sid:584151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for change4corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"change4corona.net"; sid:584152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for change4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"change4covid.com"; sid:584153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for change4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"change4covid.net"; sid:584154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeaftercovid.com"; sid:584155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changedbycorona.com"; sid:584156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changingcorona.com"; sid:584157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changingcovid.com"; sid:584158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changingcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changingcovids.com"; sid:584159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronastatus.com"; sid:584160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronavirusstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronavirusstatus.com"; sid:584161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidstatus.com"; sid:584162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronatest.com"; sid:584163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19lab.com"; sid:584164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19labtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19labtest.com"; sid:584165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronasettlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronasettlementfund.com"; sid:584166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacoronavictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacoronavictimfund.com"; sid:584167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19setlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19setlementfund.com"; sid:584168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19victimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19victimfund.com"; sid:584169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapandemicclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapandemicclaims.com"; sid:584170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinaplantedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinaplantedcorona.com"; sid:584171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusbook.com"; sid:584172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusclassactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusclassactions.com"; sid:584173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusclass.com"; sid:584174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecoronavirusclassesaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecoronavirusclassesaction.com"; sid:584175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovidclaim.com"; sid:584176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovidclaims.com"; sid:584177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclecovid19.com"; sid:584178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclecovid.com"; sid:584179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for civil-rights-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"civil-rights-covid19.com"; sid:584180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for civilrightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"civilrightscovid19.com"; sid:584181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for civil-rights-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"civil-rights-covid19.net"; sid:584182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for civilrightscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"civilrightscovid19.net"; sid:584183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid19.net"; sid:584184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearfromcovid.com"; sid:584185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codeagainst-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codeagainst-covid19.com"; sid:584186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coin2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coin2covid.com"; sid:584187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coin4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coin4covid.com"; sid:584188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coin4covids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coin4covids.com"; sid:584189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinagecovid.com"; sid:584190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinageforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinageforcovid.com"; sid:584191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinagescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinagescorona.com"; sid:584192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinchangecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinchangecovid.com"; sid:584193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinforcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinforcorona.net"; sid:584194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coins2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coins2corona.com"; sid:584195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coins2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coins2covid.com"; sid:584196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coins4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coins4covid.com"; sid:584197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinschangecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinschangecorona.com"; sid:584198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinschangecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinschangecovid.com"; sid:584199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinscorona.com"; sid:584200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinsforcovid.com"; sid:584201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinsforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinsforcovid.net"; sid:584202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinsofcorona.com"; sid:584203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cointocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cointocorona.com"; sid:584204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cointocorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cointocorona.net"; sid:584205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegeaftercovid.com"; sid:584206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorofcovid.com"; sid:584207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorofcovidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorofcovidus.com"; sid:584208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comfortforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comfortforcorona.com"; sid:584209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comiccovidention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comiccovidention.com"; sid:584210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcovidcleaning.com"; sid:584211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compensationforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compensationforcorona.com"; sid:584212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conectaconelexpertocovid19ydm2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conectaconelexpertocovid19ydm2.com"; sid:584213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congresocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congresocovid.com"; sid:584214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueredcoronaviruscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueredcoronaviruscom.com"; sid:584215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueredcovid19.com"; sid:584216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contratenocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contratenocorona.com"; sid:584217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contravention-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contravention-covid.com"; sid:584218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contraventioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contraventioncovid.com"; sid:584219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingduringcovid.com"; sid:584220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copaycovid19.com"; sid:584221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingaftercovid.com"; sid:584222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coromandelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coromandelcovid19.com"; sid:584223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19claim.com"; sid:584224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19claims.com"; sid:584225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19flclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19flclaims.com"; sid:584226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19pro.com"; sid:584227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19s.com"; sid:584228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19solution.com"; sid:584229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4us.com"; sid:584230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaffection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaffection.com"; sid:584231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aid.biz"; sid:584232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaajuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaajuda.com"; sid:584233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalys.com"; sid:584234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antikoerpertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antikoerpertest.com"; sid:584235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarmourstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarmourstore.com"; sid:584236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-australis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-australis.com"; sid:584237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bagis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bagis.com"; sid:584238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcy.net"; sid:584239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyutah.com"; sid:584240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabanner.com"; sid:584241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabedarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabedarf.com"; sid:584242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabenevolenceindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabenevolenceindex.com"; sid:584243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiometrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiometrics.com"; sid:584244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiometrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiometrix.com"; sid:584245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiopharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiopharma.com"; sid:584246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiopharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiopharm.com"; sid:584247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiosafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiosafety.com"; sid:584248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiosystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiosystems.com"; sid:584249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabloc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabloc.com"; sid:584250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabodybags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabodybags.com"; sid:584251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabogus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabogus.com"; sid:584252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabomb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabomb.net"; sid:584253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabondfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabondfund.com"; sid:584254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborn.com"; sid:584255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborn.net"; sid:584256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamo.com"; sid:584257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarshields.com"; sid:584258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacate.com"; sid:584259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-certificate.com"; sid:584260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-china.com"; sid:584261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachow.com"; sid:584262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacides.com"; sid:584263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimservices.com"; sid:584264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimsolutions.com"; sid:584265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclassactionlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclassactionlawsuits.com"; sid:584266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleandc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleandc.com"; sid:584267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningexpert.com"; sid:584268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoinage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoinage.net"; sid:584269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompassion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompassion.net"; sid:584270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsulta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsulta.com"; sid:584271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacttracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacttracers.com"; sid:584272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conversations.com"; sid:584273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacornerstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacornerstore.com"; sid:584274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacornteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacornteen.com"; sid:584275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19turkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19turkiye.com"; sid:584276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrashemergencysummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrashemergencysummit.com"; sid:584277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis-live.com"; sid:584278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisislive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisislive.com"; sid:584279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.solutions"; sid:584280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrispr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrispr.com"; sid:584281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisprtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisprtest.com"; sid:584282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensecom.com"; sid:584283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease-2020.com"; sid:584284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonateproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonateproject.com"; sid:584285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-donations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-donations.com"; sid:584286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-vision-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-vision-therapy.com"; sid:584287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpertservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpertservices.com"; sid:584288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacecoverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacecoverings.com"; sid:584289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacemaskmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacemaskmission.com"; sid:584290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsnc.com"; sid:584291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilybankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilybankruptcy.com"; sid:584292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashion20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashion20.com"; sid:584293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafasttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafasttestkit.com"; sid:584294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafat.com"; sid:584295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafender.com"; sid:584296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-films.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-films.com"; sid:584297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafingertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafingertest.com"; sid:584298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflclaims.com"; sid:584299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foreclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foreclosure.com"; sid:584300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforeclosuredefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforeclosuredefense.com"; sid:584301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforeclosuredefense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforeclosuredefense.net"; sid:584302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforeclosurehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforeclosurehelp.com"; sid:584303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforjesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforjesus.com"; sid:584304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeemployee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeemployee.com"; sid:584305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrontliner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrontliner.com"; sid:584306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagm.com"; sid:584307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrace.com"; sid:584308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrind.com"; sid:584309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguard.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguard.info"; sid:584310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguider.com"; sid:584311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalo.com"; sid:584312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpgroup.com"; sid:584313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomesandhouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomesandhouses.com"; sid:584314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindialaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindialaw.com"; sid:584315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainv.com"; sid:584316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairis.com"; sid:584317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakabin.com"; sid:584318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersthegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersthegame.com"; sid:584319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillmask.com"; sid:584320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kindess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kindess.com"; sid:584321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindessindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindessindex.com"; sid:584322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleaners.com"; sid:584323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleaners.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleaners.info"; sid:584324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleaners.net"; sid:584325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabkit.com"; sid:584326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabkits.com"; sid:584327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuitclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuitclaims.com"; sid:584328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegal.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegal.info"; sid:584329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigationlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigationlawyers.com"; sid:584330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live-monitor.com"; sid:584331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdown.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdown.club"; sid:584332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloveclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloveclub.com"; sid:584333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluck.com"; sid:584334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluvclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluvclub.com"; sid:584335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarkt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarkt.com"; sid:584336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskclub.com"; sid:584337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksandmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksandmore.com"; sid:584338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilionaire.com"; sid:584339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonitor.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonitor.biz"; sid:584340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamorah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamorah.com"; sid:584341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundschutz-handschuhe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundschutz-handschuhe.com"; sid:584342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-network.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-network.com"; sid:584343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanetworkusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanetworkusa.com"; sid:584344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews360.com"; sid:584345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsmatome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsmatome.com"; sid:584346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficescan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficescan.com"; sid:584347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonenine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonenine.com"; sid:584348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaintingspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaintingspecialist.com"; sid:584349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemictesters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemictesters.com"; sid:584350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicthemovie.com"; sid:584351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapara-al.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapara-al.com"; sid:584352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronape.com"; sid:584353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplexi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplexi.com"; sid:584354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappe.net"; sid:584355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventieshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventieshop.com"; sid:584356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprojkt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprojkt.com"; sid:584357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquips.com"; sid:584358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebellen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebellen.info"; sid:584359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregalos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregalos.com"; sid:584360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarosis.com"; sid:584361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasarskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasarskits.com"; sid:584362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzmasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzmasken.info"; sid:584363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascream.com"; sid:584364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashaming.com"; sid:584365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield.pro"; sid:584366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldpro.com"; sid:584367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasingles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasingles.net"; sid:584368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sport.com"; sid:584369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrongus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrongus.com"; sid:584370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasummer2020offer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasummer2020offer.com"; sid:584371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportsyllhet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportsyllhet.com"; sid:584372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taisaku.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taisaku.net"; sid:584373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingbooth.com"; sid:584374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting-lab.com"; sid:584375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinyourhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinyourhome.com"; sid:584376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsupplies.com"; sid:584377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesttech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesttech.com"; sid:584378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-therapie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-therapie.com"; sid:584379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-time2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-time2020.com"; sid:584380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack-israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack-israel.com"; sid:584381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavalert.com"; sid:584382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverificado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverificado.com"; sid:584383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverschallenge.com"; sid:584384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavfraud.com"; sid:584385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavglbl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavglbl.com"; sid:584386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-victimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-victimes.com"; sid:584387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir2020.com"; sid:584388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralnews.com"; sid:584389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralprotection.com"; sid:584390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralstore.com"; sid:584391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19pro.com"; sid:584392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019fivedollarchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019fivedollarchallenge.com"; sid:584393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019give.com"; sid:584394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019memories.com"; sid:584395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019store.com"; sid:584396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019support.com"; sid:584397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020-awareness.com"; sid:584398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020covid-19.com"; sid:584399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020keychains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020keychains.com"; sid:584400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusacoustics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusacoustics.com"; sid:584401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyutah.com"; sid:584402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarrister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarrister.com"; sid:584403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bd.com"; sid:584404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiodefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiodefense.com"; sid:584405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiosafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiosafety.com"; sid:584406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bracelet.com"; sid:584407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionlaw.com"; sid:584408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptions.com"; sid:584409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessprofitloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessprofitloss.com"; sid:584410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscashback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscashback.com"; sid:584411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscheck.com"; sid:584412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinasettlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinasettlementfund.com"; sid:584413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschinavictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschinavictimfund.com"; sid:584414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimss.com"; sid:584415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclassesaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclassesaction.com"; sid:584416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanco.com"; sid:584417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean.solutions"; sid:584418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanion.com"; sid:584419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensationclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensationclaim.com"; sid:584420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplaints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplaints.com"; sid:584421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliantrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliantrealtor.com"; sid:584422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultingllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultingllc.com"; sid:584423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontacttracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontacttracer.com"; sid:584424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontrolpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontrolpr.com"; sid:584425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-coverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-coverage.com"; sid:584426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19decontamination.com"; sid:584427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiselaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiselaw.com"; sid:584428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectionnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectionnyc.com"; sid:584429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdispositivi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdispositivi.com"; sid:584430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusehs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusehs.com"; sid:584431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.fan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.fan"; sid:584432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfase2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfase2.com"; sid:584433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflashtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflashtest.com"; sid:584434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflashtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflashtests.com"; sid:584435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoodsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoodsecurity.com"; sid:584436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fr.com"; sid:584437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfr.com"; sid:584438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfrisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfrisco.com"; sid:584439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgardenhustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgardenhustle.com"; sid:584440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgardens.com"; sid:584441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushaiku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushaiku.com"; sid:584442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimage.com"; sid:584443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurycompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurycompensation.com"; sid:584444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinny.com"; sid:584445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsa.com"; sid:584446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancefraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancefraud.com"; sid:584447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancerelief.com"; sid:584448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsure.com"; sid:584449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeychains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeychains.com"; sid:584450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-latestupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-latestupdate.com"; sid:584451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyernewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyernewyork.com"; sid:584452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalcompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalcompensation.com"; sid:584453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-logo-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-logo-masks.com"; sid:584454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-masks-custom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-masks-custom.com"; sid:584455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-masks-for-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-masks-for-sale.com"; sid:584456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiamilaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiamilaw.com"; sid:584457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnosistemaprisional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnosistemaprisional.com"; sid:584458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotification.com"; sid:584459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomedeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomedeaths.com"; sid:584460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomelaw.com"; sid:584461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicbooks.com"; sid:584462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmovies.com"; sid:584463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicwall.com"; sid:584464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayouts.com"; sid:584465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-peru.com"; sid:584466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspicturebooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspicturebooks.com"; sid:584467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-products.com"; sid:584468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspure.com"; sid:584469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregistries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregistries.com"; sid:584470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelieflive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelieflive.com"; sid:584471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcepage.com"; sid:584472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatestkit.com"; sid:584473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatestkits.com"; sid:584474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussniper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussniper.com"; sid:584475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolarstimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolarstimulus.com"; sid:584476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingspots.com"; sid:584477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestrapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestrapid.com"; sid:584478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimrelief.com"; sid:584479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-visieres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-visieres.com"; sid:584480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkspaceaudit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkspaceaudit.com"; sid:584481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldrelief.com"; sid:584482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-visa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-visa.com"; sid:584483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisors.net"; sid:584484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavseconomy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavseconomy.net"; sid:584485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsguns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsguns.com"; sid:584486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaramt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaramt.com"; sid:584487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarestore.com"; sid:584488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawont.com"; sid:584489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldcup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldcup.com"; sid:584490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-yushi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-yushi.com"; sid:584491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costablancacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costablancacovidfree.com"; sid:584492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costcuttingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costcuttingcovid.com"; sid:584493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coverorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coverorcovid.com"; sid:584494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aachen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aachen.com"; sid:584495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abogadas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abogadas.com"; sid:584496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abroad.com"; sid:584497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abudhabi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abudhabi.com"; sid:584498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acutehomehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acutehomehealth.com"; sid:584499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advertising.com"; sid:584500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19affect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19affect.com"; sid:584501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afterpartymanchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afterpartymanchester.com"; sid:584502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidatinizigerialiniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidatinizigerialiniz.com"; sid:584503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidatlariniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidatlariniz.com"; sid:584504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aideleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aideleriniz.com"; sid:584505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidepp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidepp.com"; sid:584506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airtravel.com"; sid:584507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19answered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19answered.com"; sid:584508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antarctica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antarctica.com"; sid:584509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodiestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodiestest.com"; sid:584510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodypass.com"; sid:584511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodyrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodyrapidtesting.com"; sid:584512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestonline.com"; sid:584513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestsites.com"; sid:584514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ar.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ar.info"; sid:584515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autoinsurancerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autoinsurancerelief.com"; sid:584516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avtmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avtmasks.com"; sid:584517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backtowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backtowork.com"; sid:584518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bailouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bailouts.com"; sid:584519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19balaclavas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19balaclavas.com"; sid:584520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcys.com"; sid:584521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barrister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barrister.com"; sid:584522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bd.com"; sid:584523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beacon.com"; sid:584524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beginning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beginning.com"; sid:584525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19biden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19biden.com"; sid:584526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bingo.com"; sid:584527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19biosecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19biosecurity.com"; sid:584528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthdays.com"; sid:584529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizins.com"; sid:584530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bizlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bizlaw.com"; sid:584531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blackribboncampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blackribboncampaign.com"; sid:584532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19botswana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19botswana.com"; sid:584533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bracelet.com"; sid:584534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19britain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19britain.com"; sid:584535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19britain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19britain.net"; sid:584536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19britishcolumbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19britishcolumbia.com"; sid:584537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bulkppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bulkppe.com"; sid:584538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19burkinafaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19burkinafaso.com"; sid:584539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-businessclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-businessclaims.com"; sid:584540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessconsultants.com"; sid:584541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionattorneys.com"; sid:584542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptioninsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptioninsurancelawyer.com"; sid:584543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptionlawyers.com"; sid:584544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinterruptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinterruptions.com"; sid:584545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslosslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslosslaw.com"; sid:584546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessprotection.com"; sid:584547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buslaw.com"; sid:584548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busters.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busters.biz"; sid:584549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19campaignmedal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19campaignmedal.com"; sid:584550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19campaignmedal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19campaignmedal.com"; sid:584551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canadadata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canadadata.com"; sid:584552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careclub.com"; sid:584553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carestation.com"; sid:584554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careteam.com"; sid:584555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carte.com"; sid:584556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casespk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casespk.com"; sid:584557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cdu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cdu.com"; sid:584558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chad.com"; sid:584559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19change.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19change.com"; sid:584560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinasettlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinasettlementfund.com"; sid:584561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinavictimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinavictimfund.com"; sid:584562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-civil-rights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-civil-rights.com"; sid:584563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19civilrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19civilrights.com"; sid:584564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-civil-rights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-civil-rights.net"; sid:584565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19civilrights.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19civilrights.net"; sid:584566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimscenters.com"; sid:584567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classesaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classesaction.com"; sid:584568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaner.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaner.biz"; sid:584569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservice2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservice2020.com"; sid:584570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanservice.com"; sid:584571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearid.com"; sid:584572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearinghouse.com"; sid:584573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicalteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicalteam.com"; sid:584574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coloradosprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coloradosprings.com"; sid:584575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communityaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communityaction.com"; sid:584576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensationclaims.com"; sid:584577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complaint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complaint.com"; sid:584578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19complaints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19complaints.com"; sid:584579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19completetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19completetest.com"; sid:584580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantbuyeragent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantbuyeragent.com"; sid:584581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantlistingagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantlistingagent.com"; sid:584582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantrealestate.com"; sid:584583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliantrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliantrealtor.com"; sid:584584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliantrealtor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliantrealtor.com"; sid:584585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-connections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-connections.com"; sid:584586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conquered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conquered.com"; sid:584587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19constructionconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19constructionconsulting.com"; sid:584588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19contactsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19contactsolutions.com"; sid:584589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19copay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19copay.com"; sid:584590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19creativity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19creativity.com"; sid:584591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crewtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crewtest.com"; sid:584592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crewtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crewtesting.com"; sid:584593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cubes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cubes.com"; sid:584594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cubicles.com"; sid:584595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19culture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19culture.com"; sid:584596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cup.com"; sid:584597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailystats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailystats.com"; sid:584598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19danger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19danger.com"; sid:584599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datacenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datacenter.com"; sid:584600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datacentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datacentre.com"; sid:584601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datacentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datacentre.com"; sid:584602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataservice.com"; sid:584603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19data.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19data.technology"; sid:584604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dayreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dayreport.com"; sid:584605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dayreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dayreports.com"; sid:584606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentistsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentistsolution.com"; sid:584607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19depression2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19depression2020.com"; sid:584608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19depression2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19depression2021.com"; sid:584609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19depressionaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19depressionaustralia.com"; sid:584610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diningsolutions.com"; sid:584611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfection-coloradosprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfection-coloradosprings.com"; sid:584612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionnyc.com"; sid:584613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donations.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donations.info"; sid:584614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dose.com"; sid:584615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dougford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dougford.com"; sid:584616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dougford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dougford.com"; sid:584617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drfauci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drfauci.com"; sid:584618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drfauci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drfauci.com"; sid:584619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dubai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dubai.com"; sid:584620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eco.com"; sid:584621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elculpable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elculpable.com"; sid:584622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeewristtag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeewristtag.com"; sid:584623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerwristtagtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerwristtagtestkit.com"; sid:584624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-er.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-er.com"; sid:584625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19escape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19escape.com"; sid:584626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facefashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facefashion.com"; sid:584627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19face-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19face-masks.com"; sid:584628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factchecker.com"; sid:584629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsnc.com"; sid:584630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fakenews-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fakenews-tracker.com"; sid:584631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fasttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fasttest.com"; sid:584632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fasttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fasttest.com"; sid:584633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fest.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fest.cat"; sid:584634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fingertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fingertest.com"; sid:584635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstrespondersfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstrespondersfund.com"; sid:584636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flclaim.com"; sid:584637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flclaims.com"; sid:584638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flrelief.com"; sid:584639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19focus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19focus.com"; sid:584640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosuresolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosuresolutions.com"; sid:584641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.biz"; sid:584642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecommunity.com"; sid:584643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freenation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freenation.com"; sid:584644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freespace.com"; sid:584645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frisco.com"; sid:584646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinenurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinenurse.com"; sid:584647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19frontliner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19frontliner.com"; sid:584648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlineworker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlineworker.com"; sid:584649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gabon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gabon.com"; sid:584650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19garden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19garden.com"; sid:584651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gardenhustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gardenhustle.com"; sid:584652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gardens.com"; sid:584653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19governmentreleif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19governmentreleif.com"; sid:584654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graduations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graduations.com"; sid:584655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graphs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graphs.net"; sid:584656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19guyana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19guyana.com"; sid:584657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-handsanitizer.com"; sid:584658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hardmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hardmoney.com"; sid:584659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hardmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hardmoney.com"; sid:584660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcenter.com"; sid:584661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthysex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthysex.com"; sid:584662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthysex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthysex.com"; sid:584663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroloan.com"; sid:584664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroloans.com"; sid:584665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hhnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hhnurse.com"; sid:584666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hhnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hhnursing.com"; sid:584667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19historymonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19historymonth.com"; sid:584668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecarenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecarenews.com"; sid:584669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecareteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecareteam.com"; sid:584670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehealthcare.com"; sid:584671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehealthnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehealthnews.com"; sid:584672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehealthnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehealthnurse.com"; sid:584673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homehealthteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homehealthteam.com"; sid:584674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometeam.com"; sid:584675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-iade-aidatlarinizialinn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-iade-aidatlarinizialinn.com"; sid:584676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iadeleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iadeleriniz.com"; sid:584677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ict.com"; sid:584678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-immuneresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-immuneresponse.com"; sid:584679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19in321.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19in321.com"; sid:584680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-info.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-info.net"; sid:584681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inpk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inpk.com"; sid:584682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-insurancecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-insurancecoverage.com"; sid:584683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-insurancecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-insurancecoverage.com"; sid:584684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancefraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancefraud.com"; sid:584685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancerecoveryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancerecoveryattorneys.com"; sid:584686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancerecoverylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancerecoverylawyers.com"; sid:584687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investmentconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investmentconsulting.com"; sid:584688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investments.com"; sid:584689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isolation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isolation.info"; sid:584690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ivtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ivtreatment.com"; sid:584691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jerseys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jerseys.com"; sid:584692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jerseys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jerseys.net"; sid:584693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19joebiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19joebiden.com"; sid:584694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jungle.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jungle.world"; sid:584695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19justintrudeau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19justintrudeau.com"; sid:584696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kampala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kampala.com"; sid:584697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kartiadeleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kartiadeleriniz.com"; sid:584698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keychains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keychains.com"; sid:584699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latestupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latestupdate.com"; sid:584700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfl.com"; sid:584701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawillinois.com"; sid:584702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawoc.com"; sid:584703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawpllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawpllc.com"; sid:584704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuit.net"; sid:584705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyernewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyernewyork.com"; sid:584706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyersforbusinessinterruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyersforbusinessinterruption.com"; sid:584707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-learn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-learn.com"; sid:584708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-livestat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-livestat.com"; sid:584709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19liveview.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19liveview.info"; sid:584710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanprogram.com"; sid:584711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-log.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-log.com"; sid:584712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-loss.com"; sid:584713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lossprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lossprevention.com"; sid:584714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-management.com"; sid:584715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mane.com"; sid:584716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19manhattan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19manhattan.com"; sid:584717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19manitoba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19manitoba.com"; sid:584718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-maske.com"; sid:584719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maskforsale.com"; sid:584720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskmyway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskmyway.com"; sid:584721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masks.net"; sid:584722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalresearch.com"; sid:584723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalshop.com"; sid:584724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-meditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-meditation.com"; sid:584725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mentalhealthhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mentalhealthhealing.com"; sid:584726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19message.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19message.com"; sid:584727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19metroone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19metroone.com"; sid:584728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mia.com"; sid:584729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19middleeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19middleeast.com"; sid:584730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mmnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mmnews.com"; sid:584731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moderna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moderna.com"; sid:584732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19months.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19months.com"; sid:584733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19morocco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19morocco.com"; sid:584734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mortgagedeferral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mortgagedeferral.com"; sid:584735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagesolutions.com"; sid:584736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musuem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musuem.com"; sid:584737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mx.net"; sid:584738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mymentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mymentalhealth.com"; sid:584739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-n95.com"; sid:584740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nairobi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nairobi.com"; sid:584741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nbi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nbi.com"; sid:584742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19newfoundland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19newfoundland.com"; sid:584743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-news-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-news-info.com"; sid:584744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newzealand.com"; sid:584745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19niger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19niger.com"; sid:584746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notredame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notredame.com"; sid:584747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomedeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomedeaths.com"; sid:584748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19obama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19obama.com"; sid:584749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obama.com"; sid:584750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obits.com"; sid:584751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obituary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obituary.com"; sid:584752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odr-hk.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odr-hk.biz"; sid:584753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-odrhk.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-odrhk.biz"; sid:584754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19office.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19office.com"; sid:584755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-office.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-office.com"; sid:584756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officer.com"; sid:584757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19openletter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19openletter.net"; sid:584758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19options.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19options.com"; sid:584759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19origins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19origins.com"; sid:584760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-or-movie.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-or-movie.pizza"; sid:584761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19osaka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19osaka.com"; sid:584762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19osaka.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19osaka.net"; sid:584763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outfit.com"; sid:584764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paintings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paintings.com"; sid:584765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partnership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partnership.com"; sid:584766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partystreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partystreams.com"; sid:584767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pasms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pasms.com"; sid:584768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pelobrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pelobrasil.com"; sid:584769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phrasegenerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phrasegenerator.com"; sid:584770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pinas.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pinas.info"; sid:584771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poland.com"; sid:584772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poster.com"; sid:584773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19postive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19postive.com"; sid:584774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppekit.com"; sid:584775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pray4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pray4.com"; sid:584776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preppers.com"; sid:584777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prevencion.com"; sid:584778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19privateloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19privateloans.com"; sid:584779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privateloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privateloans.com"; sid:584780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19privatemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19privatemoney.com"; sid:584781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privatemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privatemoney.com"; sid:584782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19products.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19products.biz"; sid:584783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proof.com"; sid:584784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proofoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proofoffice.com"; sid:584785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prophylaxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prophylaxis.com"; sid:584786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionfacemask.com"; sid:584787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protests.com"; sid:584788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protezioni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protezioni.com"; sid:584789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19providers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19providers.com"; sid:584790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qrt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qrt.com"; sid:584791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quickresponsetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quickresponsetest.com"; sid:584792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapiddetectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapiddetectionkit.com"; sid:584793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresult.com"; sid:584794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ravage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ravage.com"; sid:584795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestateconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestateconsultants.com"; sid:584796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recession2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recession2020.com"; sid:584797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recession2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recession2021.com"; sid:584798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recessionaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recessionaustralia.com"; sid:584799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverylaw.com"; sid:584800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryplan.com"; sid:584801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryservice.com"; sid:584802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19registries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19registries.com"; sid:584803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieflaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieflaw.com"; sid:584804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relieflive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relieflive.com"; sid:584805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remembranceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remembranceday.com"; sid:584806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remembranceday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remembranceday.net"; sid:584807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotevisits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotevisits.com"; sid:584808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentfund.com"; sid:584809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19research-medisunhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19research-medisunhealth.com"; sid:584810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-researchtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-researchtreatments.com"; sid:584811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchtreatments.com"; sid:584812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailsecurity.com"; sid:584813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rush.com"; sid:584814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeservices.com"; sid:584815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevenue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevenue.com"; sid:584816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevenues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevenues.com"; sid:584817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatestkit.com"; sid:584818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatestkits.com"; sid:584819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schedulingsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schedulingsoftware.com"; sid:584820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schedulingsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schedulingsoftware.com"; sid:584821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scramble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scramble.com"; sid:584822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningdogs.com"; sid:584823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19searchalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19searchalliance.com"; sid:584824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19searchallies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19searchallies.com"; sid:584825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19searchpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19searchpartners.com"; sid:584826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securityguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securityguard.com"; sid:584827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securityofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securityofficer.com"; sid:584828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfchecker.com"; sid:584829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftracker.com"; sid:584830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19series.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19series.com"; sid:584831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19severity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19severity.com"; sid:584832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sex.com"; sid:584833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shiva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shiva.com"; sid:584834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shiva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shiva.com"; sid:584835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shortsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shortsale.com"; sid:584836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sidejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sidejobs.com"; sid:584837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signsandprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signsandprinting.com"; sid:584838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinessloss.com"; sid:584839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smithfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smithfield.com"; sid:584840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialstories.com"; sid:584841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialstory.com"; sid:584842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19society.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19society.com"; sid:584843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-so.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-so.com"; sid:584844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19software.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19software.com"; sid:584845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solar.com"; sid:584846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19somalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19somalia.com"; sid:584847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19source.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19source.com"; sid:584848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southamerica.com"; sid:584849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19southsudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19southsudan.com"; sid:584850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statefacts.com"; sid:584851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stateserviceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stateserviceprogram.com"; sid:584852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statsworld.com"; sid:584853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stp.com"; sid:584854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19streetwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19streetwear.com"; sid:584855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stresshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stresshelp.com"; sid:584856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stx.com"; sid:584857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sudan.com"; sid:584858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliers.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliers.info"; sid:584859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supply.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supply.info"; sid:584860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19support247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19support247.com"; sid:584861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportgroups.com"; sid:584862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surivor.com"; sid:584863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorcount.com"; sid:584864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tanzania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tanzania.com"; sid:584865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tchad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tchad.com"; sid:584866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techsolution.com"; sid:584867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teeshirt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teeshirt.net"; sid:584868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19teeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19teeshirts.com"; sid:584869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teeshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teeshirts.net"; sid:584870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testantibody.com"; sid:584871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testapp.com"; sid:584872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testdirect.com"; sid:584873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testers.com"; sid:584874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingindfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingindfw.com"; sid:584875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitsuk.com"; sid:584876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testrapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testrapid.com"; sid:584877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testrating.com"; sid:584878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testreview.com"; sid:584879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testspots.com"; sid:584880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thai.net"; sid:584881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19theaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19theaftermath.com"; sid:584882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapies.com"; sid:584883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19time2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19time2020.com"; sid:584884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19times-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19times-2020.com"; sid:584885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19times2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19times2020.com"; sid:584886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19together.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19together.info"; sid:584887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tokyo.com"; sid:584888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tokyo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tokyo.net"; sid:584889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tort.com"; sid:584890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tourisim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tourisim.com"; sid:584891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trace.com"; sid:584892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracker-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracker-alerts.com"; sid:584893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.info"; sid:584894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackingapp.com"; sid:584895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tradewar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tradewar.com"; sid:584896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tragic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tragic.com"; sid:584897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-trial.com"; sid:584898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19truedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19truedata.com"; sid:584899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truedata.com"; sid:584900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvseries.com"; sid:584901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvshow.com"; sid:584902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uea-jp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uea-jp.info"; sid:584903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uganda.com"; sid:584904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usarelief-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usarelief-fund.com"; sid:584905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19us.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19us.today"; sid:584906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvmask.com"; sid:584907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ventures.com"; sid:584908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verifyedrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verifyedrestaurants.com"; sid:584909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimfund.com"; sid:584910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimrelief.com"; sid:584911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimscemetery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimscemetery.com"; sid:584912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimsfund.com"; sid:584913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralnews.com"; sid:584914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualvisits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualvisits.com"; sid:584915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-virus-coverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-virus-coverage.com"; sid:584916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruscoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruscoverage.com"; sid:584917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusdisaster.com"; sid:584918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdisaster.com"; sid:584919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfree2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfree2020.com"; sid:584920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusfree2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusfree2021.com"; sid:584921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-viruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-viruskits.com"; sid:584922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-virus-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-virus-masks.com"; sid:584923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-masks.com"; sid:584924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusthemovie.com"; sid:584925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusthemovie.com"; sid:584926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusus.com"; sid:584927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruswall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruswall.com"; sid:584928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruswall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruswall.com"; sid:584929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-visieres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-visieres.com"; sid:584930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visualization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visualization.com"; sid:584931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.vlaanderen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.vlaanderen"; sid:584932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsamerica.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsamerica.info"; sid:584933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waiver.com"; sid:584934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ware.com"; sid:584935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warfare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warfare.com"; sid:584936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19windowcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19windowcleaning.com"; sid:584937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workspaceaudit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workspaceaudit.com"; sid:584938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldrelief.com"; sid:584939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wristtag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wristtag.com"; sid:584940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wristtagprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wristtagprogram.com"; sid:584941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wuhan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wuhan.info"; sid:584942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19year.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19year.com"; sid:584943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zambia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zambia.com"; sid:584944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19zihuatanejo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19zihuatanejo.com"; sid:584945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zimbabwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zimbabwe.com"; sid:584946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019fight.com"; sid:584947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019fitnesschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019fitnesschallenge.com"; sid:584948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019fivedollarchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019fivedollarchallenge.com"; sid:584949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019fund.com"; sid:584950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019give.com"; sid:584951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019helpchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019helpchallenge.com"; sid:584952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019help.com"; sid:584953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019heros.com"; sid:584954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019lovechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019lovechallenge.com"; sid:584955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019remember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019remember.com"; sid:584956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019share.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019share.com"; sid:584957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019supportchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019supportchallenge.com"; sid:584958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019together.com"; sid:584959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020-ppe.com"; sid:584960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020scherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020scherm.com"; sid:584961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2088.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2088.com"; sid:584962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4cause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4cause.com"; sid:584963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4home.com"; sid:584964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid5050.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid5050.com"; sid:584965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9data.com"; sid:584966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teencollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teencollective.com"; sid:584967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachef.com"; sid:584968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacure.com"; sid:584969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacurse.com"; sid:584970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacy.com"; sid:584971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaftercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaftercare.com"; sid:584972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidair.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidair.one"; sid:584973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamakers.com"; sid:584974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandi.com"; sid:584975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanniversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanniversary.com"; sid:584976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantivirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantivirals.com"; sid:584977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapi.codes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapi.codes"; sid:584978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmourstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmourstore.com"; sid:584979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidastore.com"; sid:584980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidastudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidastudy.com"; sid:584981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneygroup.com"; sid:584982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaviation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaviation.com"; sid:584983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarenessmonths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarenessmonths.com"; sid:584984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ayuda.com"; sid:584985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbalayage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbalayage.com"; sid:584986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyclaims.com"; sid:584987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarque.com"; sid:584988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeacon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeacon.com"; sid:584989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeats.com"; sid:584990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbescherming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbescherming.com"; sid:584991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbestfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbestfacemasks.com"; sid:584992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeveiliging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeveiliging.com"; sid:584993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiometrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiometrics.com"; sid:584994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiometrix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiometrix.com"; sid:584995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiopharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiopharm.com"; sid:584996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiosafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiosafety.com"; sid:584997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizsolutions.com"; sid:584998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbodybags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbodybags.com"; sid:584999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboss.com"; sid:585000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-calories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-calories.com"; sid:585001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanine.com"; sid:585002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareclub.com"; sid:585003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecorps.com"; sid:585004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecoverage.com"; sid:585005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareercomeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareercomeback.com"; sid:585006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarelearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarelearning.com"; sid:585007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareregistry.com"; sid:585008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarestation.com"; sid:585009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarwash.com"; sid:585010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasesindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasesindia.com"; sid:585011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckedbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckedbusiness.com"; sid:585012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchefs.com"; sid:585013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcivillaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcivillaw.com"; sid:585014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsolutions.com"; sid:585015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclash.com"; sid:585016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanandclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanandclear.com"; sid:585017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancolombia.com"; sid:585018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanct.com"; sid:585019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners19.com"; sid:585020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersny.com"; sid:585021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanfl.com"; sid:585022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanlosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanlosangeles.com"; sid:585023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean-ny.com"; sid:585024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanplus.com"; sid:585025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearid.biz"; sid:585026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearjobs.com"; sid:585027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleartowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleartowork.com"; sid:585028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearwork.com"; sid:585029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicusa.com"; sid:585030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosurelandmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosurelandmark.com"; sid:585031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoatings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoatings.com"; sid:585032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoinage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoinage.com"; sid:585033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoinage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoinage.net"; sid:585034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoloring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoloring.com"; sid:585035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebacks.com"; sid:585036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackstories.com"; sid:585037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommiserate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommiserate.com"; sid:585038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityaction.com"; sid:585039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompletetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompletetest.com"; sid:585040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancegroup.com"; sid:585041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance.net"; sid:585042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantbuyeragent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantbuyeragent.com"; sid:585043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantlistingagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantlistingagent.com"; sid:585044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfidant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfidant.com"; sid:585045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconquered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconquered.com"; sid:585046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsequences.com"; sid:585047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumerlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumerlawyers.com"; sid:585048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontainers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontainers.com"; sid:585049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolpr.com"; sid:585050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooker.com"; sid:585051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornhole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornhole.com"; sid:585052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronavirus19.com"; sid:585053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-counselor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-counselor.com"; sid:585054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovenant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovenant.com"; sid:585055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovercare.com"; sid:585056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrewtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrewtesting.com"; sid:585057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrispr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrispr.com"; sid:585058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisprtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisprtest.com"; sid:585059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiseships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiseships.com"; sid:585060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcubes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcubes.com"; sid:585061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcubicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcubicles.com"; sid:585062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuffs.com"; sid:585063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcult.com"; sid:585064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupboardcreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupboardcreations.com"; sid:585065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure4u.com"; sid:585066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailynews.com"; sid:585067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddataproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddataproject.com"; sid:585068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeepcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeepcleaning.com"; sid:585069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseattorney.com"; sid:585070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensecom.com"; sid:585071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenselawyer.com"; sid:585072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-depot.com"; sid:585073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetectiondogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetectiondogs.com"; sid:585074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddischarge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddischarge.com"; sid:585075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectioncanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectioncanada.com"; sid:585076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctoroncall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctoroncall.com"; sid:585077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddom.com"; sid:585078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugtrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugtrial.com"; sid:585079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrugtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrugtrials.com"; sid:585080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covided.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covided.info"; sid:585081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideffects.com"; sid:585082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ehealth.com"; sid:585083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eliminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eliminate.com"; sid:585084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eliminators.com"; sid:585085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyhelp.com"; sid:585086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployeetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployeetesting.com"; sid:585087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenc.com"; sid:585088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-end.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-end.com"; sid:585089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentalaerobox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentalaerobox.com"; sid:585090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidention.com"; sid:585091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideonow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideonow.com"; sid:585092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideotape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideotape.com"; sid:585093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-etiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-etiquette.com"; sid:585094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetiquette.com"; sid:585095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eurodisplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eurodisplay.com"; sid:585096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexplained.com"; sid:585097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidezpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidezpass.com"; sid:585098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacecoverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacecoverings.com"; sid:585099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemasksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemasksonline.com"; sid:585100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactorysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactorysupply.com"; sid:585101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaruv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaruv.com"; sid:585102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfat.com"; sid:585103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfig.com"; sid:585104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightersale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightersale.com"; sid:585105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightingsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightingsale.com"; sid:585106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerbloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerbloodtest.com"; sid:585107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflashtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflashtest.com"; sid:585108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflinsuranceclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflinsuranceclaim.com"; sid:585109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-food-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-food-map.com"; sid:585110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootregistry.com"; sid:585111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudlawyers.com"; sid:585112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeaccommodation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeaccommodation.com"; sid:585113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertificate.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertificate.cat"; sid:585114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertificate.com"; sid:585115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertificate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertificate.net"; sid:585116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecompany.com"; sid:585117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecruises.com"; sid:585118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedelivery.com"; sid:585119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedestination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedestination.com"; sid:585120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedestinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedestinations.com"; sid:585121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedestiny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedestiny.com"; sid:585122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefertility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefertility.com"; sid:585123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefl.com"; sid:585124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefly.com"; sid:585125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegyms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegyms.com"; sid:585126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehoteles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehoteles.com"; sid:585127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-hotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-hotels.com"; sid:585128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-hotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-hotels.com"; sid:585129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehotels.com"; sid:585130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeivf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeivf.com"; sid:585131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-madrid.com"; sid:585132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemarket.com"; sid:585133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeproducts.com"; sid:585134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-restaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-restaurants.com"; sid:585135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeschools.com"; sid:585136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-shop.com"; sid:585137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeshops.com"; sid:585138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreespaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreespaces.com"; sid:585139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestadium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestadium.com"; sid:585140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-stores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-stores.com"; sid:585141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestores.com"; sid:585142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestrippers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestrippers.com"; sid:585143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetenerife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetenerife.com"; sid:585144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetrip.com"; sid:585145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkforce.com"; sid:585146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-zone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-zone.com"; sid:585147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriends.com"; sid:585148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrisco.com"; sid:585149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgadget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgadget.com"; sid:585150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gfcbcn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gfcbcn.com"; sid:585151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgiftpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgiftpack.com"; sid:585152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguider.com"; sid:585153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandrub.com"; sid:585154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-handsanitizer.com"; sid:585155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidharm.com"; sid:585156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpgroup.com"; sid:585157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroloan.com"; sid:585158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroloans.com"; sid:585159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhhcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhhcare.com"; sid:585160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhhnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhhnurse.com"; sid:585161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhhnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhhnursing.com"; sid:585162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhistorymonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhistorymonth.com"; sid:585163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax.info"; sid:585164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax.mobi"; sid:585165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax.net"; sid:585166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhollandcruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhollandcruises.com"; sid:585167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecareteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecareteam.com"; sid:585168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehealthnurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehealthnurse.com"; sid:585169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehealthnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehealthnursing.com"; sid:585170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehealthteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehealthteam.com"; sid:585171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometeam.com"; sid:585172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotsauce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotsauce.com"; sid:585173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhype.com"; sid:585174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhysteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhysteria.com"; sid:585175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicized.com"; sid:585176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicure.com"; sid:585177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicures.com"; sid:585178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicurse.com"; sid:585179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididiots.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididiots.today"; sid:585180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidignorance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidignorance.com"; sid:585181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidignorant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidignorant.com"; sid:585182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidillinoisnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidillinoisnews.com"; sid:585183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinblack.com"; sid:585184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia2020.com"; sid:585185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindustryreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindustryreport.com"; sid:585186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo19.com"; sid:585187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfosnonvoulues.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfosnonvoulues.net"; sid:585188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjection.com"; sid:585189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinmarketing.com"; sid:585190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinny.com"; sid:585191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintech.com"; sid:585192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot45.com"; sid:585193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioting.com"; sid:585194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotnews.com"; sid:585195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoblink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoblink.com"; sid:585196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkaren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkaren.com"; sid:585197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillercanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillercanada.com"; sid:585198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerz.com"; sid:585199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitrating.com"; sid:585200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitratings.com"; sid:585201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitreview.com"; sid:585202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitreviews.com"; sid:585203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits.biz"; sid:585204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkn95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkn95mask.com"; sid:585205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabkit.com"; sid:585206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabkits.com"; sid:585207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-la.com"; sid:585208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lake.net"; sid:585209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlake.net"; sid:585210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaontracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaontracker.com"; sid:585211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlast.com"; sid:585212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw360.com"; sid:585213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawclaims.com"; sid:585214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsrq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsrq.com"; sid:585215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsrq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsrq.net"; sid:585216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloantraker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloantraker.com"; sid:585217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-logistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-logistic.com"; sid:585218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogistic.com"; sid:585219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-logistique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-logistique.com"; sid:585220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogistique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogistique.com"; sid:585221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloveclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloveclub.com"; sid:585222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlullaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlullaby.com"; sid:585223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlungscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlungscan.com"; sid:585224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidluvclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidluvclub.com"; sid:585225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingaz.com"; sid:585226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.biz"; sid:585227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskclearinghouse.com"; sid:585228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskclub.com"; sid:585229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskkit.com"; sid:585230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.life"; sid:585231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.world"; sid:585232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmate.com"; sid:585233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmazk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmazk.com"; sid:585234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicallaw.com"; sid:585235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalmalpractice.com"; sid:585236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalnegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalnegligence.com"; sid:585237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialpage.com"; sid:585238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmen.com"; sid:585239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalhealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalhealthcare.com"; sid:585240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetamorfisys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetamorfisys.com"; sid:585241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmiracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmiracle.com"; sid:585242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmiracles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmiracles.com"; sid:585243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmiyim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmiyim.com"; sid:585244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-modeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-modeling.com"; sid:585245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmomcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmomcamp.com"; sid:585246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonth.com"; sid:585247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmv.com"; sid:585248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-my-healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-my-healthcare.com"; sid:585249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneglect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneglect.com"; sid:585250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-net.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-net.info"; sid:585251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnostic.com"; sid:585252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghomedeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghomedeaths.com"; sid:585253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidodisha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidodisha.com"; sid:585254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-office.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-office.com"; sid:585255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficer.com"; sid:585256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinemap.com"; sid:585257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorigins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorigins.com"; sid:585258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaintingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaintingservices.com"; sid:585259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaintingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaintingsolutions.com"; sid:585260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpaintingspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpaintingspecialist.com"; sid:585261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemiceffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemiceffects.com"; sid:585262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassport.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassport.club"; sid:585263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-passport.com"; sid:585264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-passport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-passport.net"; sid:585265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpax.com"; sid:585266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcrtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcrtesting.com"; sid:585267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphaseone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphaseone.com"; sid:585268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplandemic.com"; sid:585269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoctest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoctest.com"; sid:585270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoker.club"; sid:585271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpop.com"; sid:585272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppe.biz"; sid:585273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-precheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-precheck.net"; sid:585274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprincesscruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprincesscruises.com"; sid:585275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductsusa.com"; sid:585276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.info"; sid:585277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotection.biz"; sid:585278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqroo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqroo.com"; sid:585279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqrt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqrt.com"; sid:585280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarrel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarrel.com"; sid:585281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidques.com"; sid:585282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickresponsetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickresponsetest.com"; sid:585283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidraid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidraid.com"; sid:585284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrally.com"; sid:585285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestdelivered.com"; sid:585286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestnow.com"; sid:585287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rapidtests.com"; sid:585288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestsdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestsdelivered.com"; sid:585289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestsnow.com"; sid:585290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyjobs.com"; sid:585291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadytowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadytowork.com"; sid:585292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadywork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadywork.com"; sid:585293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealty.com"; sid:585294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovary.com"; sid:585295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycommission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycommission.com"; sid:585296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryservices.com"; sid:585297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredesign.com"; sid:585298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredesign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredesign.net"; sid:585299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefundlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefundlawyers.com"; sid:585300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieflaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieflaw.com"; sid:585301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieflive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieflive.com"; sid:585302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefsupplies.com"; sid:585303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-remdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-remdesivir.com"; sid:585304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrentdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrentdebt.com"; sid:585305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreopentracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreopentracker.com"; sid:585306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resolve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resolve.com"; sid:585307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resource.com"; sid:585308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponceteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponceteam.com"; sid:585309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsegov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsegov.com"; sid:585310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskmanagement.com"; sid:585311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroaster.com"; sid:585312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroyalcaribbeancruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroyalcaribbeancruises.com"; sid:585313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rpm.com"; sid:585314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrub.com"; sid:585315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeawareness.com"; sid:585316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebusiness.com"; sid:585317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertify.com"; sid:585318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepass.com"; sid:585319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeshopping.com"; sid:585320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycleaningservice.com"; sid:585321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.club"; sid:585322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetygraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetygraphics.com"; sid:585323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeway.com"; sid:585324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafework.com"; sid:585325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitary.com"; sid:585326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsauce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsauce.com"; sid:585327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsauces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsauces.com"; sid:585328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsavfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsavfe.com"; sid:585329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscherm.com"; sid:585330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseat.com"; sid:585331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurityofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurityofficer.com"; sid:585332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseeker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseeker.com"; sid:585333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfchecker.com"; sid:585334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentiments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentiments.com"; sid:585335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserologicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserologicaltest.com"; sid:585336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseverity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseverity.com"; sid:585337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield.pro"; sid:585338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsiperlik.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsiperlik.net"; sid:585339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoaps.com"; sid:585340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialstories.com"; sid:585341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialstory.com"; sid:585342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsofa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsofa.com"; sid:585343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolidaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolidaire.com"; sid:585344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutioncoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutioncoin.com"; sid:585345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouss.com"; sid:585346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspottest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspottest.com"; sid:585347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspread.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspread.info"; sid:585348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsrqlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsrqlaw.com"; sid:585349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaff.com"; sid:585350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatue.com"; sid:585351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoodmedown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoodmedown.com"; sid:585352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopfrance.com"; sid:585353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrongtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrongtogether.com"; sid:585354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstupid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstupid.info"; sid:585355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies2020.com"; sid:585356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupply2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupply2020.com"; sid:585357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtafilalet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtafilalet.com"; sid:585358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtek.com"; sid:585359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest4u.com"; sid:585360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbox.com"; sid:585361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcorp.com"; sid:585362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingbirmingham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingbirmingham.com"; sid:585363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting-lab.com"; sid:585364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglocator.com"; sid:585365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingpanhandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingpanhandle.com"; sid:585366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingprogram.com"; sid:585367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtexas.com"; sid:585368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlogistics.com"; sid:585369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestrating.com"; sid:585370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestreview.com"; sid:585371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestreviews.com"; sid:585372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsandiego.com"; sid:585373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsreview.com"; sid:585374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsupplies.com"; sid:585375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttech.com"; sid:585376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.zone"; sid:585377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtex.com"; sid:585378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtigermasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtigermasks.com"; sid:585379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtime2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtime2020.com"; sid:585380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimethoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimethoughts.com"; sid:585381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtini.com"; sid:585382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtinitime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtinitime.com"; sid:585383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtinitimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtinitimes.com"; sid:585384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tips.com"; sid:585385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtort.com"; sid:585386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransition.com"; sid:585387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrendy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrendy.com"; sid:585388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtron.com"; sid:585389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviducure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviducure.com"; sid:585390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uk.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uk.info"; sid:585391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunity.com"; sid:585392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvalid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvalid.com"; sid:585393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvalid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvalid.net"; sid:585394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimrelief.com"; sid:585395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19info.com"; sid:585396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusthemovie.com"; sid:585397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-visieres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-visieres.com"; sid:585398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvision.com"; sid:585399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvision.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvision.net"; sid:585400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualilizer.com"; sid:585401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-visualization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-visualization.com"; sid:585402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvseconomy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvseconomy.net"; sid:585403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarestore.com"; sid:585404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashes.com"; sid:585405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wear.com"; sid:585406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebinars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebinars.com"; sid:585407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwisualizer.com"; sid:585408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldrelief.com"; sid:585409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-worldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-worldwide.com"; sid:585410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld.world"; sid:585411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwraps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwraps.com"; sid:585412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxsim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxsim.com"; sid:585413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyearbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyearbook.com"; sid:585414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyears.com"; sid:585415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyesterday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyesterday.com"; sid:585416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyourself.com"; sid:585417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackcovid-19.com"; sid:585418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackcovid19.com"; sid:585419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crush-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crush-covid.com"; sid:585420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19attorney.com"; sid:585421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19attorneys.com"; sid:585422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19claims.com"; sid:585423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19law.com"; sid:585424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19lawyer.com"; sid:585425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19lawyers.com"; sid:585426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultureaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultureaftercovid19.com"; sid:585427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culture-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culture-covid19.com"; sid:585428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cybercrimepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cybercrimepandemic.com"; sid:585429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyberpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyberpandemic.net"; sid:585430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dadbabyanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dadbabyanticovid.com"; sid:585431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycostofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycostofcovid19.com"; sid:585432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19.email"; sid:585433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19.net"; sid:585434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidtracker.com"; sid:585435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datescorona.com"; sid:585436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-covid19.net"; sid:585437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontaminationcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontaminationcovid19.net"; sid:585438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidizar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidizar.com"; sid:585439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcoronavirusnow.com"; sid:585440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingthecoronavirus.com"; sid:585441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliveredcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliveredcoronavirustest.com"; sid:585442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deliveredcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deliveredcovid19test.com"; sid:585443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depoisdocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depoisdocoronavirus.com"; sid:585444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derechoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derechoscoronavirus.com"; sid:585445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derechoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derechoscovid.com"; sid:585446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descorona2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descorona2.com"; sid:585447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descoronados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descoronados.com"; sid:585448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descoronandoelvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descoronandoelvirus.com"; sid:585449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descovid.com"; sid:585450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desempleadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desempleadoscovid.com"; sid:585451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccion-coronavirus-valencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccion-coronavirus-valencia.com"; sid:585452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovidcdmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovidcdmx.com"; sid:585453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionparacoronavirus.com"; sid:585454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectioncovid-19.com"; sid:585455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectioncovid.com"; sid:585456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidcleaning.com"; sid:585457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discountcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discountcovidmask.com"; sid:585458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divisorianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divisorianticovid.com"; sid:585459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djtpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djtpandemic.com"; sid:585460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmkagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmkagainstcorona.com"; sid:585461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmvcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmvcoronarelief.com"; sid:585462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecorona.world"; sid:585463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doken-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doken-covid19.info"; sid:585464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domyneighborshavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domyneighborshavecorona.com"; sid:585465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domyneighbourshavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domyneighbourshavecorona.com"; sid:585466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatefor-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatefor-corona.com"; sid:585467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocovid-19.com"; sid:585468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dornazcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dornazcorona.com"; sid:585469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drive-in-coronasneltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drive-in-coronasneltest.com"; sid:585470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dudascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dudascoronavirus.com"; sid:585471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earningaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earningaftercorona.com"; sid:585472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earningduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earningduringcorona.com"; sid:585473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecatcovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecatcovidupdates.com"; sid:585474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economyvscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economyvscovid.net"; sid:585475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoronatravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoronatravel.com"; sid:585476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-devletcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-devletcorona.com"; sid:585477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcoronavirusliquidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcoronavirusliquidation.com"; sid:585478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectofcovid19.com"; sid:585479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elimina-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elimina-coronavirus.com"; sid:585480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminacovid19.com"; sid:585481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminacovid19.net"; sid:585482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminate-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminate-covid.com"; sid:585483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ellibrodecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ellibrodecoronavirus.com"; sid:585484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ellibrodecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ellibrodecovid19.com"; sid:585485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endurecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endurecovid.com"; sid:585486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enduredcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enduredcovid19.com"; sid:585487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enduredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enduredcovid.com"; sid:585488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enfrentacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enfrentacovid.com"; sid:585489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.guru"; sid:585490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-insurance.com"; sid:585491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicrisk.com"; sid:585492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciolibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciolibredecovid19.com"; sid:585493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evdekalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evdekalcorona.com"; sid:585494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evitacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evitacoronavirus.com"; sid:585495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examcovid19.com"; sid:585496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examcovid19.info"; sid:585497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expertoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expertoscoronavirus.com"; sid:585498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expertoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expertoscovid.com"; sid:585499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks4coronavirus.com"; sid:585500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facetocovid.com"; sid:585501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmaceuticosfrentealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmaceuticosfrentealcovid.com"; sid:585502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncovid.com"; sid:585503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidtesting.com"; sid:585504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttest-covid19.com"; sid:585505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttestcovid-19.com"; sid:585506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fck-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fck-covid19.com"; sid:585507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feedthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feedthepandemic.com"; sid:585508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feedthepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feedthepandemic.net"; sid:585509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fema360covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fema360covid19.com"; sid:585510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for festivalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"festivalcovid19.com"; sid:585511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fidecorona.com"; sid:585512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronanaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronanaturally.com"; sid:585513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusnaturally.com"; sid:585514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid-19.info"; sid:585515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19mane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19mane.com"; sid:585516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidnaturally.com"; sid:585517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingagainstcovid19.com"; sid:585518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmedocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmedocoronavirus.com"; sid:585519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingcorona.com"; sid:585520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fisioterapiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fisioterapiacovid19.com"; sid:585521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondscovidcali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondscovidcali.com"; sid:585522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forbidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forbidcovid.com"; sid:585523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formation-referent-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formation-referent-covid.com"; sid:585524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fotoscontralacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fotoscontralacovid.com"; sid:585525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid-19.com"; sid:585526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freetourismcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freetourismcovid.com"; sid:585527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19challenge.com"; sid:585528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovidbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovidbrand.com"; sid:585529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid-19.net"; sid:585530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumicovid.com"; sid:585531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundacioncovid.com"; sid:585532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvckcovid.com"; sid:585533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for g2k-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"g2k-covid.com"; sid:585534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for g2k-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"g2k-covid.net"; sid:585535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gadgetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gadgetcorona.com"; sid:585536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gadgetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gadgetcovid.com"; sid:585537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gatingcovid19.com"; sid:585538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationpandemic.com"; sid:585539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gensancovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gensancovidupdates.com"; sid:585540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidcapital.com"; sid:585541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getlostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getlostcorona.com"; sid:585542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovid19.com"; sid:585543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovid.com"; sid:585544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettestedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettestedcorona.com"; sid:585545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettestedcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettestedcoronavirus.com"; sid:585546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettestedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettestedcovid.com"; sid:585547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gettestedforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gettestedforcovid-19.com"; sid:585548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glamourmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glamourmaskscovid19.com"; sid:585549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19cases.com"; sid:585550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19pledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19pledge.com"; sid:585551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19pledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19pledge.com"; sid:585552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19stats.com"; sid:585553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidtherapists.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidtherapists.net"; sid:585554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicfree.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicfree.biz"; sid:585555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicssupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicssupplies.com"; sid:585556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicssupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicssupply.com"; sid:585557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronas.com"; sid:585558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidsmart.com"; sid:585559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotitcovid.com"; sid:585560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemic2020.com"; sid:585561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencovidcleaning.com"; sid:585562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grooveforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grooveforcovid19.com"; sid:585563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackthepandemicinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackthepandemicinternational.com"; sid:585564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltecovid.com"; sid:585565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hanacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hanacovid.com"; sid:585566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handicovid.com"; sid:585567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbotvccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbotvccovid19.com"; sid:585568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcacovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcacovidresearch.com"; sid:585569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingfromthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingfromthecoronavirus.com"; sid:585570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcorona.club"; sid:585571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-fr-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-fr-covid.com"; sid:585572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcorona.club"; sid:585573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcoronahands.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcoronahands.club"; sid:585574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofcoronavirus.com"; sid:585575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heropasscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heropasscovid19.com"; sid:585576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcovid19.com"; sid:585577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcovid.com"; sid:585578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotel-covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotel-covidfree.com"; sid:585579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidfree.com"; sid:585580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidfree.net"; sid:585581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidfreespain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidfreespain.com"; sid:585582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteles-covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteles-covidfree.com"; sid:585583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelescovidfree.com"; sid:585584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelescovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelescovidfree.net"; sid:585585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelscovidfree.com"; sid:585586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelscovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelscovidfree.net"; sid:585587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirusemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirusemployerlawyer.com"; sid:585588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidemployerattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidemployerattorney.com"; sid:585589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidemployerlawyer.com"; sid:585590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hydrocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hydrocovid.com"; sid:585591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidpositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidpositive.com"; sid:585592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidsafecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidsafecertified.com"; sid:585593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icankillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icankillcorona.com"; sid:585594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconqueredcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconqueredcoronavirus.com"; sid:585595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronaviruscovid19.com"; sid:585596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovid.com"; sid:585597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilcovidnews.com"; sid:585598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscoronavirustest.com"; sid:585599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovid19test.com"; sid:585600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovidnews.com"; sid:585601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicovid.com"; sid:585602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunityfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunityfromcoronavirus.com"; sid:585603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcoronatherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcoronatherapy.com"; sid:585604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid.cloud"; sid:585605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovidpaisanos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovidpaisanos.com"; sid:585606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovitacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovitacovid19.com"; sid:585607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19kit.com"; sid:585608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidkit.com"; sid:585609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecovid19relief.com"; sid:585610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecovidrelief.com"; sid:585611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipandemics.com"; sid:585612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidreal.com"; sid:585613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ispandemicoveryet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ispandemicoveryet.net"; sid:585614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthepandemicoveryet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthepandemicoveryet.net"; sid:585615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecovid-19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecovid-19in2020.com"; sid:585616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itaucardcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itaucardcovid.com"; sid:585617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itnacoronamujhepyaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itnacoronamujhepyaar.com"; sid:585618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsacovidthing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsacovidthing.com"; sid:585619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itstartedinwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itstartedinwuhan.com"; sid:585620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantacovid19test.com"; sid:585621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantacovidtest.com"; sid:585622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jemefaisdepisterducoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jemefaisdepisterducoronavirus.com"; sid:585623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jemefaisdepisterducovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jemefaisdepisterducovid19.com"; sid:585624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jimijohncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jimijohncorona.com"; sid:585625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jubileecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jubileecovid19.com"; sid:585626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntadeandaluciacertificadocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntadeandaluciacertificadocovidfree.com"; sid:585627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karenacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karenacorona.com"; sid:585628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kccovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kccovid19testing.com"; sid:585629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kennycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kennycovid.com"; sid:585630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for key4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"key4covid.com"; sid:585631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keyforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keyforcovid.com"; sid:585632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keyfourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keyfourcovid.com"; sid:585633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidneycovidinfocenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidneycovidinfocenter.com"; sid:585634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitdetectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitdetectioncovid.com"; sid:585635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitpcrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitpcrcovid.com"; sid:585636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronaviruscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronaviruscovid-19.com"; sid:585637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koshishcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koshishcovid19.com"; sid:585638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcovid.com"; sid:585639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laeracovidiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laeracovidiana.com"; sid:585640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawancovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawancovid-19.info"; sid:585641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcovid.com"; sid:585642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcovid.net"; sid:585643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuit-covid19.com"; sid:585644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitcovid-19.com"; sid:585645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitscovid-19.com"; sid:585646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawsuitscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawsuitscovid19.com"; sid:585647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lemcornwall-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lemcornwall-covid.com"; sid:585648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid.com"; sid:585649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for librodecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"librodecoronavirus.com"; sid:585650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifestylecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifestylecovid19.com"; sid:585651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiarcovid.com"; sid:585652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacorona-virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacorona-virus.net"; sid:585653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacovid.com"; sid:585654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liunacovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liunacovidinfo.com"; sid:585655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaftercovid19.com"; sid:585656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidfree.com"; sid:585657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingaftercovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingaftercovid19.info"; sid:585658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingpostcovid19.com"; sid:585659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingpostcovid.com"; sid:585660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livrodocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livrodocoronavirus.com"; sid:585661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livrodocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livrodocovid19.com"; sid:585662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livzoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livzoncovid19.com"; sid:585663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid19news.com"; sid:585664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locatecovid19.com"; sid:585665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid.com"; sid:585666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistic-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistic-covid.com"; sid:585667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logisticcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logisticcovid.com"; sid:585668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistiquecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistiquecovid19.com"; sid:585669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistique-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistique-covid.com"; sid:585670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logistiquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logistiquecovid.com"; sid:585671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lohdownonsciencepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lohdownonsciencepandemic.com"; sid:585672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-during-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-during-covid19.com"; sid:585673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lunangtiga-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lunangtiga-covid19.com"; sid:585674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mad-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mad-covid.com"; sid:585675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makechinapayforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makechinapayforcovid19.com"; sid:585676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasdeproteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasdeproteccioncovid.com"; sid:585677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasproteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasproteccioncovid.com"; sid:585678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasprotectorascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasprotectorascoronavirus.com"; sid:585679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasprotectorascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasprotectorascovid.com"; sid:585680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingapandemic.com"; sid:585681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingcovid19.com"; sid:585682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacovid-19.com"; sid:585683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascontracovid19.com"; sid:585684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinecovid19.net"; sid:585685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascovida.com"; sid:585686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticovid19.com"; sid:585687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid19cieletmer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid19cieletmer.com"; sid:585688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquedeprotectionanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquedeprotectionanticoronavirus.com"; sid:585689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-corona.com"; sid:585690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescoronavirus.net"; sid:585691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masscovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masscovidsupply.com"; sid:585692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masspandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masspandemics.com"; sid:585693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchingcorona.com"; sid:585694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medcovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medcovidstore.com"; sid:585695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medisunhealth-covid19research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medisunhealth-covid19research.com"; sid:585696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medsancovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medsancovid19test.com"; sid:585697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencoronavirus.com"; sid:585698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mercovid19.com"; sid:585699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mercovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mercovida.com"; sid:585700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metroonecovid19security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metroonecovid19security.com"; sid:585701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mgt-checkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mgt-checkcorona.com"; sid:585702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micoviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micoviddiaries.com"; sid:585703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidtest.com"; sid:585704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for midlandscovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"midlandscovidresources.com"; sid:585705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitestcovid19.com"; sid:585706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncovidtest.com"; sid:585707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecorona.com"; sid:585708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilefightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilefightingcovid.com"; sid:585709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for momentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"momentcorona.com"; sid:585710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monolaurinacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monolaurinacovid.com"; sid:585711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monolaurincovidessens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monolaurincovidessens.com"; sid:585712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montestcovid19.com"; sid:585713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcovid19.com"; sid:585714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multacoronavirus.com"; sid:585715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multascovid19.net"; sid:585716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multascovid.com"; sid:585717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multascovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multascovid.net"; sid:585718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for murderinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"murderinthetimeofcorona.com"; sid:585719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicalpandemic.com"; sid:585720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicalpandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicalpandemic.info"; sid:585721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicalpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicalpandemic.net"; sid:585722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalove.com"; sid:585723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-t.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-t.biz"; sid:585724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatshirts.com"; sid:585725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusmovie.com"; sid:585726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19help.com"; sid:585727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19homevalue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19homevalue.com"; sid:585728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19lawsuit.com"; sid:585729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19lawsuit.com"; sid:585730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcase.com"; sid:585731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlawsuit.com"; sid:585732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidonline.com"; sid:585733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidsafety.com"; sid:585734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeaftercorona.com"; sid:585735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysafecovid19.com"; sid:585736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestforcoronavirus.com"; sid:585737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19masksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19masksonline.com"; sid:585738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95covid19masksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95covid19masksupply.com"; sid:585739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationaltestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationaltestingcovid19.com"; sid:585740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronafighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronafighter.com"; sid:585741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronafighters.com"; sid:585742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirusfighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirusfighter.com"; sid:585743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirusfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirusfighters.com"; sid:585744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcovidfighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcovidfighter.com"; sid:585745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcovidfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcovidfighters.com"; sid:585746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for need4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"need4covid.com"; sid:585747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negociosenlineacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negociosenlineacovid.com"; sid:585748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nellaterracoronacouples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nellaterracoronacouples.com"; sid:585749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neogenestar-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neogenestar-covid19.com"; sid:585750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netflix-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netflix-covid-19.com"; sid:585751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for networcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"networcorona.com"; sid:585752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for networkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"networkcorona.com"; sid:585753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirus2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirus2019.com"; sid:585754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusmovie.com"; sid:585755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaviruspandemic.com"; sid:585756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaviruspicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaviruspicture.com"; sid:585757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronaviruspictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronaviruspictures.com"; sid:585758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusthebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusthebook.com"; sid:585759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19test.com"; sid:585760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidlaw.com"; sid:585761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for next-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"next-corona.com"; sid:585762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for next-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"next-corona.info"; sid:585763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for next-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"next-corona.net"; sid:585764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicoronanivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicoronanivirus.com"; sid:585765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidresponse.com"; sid:585766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidsentiments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidsentiments.com"; sid:585767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcovidclaim.com"; sid:585768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcovidclaims.com"; sid:585769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for not-only-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"not-only-covid.com"; sid:585770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovid.com"; sid:585771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nybeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nybeatcorona.com"; sid:585772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nybeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nybeatcovid19.com"; sid:585773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid-19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid-19memorial.com"; sid:585774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyfwcovidcollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyfwcovidcollection.com"; sid:585775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyfwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyfwcovid.com"; sid:585776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nysbeatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nysbeatcorona.com"; sid:585777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oakbrookcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oakbrookcovid19test.com"; sid:585778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for o-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"o-covid19.com"; sid:585779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirusmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirusmerch.com"; sid:585780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ofilmedocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ofilmedocoronavirus.com"; sid:585781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcovid19free.com"; sid:585782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcovidfree.com"; sid:585783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovid19free.com"; sid:585784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidfree.com"; sid:585785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidtracker.com"; sid:585786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olivrodocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olivrodocoronavirus.com"; sid:585787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for olivrodocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"olivrodocovid19.com"; sid:585788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onedollartofuckcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onedollartofuckcoronavirus.com"; sid:585789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onedollartofuckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onedollartofuckcovid19.com"; sid:585790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestorecovid19.com"; sid:585791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oraltestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oraltestforcovid19.com"; sid:585792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandoagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandoagainstcorona.com"; sid:585793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orthocoronavirinae-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orthocoronavirinae-virus.com"; sid:585794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronalove.com"; sid:585795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronatimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronatimes.com"; sid:585796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidheros.com"; sid:585797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlivecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlivecoronavirus.com"; sid:585798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlivecovid19.com"; sid:585799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomecovid.com"; sid:585800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paloalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paloalcoronavirus.com"; sid:585801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicacoustics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicacoustics.com"; sid:585802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbr.com"; sid:585803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-careers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-careers.com"; sid:585804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccollapse.com"; sid:585805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccollection.com"; sid:585806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccouturecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccouturecompany.com"; sid:585807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccovid-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccovid-20.com"; sid:585808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccreation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccreation.com"; sid:585809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdetect.com"; sid:585810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceffect.com"; sid:585811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceffects.com"; sid:585812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirm.com"; sid:585813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfirst.com"; sid:585814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgifts.com"; sid:585815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichaircut.com"; sid:585816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichic.com"; sid:585817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-immunity.com"; sid:585818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancepolicy.com"; sid:585819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickitsusa.com"; sid:585820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawoffice.com"; sid:585821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawoffices.com"; sid:585822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-lawyers.com"; sid:585823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmovement.com"; sid:585824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpops.com"; sid:585825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppe.net"; sid:585826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprooflife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprooflife.com"; sid:585827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofpractice.com"; sid:585828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofprofessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofprofessions.com"; sid:585829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectioncoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectioncoverage.com"; sid:585830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectioninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectioninsurance.com"; sid:585831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionshop.com"; sid:585832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadyornot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadyornot.com"; sid:585833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelieflaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelieflaw.com"; sid:585834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-response-research.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-response-research.net"; sid:585835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseresearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseresearch.net"; sid:585836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsespecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsespecialists.com"; sid:585837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrunning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrunning.com"; sid:585838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicslaw.com"; sid:585839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicslawyer.com"; sid:585840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsoldier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsoldier.com"; sid:585841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspecial.com"; sid:585842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspirits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspirits.com"; sid:585843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsprotection.com"; sid:585844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicssuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicssuck.com"; sid:585845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstream.com"; sid:585846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrength.com"; sid:585847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrengths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrengths.com"; sid:585848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstyles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstyles.com"; sid:585849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsummer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsummer.com"; sid:585850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalbookguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalbookguide.com"; sid:585851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictechnologies.com"; sid:585852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-technology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-technology.com"; sid:585853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicunemploymentassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicunemploymentassistance.com"; sid:585854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicuts.com"; sid:585855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicuts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicuts.net"; sid:585856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicv.com"; sid:585857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscure.com"; sid:585858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwiki.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwiki.com"; sid:585859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwine.com"; sid:585860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for partnersinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"partnersinpandemic.com"; sid:585861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcrcovid.com"; sid:585862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcrtestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcrtestcorona.com"; sid:585863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciancovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciancovidtesting.com"; sid:585864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plantpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plantpandemic.com"; sid:585865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformanacionalafectadoscoronavirusespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformanacionalafectadoscoronavirusespana.com"; sid:585866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poastpandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poastpandemiclife.com"; sid:585867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronal.net"; sid:585868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcleaning.com"; sid:585869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcorp.com"; sid:585870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covidian.com"; sid:585871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnewyork.com"; sid:585872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidofficefurniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidofficefurniture.com"; sid:585873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidresilience.com"; sid:585874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworkplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworkplaces.com"; sid:585875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworld.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworld.solutions"; sid:585876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiccorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiccorp.com"; sid:585877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicearth.com"; sid:585878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicplanet.com"; sid:585879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsociety.com"; sid:585880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicspeakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicspeakers.com"; sid:585881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postviralpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postviralpandemic.com"; sid:585882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayforamericacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayforamericacovid19.com"; sid:585883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prcovid-19.com"; sid:585884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precoronacrisis.com"; sid:585885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predictcovidnegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predictcovidnegative.com"; sid:585886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestation-canadienne-urgence-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestation-canadienne-urgence-covid19.com"; sid:585887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencionescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencionescovid-19.com"; sid:585888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencovid.com"; sid:585889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventionofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventionofcovid19.com"; sid:585890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecovid19.com"; sid:585891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocovid19.net"; sid:585892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid19.info"; sid:585893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccion-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccion-covid.com"; sid:585894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-corona.com"; sid:585895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-corona.com"; sid:585896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-covid.com"; sid:585897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-employes-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-employes-corona.com"; sid:585898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectorcovid19.com"; sid:585899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionicorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionicorona-virus.com"; sid:585900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasdecoronavirus.com"; sid:585901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasdecovid.com"; sid:585902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publichealthlifecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publichealthlifecovid19.com"; sid:585903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purgecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purgecovid.com"; sid:585904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pussypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pussypandemic.com"; sid:585905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pussypandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pussypandemic.net"; sid:585906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puzzlesinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puzzlesinthetimeofcovid19.com"; sid:585907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qpcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qpcovidmask.com"; sid:585908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for racovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"racovideo.com"; sid:585909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for racovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"racovideos.com"; sid:585910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid15.com"; sid:585911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19results.com"; sid:585912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19results.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19results.net"; sid:585913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestkitcovid19.com"; sid:585914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rclcrew-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rclcrew-covid19.com"; sid:585915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidtests.com"; sid:585916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatepostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatepostcovid19.com"; sid:585917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatepostcovid.com"; sid:585918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recht-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recht-corona.com"; sid:585919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursoscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursoscoronavirus.net"; sid:585920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursoscovid19.com"; sid:585921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursoscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursoscovid19.net"; sid:585922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursoscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursoscovid.net"; sid:585923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registriescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registriescoronavirus.com"; sid:585924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registriescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registriescovid19.com"; sid:585925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registrycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registrycoronavirus.com"; sid:585926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registrycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registrycovid19.com"; sid:585927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircovid19.com"; sid:585928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembercovid-19heroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembercovid-19heroes.com"; sid:585929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcovidfree.com"; sid:585930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantecovidfree.com"; sid:585931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovid2020.com"; sid:585932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roccovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roccovid.net"; sid:585933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rockforcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rockforcovid19relief.com"; sid:585934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rucoronavirus.com"; sid:585935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovidtest.com"; sid:585936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecoronaexit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecoronaexit.com"; sid:585937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidmasks.com"; sid:585938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safehealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safehealthcovid.com"; sid:585939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycovidcleaning.com"; sid:585940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salivacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salivacovid19test.com"; sid:585941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescoronavirus.com"; sid:585942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescoronavirus.net"; sid:585943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescovid19.com"; sid:585944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescovid19.net"; sid:585945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescovid.com"; sid:585946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancionescovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancionescovid.net"; sid:585947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocoronaviruscommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocoronaviruscommercialcleaning.com"; sid:585948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecovid19.net"; sid:585949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazione-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazione-covid.com"; sid:585950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazionecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazionecovid.net"; sid:585951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizacioncovid19.com"; sid:585952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecoronausa.com"; sid:585953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemefromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemefromcovid19.com"; sid:585954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemybusinessfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemybusinessfromcovid19.com"; sid:585955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveusfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveusfromcovid19.com"; sid:585956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveusfromthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveusfromthecoronavirus.com"; sid:585957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sce-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sce-covid19.com"; sid:585958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolcoronavirus.com"; sid:585959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolcovid19.net"; sid:585960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seeyacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seeyacovid.com"; sid:585961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seincovid19.com"; sid:585962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingaftercovid19.net"; sid:585963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingaftercovid.com"; sid:585964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingpostcovid19.com"; sid:585965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingpostcovid.com"; sid:585966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellocovidfree.com"; sid:585967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sendcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sendcovid.com"; sid:585968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexoycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexoycovid.com"; sid:585969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcovidlaw.com"; sid:585970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfcovidlawyer.com"; sid:585971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shearsailingcovidstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shearsailingcovidstyle.com"; sid:585972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shootcovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shootcovidchallenge.com"; sid:585973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronaarmour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronaarmour.com"; sid:585974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronaclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronaclothing.com"; sid:585975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronaware.com"; sid:585976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidarmour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidarmour.com"; sid:585977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidclear.com"; sid:585978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidware.com"; sid:585979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezza-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezza-covid.com"; sid:585980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sinocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sinocovid19.com"; sid:585981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sintomascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sintomascovid19.com"; sid:585982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaycorona.com"; sid:585983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slaycovidnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slaycovidnaturally.com"; sid:585984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovidspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovidspread.com"; sid:585985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snowdeckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snowdeckcovid.com"; sid:585986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialgovernmentpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialgovernmentpandemic.com"; sid:585987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solongcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solongcovid.com"; sid:585988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovidfree.com"; sid:585989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutions-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutions-for-covid19.com"; sid:585990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvingcovid.com"; sid:585991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spcorona.com"; sid:585992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springcleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springcleancorona.com"; sid:585993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springcleancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springcleancoronavirus.com"; sid:585994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for srqcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"srqcovidlaw.com"; sid:585995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sscovidstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sscovidstyle.com"; sid:585996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafepandemic.com"; sid:585997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stevecovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stevecovidsupply.com"; sid:585998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcovidlaw.com"; sid:585999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona.biz"; sid:586000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaviruscameroun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaviruscameroun.com"; sid:586001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid19.biz"; sid:586002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecoronavirusnow.com"; sid:586003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiescovidnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiescovidnineteen.com"; sid:586004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightouttacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightouttacoronavirus.com"; sid:586005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strengthinsurvivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strengthinsurvivingcovid19.com"; sid:586006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sucovid19paiduaykan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sucovid19paiduaykan.com"; sid:586007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovidshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovidshirts.com"; sid:586008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovidtshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovidtshirts.com"; sid:586009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedthepandemic.com"; sid:586010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovidvirus.com"; sid:586011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t2coronapanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t2coronapanel.com"; sid:586012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takemycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takemycovid.com"; sid:586013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkingcovid19.com"; sid:586014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tci-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tci-covid19.com"; sid:586015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid19screening.com"; sid:586016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telepsy-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telepsy-covid19.com"; sid:586017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminatecovid.com"; sid:586018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirusadomicile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirusadomicile.com"; sid:586019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19mobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19mobile.com"; sid:586020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testdetectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testdetectioncovid.com"; sid:586021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testlocationscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testlocationscovid19.com"; sid:586022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testviruscovid19.com"; sid:586023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronavirusemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronavirusemployerlawyer.com"; sid:586024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidemployerlawyer.com"; sid:586025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankyoucoronavirushelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankyoucoronavirushelpers.com"; sid:586026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcoronabitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcoronabitch.com"; sid:586027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thatcovidlyfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thatcovidlyfe.com"; sid:586028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the2019pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the2019pandemic.com"; sid:586029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theaftercovid19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theaftercovid19plan.com"; sid:586030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestpandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestpandemiccookbook.com"; sid:586031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcovid-19.com"; sid:586032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcovid19.com"; sid:586033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcovid.com"; sid:586034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcovidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcovidus.com"; sid:586035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronachef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronachef.com"; sid:586036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-chronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-chronicle.com"; sid:586037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacollective.com"; sid:586038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadonation.com"; sid:586039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafuckers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafuckers.com"; sid:586040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakidbook.com"; sid:586041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusplaybook.com"; sid:586042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecostofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecostofcovid.com"; sid:586043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19aftermath.com"; sid:586044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19.biz"; sid:586045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19india.com"; sid:586046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19scam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19scam.com"; sid:586047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidaffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidaffect.com"; sid:586048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclassof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclassof2020.com"; sid:586049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovideffort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovideffort.com"; sid:586050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidender.com"; sid:586051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovideoproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovideoproject.com"; sid:586052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidexperts.com"; sid:586053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkitchen.com"; sid:586054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidreset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidreset.com"; sid:586055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecultureofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecultureofcovid.com"; sid:586056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcanadianbakingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcanadianbakingpandemic.com"; sid:586057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thekingofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thekingofcorona.com"; sid:586058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenewcoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenewcoronavirusbook.com"; sid:586059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenewcoronavirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenewcoronavirusmovie.com"; sid:586060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theothersideofcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theothersideofcovid.biz"; sid:586061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicof2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicof2019.com"; sid:586062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicof2019.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicof2019.info"; sid:586063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicof2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicof2019.net"; sid:586064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovid-19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovid-19economy.com"; sid:586065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovid19economy.com"; sid:586066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcovideconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcovideconomy.com"; sid:586067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thequeenofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thequeenofcorona.com"; sid:586068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapyaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapyaftercovid.com"; sid:586069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldofcovid19.com"; sid:586070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkingcovid.com"; sid:586071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiskillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiskillscorona.com"; sid:586072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thiskillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thiskillscovid.com"; sid:586073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisstopscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisstopscorona.com"; sid:586074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisstopscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisstopscovid.com"; sid:586075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tienda-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tienda-covid-19.com"; sid:586076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiendacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiendacovid-19.com"; sid:586077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiendacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiendacovid19.com"; sid:586078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidiots.com"; sid:586079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismcovidfree.com"; sid:586080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismfreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismfreecovid.com"; sid:586081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracecorona.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracecorona.one"; sid:586082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcovid-19.com"; sid:586083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracker-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracker-covid19.com"; sid:586084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trcoronavirus.com"; sid:586085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tribalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tribalcovid19.com"; sid:586086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-corona.com"; sid:586087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trump-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trump-coronavirus.com"; sid:586088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpspandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpspandemicresponse.com"; sid:586089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpvswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpvswuhan.com"; sid:586090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ttbcovid19bpnsby2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ttbcovid19bpnsby2.com"; sid:586091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tulocalcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tulocalcovidfree.com"; sid:586092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turismofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turismofreecovid.com"; sid:586093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcoronavirusemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcoronavirusemployerlawyer.com"; sid:586094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidcleaning.com"; sid:586095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidemployerlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidemployerlawyer.com"; sid:586096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncountedcoviddeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncountedcoviddeaths.com"; sid:586097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovidit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovidit.com"; sid:586098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedcovidmasks.com"; sid:586099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedcovidsupplies.com"; sid:586100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urbancovidplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urbancovidplatform.com"; sid:586101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19suppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19suppy.com"; sid:586102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usatrumpscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usatrumpscovid.com"; sid:586103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscorona2020.com"; sid:586104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusmemorial.com"; sid:586105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19testkits.com"; sid:586106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ustrumpscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ustrumpscovid.com"; sid:586107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacacionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacacionescoronavirus.com"; sid:586108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecovid19.com"; sid:586109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccines4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccines4covid19.com"; sid:586110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinesforcorona.com"; sid:586111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinesforcovid19.com"; sid:586112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinacovid.com"; sid:586113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacuna-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacuna-covid19.com"; sid:586114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacuna-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacuna-covid.com"; sid:586115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunaparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunaparacoronavirus.com"; sid:586116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vazymecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vazymecovid19.com"; sid:586117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifycovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifycovid19.info"; sid:586118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidcovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidcovideo.com"; sid:586119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virusunseencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virusunseencovid19.com"; sid:586120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visieres-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visieres-coronavirus.com"; sid:586121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visieres-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visieres-covid19.com"; sid:586122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visieres-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visieres-covid.com"; sid:586123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vision-therapy-coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vision-therapy-coronado.com"; sid:586124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vittimecovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vittimecovid.cloud"; sid:586125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscovid-19.com"; sid:586126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidsafecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidsafecertified.com"; sid:586127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid2020.com"; sid:586128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatnycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatnycorona.com"; sid:586129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefoughtcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefoughtcovid-19.com"; sid:586130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotyoucovid.com"; sid:586131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatispandemic2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatispandemic2019.com"; sid:586132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatispandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatispandemic2020.com"; sid:586133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscoronavirus.net"; sid:586134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid-19.com"; sid:586135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid-19.net"; sid:586136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid19.net"; sid:586137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatscovid.com"; sid:586138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencoronavirusend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencoronavirusend.com"; sid:586139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-covid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-covid19pandemic.com"; sid:586140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid19test.com"; sid:586141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid19world.com"; sid:586142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-covid.com"; sid:586143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid.com"; sid:586144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoisyourcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoisyourcovid19.com"; sid:586145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for windowcleaningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"windowcleaningcovid19.com"; sid:586146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wolneodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wolneodcovid19.com"; sid:586147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for womanofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"womanofcovid.com"; sid:586148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for womenofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"womenofcovid.com"; sid:586149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wondfocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wondfocovid19.com"; sid:586150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirushelp.com"; sid:586151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidmonth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidmonth.com"; sid:586152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarepidemic.com"; sid:586153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan2019.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan2019.info"; sid:586154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan2020facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan2020facts.com"; sid:586155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanaiker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanaiker.com"; sid:586156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanboogie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanboogie.com"; sid:586157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanciudadchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanciudadchina.com"; sid:586158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancoverup.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancoverup.info"; sid:586159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancrazy.com"; sid:586160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandaowuliu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandaowuliu.com"; sid:586161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhtls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhtls.com"; sid:586162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhaninstituteofvirology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhaninstituteofvirology.com"; sid:586163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjuice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjuice.com"; sid:586164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrecovery.com"; sid:586165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansgreatesthits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansgreatesthits.com"; sid:586166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshiguda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshiguda.com"; sid:586167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshitcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshitcrazy.com"; sid:586168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--desinfeccincovid-fvb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--desinfeccincovid-fvb.com"; sid:586169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--plataformanacionalafectadoscoronavirusespaa-jde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--plataformanacionalafectadoscoronavirusespaa-jde.com"; sid:586170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--vacunacovidespaa-lub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--vacunacovidespaa-lub.com"; sid:586171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronalove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronalove.com"; sid:586172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19testkit.com"; sid:586173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zotecfightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zotecfightscovid.com"; sid:586174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zotecfightscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zotecfightscovid.net"; sid:586175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovid.com"; sid:586176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covideo.com"; sid:586177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1aftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1aftercovid19.com"; sid:586178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1aftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1aftercovid.com"; sid:586179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid-19-d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid-19-d.com"; sid:586180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronacrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronacrash.com"; sid:586181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19pandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19pandemicmovie.com"; sid:586182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2covidfree.com"; sid:586183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-corona.info"; sid:586184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid19vaccine.com"; sid:586185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adayinthelifeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adayinthelifeofcorona.com"; sid:586186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoporcoronavirus.com"; sid:586187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovidvirus.com"; sid:586188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovid.com"; sid:586189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonstopcovid-19.com"; sid:586190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonstopcovid19.com"; sid:586191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovidcare.com"; sid:586192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronarelief.com"; sid:586193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-fi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-fi.com"; sid:586194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaring.com"; sid:586195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anularsancionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anularsancionescovid19.com"; sid:586196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apcovid.com"; sid:586197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applecorona-virus.com"; sid:586198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apple-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apple-covid19.com"; sid:586199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronatesting.com"; sid:586200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auscoronavirussurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auscoronavirussurvivalkit.com"; sid:586201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronatesting.com"; sid:586202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidresearch.com"; sid:586203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidresource.com"; sid:586204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backfromcovid.com"; sid:586205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastacovid.com"; sid:586206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastacovid.info"; sid:586207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdcovid-19.info"; sid:586208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthecovid19.com"; sid:586209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthewuhan.com"; sid:586210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthewuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthewuhan.net"; sid:586211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamedicine.com"; sid:586212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronatablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronatablets.com"; sid:586213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-covid19-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-covid19-stocks.com"; sid:586214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19-stocks.com"; sid:586215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicicletascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicicletascovid19.com"; sid:586216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birminghamcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birminghamcovid19testing.com"; sid:586217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birminghamcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birminghamcovidtesting.com"; sid:586218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bnbcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bnbcovidfree.com"; sid:586219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bocorona.com"; sid:586220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcoronalations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcoronalations.com"; sid:586221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovidchain.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovidchain.info"; sid:586222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovidchain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovidchain.net"; sid:586223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bthocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bthocovid-19.com"; sid:586224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burycovid19.com"; sid:586225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buybuycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buybuycorona.com"; sid:586226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid.com"; sid:586227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callmecoolcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callmecoolcovid.com"; sid:586228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camera-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camera-covid.com"; sid:586229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cameracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cameracovid.com"; sid:586230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadafightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadafightscovid.com"; sid:586231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carnetcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carnetcovid-19.com"; sid:586232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carnetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carnetcovid.com"; sid:586233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificatecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificatecovidfree.com"; sid:586234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chessagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chessagainstcovid.com"; sid:586235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciis-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciis-covid19.com"; sid:586236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofcovid.com"; sid:586237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciudatedelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciudatedelcovid.com"; sid:586238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classiccovidmoments.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classiccovidmoments.info"; sid:586239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleansingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleansingcorona.com"; sid:586240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidclean.com"; sid:586241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedcovid.com"; sid:586242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for climateforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"climateforcovid.com"; sid:586243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocacolastopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocacolastopcovid-19.com"; sid:586244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocacolastopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocacolastopcovid19.com"; sid:586245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocinaentiemposdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocinaentiemposdelcoronavirus.com"; sid:586246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codeagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codeagainstcovid.com"; sid:586247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collabcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collabcovid19.com"; sid:586248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorofcorona.com"; sid:586249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorofcovid19.com"; sid:586250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorofcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorofcovidusa.com"; sid:586251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colourofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colourofcovid.com"; sid:586252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciertoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciertoscovid19.com"; sid:586253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for convocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"convocovid.com"; sid:586254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copethroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copethroughcovid.com"; sid:586255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copethrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copethrucovid.com"; sid:586256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingcovid.com"; sid:586257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1970.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1970.com"; sid:586258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-testing.com"; sid:586259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona24bd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona24bd.com"; sid:586260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-accountantsverklaring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-accountantsverklaring.com"; sid:586261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarab.com"; sid:586262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassay.com"; sid:586263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatemmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatemmaske.com"; sid:586264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabaz.com"; sid:586265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeleid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeleid.com"; sid:586266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-berater.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-berater.info"; sid:586267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-berater.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-berater.net"; sid:586268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburner.com"; sid:586269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarcrashsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarcrashsurvival.com"; sid:586270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacerts.com"; sid:586271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecklists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecklists.com"; sid:586272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclosure.com"; sid:586273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoaches.com"; sid:586274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsortium.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsortium.info"; sid:586275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consult.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consult.net"; sid:586276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid.info"; sid:586277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisplanner.com"; sid:586278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrm.com"; sid:586279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadailystatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadailystatus.com"; sid:586280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadealz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadealz.com"; sid:586281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathattorney.com"; sid:586282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathattorneys.com"; sid:586283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathlaw.com"; sid:586284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefendermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefendermask.com"; sid:586285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadigi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadigi.com"; sid:586286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeconomyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeconomyfund.com"; sid:586287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeinmalumdiewelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeinmalumdiewelt.com"; sid:586288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenglish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenglish.com"; sid:586289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafatalities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafatalities.com"; sid:586290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafixers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafixers.com"; sid:586291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedestination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedestination.com"; sid:586292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedestinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedestinations.com"; sid:586293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeholiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeholiday.com"; sid:586294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeholidays.com"; sid:586295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeproperty.com"; sid:586296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevacation.com"; sid:586297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreewipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreewipes.com"; sid:586298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguarantee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguarantee.com"; sid:586299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahambre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahambre.com"; sid:586300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelper.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelper.club"; sid:586301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpuk.com"; sid:586302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpuk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpuk.net"; sid:586303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaho.com"; sid:586304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoe.com"; sid:586305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoes.com"; sid:586306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahos.com"; sid:586307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahumidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahumidity.com"; sid:586308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspection.com"; sid:586309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspections.com"; sid:586310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeyusa.com"; sid:586311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerfoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerfoil.com"; sid:586312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakills-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakills-uv.com"; sid:586313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalations2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalations2020.com"; sid:586314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalservice.com"; sid:586315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-luxury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-luxury.com"; sid:586316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamalls.com"; sid:586317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketing.info"; sid:586318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasken.info"; sid:586319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasken-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasken-online.com"; sid:586320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedpack.com"; sid:586321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedstack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedstack.com"; sid:586322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametrics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametrics.net"; sid:586323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusicawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusicawards.com"; sid:586324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsroom.com"; sid:586325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nova.com"; sid:586326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutside.com"; sid:586327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapillows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapillows.com"; sid:586328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapleasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapleasure.com"; sid:586329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappointment.com"; sid:586330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprevencion.com"; sid:586331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionshop.com"; sid:586332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protecting.com"; sid:586333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebellen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebellen.com"; sid:586334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebels.com"; sid:586335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelapse.com"; sid:586336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.restaurant"; sid:586337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestrictions.com"; sid:586338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariddle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariddle.com"; sid:586339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasebachav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasebachav.com"; sid:586340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronash.com"; sid:586341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasignage.com"; sid:586342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasong.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasong.world"; sid:586343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasorulari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasorulari.com"; sid:586344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassurance.com"; sid:586345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastandards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastandards.com"; sid:586346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatistieken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatistieken.com"; sid:586347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswish.com"; sid:586348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinglocations.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinglocations.info"; sid:586349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatips.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatips.club"; sid:586350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatransfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatransfusion.com"; sid:586351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreasurehunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreasurehunt.com"; sid:586352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavices.com"; sid:586353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliance.club"; sid:586354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliance.club"; sid:586355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliance.com"; sid:586356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliance.com"; sid:586357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliance.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliance.flights"; sid:586358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliance.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliance.flights"; sid:586359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliance.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliance.voyage"; sid:586360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliance.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliance.voyage"; sid:586361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliant.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliant.club"; sid:586362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliant.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliant.club"; sid:586363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliant.com"; sid:586364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliant.com"; sid:586365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliant.flights"; sid:586366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliant.flights"; sid:586367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19compliant.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19compliant.voyage"; sid:586368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19compliant.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19compliant.voyage"; sid:586369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.club"; sid:586370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.club"; sid:586371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safety.club"; sid:586372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safety.club"; sid:586373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safety.com"; sid:586374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safety.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safety.flights"; sid:586375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safety.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safety.flights"; sid:586376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safety.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safety.voyage"; sid:586377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safety.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safety.voyage"; sid:586378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19safe.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19safe.voyage"; sid:586379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19safe.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19safe.voyage"; sid:586380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus19testing.com"; sid:586381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19-testkits.com"; sid:586382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020movie.com"; sid:586383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirmingham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirmingham.com"; sid:586384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharleston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharleston.com"; sid:586385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathattorney.com"; sid:586386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathattorneys.com"; sid:586387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathlaw.com"; sid:586388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefendermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefendermask.com"; sid:586389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdnatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdnatestkits.com"; sid:586390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgy.com"; sid:586391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincubator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincubator.com"; sid:586392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinspector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinspector.com"; sid:586393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinventions.com"; sid:586394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinventors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinventors.com"; sid:586395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-killer.com"; sid:586396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabsfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabsfinder.com"; sid:586397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocal.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocal.life"; sid:586398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocal.net"; sid:586399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalls.com"; sid:586400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarkmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarkmerch.com"; sid:586401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskmerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskmerch.com"; sid:586402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmodification.com"; sid:586403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonde.com"; sid:586404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnameblameandshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnameblameandshame.com"; sid:586405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewzz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewzz.com"; sid:586406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusof2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusof2019.com"; sid:586407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusranking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusranking.com"; sid:586408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetystylus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetystylus.com"; sid:586409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscience.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscience.net"; sid:586410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussobriety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussobriety.com"; sid:586411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstartups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstartups.com"; sid:586412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustodaynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustodaynews.com"; sid:586413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswolrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswolrd.com"; sid:586414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijevakantie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijevakantie.com"; sid:586415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wahnsinn.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wahnsinn.info"; sid:586416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawand.com"; sid:586417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebtools.com"; sid:586418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazur.com"; sid:586419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdecovid.com"; sid:586420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covercovid19.com"; sid:586421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-18.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-18.net"; sid:586422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020movie.com"; sid:586423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020movie.com"; sid:586424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1970.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1970.com"; sid:586425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19a2z.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19a2z.com"; sid:586426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-algerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-algerie.com"; sid:586427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytracker.com"; sid:586428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytracking.com"; sid:586429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytracking.com"; sid:586430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antidotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antidotes.com"; sid:586431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigencheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigencheck.com"; sid:586432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigenkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigenkit.com"; sid:586433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19approvedsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19approvedsuppliers.com"; sid:586434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19approvedsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19approvedsupplies.com"; sid:586435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autocleaning.com"; sid:586436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19autodetail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19autodetail.com"; sid:586437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autodetail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autodetail.com"; sid:586438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banksales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banksales.com"; sid:586439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bargain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bargain.com"; sid:586440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bargains.com"; sid:586441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blogde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blogde.com"; sid:586442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesssignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesssignage.com"; sid:586443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesssolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesssolutions.com"; sid:586444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busted.com"; sid:586445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busted.com"; sid:586446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caism.com"; sid:586447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cards.com"; sid:586448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carsafety.com"; sid:586449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carsafety.com"; sid:586450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cell.com"; sid:586451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ceohuddle.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ceohuddle.pro"; sid:586452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-certificate.com"; sid:586453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedsafe.com"; sid:586454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningtaskforce.com"; sid:586455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19click.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19click.com"; sid:586456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19climate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19climate.com"; sid:586457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cnn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cnn.com"; sid:586458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliance.club"; sid:586459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.club"; sid:586460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliance.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliance.flights"; sid:586461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.flights"; sid:586462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliance.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliance.voyage"; sid:586463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.voyage"; sid:586464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliant.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliant.club"; sid:586465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliant.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliant.club"; sid:586466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliant.flights"; sid:586467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliant.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliant.flights"; sid:586468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliant.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliant.voyage"; sid:586469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliant.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliant.voyage"; sid:586470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19confessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19confessions.com"; sid:586471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conspiracytheory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conspiracytheory.com"; sid:586472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controls.com"; sid:586473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.coupons - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.coupons"; sid:586474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crooks.com"; sid:586475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curatives.com"; sid:586476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureall.com"; sid:586477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cure-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cure-coronavirus.com"; sid:586478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dailynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dailynews.com"; sid:586479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathattorney.com"; sid:586480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathattorneys.com"; sid:586481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathlaw.com"; sid:586482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defendermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defendermask.com"; sid:586483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destroy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destroy.com"; sid:586484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionlasvegas.com"; sid:586485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19distresshomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19distresshomes.com"; sid:586486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divisori.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divisori.com"; sid:586487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19domain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19domain.com"; sid:586488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donaldtrump.com"; sid:586489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donateonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donateonline.com"; sid:586490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfoodstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfoodstore.com"; sid:586491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emoji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emoji.com"; sid:586492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19emojis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19emojis.com"; sid:586493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emojis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emojis.com"; sid:586494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeetesting.com"; sid:586495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialskit.com"; sid:586496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fact.net"; sid:586497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fest.net"; sid:586498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forclosures.com"; sid:586499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formula.com"; sid:586500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fortlauderdale.com"; sid:586501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fox.com"; sid:586502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsresponse.com"; sid:586503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19geek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19geek.com"; sid:586504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gene.com"; sid:586505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gini.com"; sid:586506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guarantee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guarantee.com"; sid:586507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guidelines2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guidelines2020.com"; sid:586508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gujarat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gujarat.com"; sid:586509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthequipment.com"; sid:586510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpforhomeowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpforhomeowner.com"; sid:586511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-help.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-help.info"; sid:586512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesale.com"; sid:586513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hosteleria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hosteleria.com"; sid:586514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housingcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housingcrash.com"; sid:586515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19imasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19imasurvivor.com"; sid:586516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indialive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indialive.com"; sid:586517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiaresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiaresult.com"; sid:586518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inpictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inpictures.com"; sid:586519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspection.com"; sid:586520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspections.com"; sid:586521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19invisibleshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19invisibleshield.com"; sid:586522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iphone.com"; sid:586523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-japan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-japan.info"; sid:586524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jungle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jungle.com"; sid:586525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kits.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kits.info"; sid:586526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kn95.com"; sid:586527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laboratories.com"; sid:586528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawonyourside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawonyourside.com"; sid:586529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalquest.com"; sid:586530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalquestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalquestion.com"; sid:586531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalquestionsanswered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalquestionsanswered.com"; sid:586532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifeinsured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifeinsured.com"; sid:586533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19liveview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19liveview.com"; sid:586534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19local.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19local.life"; sid:586535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19local.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19local.net"; sid:586536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19magicbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19magicbullet.com"; sid:586537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malls.com"; sid:586538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masken.com"; sid:586539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masques.com"; sid:586540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19matches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19matches.com"; sid:586541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19matchs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19matchs.com"; sid:586542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicinaintegral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicinaintegral.com"; sid:586543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19modification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19modification.com"; sid:586544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nameblameandshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nameblameandshame.com"; sid:586545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalizer.com"; sid:586546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nebraska.com"; sid:586547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nettoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nettoyage.com"; sid:586548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neuropsychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neuropsychology.com"; sid:586549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsclips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsclips.com"; sid:586550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notalone.com"; sid:586551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsitetesting.com"; sid:586552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orangecounty.com"; sid:586553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organization.com"; sid:586554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-passport.com"; sid:586555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pics.com"; sid:586556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pool.com"; sid:586557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prevenciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prevenciones.com"; sid:586558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventions.com"; sid:586559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proteccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proteccion.com"; sid:586560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionshop.com"; sid:586561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionshop.com"; sid:586562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qrcodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qrcodes.com"; sid:586563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19questionsanswered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19questionsanswered.com"; sid:586564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rainbow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rainbow.info"; sid:586565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19r.com"; sid:586566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recipesharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recipesharing.com"; sid:586567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refinancing.com"; sid:586568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regulations.com"; sid:586569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.biz"; sid:586570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renaissance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renaissance.info"; sid:586571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19renaissance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19renaissance.net"; sid:586572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailers.com"; sid:586573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-riposte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-riposte.com"; sid:586574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rome.com"; sid:586575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.club"; sid:586576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safekit.com"; sid:586577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safekit.com"; sid:586578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safesalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safesalon.com"; sid:586579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.biz"; sid:586580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safety.club"; sid:586581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.club"; sid:586582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safety.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safety.flights"; sid:586583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.flights"; sid:586584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetystylus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetystylus.com"; sid:586585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safety.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safety.voyage"; sid:586586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.voyage"; sid:586587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.voyage - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.voyage"; sid:586588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizingproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizingproducts.com"; sid:586589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sars2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sars2.com"; sid:586590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19skincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19skincare.com"; sid:586591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sober.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sober.com"; sid:586592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sony.com"; sid:586593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19standards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19standards.com"; sid:586594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stocks.com"; sid:586595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19story.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19story.net"; sid:586596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supply.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supply.city"; sid:586597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supply.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supply.today"; sid:586598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportservices.com"; sid:586599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportsystem.com"; sid:586600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tackle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tackle.com"; sid:586601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taiwan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taiwan.com"; sid:586602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxrelief.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxrelief.info"; sid:586603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxrelief.net"; sid:586604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfree.com"; sid:586605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglocations.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglocations.info"; sid:586606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tex.com"; sid:586607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapeutic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapeutic.com"; sid:586608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tnpolice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tnpolice.com"; sid:586609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracing.com"; sid:586610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackingupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackingupdates.com"; sid:586611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tradepost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tradepost.com"; sid:586612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-treatment-drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-treatment-drug.com"; sid:586613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentdrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentdrug.com"; sid:586614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-treatment-site.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-treatment-site.com"; sid:586615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-turkiyegovtr-aidatgeriodeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-turkiyegovtr-aidatgeriodeme.com"; sid:586616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uvc.com"; sid:586617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusshield.com"; sid:586618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virustest.com"; sid:586619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vox.com"; sid:586620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsamerica.com"; sid:586621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsearth.com"; sid:586622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vstheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vstheworld.com"; sid:586623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsusa.com"; sid:586624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsus.com"; sid:586625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warheros.com"; sid:586626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weightloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weightloss.com"; sid:586627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplaceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplaceprotection.com"; sid:586628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xit.com"; sid:586629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019checker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019checker.com"; sid:586630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019war.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019war.com"; sid:586631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020mask.com"; sid:586632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020mask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020mask.net"; sid:586633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20news.com"; sid:586634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2suppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2suppliers.com"; sid:586635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2testing.com"; sid:586636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2testresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2testresults.com"; sid:586637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2tests.com"; sid:586638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3d.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3d.net"; sid:586639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9-tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9-tees.com"; sid:586640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachain.com"; sid:586641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachtung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachtung.com"; sid:586642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasia.com"; sid:586643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidastock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidastock.com"; sid:586644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautocleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautocleaning.com"; sid:586645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautodetail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautodetail.com"; sid:586646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandarqq.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandarqq.info"; sid:586647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeatz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeatz.com"; sid:586648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-besafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-besafe.com"; sid:586649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbitches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbitches.com"; sid:586650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbounceback.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbounceback.biz"; sid:586651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbounce.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbounce.biz"; sid:586652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrief.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrief.info"; sid:586653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbullcrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbullcrap.com"; sid:586654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbump.com"; sid:586655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.services"; sid:586656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.solutions"; sid:586657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-button.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-button.com"; sid:586658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabinclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabinclean.com"; sid:586659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaism.com"; sid:586660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-canine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-canine.com"; sid:586661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanandcertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanandcertified.com"; sid:586662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.biz"; sid:586663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancert.com"; sid:586664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancertified.com"; sid:586665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninglasvegas.com"; sid:586666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupteam.com"; sid:586667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomate.com"; sid:586668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomforts.com"; sid:586669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfederation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfederation.com"; sid:586670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-confessions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-confessions.com"; sid:586671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconstruct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconstruct.com"; sid:586672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumerlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumerlawsuit.com"; sid:586673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumerlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumerlawsuits.com"; sid:586674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.coupons - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.coupons"; sid:586675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourse.com"; sid:586676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddare.com"; sid:586677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathattorney.com"; sid:586678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathattorneys.com"; sid:586679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathlaw.com"; sid:586680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefendermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefendermask.com"; sid:586681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetective.com"; sid:586682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemojis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemojis.com"; sid:586683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencounters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencounters.com"; sid:586684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenvironmental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenvironmental.com"; sid:586685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfatalities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfatalities.com"; sid:586686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfixer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfixer.com"; sid:586687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfixers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfixers.com"; sid:586688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfogoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfogoff.com"; sid:586689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoodfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoodfinder.com"; sid:586690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforclimate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforclimate.com"; sid:586691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree2020.com"; sid:586692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebenidorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebenidorm.com"; sid:586693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.biz"; sid:586694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehousekeeping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehousekeeping.com"; sid:586695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-freerestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-freerestaurant.com"; sid:586696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgermbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgermbusters.com"; sid:586697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgermbusters.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgermbusters.info"; sid:586698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgermbusters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgermbusters.net"; sid:586699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgurus.com"; sid:586700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-heatmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-heatmap.com"; sid:586701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesyardsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesyardsign.com"; sid:586702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.holiday"; sid:586703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeo.com"; sid:586704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhooves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhooves.com"; sid:586705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhosteleria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhosteleria.com"; sid:586706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmune.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmune.club"; sid:586707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immune.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immune.life"; sid:586708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunelife.com"; sid:586709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immune.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immune.world"; sid:586710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmune.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmune.world"; sid:586711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidina.com"; sid:586712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiabetes.com"; sid:586713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiaseva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiaseva.com"; sid:586714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspections.com"; sid:586715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidip.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidip.net"; sid:586716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidir-combi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidir-combi.com"; sid:586717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscount.com"; sid:586718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscounts.com"; sid:586719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisdisinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisdisinfected.com"; sid:586720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidit.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidit.world"; sid:586721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ity.com"; sid:586722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjapan.com"; sid:586723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkelly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkelly.com"; sid:586724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkermit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkermit.com"; sid:586725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkicker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkicker.com"; sid:586726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kpi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kpi.com"; sid:586727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kpis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kpis.com"; sid:586728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkpis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkpis.com"; sid:586729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecoach.com"; sid:586730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlimit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlimit.com"; sid:586731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlimits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlimits.com"; sid:586732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlists.com"; sid:586733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlit.com"; sid:586734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanager.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanager.club"; sid:586735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanager.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanager.info"; sid:586736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanager.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanager.net"; sid:586737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.pro"; sid:586738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskco.com"; sid:586739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskrus.com"; sid:586740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasters.com"; sid:586741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmore.com"; sid:586742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouthtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouthtest.com"; sid:586743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouthwashtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouthwashtest.com"; sid:586744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-n95mask.com"; sid:586745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenlitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenlitigation.com"; sid:586746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteentesting.com"; sid:586747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnine-tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnine-tees.com"; sid:586748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnol.com"; sid:586749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghomedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghomedeath.com"; sid:586750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficeclean.com"; sid:586751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoids.com"; sid:586752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganic.info"; sid:586753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutfit.com"; sid:586754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientstracker.com"; sid:586755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpedia.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpedia.club"; sid:586756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpleasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpleasure.com"; sid:586757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpost.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpost.net"; sid:586758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidposts.com"; sid:586759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidposts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidposts.net"; sid:586760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevencion.com"; sid:586761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprintsplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprintsplus.com"; sid:586762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprn.com"; sid:586763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-profit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-profit.com"; sid:586764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionprogram.com"; sid:586765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionprogram.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionprogram.info"; sid:586766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionprogram.net"; sid:586767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpurecertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpurecertified.com"; sid:586768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqrcodes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqrcodes.com"; sid:586769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqualifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqualifications.com"; sid:586770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrainbow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrainbow.info"; sid:586771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rdt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rdt.com"; sid:586772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreagents.com"; sid:586773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovered.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovered.info"; sid:586774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecuperartd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecuperartd.com"; sid:586775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefundlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefundlawsuit.com"; sid:586776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefundlawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefundlawsuits.com"; sid:586777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregulations.com"; sid:586778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourceaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourceaz.com"; sid:586779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsezim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsezim.com"; sid:586780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantguidelines.com"; sid:586781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestriction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestriction.com"; sid:586782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeaware.com"; sid:586783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeclean.com"; sid:586784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetykits.com"; sid:586785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysignage.com"; sid:586786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsa.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsa.info"; sid:586787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurity.net"; sid:586788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshark.com"; sid:586789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskit.com"; sid:586790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sober.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sober.com"; sid:586791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsober.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsober.com"; sid:586792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsprayers.com"; sid:586793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsrus.com"; sid:586794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stock.com"; sid:586795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stop.net"; sid:586796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstupid.com"; sid:586797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstupid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstupid.net"; sid:586798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sucks.com"; sid:586799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuplies.com"; sid:586800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalflorida.com"; sid:586801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorstories.com"; sid:586802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteam.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteam.care"; sid:586803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestalabama.com"; sid:586804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthub.com"; sid:586805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestph.com"; sid:586806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestslab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestslab.com"; sid:586807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransfusion.com"; sid:586808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtranslation.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtranslation.email"; sid:586809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uvc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uvc.net"; sid:586810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictoryusonyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictoryusonyc.com"; sid:586811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictoryusonyc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictoryusonyc.net"; sid:586812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirucide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirucide.com"; sid:586813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushometesting.com"; sid:586814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusneeds.com"; sid:586815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwand.com"; sid:586816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarnings.com"; sid:586817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwear19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwear19.net"; sid:586818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhisky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhisky.com"; sid:586819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxcleanup.com"; sid:586820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyl.com"; sid:586821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubrebocascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubrebocascoronavirus.com"; sid:586822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidatedelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidatedelcovid.com"; sid:586823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona19.com"; sid:586824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedofcovid19.com"; sid:586825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid-19masks.com"; sid:586826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customfacemaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customfacemaskscovid19.com"; sid:586827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deconfinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deconfinecovid19.com"; sid:586828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcorona.club"; sid:586829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derechocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derechocovid.com"; sid:586830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciocoronavirus.com"; sid:586831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecovid19.com"; sid:586832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingchicagocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingchicagocovid.com"; sid:586833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcovidchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcovidchicago.com"; sid:586834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ditel-covid19-camera-systems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ditel-covid19-camera-systems.com"; sid:586835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divisoricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divisoricoronavirus.com"; sid:586836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycoronamask.com"; sid:586837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovidmask.com"; sid:586838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovidtests.com"; sid:586839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorcoronavirusday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorcoronavirusday.com"; sid:586840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateforcovid19.net"; sid:586841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elevatebeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elevatebeyondcovid19.com"; sid:586842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elmcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elmcovid19.net"; sid:586843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadesinfeccioncoronavirus.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadesinfeccioncoronavirus.cat"; sid:586844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-covid.com"; sid:586845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-covid.info"; sid:586846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-covid.net"; sid:586847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for environmentalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"environmentalcovid.com"; sid:586848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facestopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facestopcovid-19.com"; sid:586849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facestopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facestopcovid19.com"; sid:586850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19mortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19mortgage.com"; sid:586851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovid19refinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovid19refinance.com"; sid:586852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovidfindacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovidfindacure.com"; sid:586853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearingcorona.com"; sid:586854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feelingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feelingthepandemic.com"; sid:586855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid19together.com"; sid:586856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmingcorona.com"; sid:586857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronadisease.com"; sid:586858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridahealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridahealthcovid.com"; sid:586859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for food-with-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"food-with-corona.net"; sid:586860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidcar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidcar.com"; sid:586861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19masks.com"; sid:586862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfacemask.com"; sid:586863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestednow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestednow.com"; sid:586864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcorona-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcorona-help.com"; sid:586865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemictracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemictracker.com"; sid:586866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globecovid.com"; sid:586867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlestopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlestopcovid-19.com"; sid:586868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googlestopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googlestopcovid19.com"; sid:586869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtacovid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtacovid19cleaners.com"; sid:586870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hablemosdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hablemosdecoronavirus.com"; sid:586871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hbotvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hbotvscovid19.com"; sid:586872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcoronavirus2020.com"; sid:586873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidkids.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidkids.info"; sid:586874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcorona.com"; sid:586875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcoronafamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcoronafamily.com"; sid:586876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcoronahandclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcoronahandclub.com"; sid:586877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcorona-hand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcorona-hand.com"; sid:586878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingcoronahands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingcoronahands.com"; sid:586879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelpostcovid.com"; sid:586880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelsincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelsincoronavirus.com"; sid:586881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntsvillecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntsvillecovid19testing.com"; sid:586882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huntsvillecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huntsvillecovidtesting.com"; sid:586883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidtested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidtested.com"; sid:586884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronafest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronafest.com"; sid:586885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inlandcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inlandcovidsupply.com"; sid:586886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instastopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instastopcovid-19.com"; sid:586887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instastopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instastopcovid19.com"; sid:586888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovidof2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovidof2019.com"; sid:586889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecornoviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecornoviruspandemic.com"; sid:586890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedtheworstpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedtheworstpandemic.com"; sid:586891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedtheworstpandemicinthehistoryoftheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedtheworstpandemicinthehistoryoftheworld.com"; sid:586892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ithinkihadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ithinkihadcovid19.com"; sid:586893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ittookapandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ittookapandemicbook.com"; sid:586894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jumpycarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jumpycarcovid19.com"; sid:586895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karascoronabirthday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karascoronabirthday.com"; sid:586896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcovidst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcovidst.com"; sid:586897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovid-19.com"; sid:586898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovid-19.info"; sid:586899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovid-19.net"; sid:586900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusproducts.com"; sid:586901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19products.com"; sid:586902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19store.com"; sid:586903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killthecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killthecovid-19.net"; sid:586904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kontracovid.com"; sid:586905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19-test.com"; sid:586906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latamcovid.com"; sid:586907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalaid4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalaid4covid19.com"; sid:586908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalaid4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalaid4covid.com"; sid:586909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letscurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letscurecovid19.com"; sid:586910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for listcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"listcorona.com"; sid:586911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingaftercovid.com"; sid:586912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loscoronaoventa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loscoronaoventa.com"; sid:586913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinatimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinatimeofcorona.net"; sid:586914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luxurycoronamask.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luxurycoronamask.info"; sid:586915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maccoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maccoronavirus.com"; sid:586916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid19.net"; sid:586917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancoronadisease.com"; sid:586918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mislabeledcoronavictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mislabeledcoronavictim.com"; sid:586919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mislabeledcoronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mislabeledcoronavictims.com"; sid:586920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mislabelledcoronavictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mislabelledcoronavictim.com"; sid:586921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mislabelledcoronavictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mislabelledcoronavictims.com"; sid:586922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mke-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mke-covid.info"; sid:586923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababyshop.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababyshop.info"; sid:586924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahack.com"; sid:586925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaneeds.com"; sid:586926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19journey.com"; sid:586927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidblog.com"; sid:586928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcomfort.com"; sid:586929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddisaster.com"; sid:586930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidnews.com"; sid:586931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidscreen.com"; sid:586932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidscreening.com"; sid:586933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicromance.com"; sid:586934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicsummer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicsummer.com"; sid:586935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytimeincoronalockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytimeincoronalockdown.com"; sid:586936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nameblameandshamecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nameblameandshamecoronavirus.com"; sid:586937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nameblameandshamecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nameblameandshamecovid19.com"; sid:586938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netcovid.net"; sid:586939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirus.biz"; sid:586940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycoronadisease.com"; sid:586941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscoronavirusonline.com"; sid:586942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronadisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronadisease.com"; sid:586943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nofearcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nofearcovidclear.com"; sid:586944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovid-19virus.com"; sid:586945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovid19virus.com"; sid:586946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwhcovid19testkit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwhcovid19testkit.info"; sid:586947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsightcovid.com"; sid:586948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovid.com"; sid:586949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onustopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onustopcovid-19.com"; sid:586950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onustopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onustopcovid19.com"; sid:586951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcovidmask.com"; sid:586952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcorona.net"; sid:586953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19vaccine.com"; sid:586954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2120.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2120.com"; sid:586955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicauto.com"; sid:586956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-claims.com"; sid:586957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclassactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclassactions.com"; sid:586958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccompliance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccompliance.info"; sid:586959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-diary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-diary.com"; sid:586960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdreamjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdreamjournal.com"; sid:586961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfighters.com"; sid:586962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgrowthresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgrowthresources.com"; sid:586963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichappyhour.com"; sid:586964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichotspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichotspots.com"; sid:586965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichustle.com"; sid:586966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicia.com"; sid:586967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmotor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmotor.com"; sid:586968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnormality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnormality.com"; sid:586969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconium.com"; sid:586970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphilosophy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphilosophy.com"; sid:586971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppefar-uvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppefar-uvc.com"; sid:586972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppefar-uvc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppefar-uvc.net"; sid:586973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrides.com"; sid:586974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicromance.com"; sid:586975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetymask.com"; sid:586976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsavior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsavior.com"; sid:586977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsprays.com"; sid:586978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstorm.com"; sid:586979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-trauma-release.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-trauma-release.com"; sid:586980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicurbanism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicurbanism.com"; sid:586981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirallogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirallogistics.com"; sid:586982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviralprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviralprotection.com"; sid:586983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviralsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviralsolutions.com"; sid:586984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirus2020movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirus2020movie.com"; sid:586985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicweddings.com"; sid:586986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pansofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pansofthepandemic.com"; sid:586987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-corona-tours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-corona-tours.com"; sid:586988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-19syndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-19syndrome.com"; sid:586989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19syndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19syndrome.net"; sid:586990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.cat"; sid:586991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidgroup.com"; sid:586992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.guru"; sid:586993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtechnologies.com"; sid:586994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidurbanism.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidurbanism.info"; sid:586995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for potuscovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"potuscovidcare.com"; sid:586996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppecoronavirus.net"; sid:586997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventivoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventivoscovid19.com"; sid:586998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for printforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"printforcovid.com"; sid:586999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procleancovid-19.com"; sid:587000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procleancovid19.com"; sid:587001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for propertycoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"propertycoronafree.com"; sid:587002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionscovid.com"; sid:587003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegecoronavirus.com"; sid:587004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocollosicurezzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocollosicurezzacovid19.com"; sid:587005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocollosicurezzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocollosicurezzacovid.com"; sid:587006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puebacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puebacovid.com"; sid:587007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronarelief.com"; sid:587008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronaresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronaresponse.com"; sid:587009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rankcovid19.com"; sid:587010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestingcovid-19.com"; sid:587011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestkitsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestkitsforcovid19.com"; sid:587012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for razcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"razcovid19.com"; sid:587013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveredcovid.com"; sid:587014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renaissancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renaissancecovid19.com"; sid:587015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renaissancecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renaissancecovid.com"; sid:587016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renaissancecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renaissancecovid.info"; sid:587017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renaissancecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renaissancecovid.net"; sid:587018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid19.net"; sid:587019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridcovidpro.com"; sid:587020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rylcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rylcovid-19.com"; sid:587021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for s3covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"s3covidtest.com"; sid:587022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetest-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetest-covid-19.com"; sid:587023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samendoorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samendoorcorona.com"; sid:587024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizingcovid19.com"; sid:587025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19mall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19mall.com"; sid:587026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19sanitizer.com"; sid:587027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19sanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19sanitizers.com"; sid:587028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19shop.com"; sid:587029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19ventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19ventilator.com"; sid:587030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savemefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savemefromcorona.com"; sid:587031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sc-covid19.com"; sid:587032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schulenachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schulenachcorona.com"; sid:587033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sd2corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sd2corona.com"; sid:587034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for senzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"senzacovid19.com"; sid:587035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for senzacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"senzacovid.com"; sid:587036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seriousgamecoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seriousgamecoronavirus.info"; sid:587037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skipcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skipcorona.com"; sid:587038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowdowncovid19.com"; sid:587039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sneezeguardcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sneezeguardcovid19.com"; sid:587040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for southcoastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"southcoastcovid.com"; sid:587041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid9teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid9teen.com"; sid:587042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suechinacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suechinacovid19.com"; sid:587043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suechinacovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suechinacovid19.info"; sid:587044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suechinacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suechinacovid19.net"; sid:587045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkitsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkitsforcovid19.com"; sid:587046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testtrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testtrackcovid.com"; sid:587047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texasfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texasfightscovid19.com"; sid:587048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texcovid-19.com"; sid:587049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texcovid19.com"; sid:587050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texcovid.com"; sid:587051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texpandemic.com"; sid:587052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theartofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theartofcovid.com"; sid:587053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechurchaftercoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechurchaftercoronavirus.info"; sid:587054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcovidusa.com"; sid:587055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacompany.com"; sid:587056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafixers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafixers.com"; sid:587057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatea.com"; sid:587058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspandemic2020.com"; sid:587059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusplan.com"; sid:587060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19outlook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19outlook.com"; sid:587061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19recovery.com"; sid:587062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidanalysis.com"; sid:587063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidbane.com"; sid:587064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleanteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleanteam.com"; sid:587065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconsortium.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconsortium.info"; sid:587066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddisaster.com"; sid:587067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddisaster.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddisaster.info"; sid:587068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddisaster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddisaster.net"; sid:587069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddisasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddisasters.com"; sid:587070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddisaster.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddisaster.systems"; sid:587071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfixer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfixer.com"; sid:587072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfixers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfixers.com"; sid:587073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidflower.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidflower.info"; sid:587074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicrecovery.com"; sid:587075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicrecovery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicrecovery.net"; sid:587076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapidcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapidcovid19kit.com"; sid:587077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapidcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapidcovid19testkits.com"; sid:587078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcovid.com"; sid:587079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewaragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewaragainstcoronavirus.com"; sid:587080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewaragainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewaragainstcovid19.com"; sid:587081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworlaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworlaftercorona.com"; sid:587082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanwar.com"; sid:587083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiktokstopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiktokstopcovid-19.com"; sid:587084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tiktokstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tiktokstopcovid19.com"; sid:587085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocovidcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocovidcollective.com"; sid:587086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19health.com"; sid:587087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19tests.com"; sid:587088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triagecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triagecovid.info"; sid:587089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trirock-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trirock-covid.com"; sid:587090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trucovid.com"; sid:587091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpkillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpkillscoronavirus.com"; sid:587092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpskillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpskillscoronavirus.com"; sid:587093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txpandemic.com"; sid:587094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultracleancovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultracleancovid-19.com"; sid:587095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultracleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultracleancovid19.com"; sid:587096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedbycovid19.com"; sid:587097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for universalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"universalcovid19.com"; sid:587098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronation.com"; sid:587099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcare.com"; sid:587100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-covid19.com"; sid:587101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcare.com"; sid:587102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtaskforce.com"; sid:587103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uzmancorona.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uzmancorona.email"; sid:587104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifycovid-19.com"; sid:587105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verifycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verifycovid19.com"; sid:587106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid19meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid19meds.com"; sid:587107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waragainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waragainstcoronavirus.com"; sid:587108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weg-mit-dem-corona-speck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weg-mit-dem-corona-speck.com"; sid:587109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscoronavirusonsurfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscoronavirusonsurfaces.com"; sid:587110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscoronavirusonsurfaces.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscoronavirusonsurfaces.net"; sid:587111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid-19onsurfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid-19onsurfaces.com"; sid:587112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid-19onsurfaces.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid-19onsurfaces.net"; sid:587113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid19surfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid19surfaces.com"; sid:587114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatkillscovid19surfaces.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatkillscovid19surfaces.net"; sid:587115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whcoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whcoronavirustaskforce.com"; sid:587116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whcovid19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whcovid19taskforce.com"; sid:587117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitehousecovid19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitehousecovid19taskforce.com"; sid:587118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitehousecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitehousecovidcare.com"; sid:587119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-covid19relieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-covid19relieffunds.com"; sid:587120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for who-covidsolidarityresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"who-covidsolidarityresponse.com"; sid:587121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusmovie.com"; sid:587122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusthemovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusthemovie.com"; sid:587123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirususa.com"; sid:587124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwar.com"; sid:587125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19titer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19titer.com"; sid:587126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19titer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19titer.net"; sid:587127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoviddisaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoviddisaster.com"; sid:587128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourpandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourpandemicrecovery.com"; sid:587129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 11predictionsfashionpostpandemicstyle.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"11predictionsfashionpostpandemicstyle.cloud"; sid:587130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidlbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidlbs.com"; sid:587131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19thingsididduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19thingsididduringcovid.com"; sid:587132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-thing-i-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-thing-i-covid.net"; sid:587133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020gencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020gencovid.com"; sid:587134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abujafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abujafightingcovid.com"; sid:587135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.life"; sid:587136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecovid19.com"; sid:587137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovideverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovideverything.com"; sid:587138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcoronavirus.club"; sid:587139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovid-19.club"; sid:587140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovid19.club"; sid:587141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altolacovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altolacovid19.club"; sid:587142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid-19test.com"; sid:587143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirusackit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirusackit.com"; sid:587144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusackits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusackits.com"; sid:587145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemicsupplies.com"; sid:587146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipanicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipanicovid.com"; sid:587147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appareildesinfectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appareildesinfectioncovid19.com"; sid:587148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argcovid.info"; sid:587149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for att-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"att-covid19.com"; sid:587150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyforcovid19.com"; sid:587151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atualizacaocovid19adesao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atualizacaocovid19adesao.com"; sid:587152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aucklandcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aucklandcovidfree.com"; sid:587153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aus-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aus-covid.com"; sid:587154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincoronasanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincoronasanitizing.com"; sid:587155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19testing.com"; sid:587156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoworkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoworkcovid.com"; sid:587157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backwardscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backwardscovid19.com"; sid:587158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bastacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bastacovid.net"; sid:587159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecovid.net"; sid:587160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcg-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcg-covid.info"; sid:587161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatitcoronavirus.com"; sid:587162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidtests.com"; sid:587163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blbcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blbcovid19.com"; sid:587164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bogota-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bogota-covid19.com"; sid:587165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buscovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buscovid-19testing.com"; sid:587166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovidclaims.com"; sid:587167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidclaims.com"; sid:587168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careincorona.com"; sid:587169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretasparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretasparacoronavirus.com"; sid:587170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretasparacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretasparacoronavirus.net"; sid:587171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carnival-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carnival-covid19.info"; sid:587172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certcovid.com"; sid:587173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidfreeworkplace.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidfreeworkplace.info"; sid:587174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifycovidfree.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifycovidfree.info"; sid:587175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmatecovid.com"; sid:587176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classiccovidmoments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classiccovidmoments.com"; sid:587177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classiccovidmoments.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classiccovidmoments.net"; sid:587178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claude-escarguelvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claude-escarguelvscovid19.com"; sid:587179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicaltrialscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicaltrialscovid-19.com"; sid:587180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicaltrialscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicaltrialscovid19.com"; sid:587181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityovercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityovercorona.net"; sid:587182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueredcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueredcoronavirus.com"; sid:587183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultoriacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultoriacovid.com"; sid:587184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19clean.com"; sid:587185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19remediation.com"; sid:587186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19remediation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19remediation.info"; sid:587187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19remediation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19remediation.net"; sid:587188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afschermingen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afschermingen.com"; sid:587189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaagain.com"; sid:587190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbeitsschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbeitsschutz.com"; sid:587191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atem-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atem-schutz.com"; sid:587192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atemschutz-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atemschutz-maske.com"; sid:587193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaware.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaware.info"; sid:587194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababynames.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababynames.info"; sid:587195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababynames.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababynames.net"; sid:587196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabattleshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabattleshield.com"; sid:587197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeeper.com"; sid:587198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersusa.com"; sid:587199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalist.com"; sid:587200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarect.com"; sid:587201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarenj.com"; sid:587202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarenyc.com"; sid:587203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareny.com"; sid:587204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashforclunkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashforclunkers.com"; sid:587205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-casual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-casual.com"; sid:587206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacationnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacationnation.com"; sid:587207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanzone.com"; sid:587208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclinicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclinicalresearch.com"; sid:587209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconomist.com"; sid:587210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsortium.com"; sid:587211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsortium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsortium.net"; sid:587212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconspires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconspires.com"; sid:587213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorrupt.com"; sid:587214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorruption.com"; sid:587215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidglobal.com"; sid:587216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidresearch.com"; sid:587217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaco.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaco.world"; sid:587218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrackdown.com"; sid:587219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crysis.com"; sid:587220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrysis.com"; sid:587221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuina.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuina.cat"; sid:587222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuina.com"; sid:587223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureall.com"; sid:587224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatainfo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatainfo.info"; sid:587225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detection-service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detection-service.com"; sid:587226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detectionservice.com"; sid:587227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetection-service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetection-service.com"; sid:587228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetectionservice.com"; sid:587229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadivide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadivide.com"; sid:587230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronads.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronads.info"; sid:587231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-eikyo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-eikyo.net"; sid:587232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-esthe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-esthe.com"; sid:587233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexterminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexterminators.com"; sid:587234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-face-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-face-masks.com"; sid:587235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-face-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-face-protection.com"; sid:587236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafailure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafailure.com"; sid:587237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafee.com"; sid:587238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fences.com"; sid:587239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-finanzhilfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-finanzhilfen.com"; sid:587240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fixkostenzuschuss.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fixkostenzuschuss.info"; sid:587241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forte.com"; sid:587242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforte.com"; sid:587243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforums.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforums.net"; sid:587244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreegym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreegym.com"; sid:587245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagardens.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagardens.club"; sid:587246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagardens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagardens.net"; sid:587247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gesichtsmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gesichtsmaske.com"; sid:587248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe.tirol - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe.tirol"; sid:587249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfspaket24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfspaket24.com"; sid:587250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoaxcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoaxcure.com"; sid:587251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpactanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpactanalysis.com"; sid:587252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakantoorscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakantoorscan.com"; sid:587253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kart.com"; sid:587254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakittesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakittesting.com"; sid:587255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-koeln.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-koeln.com"; sid:587256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise-consulting.com"; sid:587257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise-consulting.com"; sid:587258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise-consulting.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise-consulting.info"; sid:587259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakronieken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakronieken.com"; sid:587260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivesstats.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivesstats.info"; sid:587261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-makenai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-makenai.net"; sid:587262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mondkapjes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mondkapjes.com"; sid:587263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamontgomery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamontgomery.com"; sid:587264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamotion.com"; sid:587265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mouth-nose-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mouth-nose-protection.com"; sid:587266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamultas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamultas.com"; sid:587267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mund-nase-schutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mund-nase-schutz.com"; sid:587268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-museum.com"; sid:587269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanasalspray.com"; sid:587270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsblog.com"; sid:587271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanikatsu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanikatsu.com"; sid:587272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlinetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlinetraining.com"; sid:587273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoplossingen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoplossingen.com"; sid:587274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolooza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolooza.com"; sid:587275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprisoners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprisoners.com"; sid:587276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofkit.com"; sid:587277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-masks.com"; sid:587278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rainbow.com"; sid:587279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarainbow.com"; sid:587280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareceptes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareceptes.com"; sid:587281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieffundbihar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieffundbihar.com"; sid:587282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresearchcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresearchcenter.com"; sid:587283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponseadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponseadvisors.com"; sid:587284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarival.com"; sid:587285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz.biz"; sid:587286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-masken.com"; sid:587287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-shop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-shop24.com"; sid:587288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdead.com"; sid:587289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselling.com"; sid:587290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldusa.com"; sid:587291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-signage.com"; sid:587292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestservice.com"; sid:587293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sommerurlaub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sommerurlaub.com"; sid:587294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sommerurlaub.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sommerurlaub.info"; sid:587295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sommerurlaub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sommerurlaub.net"; sid:587296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspolitics.com"; sid:587297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasterilize.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasterilize.net"; sid:587298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastichtingnederland.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastichtingnederland.info"; sid:587299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportsylhet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportsylhet.com"; sid:587300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswabs.com"; sid:587301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelte.com"; sid:587302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatenda.com"; sid:587303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatente.com"; sid:587304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatents.com"; sid:587305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingtucson.com"; sid:587306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.one"; sid:587307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tip.com"; sid:587308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracking-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracking-app.com"; sid:587309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracking-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracking-app.com"; sid:587310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vacation.com"; sid:587311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vault.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vault.com"; sid:587312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicio.com"; sid:587313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavicius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavicius.com"; sid:587314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinyl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinyl.com"; sid:587315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruclassaction.com"; sid:587316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19relief.com"; sid:587317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19-remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19-remediation.com"; sid:587318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19remediation.com"; sid:587319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountability.com"; sid:587320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountability.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountability.info"; sid:587321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountability.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountability.net"; sid:587322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountabilityplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountabilityplatform.com"; sid:587323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountabilityplatform.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountabilityplatform.info"; sid:587324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccountabilityplatform.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccountabilityplatform.net"; sid:587325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtesting.com"; sid:587326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptioninsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptioninsurancelawyer.com"; sid:587327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-busters.com"; sid:587328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedclean.com"; sid:587329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedcleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedcleaned.com"; sid:587330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedcleaningexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedcleaningexperts.com"; sid:587331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschangedtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschangedtheworld.com"; sid:587332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschine.com"; sid:587333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimswv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimswv.com"; sid:587334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningatlanta.com"; sid:587335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningboston.com"; sid:587336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcolumbus.com"; sid:587337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdallas.com"; sid:587338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningftworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningftworth.com"; sid:587339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninghouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninghouston.com"; sid:587340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningindianapolis.com"; sid:587341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningjacksonville.com"; sid:587342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglasvegas.com"; sid:587343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglosangeles.com"; sid:587344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglouisville.com"; sid:587345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmemphis.com"; sid:587346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnashville.com"; sid:587347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningneworleans.com"; sid:587348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningphiladelphia.com"; sid:587349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningphoenix.com"; sid:587350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsanantonio.com"; sid:587351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsandiego.com"; sid:587352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsanjose.com"; sid:587353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningseattle.com"; sid:587354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningwashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningwashington.com"; sid:587355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoding.com"; sid:587356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscorruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscorruption.com"; sid:587357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenguadalajara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenguadalajara.com"; sid:587358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessentialstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessentialstore.com"; sid:587359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreecertificate.com"; sid:587360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-guia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-guia.com"; sid:587361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimg.com"; sid:587362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindependenceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindependenceday.com"; sid:587363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindex.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindex.info"; sid:587364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleaderboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleaderboard.com"; sid:587365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleaderboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleaderboard.net"; sid:587366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmart.net"; sid:587367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmetric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmetric.com"; sid:587368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remediation.com"; sid:587369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrentrelief.com"; sid:587370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitized.com"; sid:587371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussterilizationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussterilizationservice.com"; sid:587372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivor.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivor.info"; sid:587373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-website.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-website.com"; sid:587374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavx.com"; sid:587375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawith.com"; sid:587376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawonderful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawonderful.com"; sid:587377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-work-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-work-protection.com"; sid:587378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazelt.com"; sid:587379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corruptcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corruptcorona.com"; sid:587380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corruptioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corruptioncorona.com"; sid:587381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cover4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cover4covid.com"; sid:587382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrace.com"; sid:587383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arab.com"; sid:587384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-attack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-attack.com"; sid:587385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ayuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ayuda.com"; sid:587386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19backwardsbrainrepeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19backwardsbrainrepeat.com"; sid:587387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19backwards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19backwards.com"; sid:587388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backwards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backwards.com"; sid:587389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bangalore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bangalore.com"; sid:587390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business.info"; sid:587391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinterruptioninsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinterruptioninsurancelawyer.com"; sid:587392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesslossesclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesslossesclaim.com"; sid:587393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cam.com"; sid:587394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cansuckit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cansuckit.com"; sid:587395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caution.com"; sid:587396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ceohuddle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ceohuddle.com"; sid:587397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certifiedclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certifiedclean.com"; sid:587398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedclean.com"; sid:587399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19certifiedcleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19certifiedcleaned.com"; sid:587400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19charge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19charge.com"; sid:587401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19china.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19china.net"; sid:587402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims-wv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims-wv.com"; sid:587403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleankill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleankill.com"; sid:587404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleansers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleansers.com"; sid:587405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicalresearch.com"; sid:587406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19com.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19com.com"; sid:587407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttrace.com"; sid:587408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contact-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contact-tracing.com"; sid:587409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-coronavirus-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-coronavirus-updates.com"; sid:587410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cottonmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cottonmasks.com"; sid:587411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiselegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiselegalhelp.com"; sid:587412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cuarentena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cuarentena.com"; sid:587413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datalab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datalab.com"; sid:587414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenses.com"; sid:587415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenses.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenses.info"; sid:587416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfectant.com"; sid:587417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectioncertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectioncertification.com"; sid:587418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectionlaverne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectionlaverne.com"; sid:587419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectionranchocucamonga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectionranchocucamonga.com"; sid:587420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectionservice.com"; sid:587421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectionupland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectionupland.com"; sid:587422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19divine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19divine.com"; sid:587423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ec.com"; sid:587424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-eligibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-eligibility.com"; sid:587425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19energy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19energy.com"; sid:587426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epis.com"; sid:587427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19etcconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19etcconnect.com"; sid:587428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemaskplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemaskplus.com"; sid:587429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facemasks.net"; sid:587430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filter.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filter.info"; sid:587431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fincompass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fincompass.com"; sid:587432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19france.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19france.net"; sid:587433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedating.com"; sid:587434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedating.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedating.net"; sid:587435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freegym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freegym.com"; sid:587436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freejobs.com"; sid:587437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freematch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freematch.com"; sid:587438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freematch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freematch.net"; sid:587439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemeetup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemeetup.com"; sid:587440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freemeetup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freemeetup.net"; sid:587441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freerideshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freerideshare.com"; sid:587442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freesports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freesports.com"; sid:587443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundings.com"; sid:587444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gambling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gambling.com"; sid:587445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gambling.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gambling.info"; sid:587446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glasses.com"; sid:587447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalteenideachallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalteenideachallenge.net"; sid:587448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalwar.com"; sid:587449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glove.com"; sid:587450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gob.com"; sid:587451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19godschoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19godschoice.com"; sid:587452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-govfr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-govfr.com"; sid:587453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsinks.com"; sid:587454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handwashing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handwashing.com"; sid:587455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handwashingposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handwashingposter.com"; sid:587456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazmatteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazmatteam.com"; sid:587457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herd.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herd.info"; sid:587458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoaxcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoaxcure.com"; sid:587459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hrqol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hrqol.com"; sid:587460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunityherd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunityherd.com"; sid:587461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunityherd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunityherd.net"; sid:587462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incarehomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incarehomes.com"; sid:587463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19independenceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19independenceday.com"; sid:587464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infoindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infoindia.com"; sid:587465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investigater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investigater.com"; sid:587466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investigator.com"; sid:587467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jalisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jalisco.com"; sid:587468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killercleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killercleaners.com"; sid:587469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killercleansers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killercleansers.com"; sid:587470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leaderboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leaderboard.com"; sid:587471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19leaderboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19leaderboard.net"; sid:587472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losseslegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losseslegalhelp.com"; sid:587473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losseslegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losseslegalhelpline.com"; sid:587474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loves.com"; sid:587475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maid.com"; sid:587476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maidscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maidscleaning.com"; sid:587477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maidsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maidsonline.com"; sid:587478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maidsservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maidsservice.com"; sid:587479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maidsservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maidsservices.com"; sid:587480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medstore.com"; sid:587481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moscow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moscow.com"; sid:587482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newspress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newspress.com"; sid:587483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organics.com"; sid:587484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pimacounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pimacounty.com"; sid:587485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19place.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19place.com"; sid:587486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plakati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plakati.com"; sid:587487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19planet.com"; sid:587488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasma.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasma.info"; sid:587489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasma.net"; sid:587490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-plus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-plus.com"; sid:587491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portablesinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portablesinks.com"; sid:587492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psyop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psyop.com"; sid:587493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pune.com"; sid:587494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-qlq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-qlq.com"; sid:587495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-qol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-qol.com"; sid:587496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ra.com"; sid:587497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rainbow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rainbow.net"; sid:587498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realorfake.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realorfake.info"; sid:587499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19regularity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19regularity.com"; sid:587500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.world"; sid:587501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reminders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reminders.com"; sid:587502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remodeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remodeling.com"; sid:587503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentrelief.com"; sid:587504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19repeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19repeat.com"; sid:587505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repro.com"; sid:587506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchcenter.com"; sid:587507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resistance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resistance.info"; sid:587508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resistance.net"; sid:587509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19respiratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19respiratory.com"; sid:587510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskappraisal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskappraisal.com"; sid:587511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19runningdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19runningdiary.com"; sid:587512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rwd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rwd.com"; sid:587513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rwd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rwd.com"; sid:587514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rwd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rwd.net"; sid:587515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rwd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rwd.net"; sid:587516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rwe.com"; sid:587517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rwe.com"; sid:587518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rwe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rwe.net"; sid:587519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rwe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rwe.net"; sid:587520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safebusinessdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safebusinessdirectory.com"; sid:587521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety1st.com"; sid:587522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyshop.com"; sid:587523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salontraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salontraining.com"; sid:587524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-secure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-secure.net"; sid:587525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shanghai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shanghai.com"; sid:587526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shield.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shield.world"; sid:587527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19singapore.com"; sid:587528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solution4forindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solution4forindustry.com"; sid:587529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsforindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsforindustry.com"; sid:587530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statusregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statusregistry.com"; sid:587531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilizationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilizationservice.com"; sid:587532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilizationupland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilizationupland.com"; sid:587533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stylistsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stylistsafety.com"; sid:587534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surfacesanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surfacesanitizer.com"; sid:587535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surfacesanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surfacesanitizing.com"; sid:587536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivor1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivor1.com"; sid:587537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors2020.com"; sid:587538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.sydney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.sydney"; sid:587539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomtracker.com"; sid:587540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-takeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-takeout.com"; sid:587541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tempcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tempcam.com"; sid:587542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19temp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19temp.com"; sid:587543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingaz.com"; sid:587544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingonline.com"; sid:587545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtucson.com"; sid:587546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitkorea.com"; sid:587547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testonline.com"; sid:587548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermalcamera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermalcamera.com"; sid:587549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timestream.com"; sid:587550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tribunal.com"; sid:587551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tv.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tv.info"; sid:587552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvcdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvcdisinfection.com"; sid:587553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvdisinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvdisinfectionservice.com"; sid:587554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvsterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvsterilization.com"; sid:587555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccination.net"; sid:587556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineus.com"; sid:587557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-virucidas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-virucidas.com"; sid:587558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdisinfection.com"; sid:587559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vitamin-d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vitamin-d.com"; sid:587560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warriorproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warriorproject.com"; sid:587561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wiseguys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wiseguys.com"; sid:587562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worksitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worksitetesting.com"; sid:587563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrathofgod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrathofgod.com"; sid:587564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xproject.com"; sid:587565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020facts.com"; sid:587566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2050.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2050.com"; sid:587567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20virus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20virus.info"; sid:587568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2norm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2norm.com"; sid:587569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3ply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3ply.com"; sid:587570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teentesting.com"; sid:587571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9tin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9tin.com"; sid:587572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabout.com"; sid:587573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachtung.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachtung.cloud"; sid:587574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactivity.com"; sid:587575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadate.com"; sid:587576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaguard.com"; sid:587577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidallstars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidallstars.com"; sid:587578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandyou.com"; sid:587579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanimal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanimal.com"; sid:587580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytest.net"; sid:587581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarium.com"; sid:587582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarthritis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarthritis.com"; sid:587583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidashield.com"; sid:587584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistants.com"; sid:587585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-awards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-awards.com"; sid:587586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbear.com"; sid:587587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbesity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbesity.com"; sid:587588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbetes.com"; sid:587589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuffer.com"; sid:587590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbunny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbunny.com"; sid:587591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessgraveyard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessgraveyard.com"; sid:587592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersusa.com"; sid:587593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-care-club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-care-club.com"; sid:587594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaree.com"; sid:587595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremd.com"; sid:587596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertid.com"; sid:587597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-certification.com"; sid:587598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedbusiness.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedbusiness.info"; sid:587599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedworkplace.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedworkplace.info"; sid:587600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chart.com"; sid:587601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronic.com"; sid:587602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclcpannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclcpannel.com"; sid:587603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcld.com"; sid:587604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancar.com"; sid:587605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleankill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleankill.com"; sid:587606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleans.com"; sid:587607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearingstation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearingstation.net"; sid:587608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicalresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicalresearch.com"; sid:587609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcnn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcnn.com"; sid:587610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coaching.com"; sid:587611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoffeehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoffeehouse.com"; sid:587612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoke.com"; sid:587613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollabs.com"; sid:587614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-collection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-collection.com"; sid:587615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidco.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidco.net"; sid:587616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnect20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnect20.com"; sid:587617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopingcorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopingcorner.com"; sid:587618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronaresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronaresearch.com"; sid:587619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrackdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrackdown.com"; sid:587620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureforall.com"; sid:587621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureforyou.com"; sid:587622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutsllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutsllc.com"; sid:587623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailyreport.com"; sid:587624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddank.com"; sid:587625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatalab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatalab.com"; sid:587626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeaths.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeaths.info"; sid:587627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtproblems.com"; sid:587628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefence.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefence.info"; sid:587629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddelivery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddelivery.net"; sid:587630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddinero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddinero.com"; sid:587631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscount.com"; sid:587632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dispositivi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dispositivi.com"; sid:587633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddxtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddxtest.com"; sid:587634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide.international"; sid:587635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covident.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covident.info"; sid:587636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoco.com"; sid:587637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoindia.com"; sid:587638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepack.com"; sid:587639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideupdate.com"; sid:587640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexercises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexercises.com"; sid:587641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexercises.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexercises.net"; sid:587642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-expert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-expert.com"; sid:587643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-eye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-eye.com"; sid:587644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfabricmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfabricmask.com"; sid:587645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfairy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfairy.com"; sid:587646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfatigue.com"; sid:587647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfied.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfied.network"; sid:587648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfighting.com"; sid:587649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfired.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfired.com"; sid:587650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoundations.com"; sid:587651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfox.com"; sid:587652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreealto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreealto.com"; sid:587653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebarber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebarber.com"; sid:587654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecams.com"; sid:587655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecar.com"; sid:587656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertifiedworkplace.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertifiedworkplace.info"; sid:587657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeclubgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeclubgirls.com"; sid:587658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeconcierge.com"; sid:587659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeconnections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeconnections.com"; sid:587660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecontractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecontractors.com"; sid:587661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedating.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedating.net"; sid:587662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedmovietheatre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedmovietheatre.com"; sid:587663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeemployee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeemployee.com"; sid:587664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeemployment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeemployment.net"; sid:587665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefriends.com"; sid:587666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegym.com"; sid:587667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehaircut.com"; sid:587668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehousekeepers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehousekeepers.com"; sid:587669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeindeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeindeed.com"; sid:587670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemaid.com"; sid:587671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemalaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemalaga.com"; sid:587672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemanicure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemanicure.com"; sid:587673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreematch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreematch.net"; sid:587674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemedical.com"; sid:587675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemeetup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemeetup.com"; sid:587676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemeetup.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemeetup.net"; sid:587677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemenus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemenus.com"; sid:587678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeneighbors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeneighbors.com"; sid:587679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenewzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenewzealand.com"; sid:587680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreephysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreephysicians.com"; sid:587681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerideshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerideshare.com"; sid:587682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesports.com"; sid:587683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreestay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreestay.com"; sid:587684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetinder.com"; sid:587685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetravelnewzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetravelnewzealand.com"; sid:587686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreewework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreewework.com"; sid:587687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeweworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeweworkspace.com"; sid:587688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkplaces.com"; sid:587689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunder.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunder.info"; sid:587690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgaming.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgaming.info"; sid:587691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgems.com"; sid:587692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglass.com"; sid:587693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgloryholeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgloryholeprotection.com"; sid:587694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gps.com"; sid:587695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gps.net"; sid:587696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrowthrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrowthrate.com"; sid:587697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardus.com"; sid:587698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheadache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheadache.com"; sid:587699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpthailand.com"; sid:587700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestingkits.com"; sid:587701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestkits.com"; sid:587702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidilaaj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidilaaj.com"; sid:587703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfonepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfonepal.com"; sid:587704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotscom.com"; sid:587705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisinfection.com"; sid:587706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidita.com"; sid:587707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivorceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivorceattorney.com"; sid:587708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjdrf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjdrf.com"; sid:587709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjourneys.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjourneys.world"; sid:587710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeychain.com"; sid:587711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitchen.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitchen.club"; sid:587712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kitz.com"; sid:587713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleaderboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleaderboard.com"; sid:587714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleaderboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleaderboard.net"; sid:587715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlyseparated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlyseparated.com"; sid:587716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlyyours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlyyours.com"; sid:587717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksource.com"; sid:587718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedipro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedipro.com"; sid:587719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmorons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmorons.com"; sid:587720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgage.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgage.info"; sid:587721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmultas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmultas.com"; sid:587722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmuscle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmuscle.com"; sid:587723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnasalspray.com"; sid:587724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnav.com"; sid:587725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnerve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnerve.com"; sid:587726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnetga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnetga.com"; sid:587727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneuralgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneuralgia.com"; sid:587728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneuropathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneuropathy.com"; sid:587729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteensettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteensettlement.com"; sid:587730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficeprotection.com"; sid:587731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoplossing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoplossing.com"; sid:587732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopolis.com"; sid:587733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganic.com"; sid:587734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.club"; sid:587735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organics.com"; sid:587736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.com"; sid:587737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organics.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organics.info"; sid:587738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.info"; sid:587739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organix.com"; sid:587740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganix.com"; sid:587741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpadlock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpadlock.com"; sid:587742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprocure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprocure.com"; sid:587743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprod.com"; sid:587744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprot.com"; sid:587745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpub.com"; sid:587746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpussy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpussy.com"; sid:587747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqueues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqueues.com"; sid:587748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rainbow.com"; sid:587749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrainbow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrainbow.com"; sid:587750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrainbow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrainbow.net"; sid:587751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrallymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrallymask.com"; sid:587752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreportdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreportdaily.com"; sid:587753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchcenter.com"; sid:587754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchusa.com"; sid:587755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskappraisal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskappraisal.com"; sid:587756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19killer.com"; sid:587757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19live.com"; sid:587758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19maid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19maid.com"; sid:587759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyexchange.com"; sid:587760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetymart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetymart.com"; sid:587761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysolutions.com"; sid:587762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalonsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalonsafety.com"; sid:587763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalons.com"; sid:587764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitari.com"; sid:587765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsasa.com"; sid:587766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsearches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsearches.com"; sid:587767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecuritytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecuritytracker.com"; sid:587768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shop24.com"; sid:587769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortfilms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortfilms.com"; sid:587770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-signage.com"; sid:587771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigning.com"; sid:587772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-signs.com"; sid:587773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsion.net"; sid:587774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskills.com"; sid:587775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmaids.com"; sid:587776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smart.com"; sid:587777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smart.net"; sid:587778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmarts.com"; sid:587779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sneltestservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sneltestservice.com"; sid:587780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneltestservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneltestservice.com"; sid:587781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspa.com"; sid:587782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspasafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspasafety.com"; sid:587783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedtests.com"; sid:587784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstache.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstache.com"; sid:587785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatz.info"; sid:587786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stores.com"; sid:587787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswindle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswindle.com"; sid:587788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaleignorance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaleignorance.com"; sid:587789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtargetzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtargetzero.com"; sid:587790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteck.com"; sid:587791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtempcam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtempcam.com"; sid:587792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestforyou.com"; sid:587793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingaz.com"; sid:587794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingla.com"; sid:587795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testing.net"; sid:587796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtucson.com"; sid:587797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlocation.com"; sid:587798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmichigan.com"; sid:587799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-the-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-the-game.com"; sid:587800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtonic.com"; sid:587801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidur.com"; sid:587802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinefree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinefree.com"; sid:587803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetracker.com"; sid:587804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus19.info"; sid:587805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusbusters.com"; sid:587806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirushistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirushistory.com"; sid:587807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvx.com"; sid:587808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweakness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweakness.com"; sid:587809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwith.com"; sid:587810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld19.com"; sid:587811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingcovid19.com"; sid:587812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct7covid1981.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct7covid1981.info"; sid:587813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidreport.com"; sid:587814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailypandemic.com"; sid:587815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidfree.com"; sid:587816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datecovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datecovid19free.com"; sid:587817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datecovid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datecovid19free.net"; sid:587818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datecovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datecovidfree.net"; sid:587819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dateingcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dateingcovid19free.com"; sid:587820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dateingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dateingcovidfree.com"; sid:587821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datemecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datemecovidfree.com"; sid:587822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datemecovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datemecovidfree.net"; sid:587823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayaftercovid.com"; sid:587824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for d-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"d-covid.com"; sid:587825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronakronieken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronakronieken.com"; sid:587826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deepkleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deepkleancovid19.com"; sid:587827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectercovid19.com"; sid:587828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncoronavirus.net"; sid:587829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid.com"; sid:587830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid-rouen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid-rouen.com"; sid:587831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dietacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dietacovid.com"; sid:587832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dinecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dinecovidfree.com"; sid:587833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discocovid-19.com"; sid:587834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disney-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disney-covid19.info"; sid:587835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for docscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"docscovidtesting.com"; sid:587836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorscovid19.com"; sid:587837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dom-covid77.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dom-covid77.com"; sid:587838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drinkcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drinkcovidfree.com"; sid:587839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatcovidfree.com"; sid:587840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecgcovid19cardioa1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecgcovid19cardioa1.com"; sid:587841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emocovid.com"; sid:587842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmecovidfree19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmecovidfree19.com"; sid:587843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmecovidfree.com"; sid:587844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmecovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmecovidfree.net"; sid:587845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmentcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmentcovid.com"; sid:587846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19virus.com"; sid:587847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidvirus.com"; sid:587848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicllc.com"; sid:587849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipements-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipements-covid19.com"; sid:587850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurocoronavirus.com"; sid:587851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examencovid.com"; sid:587852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exercisecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exercisecovid.com"; sid:587853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecovidfund.com"; sid:587854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks-corona.com"; sid:587855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasks-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasks-covid.com"; sid:587856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famouscoviddeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famouscoviddeaths.com"; sid:587857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncovidmask.com"; sid:587858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncovidmasks.com"; sid:587859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovid19test.com"; sid:587860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feministcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feministcovidresponse.com"; sid:587861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fired4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fired4covid.com"; sid:587862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedcovid.com"; sid:587863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firedforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firedforcovid.com"; sid:587864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronaexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronaexam.com"; sid:587865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusstrategycall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusstrategycall.com"; sid:587866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidbook.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidbook.info"; sid:587867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtestingtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtestingtucson.com"; sid:587868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for friendscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"friendscovidfree.com"; sid:587869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19backwardsbrainrepeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19backwardsbrainrepeat.com"; sid:587870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19backwards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19backwards.com"; sid:587871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.clothing"; sid:587872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.email"; sid:587873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukkcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukkcoronavirus.com"; sid:587874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacdcovid19.com"; sid:587875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovidcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovidcontrol.com"; sid:587876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gel-antibacterial-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gel-antibacterial-covid-19.com"; sid:587877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gencovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gencovid2020.com"; sid:587878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-tested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-tested.com"; sid:587879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghcovid.com"; sid:587880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidtests.com"; sid:587881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicstrategygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicstrategygroup.com"; sid:587882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtncovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtncovidtracker.com"; sid:587883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthyworksitecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthyworksitecovid-19testing.com"; sid:587884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidkids.com"; sid:587885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidkids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidkids.net"; sid:587886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herdimmunitycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herdimmunitycovid19.net"; sid:587887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herdimmunitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herdimmunitycovid.com"; sid:587888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heretohelpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heretohelpcovid19.com"; sid:587889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herocovid19.com"; sid:587890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hijoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hijoscovid19.com"; sid:587891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hita-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hita-covid.net"; sid:587892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodisinfectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodisinfectcovid19.com"; sid:587893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopandemic.com"; sid:587894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hulpbijcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hulpbijcorona.com"; sid:587895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygiaphone-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygiaphone-covid.com"; sid:587896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygiene-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygiene-covid.com"; sid:587897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ikickcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ikickcorona.com"; sid:587898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immune-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immune-covid-19.com"; sid:587899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impots-service-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impots-service-covid19.net"; sid:587900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indeedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indeedcovidfree.com"; sid:587901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacion-covid19.com"; sid:587902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inlandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inlandcovid.com"; sid:587903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidcancelledyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidcancelledyet.com"; sid:587904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jastro-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jastro-covid19.net"; sid:587905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuiscovid19.com"; sid:587906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewishcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewishcoronacrisis.com"; sid:587907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jewishcovidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jewishcovidcrisis.com"; sid:587908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovid19free.com"; sid:587909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovid19free.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovid19free.net"; sid:587910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobscovidfree.com"; sid:587911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jointhecoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jointhecoronation.com"; sid:587912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-covids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-covids19.com"; sid:587913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killscovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killscovids19.com"; sid:587914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kissoffcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kissoffcovid.com"; sid:587915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-covid.com"; sid:587916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l2pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l2pandemic.net"; sid:587917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laborcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laborcovid.com"; sid:587918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidstudy.com"; sid:587919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ladypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ladypandemic.com"; sid:587920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latamcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latamcovidtests.com"; sid:587921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawan-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawan-corona.club"; sid:587922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadercovid19.com"; sid:587923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnmorecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnmorecorona.com"; sid:587924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leasecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leasecovidfree.com"; sid:587925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelp-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelp-covid19.com"; sid:587926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for librecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"librecovid.com"; sid:587927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid19.com"; sid:587928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid.net"; sid:587929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilvdscoronaextease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilvdscoronaextease.com"; sid:587930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilvdscoronaextease.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilvdscoronaextease.world"; sid:587931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilvdscoronaextras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilvdscoronaextras.com"; sid:587932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lineage2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lineage2covid.com"; sid:587933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovidtest.com"; sid:587934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovidtesting.com"; sid:587935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovidvaccine.com"; sid:587936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lothiancovidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lothiancovidjobs.com"; sid:587937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecovid19.com"; sid:587938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ltcovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ltcovid19sellerplan.com"; sid:587939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasanticoronavirus.com"; sid:587940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mars-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mars-covid19.com"; sid:587941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaras-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaras-covid19.com"; sid:587942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-anticovid.com"; sid:587943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masken-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masken-corona.net"; sid:587944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskoutcovid19.com"; sid:587945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-coronavirus-design.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-coronavirus-design.com"; sid:587946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchmecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchmecovidfree.com"; sid:587947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchmecovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchmecovidfree.net"; sid:587948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaldesinfectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaldesinfectioncoronavirus.com"; sid:587949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicaldesinfectioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicaldesinfectioncovid.com"; sid:587950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmachinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmachinecoronavirus.com"; sid:587951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmachinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmachinecovid19.com"; sid:587952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metacovid.com"; sid:587953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mijncoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mijncoronastatus.com"; sid:587954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minefripostecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minefripostecovid19.com"; sid:587955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movingcovidfree.com"; sid:587956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mpucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mpucovid19.com"; sid:587957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundocovid19.com"; sid:587958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundschutz-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundschutz-corona.net"; sid:587959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababyshop.com"; sid:587960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidvaccine.com"; sid:587961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naccovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naccovid.info"; sid:587962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacincovid.com"; sid:587963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacincovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacincovid.net"; sid:587964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacovid.com"; sid:587965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacovid.net"; sid:587966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalhealthcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalhealthcovidtesting.com"; sid:587967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19info.com"; sid:587968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newzealandcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newzealandcovidfree.com"; sid:587969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovids-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovids-19.com"; sid:587970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovids19.com"; sid:587971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusww3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusww3.com"; sid:587972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nscovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nscovidcoalition.com"; sid:587973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nullcombatenocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nullcombatenocorona.com"; sid:587974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nwhcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nwhcovid19testkit.com"; sid:587975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycdannygmd-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycdannygmd-covid19.com"; sid:587976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for offcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"offcovid.com"; sid:587977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid19solutions.com"; sid:587978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecovid19test.com"; sid:587979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlineteachingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlineteachingduringcovid19.com"; sid:587980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orientacionlegalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orientacionlegalcovid.com"; sid:587981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingcoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingcoronaviruscrisis.com"; sid:587982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingcovid19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingcovid19crisis.com"; sid:587983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingthecoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingthecoronaviruscrisis.com"; sid:587984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcomingthecovid19crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcomingthecovid19crisis.com"; sid:587985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paincovid.com"; sid:587986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020baby.com"; sid:587987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020kid.com"; sid:587988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicantivirus.com"; sid:587989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicassociationoflawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicassociationoflawyers.com"; sid:587990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbaby2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbaby2020.com"; sid:587991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbunker.com"; sid:587992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccarepackage.com"; sid:587993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccarepackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccarepackages.com"; sid:587994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccompany.com"; sid:587995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-emergency.com"; sid:587996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfeed.com"; sid:587997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfutbol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfutbol.com"; sid:587998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicheros.com"; sid:587999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinfonow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinfonow.com"; sid:588000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickid2020.com"; sid:588001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-labs.com"; sid:588002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicllc.com"; sid:588003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewsnow.com"; sid:588004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoftruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoftruth.com"; sid:588005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpast.com"; sid:588006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpasts.com"; sid:588007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolemic.com"; sid:588008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpotluck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpotluck.com"; sid:588009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofseattle.com"; sid:588010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-resilient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-resilient.com"; sid:588011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresistance.com"; sid:588012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.school - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.school"; sid:588013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshow.com"; sid:588014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshows.com"; sid:588015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsplus.com"; sid:588016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalwear.com"; sid:588017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictheshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictheshow.com"; sid:588018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictrackingnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictrackingnetwork.com"; sid:588019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarningnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarningnetwork.com"; sid:588020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarningsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarningsystem.com"; sid:588021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicws.com"; sid:588022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicxpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicxpress.com"; sid:588023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parafarmaciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parafarmaciacovid19.com"; sid:588024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penawarcovid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penawarcovid19screening.com"; sid:588025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalcoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalcoronastatus.com"; sid:588026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsofcovid.com"; sid:588027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pimacountycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pimacountycovid19testing.com"; sid:588028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plandecontingenciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plandecontingenciacovid.com"; sid:588029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcovidfree.com"; sid:588030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portablesinkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portablesinkcovid19.com"; sid:588031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positifcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positifcoronavirus.com"; sid:588032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaeurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaeurope.com"; sid:588033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19investing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19investing.com"; sid:588034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19planning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19planning.com"; sid:588035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmoney.com"; sid:588036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidplanning.com"; sid:588037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe4corona.com"; sid:588038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for printsforpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"printsforpandemicrelief.com"; sid:588039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatcoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatcoronastatus.com"; sid:588040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for processcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"processcovid.com"; sid:588041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid-19.com"; sid:588042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionescoronavirus.com"; sid:588043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionescovid19.com"; sid:588044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protec-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protec-covid.com"; sid:588045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectorescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectorescoronavirus.com"; sid:588046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionecovid-19.com"; sid:588047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebascovidec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebascovidec.com"; sid:588048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pspandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pspandemicresponse.com"; sid:588049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycovid-19.com"; sid:588050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pussypandemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pussypandemic.biz"; sid:588051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rainbow-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rainbow-covid.com"; sid:588052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rainbowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rainbowcovid.com"; sid:588053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rajcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rajcovid19.info"; sid:588054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ramdancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ramdancovid19.com"; sid:588055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19check.com"; sid:588056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19test.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19test.today"; sid:588057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidresponsecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidresponsecovidtest.com"; sid:588058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid-19.com"; sid:588059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recursomultacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recursomultacoronavirus.com"; sid:588060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for regencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"regencovid-19.com"; sid:588061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rehabcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rehabcovid.com"; sid:588062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relawancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relawancovid19.com"; sid:588063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberingcovid-19.com"; sid:588064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remembermecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remembermecovid19.com"; sid:588065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rentcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rentcovidfree.com"; sid:588066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rescovid19.com"; sid:588067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rescuecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rescuecovid-19.com"; sid:588068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rescuecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rescuecovid19.com"; sid:588069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resetcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resetcovid19.com"; sid:588070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retourautravailcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retourautravailcovid.com"; sid:588071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riassicuriamoci-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riassicuriamoci-covid.com"; sid:588072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridecovidfree19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridecovidfree19.com"; sid:588073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridecovidfree.com"; sid:588074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridyourselfofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridyourselfofcovid19.com"; sid:588075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridyourselfofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridyourselfofcovid.com"; sid:588076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rwd-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rwd-covid-19.com"; sid:588077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rwd-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rwd-covid-19.net"; sid:588078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rwe-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rwe-covid-19.net"; sid:588079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safedateingcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safedateingcovid19free.com"; sid:588080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safedateingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safedateingcovidfree.com"; sid:588081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycountpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycountpandemic.com"; sid:588082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycountpandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycountpandemic.info"; sid:588083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetycountpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetycountpandemic.net"; sid:588084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetystorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetystorecoronavirus.com"; sid:588085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitaricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitaricoronavirus.com"; sid:588086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitarycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitarycovid.com"; sid:588087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizacioncovid.com"; sid:588088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizer-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizer-coronavirus.com"; sid:588089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscoronavirus.info"; sid:588090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19medication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19medication.com"; sid:588091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19meds.com"; sid:588092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayno2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayno2covid.com"; sid:588093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scan2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scan2covid.com"; sid:588094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secretsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secretsofcovid19.com"; sid:588095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniordateingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniordateingcovidfree.com"; sid:588096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidfree.com"; sid:588097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-stopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-stopcoronavirus.com"; sid:588098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-stopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-stopcovid19.com"; sid:588099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signofcovid19.com"; sid:588100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsofcovid19.com"; sid:588101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsofcovid.com"; sid:588102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for silentpandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"silentpandemic.info"; sid:588103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slowcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slowcovidmask.com"; sid:588104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sociocoronalogy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sociocoronalogy.com"; sid:588105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-coronavirus.net"; sid:588106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for springcleaningcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"springcleaningcorona.com"; sid:588107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizationcoronavirus.com"; sid:588108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.club"; sid:588109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19.club"; sid:588110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.cloud"; sid:588111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidtransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidtransport.com"; sid:588112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for straightouttacovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"straightouttacovid.biz"; sid:588113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplycovid19.com"; sid:588114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivalsuppliescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivalsuppliescovid19.com"; sid:588115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcovid.net"; sid:588116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swiftcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swiftcovid19test.com"; sid:588117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for szczepieniecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"szczepieniecovid-19.com"; sid:588118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covidvirus.com"; sid:588119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19direct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19direct.com"; sid:588120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcovid-19.com"; sid:588121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidecovid19.com"; sid:588122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testycovid19.com"; sid:588123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texancovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texancovidresources.com"; sid:588124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronabusters.com"; sid:588125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovid2019.com"; sid:588126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechurchaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechurchaftercoronavirus.com"; sid:588127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechurchaftercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechurchaftercoronavirus.net"; sid:588128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababyshop.com"; sid:588129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacrew.com"; sid:588130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadivide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadivide.com"; sid:588131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronahugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronahugs.com"; sid:588132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaspecialist.com"; sid:588133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaspecialists.com"; sid:588134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19directory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19directory.com"; sid:588135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconsortium.com"; sid:588136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconsortium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconsortium.net"; sid:588137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidflower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidflower.com"; sid:588138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidflower.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidflower.net"; sid:588139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidforum.com"; sid:588140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidking.com"; sid:588141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstoriesproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstoriesproject.com"; sid:588142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidyear.com"; sid:588143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therapycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therapycovid.com"; sid:588144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldincorona.com"; sid:588145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanblues.com"; sid:588146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thongtincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thongtincovid19.com"; sid:588147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ticovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ticovideo.com"; sid:588148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tindercovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tindercovid19free.com"; sid:588149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tindercovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tindercovidfree.com"; sid:588150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidtest.com"; sid:588151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidtests.com"; sid:588152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcorona.com"; sid:588153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcoronavirus.com"; sid:588154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackdowncovid19.com"; sid:588155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcovidfree.com"; sid:588156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triagecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triagecovid.net"; sid:588157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscoronafailures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscoronafailures.com"; sid:588158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcorona.com"; sid:588159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tucsoncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tucsoncovid19testing.com"; sid:588160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uk-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uk-covid19.info"; sid:588161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for undermorecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"undermorecovid2020.com"; sid:588162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usagainstcovid19.com"; sid:588163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19vaccination.com"; sid:588164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccoronavirusdisinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccoronavirusdisinfectionservice.com"; sid:588165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid-19.com"; sid:588166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid-19disinfectioncertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid-19disinfectioncertification.com"; sid:588167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid-19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid-19disinfection.com"; sid:588168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxcovid.com"; sid:588169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for velocitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"velocitycovid19.com"; sid:588170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for venturacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"venturacovid19.com"; sid:588171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vinicoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vinicoronas.com"; sid:588172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visierecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visierecovid.com"; sid:588173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visierescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visierescovid.com"; sid:588174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-m-cards-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-m-cards-covid19.com"; sid:588175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vrzncovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vrzncovidrelief.com"; sid:588176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallofcovid.com"; sid:588177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wanwuhang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wanwuhang.com"; sid:588178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wartimecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wartimecovid.com"; sid:588179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wcovidcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wcovidcoin.com"; sid:588180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wherecanigetcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wherecanigetcoronavirustest.com"; sid:588181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheretobuycoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheretobuycoronamasks.com"; sid:588182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wheretobuycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wheretobuycovidmasks.com"; sid:588183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whycovid.com"; sid:588184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcovid.com"; sid:588185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcovid19free.com"; sid:588186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcovidfree.com"; sid:588187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscompcoronaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscompcoronaclaims.com"; sid:588188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscompcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscompcovidclaims.com"; sid:588189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worksitecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worksitecovid-19testing.com"; sid:588190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwar3covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwar3covid-19.com"; sid:588191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwarepidemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwarepidemic.biz"; sid:588192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanblues.com"; sid:588193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfapiao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfapiao.com"; sid:588194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanflu2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanflu2020.com"; sid:588195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanminhaiwuliiuyouxiangongsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanminhaiwuliiuyouxiangongsi.com"; sid:588196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshanqiyiyuan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshanqiyiyuan.com"; sid:588197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronavirusattorney.com"; sid:588198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronavirusclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronavirusclaims.com"; sid:588199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcoronaviruslawfirm.com"; sid:588200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovid19attorney.com"; sid:588201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovid19claims.com"; sid:588202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wvcovid19lawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wvcovid19lawfirm.com"; sid:588203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ww3novelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ww3novelcoronavirus.com"; sid:588204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--espaacovid-w9a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--espaacovid-w9a.com"; sid:588205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--proteccincoronavirus-i8b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--proteccincoronavirus-i8b.com"; sid:588206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alpharettacovidcleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alpharettacovidcleaningservice.com"; sid:588207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alpharettacovidcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alpharettacovidcleaningservices.com"; sid:588208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argvscovid19.com"; sid:588209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurance-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurance-covid19.com"; sid:588210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcovidfree.com"; sid:588211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrierecovidfrre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrierecovidfrre.com"; sid:588212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bycorona.net"; sid:588213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecorona.net"; sid:588214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19wuhan2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19wuhan2020.com"; sid:588215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camisetascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camisetascovid19.com"; sid:588216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camisetascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camisetascovid19.net"; sid:588217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidfreeworkplace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidfreeworkplace.net"; sid:588218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifycovidfree.com"; sid:588219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifycovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifycovidfree.net"; sid:588220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasingcovidcohort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasingcovidcohort.com"; sid:588221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasingcovidcohort.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasingcovidcohort.net"; sid:588222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connect4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connect4covid.net"; sid:588223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-20.com"; sid:588224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afscherming.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afscherming.net"; sid:588225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aktuell.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aktuell.net"; sid:588226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aufkleber.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aufkleber.net"; sid:588227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborealmp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborealmp.com"; sid:588228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburnout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburnout.net"; sid:588229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardlive.com"; sid:588230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cat.com"; sid:588231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation2021.com"; sid:588232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningpro.com"; sid:588233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongress.net"; sid:588234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadept19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadept19.com"; sid:588235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-divider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-divider.com"; sid:588236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencycleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencycleaners.com"; sid:588237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencycleaners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencycleaners.net"; sid:588238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguilt.com"; sid:588239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahairblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahairblues.com"; sid:588240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvoice.com"; sid:588241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitty.com"; sid:588242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-litigation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-litigation.net"; sid:588243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamour.com"; sid:588244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicselftestkit.com"; sid:588245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapuppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapuppy.com"; sid:588246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quicktest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quicktest.net"; sid:588247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rescue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rescue.net"; sid:588248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponseteam.com"; sid:588249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascherm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascherm.net"; sid:588250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltester.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltester.net"; sid:588251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzmasken.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzmasken.net"; sid:588252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzsysteme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzsysteme.com"; sid:588253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasells.com"; sid:588254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasettlement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasettlement.net"; sid:588255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuffering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuffering.com"; sid:588256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatel19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatel19.com"; sid:588257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-zentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-zentrum.com"; sid:588258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatogel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatogel.net"; sid:588259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunsubscribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunsubscribe.com"; sid:588260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineafrica.com"; sid:588261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineindia.com"; sid:588262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19all.com"; sid:588263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-bcg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-bcg.com"; sid:588264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19hoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19hoy.com"; sid:588265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisisengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisisengland.com"; sid:588266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexaminer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexaminer.com"; sid:588267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussincensura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussincensura.com"; sid:588268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusworldwide.com"; sid:588269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaker.com"; sid:588270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counter-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counter-covid.net"; sid:588271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advance.com"; sid:588272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentesting.com"; sid:588273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chart.net"; sid:588274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-consultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-consultants.net"; sid:588275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cosmeticsurgery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cosmeticsurgery.com"; sid:588276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crime.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crime.net"; sid:588277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crimes.net"; sid:588278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-data.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-data.net"; sid:588279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectiondogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectiondogs.com"; sid:588280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dryfogsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dryfogsolutions.com"; sid:588281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ebook.com"; sid:588282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employertesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employertesting.com"; sid:588283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-finance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-finance.com"; sid:588284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fraud.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fraud.net"; sid:588285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19galaxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19galaxy.com"; sid:588286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guncelgelismeler.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guncelgelismeler.net"; sid:588287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hk.com"; sid:588288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunes.com"; sid:588289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intensity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intensity.com"; sid:588290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalresources.com"; sid:588291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makerchalenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makerchalenge.com"; sid:588292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makerschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makerschallenge.com"; sid:588293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19omg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19omg.com"; sid:588294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passchitradurga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passchitradurga.com"; sid:588295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rajko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rajko.com"; sid:588296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefstorecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefstorecom.com"; sid:588297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19result.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19result.net"; sid:588298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskreport.com"; sid:588299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19settlement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19settlement.net"; sid:588300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlement.net"; sid:588301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shoppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shoppe.com"; sid:588302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilizing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilizing.net"; sid:588303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tasks.com"; sid:588304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtome.com"; sid:588305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testtome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testtome.net"; sid:588306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toes.com"; sid:588307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.education"; sid:588308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattorneys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattorneys.net"; sid:588309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedbusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedbusiness.net"; sid:588310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedworkplace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedworkplace.net"; sid:588311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleared.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleared.net"; sid:588312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollection.net"; sid:588313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconspiracy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconspiracy.net"; sid:588314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoture.com"; sid:588315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecontaminationcleaning.com"; sid:588316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseproducts.com"; sid:588317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployertesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployertesting.com"; sid:588318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfes.com"; sid:588319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudattorney.net"; sid:588320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudattorneys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudattorneys.net"; sid:588321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecampus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecampus.net"; sid:588322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertifiedworkplace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertifiedworkplace.net"; sid:588323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeshopping.com"; sid:588324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesolutions.net"; sid:588325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunder.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunder.net"; sid:588326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenre.com"; sid:588327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphy.com"; sid:588328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidh20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidh20.com"; sid:588329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidh20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidh20.net"; sid:588330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiology.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiology.net"; sid:588331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.life"; sid:588332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabexpress.com"; sid:588333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlies.net"; sid:588334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlineup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlineup.com"; sid:588335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovers.com"; sid:588336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnormal.com"; sid:588337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingattorney.com"; sid:588338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonsite.com"; sid:588339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonsitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonsitetesting.com"; sid:588340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organics.net"; sid:588341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.net"; sid:588342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorra.com"; sid:588343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutfitter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutfitter.com"; sid:588344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicyproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicyproject.com"; sid:588345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreneurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreneurs.com"; sid:588346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrajkot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrajkot.com"; sid:588347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoes.net"; sid:588348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracer.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracer.training"; sid:588349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingmap.com"; sid:588350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidt-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidt-s.com"; sid:588351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidview.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidview.net"; sid:588352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct7covid1981.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct7covid1981.net"; sid:588353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealsforcovid19.com"; sid:588354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirusmallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirusmallorca.com"; sid:588355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid19mallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid19mallorca.com"; sid:588356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecoronavirus.net"; sid:588357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid-19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid-19-france.com"; sid:588358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidya.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidya.net"; sid:588359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapaaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapaaocovid.com"; sid:588360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciosincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciosincovid19.com"; sid:588361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurocovid19.net"; sid:588362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurocovid.net"; sid:588363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid2019.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid2019.net"; sid:588364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcorona-19.com"; sid:588365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid.net"; sid:588366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19funds.com"; sid:588367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsigns.com"; sid:588368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirushometestkit.com"; sid:588369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19hometestkit.com"; sid:588370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemichometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemichometestkit.com"; sid:588371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroisdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroisdacovid19.com"; sid:588372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highschoolstudentsagainstcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highschoolstudentsagainstcovid19.net"; sid:588373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteleslibresdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteleslibresdecovid.com"; sid:588374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelessincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelessincovid.com"; sid:588375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indeminite-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indeminite-coronavirus.com"; sid:588376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indeminite-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indeminite-covid19.com"; sid:588377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19now.com"; sid:588378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronapandemic.com"; sid:588379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kisscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kisscovid19.com"; sid:588380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-after-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-after-pandemic.com"; sid:588381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localecovidfree.com"; sid:588382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19awareness.com"; sid:588383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovid-19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovid-19hometestkit.com"; sid:588384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecoronavirusnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecoronavirusnation.com"; sid:588385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osteoporosisycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osteoporosisycovid.com"; sid:588386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxyshieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxyshieldcovid19.com"; sid:588387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pack-protection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pack-protection-covid19.com"; sid:588388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packprotectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packprotectioncovid19.com"; sid:588389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpolicynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpolicynews.com"; sid:588390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsystems.com"; sid:588391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusexposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusexposed.com"; sid:588392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwater.com"; sid:588393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelcovid19.com"; sid:588394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for para-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"para-covid.com"; sid:588395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perfectcovidmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perfectcovidmatch.com"; sid:588396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicinvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicinvestor.com"; sid:588397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raisingcovidawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raisingcovidawareness.com"; sid:588398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salescorona.com"; sid:588399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizandocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizandocovid19.com"; sid:588400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorescovid19.com"; sid:588401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincecorona.com"; sid:588402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strongertogethercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strongertogethercovid19.com"; sid:588403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tctcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tctcovid.info"; sid:588404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thankcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thankcoronavirus.com"; sid:588405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tienda-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tienda-covid.com"; sid:588406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelcovid19.com"; sid:588407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscoronanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscoronanation.com"; sid:588408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacacionessincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacacionessincoronavirus.com"; sid:588409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viajarsincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viajarsincoronavirus.com"; sid:588410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vrcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vrcovid-19.com"; sid:588411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wercovid.com"; sid:588412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wnycovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wnycovidprotection.com"; sid:588413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrong-about-covid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrong-about-covid.club"; sid:588414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusexposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusexposed.com"; sid:588415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirushometestkit.com"; sid:588416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirussurvivors.com"; sid:588417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zaijiancorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zaijiancorona.net"; sid:588418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100proofcovid19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100proofcovid19prevention.com"; sid:588419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidrelief.com"; sid:588420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidstore.com"; sid:588421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidsupport.com"; sid:588422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1howtokillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1howtokillcovid19.com"; sid:588423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemictracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemictracking.com"; sid:588424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dpandemic.com"; sid:588425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 420coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"420coronavirus.com"; sid:588426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covid19law.com"; sid:588427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidlaw.com"; sid:588428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid-19.com"; sid:588429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid19legal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid19legal.com"; sid:588430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covidhelp.com"; sid:588431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcovid.com"; sid:588432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesorioscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesorioscovid.com"; sid:588433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acildecovid19yaklasimlari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acildecovid19yaklasimlari.com"; sid:588434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for addiocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"addiocorona.com"; sid:588435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for addiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"addiocovid.com"; sid:588436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adeuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adeuscorona.com"; sid:588437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adieucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adieucorona.com"; sid:588438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventhealthexamencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventhealthexamencoronavirus.com"; sid:588439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affinitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affinitycovid19.com"; sid:588440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affinitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affinitycovid.com"; sid:588441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affinitycovidehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affinitycovidehealth.com"; sid:588442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affinitycovidtelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affinitycovidtelehealth.com"; sid:588443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid-19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid-19cases.com"; sid:588444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronavirus.world"; sid:588445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidplan.com"; sid:588446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidfree.com"; sid:588447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidfreeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidfreeservices.com"; sid:588448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertscovid.com"; sid:588449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliancecovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliancecovid19sellerplan.com"; sid:588450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcoronavirus.com"; sid:588451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovid-19.com"; sid:588452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altolacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altolacoronavirus.com"; sid:588453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altolacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altolacovid-19.com"; sid:588454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altolacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altolacovid19.com"; sid:588455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovidmasks.com"; sid:588456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annyeongcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annyeongcorona.com"; sid:588457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycoronavirustest.com"; sid:588458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid.com"; sid:588459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestforcorona.com"; sid:588460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestingcovid19.com"; sid:588461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestingcovid.com"; sid:588462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestingforcovid19.com"; sid:588463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodytestingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodytestingforcovid.com"; sid:588464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaa.com"; sid:588465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirus-covid19.com"; sid:588466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcoalition.com"; sid:588467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoviditalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoviditalia.com"; sid:588468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidspray.com"; sid:588469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antimicrobialcoatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antimicrobialcoatingcoronavirus.com"; sid:588470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antimicrobialcoatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antimicrobialcoatingcovid19.com"; sid:588471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivaccinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivaccinecovid.com"; sid:588472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcoatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcoatingcoronavirus.com"; sid:588473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcoatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcoatingcovid19.com"; sid:588474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingbutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingbutcovid.com"; sid:588475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apacovid.com"; sid:588476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistencialegalcovidpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistencialegalcovidpr.com"; sid:588477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associazioneitalianavittimecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associazioneitalianavittimecoronavirus.com"; sid:588478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcorona.com"; sid:588479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecoronavirustest.com"; sid:588480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecoronavirustesting.com"; sid:588481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid-19test.com"; sid:588482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-home-covid-19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-home-covid-19-testing.com"; sid:588483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid19testkit.com"; sid:588484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid-19tests.com"; sid:588485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19ready.com"; sid:588486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovid19ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovid19ready.com"; sid:588487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atomocovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atomocovid-19test.com"; sid:588488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atomocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atomocovid19test.com"; sid:588489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aurevoircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aurevoircorona.com"; sid:588490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotests-coronavirus-smartphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotests-coronavirus-smartphone.com"; sid:588491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotests-covid-smartphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotests-covid-smartphone.com"; sid:588492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for axelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"axelcovid19.com"; sid:588493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bakingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bakingpandemic.com"; sid:588494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bands-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bands-against-corona.com"; sid:588495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcelonacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcelonacovidfree.com"; sid:588496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barriere-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barriere-covid19.com"; sid:588497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrierecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrierecovid19.com"; sid:588498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrierecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrierecovidfree.com"; sid:588499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrieres-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrieres-covid19.com"; sid:588500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbmpcovidsms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbmpcovidsms.com"; sid:588501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdl-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdl-covid.com"; sid:588502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidusa.com"; sid:588503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidclean.com"; sid:588504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beratungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beratungcorona.com"; sid:588505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beratung-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beratung-corona.net"; sid:588506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beratungcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beratungcorona.net"; sid:588507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcorona-19.com"; sid:588508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcorona-19.xn--mk1bu44c - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcorona-19.xn--mk1bu44c"; sid:588509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid-19.xn--mk1bu44c - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid-19.xn--mk1bu44c"; sid:588510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicicletacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicicletacovid-19.com"; sid:588511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicicletacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicicletacovid19.com"; sid:588512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicicletascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicicletascovid-19.com"; sid:588513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biciscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biciscovid-19.com"; sid:588514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biciscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biciscovid19.com"; sid:588515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenspandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenspandemicresponse.com"; sid:588516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosaludcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosaludcovid19.com"; sid:588517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioseguridadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioseguridadcovid19.com"; sid:588518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioseguridadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioseguridadcovid.com"; sid:588519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosynex-testcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosynex-testcovid19.com"; sid:588520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronalawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronalawyer.com"; sid:588521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronaviruslawyer.com"; sid:588522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blindsidedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blindsidedbycovid19.com"; sid:588523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for booknocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"booknocovid.com"; sid:588524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bsbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bsbycovid19.com"; sid:588525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business-resource-facebook-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business-resource-facebook-covid-19.com"; sid:588526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy4covid-19.com"; sid:588527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy4covid19.com"; sid:588528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19rapidtest.com"; sid:588529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyforcovid-19.com"; sid:588530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyforcovid19.com"; sid:588531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyemycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyemycorona.com"; sid:588532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19lawyers.com"; sid:588533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidbankruptcy.com"; sid:588534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidlawyers.com"; sid:588535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitalismaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitalismaftercovid.com"; sid:588536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcleancovid19.com"; sid:588537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascovid19.com"; sid:588538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cars4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cars4covid.com"; sid:588539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causacovid.com"; sid:588540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeforcovid19.com"; sid:588541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccscovid19.com"; sid:588542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdzcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdzcovid.com"; sid:588543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrotestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrotestcoronavirus.com"; sid:588544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certfiedcovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certfiedcovid19safe.com"; sid:588545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificatdimmunitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificatdimmunitecovid19.com"; sid:588546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificatsdimmunitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificatsdimmunitecovid19.com"; sid:588547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19safe.com"; sid:588548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidfreeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidfreeworkplace.com"; sid:588549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid2020.com"; sid:588550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidtest.com"; sid:588551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicovid-19.com"; sid:588552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicovid19.com"; sid:588553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovidsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovidsettlement.com"; sid:588554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofwuhan.com"; sid:588555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronaservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronaservice.com"; sid:588556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronaservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronaservices.com"; sid:588557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningthecorona.com"; sid:588558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningthecoronavirus.com"; sid:588559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedcovid19.com"; sid:588560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clientscovidmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clientscovidmexico.com"; sid:588561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicacovidfree.com"; sid:588562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloudallycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloudallycovid19.com"; sid:588563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coalitioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coalitioncovid.com"; sid:588564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoviddriveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoviddriveup.com"; sid:588565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codingduringcovid.com"; sid:588566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitiesaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitiesaftercovid.com"; sid:588567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companiesaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companiesaftercovid.com"; sid:588568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companiesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companiesofcorona.com"; sid:588569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovidkill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovidkill.com"; sid:588570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confinement-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confinement-covid19.com"; sid:588571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connect4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connect4covid.com"; sid:588572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracoronavirusonline.com"; sid:588573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for control-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"control-covid19.com"; sid:588574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornersforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornersforcovid.com"; sid:588575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cornonaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cornonaviruspandemic.com"; sid:588576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19prevention.com"; sid:588577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa19.com"; sid:588578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactivism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactivism.com"; sid:588579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-afterlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-afterlife.com"; sid:588580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaag.com"; sid:588581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanger.com"; sid:588582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbitration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbitration.com"; sid:588583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabells.com"; sid:588584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beschilderung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beschilderung.com"; sid:588585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiology.com"; sid:588586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablau.com"; sid:588587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonding.com"; sid:588588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborder.com"; sid:588589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborders.com"; sid:588590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bowl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bowl.com"; sid:588591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuild.com"; sid:588592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cabin.com"; sid:588593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashchronicles.com"; sid:588594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation20.com"; sid:588595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachemistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachemistry.com"; sid:588596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachest.com"; sid:588597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachroniclesdreamer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachroniclesdreamer.com"; sid:588598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaimnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaimnow.com"; sid:588599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningprofessionals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningprofessionals.com"; sid:588600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cleaningpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cleaningpros.com"; sid:588601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaning-pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaning-pros.com"; sid:588602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedyblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedyblog.com"; sid:588603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conflicts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conflicts.com"; sid:588604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongress.com"; sid:588605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontain.net"; sid:588606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrivia.com"; sid:588607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidclean.com"; sid:588608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrushers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrushers.com"; sid:588609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ctf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ctf.com"; sid:588610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactivism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactivism.com"; sid:588611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacube.com"; sid:588612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cuts.com"; sid:588613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadementia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadementia.com"; sid:588614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestroyerga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestroyerga.com"; sid:588615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiplomas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiplomas.com"; sid:588616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisplay.com"; sid:588617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistancer.com"; sid:588618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoc.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoc.vision"; sid:588619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeliminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeliminate.com"; sid:588620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-eltern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-eltern.com"; sid:588621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeltern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeltern.com"; sid:588622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexhibition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexhibition.com"; sid:588623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeyespecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeyespecialist.com"; sid:588624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafab.com"; sid:588625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafarts.com"; sid:588626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafasting.com"; sid:588627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fat.com"; sid:588628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeenterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeenterprises.com"; sid:588629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreerestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreerestaurants.com"; sid:588630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunvibes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunvibes.com"; sid:588631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gang.com"; sid:588632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagap.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagap.solutions"; sid:588633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagdp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagdp.com"; sid:588634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagearco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagearco.com"; sid:588635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagolfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagolfer.com"; sid:588636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrief.com"; sid:588637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrieving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrieving.com"; sid:588638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guards.com"; sid:588639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahabits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahabits.com"; sid:588640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hack.com"; sid:588641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahallofshame.com"; sid:588642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahatred.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahatred.com"; sid:588643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahedging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahedging.com"; sid:588644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheir.com"; sid:588645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheiress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheiress.com"; sid:588646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-bayern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-bayern.com"; sid:588647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomesale.com"; sid:588648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahome-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahome-test.com"; sid:588649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hulpmiddelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hulpmiddelen.com"; sid:588650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahulpmiddelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahulpmiddelen.com"; sid:588651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjuryhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjuryhelp.com"; sid:588652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainquiry.com"; sid:588653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsomnia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsomnia.com"; sid:588654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaistatistik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaistatistik.com"; sid:588655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jazz-help.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jazz-help.support"; sid:588656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajisyukutyu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajisyukutyu.com"; sid:588657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kabine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kabine.com"; sid:588658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeychain.com"; sid:588659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersusa.com"; sid:588660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillga.com"; sid:588661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kinderstudie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kinderstudie.com"; sid:588662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitme.com"; sid:588663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalandlord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalandlord.com"; sid:588664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalandscaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalandscaper.com"; sid:588665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-leaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-leaks.com"; sid:588666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalgbtq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalgbtq.com"; sid:588667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalize.com"; sid:588668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocker.com"; sid:588669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask4u.com"; sid:588670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-maske24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-maske24.com"; sid:588671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masken.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masken.today"; sid:588672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskforce.com"; sid:588673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masks24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masks24.com"; sid:588674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksforyou.com"; sid:588675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mediation.com"; sid:588676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicate.com"; sid:588677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicated.com"; sid:588678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedspa.com"; sid:588679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminority.com"; sid:588680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamother.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamother.com"; sid:588681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanaturalcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanaturalcures.com"; sid:588682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanegligence.com"; sid:588683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanger.com"; sid:588684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronansfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronansfw.com"; sid:588685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutritionist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutritionist.com"; sid:588686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficetesting.com"; sid:588687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonline19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonline19.com"; sid:588688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganic.com"; sid:588689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganics.com"; sid:588690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaown.com"; sid:588691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaleo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaleo.com"; sid:588692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemichometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemichometestkit.com"; sid:588693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicmasks.com"; sid:588694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassports.com"; sid:588695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassqrcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassqrcode.com"; sid:588696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonaltestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonaltestkit.com"; sid:588697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplane.com"; sid:588698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-podcast.com"; sid:588699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoor.com"; sid:588700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoverty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoverty.com"; sid:588701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prediction.com"; sid:588702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapressure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapressure.com"; sid:588703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapressures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapressures.com"; sid:588704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapride.com"; sid:588705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofiling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofiling.com"; sid:588706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofschool.com"; sid:588707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectgear.com"; sid:588708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionshield.com"; sid:588709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionwall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionwall.com"; sid:588710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquell.com"; sid:588711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquit.com"; sid:588712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaracism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaracism.com"; sid:588713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rapidtesting.com"; sid:588714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtestingkit.com"; sid:588715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaratings.com"; sid:588716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefi.com"; sid:588717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregistry2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregistry2020.com"; sid:588718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevalidatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevalidatie.com"; sid:588719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeschool.com"; sid:588720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysolution.com"; sid:588721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascheck.com"; sid:588722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz24.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz24.net"; sid:588723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzprodukte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzprodukte.com"; sid:588724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzschild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzschild.com"; sid:588725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutz-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutz-shop.com"; sid:588726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-screens.com"; sid:588727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield.world"; sid:588728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop19.com"; sid:588729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasketchbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasketchbook.com"; sid:588730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmallbusinesscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmallbusinesscounseling.com"; sid:588731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmelltest.com"; sid:588732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-smitte-stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-smitte-stop.com"; sid:588733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-smittestop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-smittestop.com"; sid:588734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmittestop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmittestop.com"; sid:588735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmoking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmoking.com"; sid:588736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneeze.com"; sid:588737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spiracy.com"; sid:588738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatics.com"; sid:588739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatusregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatusregistry.com"; sid:588740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastd.com"; sid:588741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastds.com"; sid:588742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastigma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastigma.com"; sid:588743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stoppers.com"; sid:588744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateachers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateachers.com"; sid:588745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestforhome.com"; sid:588746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testingkit.com"; sid:588747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoes.com"; sid:588748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackeruganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackeruganda.com"; sid:588749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveling.com"; sid:588750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrek.com"; sid:588751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatyze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatyze.com"; sid:588752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinechina.com"; sid:588753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinetexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinetexas.com"; sid:588754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirish.com"; sid:588755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19india.com"; sid:588756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19memorialpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19memorialpage.com"; sid:588757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19memorial-page.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19memorial-page.com"; sid:588758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19tracker.com"; sid:588759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus234276222.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus234276222.com"; sid:588760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus40.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus40.com"; sid:588761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabogados.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabogados.net"; sid:588762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusag.com"; sid:588763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantigentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantigentesting.com"; sid:588764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyprotection.com"; sid:588765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbcg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbcg.com"; sid:588766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbdlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbdlive.com"; sid:588767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestadvice.com"; sid:588768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbo.com"; sid:588769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarwash.com"; sid:588770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscasesdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscasesdaily.com"; sid:588771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningalbuquerque.com"; sid:588772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninganaheim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninganaheim.com"; sid:588773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninganddisinfectioncompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninganddisinfectioncompanies.com"; sid:588774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningarlington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningarlington.com"; sid:588775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningauroa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningauroa.com"; sid:588776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbaltimore.com"; sid:588777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbatonrouge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbatonrouge.com"; sid:588778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbiloxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbiloxi.com"; sid:588779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbirmingham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbirmingham.com"; sid:588780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcalifornia.com"; sid:588781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcharleston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcharleston.com"; sid:588782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningchattanooga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningchattanooga.com"; sid:588783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcincinnati.com"; sid:588784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcleveland.com"; sid:588785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcolorado.com"; sid:588786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcoloradosprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcoloradosprings.com"; sid:588787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcompaniesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcompaniesnearme.com"; sid:588788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningconnecticut.com"; sid:588789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdetroit.com"; sid:588790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningfresno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningfresno.com"; sid:588791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningftlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningftlauderdale.com"; sid:588792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninggulfshores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninggulfshores.com"; sid:588793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninghawaii.com"; sid:588794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninghonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninghonolulu.com"; sid:588795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningjackson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningjackson.com"; sid:588796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningkansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningkansascity.com"; sid:588797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningla.com"; sid:588798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglafayette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglafayette.com"; sid:588799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmanhattan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmanhattan.com"; sid:588800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmaryland.com"; sid:588801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmassachusetts.com"; sid:588802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmilwaukee.com"; sid:588803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningminneapolis.com"; sid:588804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningminnesota.com"; sid:588805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmississippi.com"; sid:588806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmissouri.com"; sid:588807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmyrtlebeach.com"; sid:588808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnewhampshire.com"; sid:588809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnewjersey.com"; sid:588810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnorfolk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnorfolk.com"; sid:588811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningoakland.com"; sid:588812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningohio.com"; sid:588813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningoklahoma.com"; sid:588814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningomaha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningomaha.com"; sid:588815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningorangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningorangecounty.com"; sid:588816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningorlando.com"; sid:588817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpittsburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpittsburgh.com"; sid:588818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningportland.com"; sid:588819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningraleigh.com"; sid:588820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningreno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningreno.com"; sid:588821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningriverside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningriverside.com"; sid:588822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsacramento.com"; sid:588823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsaltlake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsaltlake.com"; sid:588824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsanddiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsanddiego.com"; sid:588825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsavannah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsavannah.com"; sid:588826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningscottsdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningscottsdale.com"; sid:588827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningshreveport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningshreveport.com"; sid:588828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningslc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningslc.com"; sid:588829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtucson.com"; sid:588830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningvirginiabeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningvirginiabeach.com"; sid:588831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningvirginia.com"; sid:588832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningwashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningwashingtondc.com"; sid:588833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompaniesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompaniesnearme.com"; sid:588834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoronation.com"; sid:588835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19companies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19companies.com"; sid:588836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19map.com"; sid:588837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19stats.com"; sid:588838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19tracker.com"; sid:588839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecontaminationservicesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecontaminationservicesnearme.com"; sid:588840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdenuncias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdenuncias.com"; sid:588841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectiondogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectiondogs.com"; sid:588842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectioncompaniesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectioncompaniesnearme.com"; sid:588843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflattening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflattening.com"; sid:588844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflattorney.com"; sid:588845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfly.com"; sid:588846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-free.com"; sid:588847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgdp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgdp.com"; sid:588848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushaircut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushaircut.com"; sid:588849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthstore.net"; sid:588850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushhcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushhcare.com"; sid:588851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomehealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomehealthcare.com"; sid:588852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomehealth.com"; sid:588853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushypoxia.com"; sid:588854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-immune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-immune.com"; sid:588855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmuneregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmuneregistry.com"; sid:588856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-immunity.com"; sid:588857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinseattle.com"; sid:588858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskilla.com"; sid:588859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-legalhelper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-legalhelper.com"; sid:588860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalhelpline.com"; sid:588861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalresourcecenter.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalresourcecenter.today"; sid:588862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslibre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslibre.com"; sid:588863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-tracker.com"; sid:588864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmademerich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmademerich.com"; sid:588865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmexicotendencias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmexicotendencias.com"; sid:588866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoniter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoniter.com"; sid:588867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturaltreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturaltreatments.com"; sid:588868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinedoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinedoctor.com"; sid:588869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlinehealthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlinehealthstore.com"; sid:588870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplane.com"; sid:588871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoor.com"; sid:588872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotecciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotecciones.com"; sid:588873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rapidtesting.com"; sid:588874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremit.com"; sid:588875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourceteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourceteam.com"; sid:588876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrich.com"; sid:588877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussilenthypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussilenthypoxia.com"; sid:588878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstar.com"; sid:588879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstd.com"; sid:588880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstds.com"; sid:588881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomtracker.com"; sid:588882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustally.com"; sid:588883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestforhome.com"; sid:588884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestforhomeuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestforhomeuse.com"; sid:588885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-tracer.com"; sid:588886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimscompensation.com"; sid:588887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavocat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavocat.com"; sid:588888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavolunteering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavolunteering.com"; sid:588889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavorsorge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavorsorge.com"; sid:588890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavproject.com"; sid:588891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawagen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawagen.com"; sid:588892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawagon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawagon.com"; sid:588893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawealth.com"; sid:588894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxray.com"; sid:588895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxrays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxrays.com"; sid:588896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corsocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corsocoronavirus.com"; sid:588897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for counter-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"counter-covid.com"; sid:588898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countycovidtracker.com"; sid:588899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18-mailbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18-mailbusiness.com"; sid:588900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid193dmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid193dmask.com"; sid:588901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19401kfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19401kfix.com"; sid:588902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-access.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-access.net"; sid:588903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-alameda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-alameda.com"; sid:588904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19algerie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19algerie.com"; sid:588905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andmedicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andmedicare.com"; sid:588906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodynyc.com"; sid:588907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyrapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyrapidtestkit.com"; sid:588908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyrapidtestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyrapidtestkit.net"; sid:588909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestingnyc.com"; sid:588910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestnyc.com"; sid:588911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antiviralcoating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antiviralcoating.com"; sid:588912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antybodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antybodytesting.com"; sid:588913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-art.com"; sid:588914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomekits.com"; sid:588915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atostimulus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atostimulus.com"; sid:588916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankbailout.com"; sid:588917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyprotection.com"; sid:588918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banks.com"; sid:588919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19barrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19barrier.com"; sid:588920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bayarea.com"; sid:588921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bay.com"; sid:588922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-berkeley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-berkeley.com"; sid:588923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bicicleta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bicicleta.com"; sid:588924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bicicleta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bicicleta.com"; sid:588925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bicicletas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bicicletas.com"; sid:588926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bicicletas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bicicletas.com"; sid:588927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bicis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bicis.com"; sid:588928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bkprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bkprotection.com"; sid:588929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19black.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19black.com"; sid:588930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19black.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19black.net"; sid:588931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19boutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19boutique.com"; sid:588932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19btw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19btw.com"; sid:588933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessready.com"; sid:588934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerprotectionplanga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerprotectionplanga.com"; sid:588935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buys.com"; sid:588936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carcruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carcruise.com"; sid:588937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carkit.com"; sid:588938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases2020.com"; sid:588939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casesbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casesbystate.com"; sid:588940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challengeafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challengeafrica.com"; sid:588941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningalbuquerque.com"; sid:588942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningaustin.com"; sid:588943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningbaltimore.com"; sid:588944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningbatonrouge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningbatonrouge.com"; sid:588945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningbirmingham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningbirmingham.com"; sid:588946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningboston.com"; sid:588947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcharleston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcharleston.com"; sid:588948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcharlotte.com"; sid:588949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningchattanooga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningchattanooga.com"; sid:588950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcincinnati.com"; sid:588951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcleveland.com"; sid:588952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcolumbus.com"; sid:588953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningconnecticut.com"; sid:588954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcrews.com"; sid:588955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningdallas.com"; sid:588956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningdc.com"; sid:588957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningdetroit.com"; sid:588958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningfl.com"; sid:588959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningflorida.com"; sid:588960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninghawaii.com"; sid:588961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninghouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninghouston.com"; sid:588962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningindianapolis.com"; sid:588963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningjackson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningjackson.com"; sid:588964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningjacksonville.com"; sid:588965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningkansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningkansascity.com"; sid:588966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninglasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninglasvegas.com"; sid:588967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninglosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninglosangeles.com"; sid:588968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninglouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninglouisville.com"; sid:588969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmemphis.com"; sid:588970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmichigan.com"; sid:588971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningminneapolis.com"; sid:588972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmyrtlebeach.com"; sid:588973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningneworleans.com"; sid:588974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnewyork.com"; sid:588975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnorfolk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnorfolk.com"; sid:588976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningoakland.com"; sid:588977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningoklahoma.com"; sid:588978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningorangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningorangecounty.com"; sid:588979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningorlando.com"; sid:588980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningphoenix.com"; sid:588981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningpittsburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningpittsburgh.com"; sid:588982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningportland.com"; sid:588983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningraleigh.com"; sid:588984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsacramento.com"; sid:588985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsaltlake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsaltlake.com"; sid:588986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsanantonio.com"; sid:588987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsandiego.com"; sid:588988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsanfrancisco.com"; sid:588989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsanjose.com"; sid:588990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningsavannah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningsavannah.com"; sid:588991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningseattle.com"; sid:588992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningshreveport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningshreveport.com"; sid:588993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningstlouis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningstlouis.com"; sid:588994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningtampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningtampa.com"; sid:588995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningwashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningwashingtondc.com"; sid:588996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-clear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-clear.com"; sid:588997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clientes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clientes.com"; sid:588998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-confinement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-confinement.com"; sid:588999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-conflicts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-conflicts.com"; sid:589000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-consultants.com"; sid:589001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronatest.com"; sid:589002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusmap.com"; sid:589003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirusstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirusstats.com"; sid:589004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirustracker.com"; sid:589005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19csr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19csr.com"; sid:589006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureofficial.com"; sid:589007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cuts.com"; sid:589008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cybermonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cybermonitor.com"; sid:589009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cyberthreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cyberthreat.com"; sid:589010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailycases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailycases.com"; sid:589011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-dalycity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-dalycity.com"; sid:589012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataportal.com"; sid:589013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datascience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datascience.com"; sid:589014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dayfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dayfit.com"; sid:589015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathstoday.com"; sid:589016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationservicesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationservicesnearme.com"; sid:589017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designs.com"; sid:589018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosticresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosticresult.com"; sid:589019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosticresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosticresults.com"; sid:589020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disputes.com"; sid:589021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dlt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dlt.com"; sid:589022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19docter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19docter.com"; sid:589023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donatenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donatenow.com"; sid:589024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donateplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donateplasma.com"; sid:589025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donationsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donationsnow.com"; sid:589026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edukick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edukick.com"; sid:589027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19effectsonretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19effectsonretirement.com"; sid:589028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19elbowlockingband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19elbowlockingband.com"; sid:589029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elbowlockingband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elbowlockingband.com"; sid:589030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19empolyeetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19empolyeetest.com"; sid:589031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enmaquiladoras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enmaquiladoras.com"; sid:589032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enmaquilladoras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enmaquilladoras.com"; sid:589033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eor.com"; sid:589034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19equipment.com"; sid:589035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-equipment.com"; sid:589036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equipments.com"; sid:589037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evangelization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evangelization.com"; sid:589038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exhibition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exhibition.com"; sid:589039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exposed.com"; sid:589040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposedme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposedme.com"; sid:589041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faceprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faceprotect.com"; sid:589042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsheet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsheet.com"; sid:589043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fdaapprovedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fdaapprovedmasks.com"; sid:589044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ff.com"; sid:589045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialfix.com"; sid:589046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialrescue.com"; sid:589047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fogging-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fogging-2020.com"; sid:589048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodbank.com"; sid:589049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebigsky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebigsky.com"; sid:589050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freehotels.com"; sid:589051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeplace.com"; sid:589052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeplaces.com"; sid:589053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeshop.com"; sid:589054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fremont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fremont.com"; sid:589055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlineheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlineheroes.com"; sid:589056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gallery.com"; sid:589057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19givingtuesday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19givingtuesday.com"; sid:589058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19givingtuesday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19givingtuesday.com"; sid:589059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grantassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grantassistance.com"; sid:589060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gum.com"; sid:589061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guncelgelismeler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guncelgelismeler.com"; sid:589062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hayward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hayward.com"; sid:589063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthlaws.com"; sid:589064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsupply.com"; sid:589065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heathproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heathproducts.com"; sid:589066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heranza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heranza.com"; sid:589067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hmplglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hmplglobal.com"; sid:589068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoclstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoclstore.com"; sid:589069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecarekit.com"; sid:589070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeinspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeinspections.com"; sid:589071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homekit.com"; sid:589072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitaltracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitaltracker.com"; sid:589073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hosteleriayturismo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hosteleriayturismo.com"; sid:589074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hr.com"; sid:589075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hydrolytedisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hydrolytedisinfectant.com"; sid:589076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immuneregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immuneregistry.com"; sid:589077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indiacensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indiacensus.com"; sid:589078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injuryhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injuryhelp.com"; sid:589079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inquiry.com"; sid:589080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inquiry.com"; sid:589081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancecanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancecanada.com"; sid:589082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-insurance-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-insurance-claims.com"; sid:589083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimsorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimsorganization.com"; sid:589084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceclaimsorgina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceclaimsorgina.com"; sid:589085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceprogram.com"; sid:589086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insuranceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insuranceproject.com"; sid:589087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancerelief.com"; sid:589088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intubationboxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intubationboxes.com"; sid:589089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19j.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19j.com"; sid:589090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobrights.com"; sid:589091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19karnataka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19karnataka.com"; sid:589092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keychain.com"; sid:589093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiss.com"; sid:589094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-lawsuit-attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-lawsuit-attorneys.com"; sid:589095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-leaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-leaks.com"; sid:589096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-leaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-leaks.com"; sid:589097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19legalmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19legalmarketing.com"; sid:589098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalright.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalright.com"; sid:589099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalrightsga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalrightsga.com"; sid:589100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19letgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19letgo.com"; sid:589101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifelonglesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifelonglesson.com"; sid:589102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-litigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-litigator.com"; sid:589103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lostproductivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lostproductivity.com"; sid:589104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lounge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lounge.com"; sid:589105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mademerich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mademerich.com"; sid:589106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makechallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makechallenge.com"; sid:589107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19makerchallange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19makerchallange.com"; sid:589108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malaysia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malaysia.com"; sid:589109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksmadeinusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksmadeinusa.com"; sid:589110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksusa.com"; sid:589111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskturkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskturkey.com"; sid:589112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskwholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskwholesale.com"; sid:589113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalcare.com"; sid:589114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mendoza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mendoza.com"; sid:589115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mexicotd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mexicotd.com"; sid:589116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19monitor.com"; sid:589117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19monitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19monitor.net"; sid:589118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitor.net"; sid:589119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mouthmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mouthmask.com"; sid:589120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mouthmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mouthmasks.com"; sid:589121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mouthmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mouthmasks.com"; sid:589122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nationalactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nationalactionplan.com"; sid:589123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturaltreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturaltreatment.com"; sid:589124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newretirementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newretirementplan.com"; sid:589125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newshour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newshour.com"; sid:589126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nexus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nexus.com"; sid:589127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nutraceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nutraceuticals.com"; sid:589128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nutrition.com"; sid:589129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-oakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-oakland.com"; sid:589130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oilcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oilcrisis.com"; sid:589131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-online-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-online-coronavirus.com"; sid:589132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineproducts.com"; sid:589133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-oprema.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-oprema.com"; sid:589134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19organic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19organic.com"; sid:589135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicmasks.com"; sid:589136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicvaccines.com"; sid:589137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19panel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19panel.com"; sid:589138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patienttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patienttracker.com"; sid:589139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalprotectionpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalprotectionpack.com"; sid:589140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photogallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photogallery.com"; sid:589141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photographs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photographs.com"; sid:589142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-plasma.com"; sid:589143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19point.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19point.com"; sid:589144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pppabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pppabuse.com"; sid:589145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19predictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19predictor.com"; sid:589146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventing.com"; sid:589147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prices.com"; sid:589148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19producten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19producten.com"; sid:589149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19productstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19productstore.com"; sid:589150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertysale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertysale.com"; sid:589151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionscreens.com"; sid:589152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionscreens.com"; sid:589153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectyourself.com"; sid:589154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protest.com"; sid:589155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19psychology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19psychology.com"; sid:589156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quiztime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quiztime.com"; sid:589157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestdepot.com"; sid:589158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-rapidtestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-rapidtestingkit.com"; sid:589159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestusa.com"; sid:589160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19read.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19read.com"; sid:589161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatesolutions.com"; sid:589162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realorfake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realorfake.com"; sid:589163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recuperar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recuperar.com"; sid:589164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recuperartd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recuperartd.com"; sid:589165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefsupport.com"; sid:589166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remint.com"; sid:589167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19respirators.com"; sid:589168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsepros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsepros.com"; sid:589169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseunit.com"; sid:589170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirement.com"; sid:589171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementeffects.com"; sid:589172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementfix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementfix.com"; sid:589173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementgaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementgaps.com"; sid:589174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementholes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementholes.com"; sid:589175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementmistakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementmistakes.com"; sid:589176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementreport.com"; sid:589177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementrescue.com"; sid:589178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rfp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rfp.com"; sid:589179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-richmond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-richmond.com"; sid:589180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rush.com"; sid:589181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-safe.com"; sid:589182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetygear.com"; sid:589183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetymask.com"; sid:589184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetymasks.com"; sid:589185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyvideos.com"; sid:589186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sahibinden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sahibinden.com"; sid:589187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salonreopeningguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salonreopeningguidelines.com"; sid:589188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sanfransisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sanfransisco.com"; sid:589189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitization.com"; sid:589190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sanjose.com"; sid:589191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sanleandro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sanleandro.com"; sid:589192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sanmateo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sanmateo.com"; sid:589193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19santacruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19santacruz.com"; sid:589194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scannings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scannings.com"; sid:589195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scrubbing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scrubbing.com"; sid:589196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19secondwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19secondwave.com"; sid:589197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sell.com"; sid:589198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellerprotectionplanga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellerprotectionplanga.com"; sid:589199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shirtonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shirtonline.com"; sid:589200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signs-chicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signs-chicago.com"; sid:589201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signschicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signschicago.com"; sid:589202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-silent-hypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-silent-hypoxia.com"; sid:589203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19silenthypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19silenthypoxia.com"; sid:589204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skin.com"; sid:589205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinesscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinesscounseling.com"; sid:589206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smart.com"; sid:589207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smartshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smartshields.com"; sid:589208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sme.com"; sid:589209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialmedia.com"; sid:589210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sterilizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sterilizing.com"; sid:589211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19summer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19summer.com"; sid:589212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-supplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-supplements.com"; sid:589213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesus.com"; sid:589214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surviors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surviors.com"; sid:589215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdepot.com"; sid:589216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testincalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testincalifornia.com"; sid:589217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcalifornia.com"; sid:589218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnyc.com"; sid:589219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingresults.com"; sid:589220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingsitesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingsitesnearme.com"; sid:589221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testkit.net"; sid:589222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testlab.com"; sid:589223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnj.com"; sid:589224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsforsale.com"; sid:589225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsuppliers.com"; sid:589226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsusa.com"; sid:589227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thecoronavirus.com"; sid:589228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19themovie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19themovie.net"; sid:589229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thewellspringway.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thewellspringway.solutions"; sid:589230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19threatintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19threatintel.com"; sid:589231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19threats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19threats.com"; sid:589232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thrivecampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thrivecampaign.com"; sid:589233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tips.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tips.net"; sid:589234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracer.com"; sid:589235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracers.com"; sid:589236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trader.com"; sid:589237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trainingcourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trainingcourses.com"; sid:589238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustexperts.com"; sid:589239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trustinexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trustinexperts.com"; sid:589240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trustinscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trustinscience.com"; sid:589241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustinscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustinscience.com"; sid:589242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trustscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trustscience.com"; sid:589243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trustscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trustscience.com"; sid:589244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19untold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19untold.com"; sid:589245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineofficial.com"; sid:589246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vallejo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vallejo.com"; sid:589247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimscompensation.com"; sid:589248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimscompensationfund.com"; sid:589249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimscompensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimscompensationfund.com"; sid:589250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusmask-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusmask-kit.com"; sid:589251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusmasks.com"; sid:589252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusmasque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusmasque.com"; sid:589253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vitamins.com"; sid:589254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vote.com"; sid:589255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vouchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vouchers.com"; sid:589256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19well.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19well.com"; sid:589257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whitehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whitehouse.com"; sid:589258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wholesaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wholesaler.com"; sid:589259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wikipedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wikipedia.com"; sid:589260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerrights.com"; sid:589261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacerights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacerights.com"; sid:589262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldmemorial.com"; sid:589263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wtf.com"; sid:589264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19year.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19year.com"; sid:589265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019africa.com"; sid:589266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019argentina.com"; sid:589267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019australia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019australia.com"; sid:589268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019bangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019bangladesh.com"; sid:589269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019belgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019belgium.com"; sid:589270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019brazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019brazil.com"; sid:589271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019canada.com"; sid:589272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019clinic.com"; sid:589273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019clinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019clinics.com"; sid:589274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019countries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019countries.com"; sid:589275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019diagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019diagnosis.com"; sid:589276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019disinfectant.com"; sid:589277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019doctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019doctors.com"; sid:589278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019economics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019economics.com"; sid:589279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019egypt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019egypt.com"; sid:589280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019england.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019england.com"; sid:589281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019financing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019financing.com"; sid:589282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019flu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019flu.com"; sid:589283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019france.com"; sid:589284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019germany.com"; sid:589285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019glasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019glasses.com"; sid:589286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019greece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019greece.com"; sid:589287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019hospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019hospital.com"; sid:589288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019hospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019hospitals.com"; sid:589289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019indonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019indonesia.com"; sid:589290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019insurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019insurance.com"; sid:589291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019iran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019iran.com"; sid:589292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019ireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019ireland.com"; sid:589293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019israel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019israel.com"; sid:589294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019italy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019italy.com"; sid:589295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019japan.com"; sid:589296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019korea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019korea.com"; sid:589297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019loans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019loans.com"; sid:589298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019mall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019mall.com"; sid:589299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019medicalaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019medicalaid.com"; sid:589300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019medicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019medicalcare.com"; sid:589301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019medicalsupplies.com"; sid:589302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019meds.com"; sid:589303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019mexico.com"; sid:589304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019newyork.com"; sid:589305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019newzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019newzealand.com"; sid:589306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019northkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019northkorea.com"; sid:589307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019norway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019norway.com"; sid:589308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019numbers.com"; sid:589309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019pain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019pain.com"; sid:589310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019pakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019pakistan.com"; sid:589311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019philippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019philippines.com"; sid:589312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019planet.com"; sid:589313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019prevention.com"; sid:589314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019products.com"; sid:589315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019remedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019remedy.com"; sid:589316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019russia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019russia.com"; sid:589317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019safety.com"; sid:589318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019sanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019sanitizers.com"; sid:589319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019saudiarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019saudiarabia.com"; sid:589320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019singapore.com"; sid:589321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019spain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019spain.com"; sid:589322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019stats.net"; sid:589323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019stories.com"; sid:589324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019story.com"; sid:589325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019suppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019suppliers.com"; sid:589326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019symptoms.com"; sid:589327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019thailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019thailand.com"; sid:589328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019timeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019timeline.com"; sid:589329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019treatment.com"; sid:589330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019treatments.com"; sid:589331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019turkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019turkey.com"; sid:589332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019uk.com"; sid:589333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019us.com"; sid:589334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019venezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019venezuela.com"; sid:589335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019ventilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019ventilator.com"; sid:589336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019ventilators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019ventilators.com"; sid:589337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019world.com"; sid:589338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019worldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019worldnews.com"; sid:589339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019worldometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019worldometer.com"; sid:589340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020benefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020benefits.com"; sid:589341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020film.com"; sid:589342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20art.com"; sid:589343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20free.com"; sid:589344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21free.com"; sid:589345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid37.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid37.com"; sid:589346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid60.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid60.com"; sid:589347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaar.com"; sid:589348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacoin.com"; sid:589349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmorco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmorco.com"; sid:589350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassassins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassassins.com"; sid:589351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-autotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-autotest.com"; sid:589352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaventur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaventur.com"; sid:589353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawaar.com"; sid:589354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawair.com"; sid:589355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawear.com"; sid:589356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidayush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidayush.com"; sid:589357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankbailout.com"; sid:589358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyprotection.com"; sid:589359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarberchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarberchallenge.com"; sid:589360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbisrecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbisrecover.com"; sid:589361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizrecovery.com"; sid:589362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizsupply.com"; sid:589363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbkprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbkprotection.com"; sid:589364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackness.com"; sid:589365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakthroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakthroughs.com"; sid:589366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusiness19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusiness19.com"; sid:589367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidc3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidc3.com"; sid:589368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcambodia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcambodia.com"; sid:589369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapsules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapsules.com"; sid:589370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarcruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarcruise.com"; sid:589371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarts.com"; sid:589372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasesbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasesbystate.com"; sid:589373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificate.net"; sid:589374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedbusiness.com"; sid:589375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedworkplace.com"; sid:589376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharitychallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharitychallenge.com"; sid:589377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckinstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckinstation.com"; sid:589378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchinasettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchinasettlement.com"; sid:589379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchoices.com"; sid:589380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimnow.com"; sid:589381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimonline.com"; sid:589382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsportal.com"; sid:589383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanbklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanbklyn.com"; sid:589384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersnyc.com"; sid:589385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerusa.com"; sid:589386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningalbuquerque.com"; sid:589387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningatlanta.com"; sid:589388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbaltimore.com"; sid:589389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbatonrouge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbatonrouge.com"; sid:589390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbirmingham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbirmingham.com"; sid:589391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningboston.com"; sid:589392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcharleston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcharleston.com"; sid:589393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcharlotte.com"; sid:589394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningchattanooga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningchattanooga.com"; sid:589395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningchicago.com"; sid:589396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcincinnati.com"; sid:589397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcleveland.com"; sid:589398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcolumbus.com"; sid:589399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningconnecticut.com"; sid:589400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningdallas.com"; sid:589401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningdenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningdenver.com"; sid:589402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningdetroit.com"; sid:589403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningengland.com"; sid:589404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningflorida.com"; sid:589405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningguys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningguys.com"; sid:589406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninghawaii.com"; sid:589407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninghouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninghouston.com"; sid:589408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningindianapolis.com"; sid:589409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningjackson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningjackson.com"; sid:589410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningjacksonville.com"; sid:589411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningkansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningkansascity.com"; sid:589412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninglosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninglosangeles.com"; sid:589413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninglouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninglouisville.com"; sid:589414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmemphis.com"; sid:589415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmiami.com"; sid:589416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmichigan.com"; sid:589417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmilwaukee.com"; sid:589418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningminneapolis.com"; sid:589419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmyrtlebeach.com"; sid:589420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnashville.com"; sid:589421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningneworleans.com"; sid:589422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnewyork.com"; sid:589423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnorfolk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnorfolk.com"; sid:589424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningoakland.com"; sid:589425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningoc.com"; sid:589426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningoklahoma.com"; sid:589427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningorangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningorangecounty.com"; sid:589428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningorlando.com"; sid:589429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningphiladelphia.com"; sid:589430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningphoenix.com"; sid:589431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningpittsburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningpittsburgh.com"; sid:589432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningportland.com"; sid:589433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningpro.com"; sid:589434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningproducts.com"; sid:589435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningraleigh.com"; sid:589436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsacramento.com"; sid:589437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsaltlake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsaltlake.com"; sid:589438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsanantonio.com"; sid:589439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsandiego.com"; sid:589440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsanfrancisco.com"; sid:589441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsanjose.com"; sid:589442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningseattle.com"; sid:589443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningshreveport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningshreveport.com"; sid:589444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningstlouis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningstlouis.com"; sid:589445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningtampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningtampa.com"; sid:589446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningteam.com"; sid:589447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninguk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninguk.com"; sid:589448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwashingtondc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwashingtondc.com"; sid:589449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanllc.com"; sid:589450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleannyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleannyc.com"; sid:589451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupservice.com"; sid:589452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearworkers.com"; sid:589453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearworkforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearworkforce.com"; sid:589454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coburg.com"; sid:589455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollegeclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollegeclub.com"; sid:589456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-companions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-companions.com"; sid:589457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplient.com"; sid:589458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplient.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplient.net"; sid:589459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsent.com"; sid:589460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontaminationcleaning.com"; sid:589461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcor.com"; sid:589462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornerstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornerstore.com"; sid:589463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronatesting.com"; sid:589464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorrupt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorrupt.com"; sid:589465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouncilforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouncilforbusiness.com"; sid:589466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcracker.com"; sid:589467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crusher.com"; sid:589468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureidea.com"; sid:589469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cyber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cyber.com"; sid:589470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcyberthreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcyberthreats.com"; sid:589471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcyborg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcyborg.com"; sid:589472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatasavelives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatasavelives.com"; sid:589473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathcount.com"; sid:589474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefense19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefense19.com"; sid:589475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddestroyed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddestroyed.com"; sid:589476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-distance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-distance.com"; sid:589477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocnearme.com"; sid:589478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocter.com"; sid:589479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoctornearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoctornearme.com"; sid:589480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelimination.com"; sid:589481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelisatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelisatest.com"; sid:589482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelisatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelisatests.com"; sid:589483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidence.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidence.pro"; sid:589484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-endotheliitis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-endotheliitis.com"; sid:589485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendotheliitis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendotheliitis.com"; sid:589486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenmaquilas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenmaquilas.com"; sid:589487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoplayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoplayer.com"; sid:589488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideos-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideos-19.com"; sid:589489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideuropa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideuropa.com"; sid:589490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideverything.com"; sid:589491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexforce.com"; sid:589492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexplus.com"; sid:589493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexterminate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexterminate.com"; sid:589494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextermination.com"; sid:589495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfabric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfabric.com"; sid:589496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfailures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfailures.com"; sid:589497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaith.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaith.com"; sid:589498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaqs.com"; sid:589499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfdaapprovedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfdaapprovedmasks.com"; sid:589500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeelgood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeelgood.com"; sid:589501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfhc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfhc.com"; sid:589502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-finance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-finance.com"; sid:589503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootballfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootballfighters.com"; sid:589504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootprint.com"; sid:589505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudattorney.com"; sid:589506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudattorneys.com"; sid:589507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fraud.com"; sid:589508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudlaw.com"; sid:589509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudlaws.com"; sid:589510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudnews.com"; sid:589511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fr.com"; sid:589512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreearea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreearea.com"; sid:589513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebarcelona.com"; sid:589514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebigsky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebigsky.com"; sid:589515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecampus.com"; sid:589516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertifiedworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertifiedworkplace.com"; sid:589517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeitalia.com"; sid:589518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemadrid.com"; sid:589519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemallorca.com"; sid:589520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenz.com"; sid:589521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeplace.com"; sid:589522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesevilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesevilla.com"; sid:589523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeshop.com"; sid:589524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesite.com"; sid:589525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesolutions.com"; sid:589526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreespain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreespain.com"; sid:589527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetotravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetotravel.com"; sid:589528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevalencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevalencia.com"; sid:589529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunder.com"; sid:589530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglance.com"; sid:589531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalsupplies.com"; sid:589532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgo19.com"; sid:589533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreetingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreetingcards.com"; sid:589534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgr.net"; sid:589535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhand.com"; sid:589536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandshield.com"; sid:589537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcertificate.com"; sid:589538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax19.com"; sid:589539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax-2020.com"; sid:589540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomevalues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomevalues.com"; sid:589541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoroscopes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoroscopes.com"; sid:589542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospice.com"; sid:589543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hypoxia.com"; sid:589544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidian19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidian19.com"; sid:589545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianpanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianpanel.com"; sid:589546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidical.com"; sid:589547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidico.com"; sid:589548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiculous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiculous.com"; sid:589549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindicator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindicator.com"; sid:589550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinflection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinflection.com"; sid:589551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfocus.com"; sid:589552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformation.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformation.world"; sid:589553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfovis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfovis.com"; sid:589554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidingcleaningsavannah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidingcleaningsavannah.com"; sid:589555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryhelp.com"; sid:589556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinlove.com"; sid:589557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinseattle.com"; sid:589558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceprogram.com"; sid:589559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceproject.com"; sid:589560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancerecovery.com"; sid:589561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancerelief.com"; sid:589562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurence.com"; sid:589563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthecity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthecity.com"; sid:589564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiology.com"; sid:589565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.wtf"; sid:589566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidircombi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidircombi.com"; sid:589567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ivf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ivf.com"; sid:589568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjourneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjourneys.com"; sid:589569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjuice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjuice.com"; sid:589570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsdrive.com"; sid:589571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillga.com"; sid:589572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitssuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitssuppliers.com"; sid:589573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleanup.com"; sid:589574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknights.com"; sid:589575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkoch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkoch.com"; sid:589576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabgroup.com"; sid:589577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw2020.com"; sid:589578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalhelpline.com"; sid:589579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lessons.com"; sid:589580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlg.com"; sid:589581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-litigation.com"; sid:589582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloansource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloansource.com"; sid:589583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlove19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlove19.com"; sid:589584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmafia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmafia.com"; sid:589585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetups.com"; sid:589586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicro.com"; sid:589587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmissionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmissionmasks.com"; sid:589588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagerates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagerates.com"; sid:589589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmp3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmp3.com"; sid:589590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneutral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneutral.com"; sid:589591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.today"; sid:589592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficetesting.com"; sid:589593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoilcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoilcrisis.com"; sid:589594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoline.com"; sid:589595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-oman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-oman.com"; sid:589596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidomat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidomat.com"; sid:589597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonalert.com"; sid:589598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlineproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlineproducts.com"; sid:589599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoptions.com"; sid:589600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organic.com"; sid:589601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidort.com"; sid:589602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidout19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidout19.com"; sid:589603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ozone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ozone.com"; sid:589604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ozone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ozone.net"; sid:589605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicmasks2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicmasks2020.com"; sid:589606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanelist.com"; sid:589607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatentcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatentcards.com"; sid:589608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pay.com"; sid:589609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjury.com"; sid:589610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharminfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharminfo.com"; sid:589611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidping.com"; sid:589612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpinned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpinned.com"; sid:589613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpk.com"; sid:589614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plasma.com"; sid:589615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppeshop.com"; sid:589616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpppabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpppabuse.com"; sid:589617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpppbailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpppbailout.com"; sid:589618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprime.com"; sid:589619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprisonproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprisonproject.com"; sid:589620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts19.com"; sid:589621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpropertysale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpropertysale.com"; sid:589622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protection.net"; sid:589623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectiveproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectiveproducts.com"; sid:589624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protectme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protectme.com"; sid:589625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprt.com"; sid:589626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpubcrawl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpubcrawl.com"; sid:589627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpunk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpunk.com"; sid:589628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidragnarok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidragnarok.com"; sid:589629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidantibody.com"; sid:589630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryassistance.com"; sid:589631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-recovery-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-recovery-solutions.com"; sid:589632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselist.com"; sid:589633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretrofit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretrofit.com"; sid:589634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrfp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrfp.com"; sid:589635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidromance.com"; sid:589636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecleaner.com"; sid:589637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecleaning.com"; sid:589638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safedistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safedistance.com"; sid:589639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehospitality.com"; sid:589640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemexico.com"; sid:589641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeparty.com"; sid:589642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysource.com"; sid:589643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationkit.com"; sid:589644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscloset.com"; sid:589645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsdemise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsdemise.com"; sid:589646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecondwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecondwave.com"; sid:589647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecur.com"; sid:589648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftests.com"; sid:589649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldboston.com"; sid:589650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-silent-hypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-silent-hypoxia.com"; sid:589651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilenthypoxia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilenthypoxia.com"; sid:589652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimula.com"; sid:589653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnifftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnifftest.com"; sid:589654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsfullfilmentcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsfullfilmentcenter.com"; sid:589655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsom.com"; sid:589656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeak.com"; sid:589657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsprayvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsprayvaccine.com"; sid:589658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sticker.com"; sid:589659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstronger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstronger.com"; sid:589660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsummer2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsummer2020.com"; sid:589661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies4u.com"; sid:589662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgeryscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgeryscreen.com"; sid:589663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurveys.com"; sid:589664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorband.com"; sid:589665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorbands.com"; sid:589666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorscoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorscoalition.com"; sid:589667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptons.com"; sid:589668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtamilnadu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtamilnadu.com"; sid:589669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestarizona.com"; sid:589670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestexam.com"; sid:589671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestexams.com"; sid:589672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnebraska.com"; sid:589673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnyc.com"; sid:589674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingofoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingofoklahoma.com"; sid:589675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingresources.com"; sid:589676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingresults.com"; sid:589677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingstation.com"; sid:589678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingstations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingstations.com"; sid:589679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsuppliers.com"; sid:589680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsupply.com"; sid:589681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresources.com"; sid:589682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsasap.com"; sid:589683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsaz.com"; sid:589684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststation.com"; sid:589685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttome.com"; sid:589686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttool.com"; sid:589687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreads.com"; sid:589688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tools.com"; sid:589689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackernj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackernj.com"; sid:589690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trackers.com"; sid:589691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraphouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraphouse.com"; sid:589692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trauma.com"; sid:589693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrauma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrauma.net"; sid:589694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraumas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraumas.com"; sid:589695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmenttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmenttracker.com"; sid:589696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidumat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidumat.com"; sid:589697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdatesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdatesonline.com"; sid:589698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviews.com"; sid:589699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vincheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vincheck.com"; sid:589700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfree.net"; sid:589701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinteriscoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinteriscoming.com"; sid:589702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkinjury.com"; sid:589703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkouts.com"; sid:589704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxforce.com"; sid:589705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxplus.com"; sid:589706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativeforcovid.com"; sid:589707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativesforcovid.com"; sid:589708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruise4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruise4covid.com"; sid:589709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiseforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiseforcovid.com"; sid:589710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crystalsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crystalsforcovid.com"; sid:589711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct7covid1981.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct7covid1981.com"; sid:589712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatingcovid19.com"; sid:589713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidtogether.com"; sid:589714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curincovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curincovidgame.com"; sid:589715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcorona.com"; sid:589716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for custompandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"custompandemicmasks.com"; sid:589717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyberforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyberforcovid.com"; sid:589718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daemonsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daemonsofcovid.com"; sid:589719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dannicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dannicovid.com"; sid:589720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for day4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"day4covid-19.com"; sid:589721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for day4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"day4covid19.com"; sid:589722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayforcovid-19.com"; sid:589723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayforcovid19.com"; sid:589724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deals4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deals4covid-19.com"; sid:589725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deals4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deals4covid19.com"; sid:589726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealsforcovid-19.com"; sid:589727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debunkcovidconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debunkcovidconspiracy.com"; sid:589728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronagroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronagroup.com"; sid:589729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensecovid.com"; sid:589730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for demonsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"demonsofcovid.com"; sid:589731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovid-19.com"; sid:589732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalemergencycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalemergencycovid.com"; sid:589733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacovid.com"; sid:589734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuesdelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuesdelcorona.com"; sid:589735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroycoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroycoronanow.com"; sid:589736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deteccioncovid19.com"; sid:589737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticsforcovid19.com"; sid:589738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didi-covid19.com"; sid:589739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfection-covid19.com"; sid:589740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositivicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositivicoronavirus.com"; sid:589741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovidmasks.com"; sid:589742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djs-agains-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djs-agains-corona.com"; sid:589743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesuvkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesuvkillcovid19.com"; sid:589744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcovid-19responsibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcovid-19responsibility.com"; sid:589745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovidantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovidantibodies.com"; sid:589746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dossiercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dossiercovid-19.com"; sid:589747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpicoronavirus.com"; sid:589748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drs4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drs4covid19.com"; sid:589749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duetcovid.com"; sid:589750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynamicinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynamicinpandemic.com"; sid:589751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthcovid19.com"; sid:589752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economyversuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economyversuscovid.com"; sid:589753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecrancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecrancovid.com"; sid:589754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edukickcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edukickcovidrelief.com"; sid:589755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eff-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eff-corona.com"; sid:589756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminacovid.com"; sid:589757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatecoronaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatecoronaga.com"; sid:589758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emeraldcitycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emeraldcitycovid.com"; sid:589759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronastigma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronastigma.com"; sid:589760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronasuffering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronasuffering.com"; sid:589761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entiemposdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entiemposdecoronavirus.com"; sid:589762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epi-covid19.com"; sid:589763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-proof.com"; sid:589764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicproof.com"; sid:589765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipement-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipement-coronavirus.com"; sid:589766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipement-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipement-covid-19.com"; sid:589767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipement-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipement-covid19.com"; sid:589768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapingwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapingwuhan.com"; sid:589769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciosincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciosincoronavirus.com"; sid:589770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialcovidworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialcovidworkers.com"; sid:589771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eurocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eurocovid19.com"; sid:589772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everybodyhatescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everybodyhatescorona.com"; sid:589773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everybodyhatescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everybodyhatescovid.com"; sid:589774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examtest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examtest-covid19.com"; sid:589775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ex-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ex-pandemic.com"; sid:589776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expomobile-vs-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expomobile-vs-coronavirus.com"; sid:589777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exterminatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exterminatecovid.com"; sid:589778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fabriziocoronashow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fabriziocoronashow.com"; sid:589779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecovid-19.com"; sid:589780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutpandemics.com"; sid:589781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutthepandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutthepandemics.com"; sid:589782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faktacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faktacovid19.com"; sid:589783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashionfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashionfightscovid19.com"; sid:589784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fca-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fca-covid19.com"; sid:589785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovidtesting.com"; sid:589786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fence-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fence-covid19.com"; sid:589787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid2019.com"; sid:589788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovidtogether.com"; sid:589789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fighttocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fighttocorona.com"; sid:589790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstcorona.com"; sid:589791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fishcorona.com"; sid:589792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fisiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fisiocovid.com"; sid:589793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19testing.com"; sid:589794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidinfo.com"; sid:589795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidtest.com"; sid:589796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronavirusupdates.com"; sid:589797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidattorneys.com"; sid:589798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foerderung-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foerderung-corona.com"; sid:589799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foerderungcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foerderungcorona.com"; sid:589800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foggercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foggercorona.com"; sid:589801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foggercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foggercoronavirus.com"; sid:589802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foggingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foggingcovid.com"; sid:589803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for football-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"football-against-corona.com"; sid:589804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for footballerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"footballerscovid19.com"; sid:589805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formazionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formazionecovid19.com"; sid:589806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frenemoselcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frenemoselcovid.com"; sid:589807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fu-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fu-covid19.com"; sid:589808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fueracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fueracovid.com"; sid:589809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fussball-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fussball-gegen-corona.com"; sid:589810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gbvcovid.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gbvcovid.report"; sid:589811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronaviruscleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronaviruscleaningcompany.com"; sid:589812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirusdecontaminationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirusdecontaminationservice.com"; sid:589813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirusdisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirusdisinfectionservices.com"; sid:589814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19cleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19cleaningcompany.com"; sid:589815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid19disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid19disinfectionservice.com"; sid:589816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germprotect-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germprotect-covid19.com"; sid:589817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germprotectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germprotectcovid19.com"; sid:589818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronafree.com"; sid:589819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsignsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsignsnow.com"; sid:589820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestingnow.com"; sid:589821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getpandemictraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getpandemictraining.com"; sid:589822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19hometestkit.com"; sid:589823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19stories.com"; sid:589824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalhealthpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalhealthpandemic.com"; sid:589825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotnocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotnocovid.com"; sid:589826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for great-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"great-pandemic.com"; sid:589827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haicovid.com"; sid:589828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovidsmallbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovidsmallbusiness.com"; sid:589829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heranzacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heranzacovid19.com"; sid:589830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heros-contre-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heros-contre-covid19.com"; sid:589831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highschoolstudentsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highschoolstudentsagainstcovid19.com"; sid:589832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hmstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hmstopcovid.com"; sid:589833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holisticcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holisticcovid19.com"; sid:589834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitsforcovid19.com"; sid:589835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homespaincovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homespaincovidfree.com"; sid:589836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestingforcovid19.com"; sid:589837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homtestforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homtestforcovid.com"; sid:589838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostelcovid.com"; sid:589839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howaftercovid.com"; sid:589840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hungerpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hungerpandemic.com"; sid:589841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovideos.com"; sid:589842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iggcovidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iggcovidantibody.com"; sid:589843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iknowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iknowcorona.com"; sid:589844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iknowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iknowcovid.com"; sid:589845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycardcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycardcoronavirus.com"; sid:589846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycardcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycardcovid19.com"; sid:589847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitycertificatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitycertificatecovid.com"; sid:589848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitypassportscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitypassportscovid.com"; sid:589849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitytestcovid19.com"; sid:589850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impotscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impotscovid19.com"; sid:589851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnite-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnite-coronavirus.com"; sid:589852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indemnite-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indemnite-covid19.com"; sid:589853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indorecovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indorecovidtracker.com"; sid:589854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-netfllxfilmesbrasil-juntoscontraacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-netfllxfilmesbrasil-juntoscontraacovid19.com"; sid:589855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informasicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informasicorona.com"; sid:589856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoscoronavirusgabon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoscoronavirusgabon.com"; sid:589857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcoronavirustests.com"; sid:589858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for interpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"interpandemic.com"; sid:589859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19banner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19banner.com"; sid:589860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthecoronapandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthecoronapandemicvirus.com"; sid:589861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsacovid19thing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsacovid19thing.com"; sid:589862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwanttokillcovid19vegan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwanttokillcovid19vegan.com"; sid:589863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jaliscovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jaliscovida.com"; sid:589864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justicecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justicecovid-19.com"; sid:589865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice-covid.com"; sid:589866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justicecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justicecovid.com"; sid:589867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jwbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jwbcovid.com"; sid:589868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kadindogumcovid19rehberi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kadindogumcovid19rehberi.com"; sid:589869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karnatakacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karnatakacovid19.com"; sid:589870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keto-covidiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keto-covidiet.com"; sid:589871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for khalascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"khalascorona.com"; sid:589872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidga.com"; sid:589873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kills-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kills-corona.com"; sid:589874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-covid19-govfr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-covid19-govfr.com"; sid:589875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koreacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koreacovid19.com"; sid:589876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagoscovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagoscovidfund.com"; sid:589877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcontrol-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcontrol-covid.com"; sid:589878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for levennacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"levennacorona.com"; sid:589879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronas.com"; sid:589880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacovid-19.com"; sid:589881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezadecoronavirus.com"; sid:589882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lisboncovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lisboncovidfree.com"; sid:589883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for littlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"littlecorona.com"; sid:589884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdownwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdownwuhan.com"; sid:589885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lojacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lojacovid.com"; sid:589886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisvuitton-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisvuitton-corona.com"; sid:589887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcoronavirus1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcoronavirus1.com"; sid:589888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ltc-covid19-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ltc-covid19-tracker.com"; sid:589889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lutte-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lutte-covid19.com"; sid:589890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mafecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mafecorona.com"; sid:589891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malagacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malagacovidfree.com"; sid:589892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparacovidfree.com"; sid:589893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaproteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaproteccioncoronavirus.com"; sid:589894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaproteccioncovid19.com"; sid:589895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascovidmallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascovidmallorca.com"; sid:589896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasproteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasproteccioncoronavirus.com"; sid:589897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovid-19.com"; sid:589898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marbellafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marbellafreecovid.com"; sid:589899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriageduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriageduringcovid.com"; sid:589900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasfacialescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasfacialescovid-19.com"; sid:589901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherineantiviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherineantiviruscovid19.com"; sid:589902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masecuritecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masecuritecovid.com"; sid:589903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforpandemic.com"; sid:589904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquebarrierecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquebarrierecovid.com"; sid:589905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materiel-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materiel-coronavirus.com"; sid:589906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materiel-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materiel-covid.com"; sid:589907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mc-covidcraft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mc-covidcraft.com"; sid:589908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcoronavirussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcoronavirussupplies.com"; sid:589909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalmaskcovid19.com"; sid:589910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicareandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicareandcovid19.com"; sid:589911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicovidiots.com"; sid:589912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidascontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidascontraelcoronavirus.com"; sid:589913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidascovidfree.com"; sid:589914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid19bailout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid19bailout.com"; sid:589915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidconsultants.com"; sid:589916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miltoncovidcleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miltoncovidcleaningservice.com"; sid:589917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miltoncovidcleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miltoncovidcleaningservices.com"; sid:589918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monarchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monarchcovid19.com"; sid:589919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monsieurdesinfectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monsieurdesinfectioncoronavirus.com"; sid:589920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monsuivicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monsuivicovid.com"; sid:589921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mortgagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mortgagecoronavirus.com"; sid:589922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mouthmaskcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mouthmaskcovid19.com"; sid:589923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multasporcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multasporcovid.com"; sid:589924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mupegueicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mupegueicorona.com"; sid:589925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for music-agains-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"music-agains-corona.com"; sid:589926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for music-bands-agains-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"music-bands-agains-corona.com"; sid:589927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myaircovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myaircovidfree.com"; sid:589928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myaircovidfreeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myaircovidfreeservices.com"; sid:589929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacoach.com"; sid:589930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronafilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronafilm.com"; sid:589931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakey.com"; sid:589932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronameme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronameme.com"; sid:589933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronamovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronamovie.com"; sid:589934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaphoto.com"; sid:589935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaregistry.com"; sid:589936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19heros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19heros.com"; sid:589937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19lawyers.com"; sid:589938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19result.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19result.com"; sid:589939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmap.com"; sid:589940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidpassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidpassports.com"; sid:589941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidphoto.com"; sid:589942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidresult.com"; sid:589943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycrazycovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycrazycovidlife.com"; sid:589944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymalagacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymalagacovidfree.com"; sid:589945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mymarbellafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mymarbellafreecovid.com"; sid:589946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mywuhanshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mywuhanshake.com"; sid:589947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naccovid.com"; sid:589948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nasalcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nasalcovidvaccine.com"; sid:589949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirusawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirusawareness.com"; sid:589950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacoronabible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacoronabible.com"; sid:589951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necovid.com"; sid:589952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neocovidtest.com"; sid:589953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevada-coronavirus-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevada-coronavirus-data.com"; sid:589954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19cases.com"; sid:589955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nf-covidtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nf-covidtrace.com"; sid:589956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid20.com"; sid:589957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidbus.com"; sid:589958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nostodoscontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nostodoscontraocorona.com"; sid:589959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronanews.com"; sid:589960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-coronavirus.world"; sid:589961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcovid19hometestkit.com"; sid:589962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntexassmallbusinesscovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntexassmallbusinesscovid19response.com"; sid:589963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ntxsmallbusinesscovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ntxsmallbusinesscovid19response.com"; sid:589964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nucovid.com"; sid:589965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nukecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nukecovid.com"; sid:589966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecovidhelp.com"; sid:589967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovidprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovidprogress.com"; sid:589968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocorona-hilfe-er-erh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocorona-hilfe-er-erh.com"; sid:589969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidtest.com"; sid:589970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidtesting.com"; sid:589971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oitaitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oitaitforcovid19.com"; sid:589972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid.nyc"; sid:589973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidtesting.com"; sid:589974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacovid19resources.com"; sid:589975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omgcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omgcovid19.com"; sid:589976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onenightincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onenightincorona.com"; sid:589977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovid19.com"; sid:589978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for open-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"open-covid-19.com"; sid:589979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncoronaviruslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncoronaviruslawsuit.com"; sid:589980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncovidlawsuit.com"; sid:589981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osservatoriocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osservatoriocovid.com"; sid:589982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronahero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronahero.com"; sid:589983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcoronaheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcoronaheroes.com"; sid:589984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for our-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"our-covid19.com"; sid:589985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid-19.com"; sid:589986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxygen4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxygen4covid.com"; sid:589987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozcovid.com"; sid:589988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonolimpiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonolimpiacovid.com"; sid:589989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panaspandemickitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panaspandemickitchen.com"; sid:589990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020supplies.com"; sid:589991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2022.com"; sid:589992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicacademic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicacademic.world"; sid:589993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaftershave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaftershave.com"; sid:589994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicathomelearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicathomelearning.com"; sid:589995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessprocedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessprocedures.com"; sid:589996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinesstraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinesstraining.com"; sid:589997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareprogram.com"; sid:589998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccomfort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccomfort.com"; sid:589999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefender.com"; sid:590000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiseasetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiseasetracker.com"; sid:590001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdomestic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdomestic.com"; sid:590002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicequip.com"; sid:590003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentialoils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentialoils.com"; sid:590004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfails.com"; sid:590005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfreeness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfreeness.com"; sid:590006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgroups.com"; sid:590007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicharts.com"; sid:590008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelpnow.com"; sid:590009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichistoricalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichistoricalsolutions.com"; sid:590010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichustles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichustles.com"; sid:590011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancecover.com"; sid:590012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsuranceexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsuranceexperts.com"; sid:590013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurancequote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurancequote.com"; sid:590014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsurances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsurances.com"; sid:590015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsuranceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsuranceservices.com"; sid:590016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicloteria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicloteria.com"; sid:590017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmitigationresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmitigationresource.com"; sid:590018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnecessaryessentialoils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnecessaryessentialoils.com"; sid:590019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconlinefilmfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconlinefilmfestival.com"; sid:590020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicospirits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicospirits.com"; sid:590021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpathmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpathmakers.com"; sid:590022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpe.com"; sid:590023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicperfume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicperfume.com"; sid:590024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpickups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpickups.com"; sid:590025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparationproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparationproducts.com"; sid:590026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprepus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprepus.com"; sid:590027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectiveequipment.com"; sid:590028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpubquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpubquiz.com"; sid:590029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuzzle.com"; sid:590030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadyamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadyamerica.com"; sid:590031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-rp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-rp.com"; sid:590032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscatalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscatalog.com"; sid:590033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsignage.com"; sid:590034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsinc.com"; sid:590035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsnyc.com"; sid:590036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsny.com"; sid:590037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsusa.com"; sid:590038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivaloils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivaloils.com"; sid:590039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicverse.com"; sid:590040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwebshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwebshop.com"; sid:590041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwins.com"; sid:590042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelcoronavirus.com"; sid:590043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelcovid-19.com"; sid:590044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelescoronavirus.com"; sid:590045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelescovid19.com"; sid:590046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for parentingthroughapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"parentingthroughapandemic.com"; sid:590047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcovid19.com"; sid:590048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pathwaysatcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pathwaysatcoronado.com"; sid:590049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofcorona19.com"; sid:590050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pincovid.com"; sid:590051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pizzeriacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pizzeriacovidfree.com"; sid:590052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planet-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planet-corona.com"; sid:590053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planforcovid.com"; sid:590054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataforma-perjudicados-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataforma-perjudicados-coronavirus.com"; sid:590055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portugalcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portugalcovidfree.com"; sid:590056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscovid-19.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscovid-19.world"; sid:590057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for positivityinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"positivityinthepandemic.com"; sid:590058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronasocialclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronasocialclub.com"; sid:590059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidbabies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidbabies.com"; sid:590060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidchina.com"; sid:590061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovideurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovideurope.com"; sid:590062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlives.com"; sid:590063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlombardy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlombardy.com"; sid:590064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlondon.com"; sid:590065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidlove.com"; sid:590066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnyc.com"; sid:590067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpt.com"; sid:590068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidroma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidroma.com"; sid:590069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovids.com"; sid:590070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtherapy.com"; sid:590071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidthoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidthoughts.com"; sid:590072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtoronto.com"; sid:590073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviduk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviduk.com"; sid:590074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicchurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicchurch.com"; sid:590075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicplans.com"; sid:590076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemictips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemictips.com"; sid:590077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicyou.com"; sid:590078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pourpandemico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pourpandemico.com"; sid:590079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppeforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppeforcorona.com"; sid:590080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparingforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparingforpandemics.com"; sid:590081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevcovid.com"; sid:590082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prodotticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prodotticovid.com"; sid:590083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productsforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productsforcovid-19.com"; sid:590084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prospectingthrucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prospectingthrucoronavirus.com"; sid:590085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncorona-virus.com"; sid:590086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protect-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protect-covid19.com"; sid:590087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectiongearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectiongearcovid.com"; sid:590088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionvisagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionvisagecovid.com"; sid:590089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivepandemicproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivepandemicproducts.com"; sid:590090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivepandemicprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivepandemicprotection.com"; sid:590091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegecontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegecontracovid.com"; sid:590092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteger-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteger-covid19.com"; sid:590093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionedacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionedacoronavirus.com"; sid:590094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolocovid19.com"; sid:590095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolocovid.com"; sid:590096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacovid-19.com"; sid:590097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for q8vscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"q8vscovid.com"; sid:590098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questionincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questionincovid.com"; sid:590099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocoronadz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocoronadz.com"; sid:590100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radiocoronainternationale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radiocoronainternationale.com"; sid:590101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronaantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronaantibody.com"; sid:590102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatenewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatenewscovid19.com"; sid:590103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referentcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referentcovid-19.com"; sid:590104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-covid.com"; sid:590105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referentcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referentcovid.com"; sid:590106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relatoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relatoscovid19.com"; sid:590107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rentcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rentcorona.com"; sid:590108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rentcoronavirus.com"; sid:590109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reopeningbizaftercovid-16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reopeningbizaftercovid-16.com"; sid:590110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reservascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reservascovid19.com"; sid:590111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respiratorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respiratorcovid19.com"; sid:590112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respiratorscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respiratorscovid19.com"; sid:590113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rgvcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rgvcovid19cases.com"; sid:590114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsocovid.com"; sid:590115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovid.com"; sid:590116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimentodannicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimentodannicovid.com"; sid:590117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ristorantecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ristorantecovidfree.com"; sid:590118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rockcovid19.com"; sid:590119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rutacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rutacovid19.com"; sid:590120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetyproductscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetyproductscoronavirus.com"; sid:590121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazione-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazione-covid19.com"; sid:590122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayonarascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayonarascorona.com"; sid:590123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19funds.com"; sid:590124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbacovid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbacovid19money.com"; sid:590125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scan4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scan4covid.com"; sid:590126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovidtest.com"; sid:590127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestcovid-19.com"; sid:590128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selftestforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selftestforcovid19.com"; sid:590129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorcovid.com"; sid:590130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorescoronavirus.com"; sid:590131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadorescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadorescovid.com"; sid:590132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seqfightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seqfightscovid.com"; sid:590133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecorona.com"; sid:590134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shield-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shield-covid19.com"; sid:590135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shirtscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shirtscoronavirus.com"; sid:590136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoppecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoppecovid-19.com"; sid:590137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopstopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopstopcovid19.com"; sid:590138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siamcovid.com"; sid:590139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezzacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezzacovid.net"; sid:590140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signofcorona.com"; sid:590141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsofcorona.com"; sid:590142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sintelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sintelcovid.com"; sid:590143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sltcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sltcorona.com"; sid:590144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallcoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallcoronation.com"; sid:590145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidaire-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidaire-covid19.com"; sid:590146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidaires-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidaires-covid19.com"; sid:590147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soluzionicovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soluzionicovidfree.com"; sid:590148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somcovid19.com"; sid:590149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincovid19.com"; sid:590150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincovidfree.com"; sid:590151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spanishcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spanishcovidfree.com"; sid:590152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportschoolcoronaproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportschoolcoronaproof.com"; sid:590153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizecovid-19.com"; sid:590154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickercovid.com"; sid:590155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickerscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickerscovid.com"; sid:590156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.city"; sid:590157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidforeclosure.com"; sid:590158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidspray.com"; sid:590159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stresscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stresscovid19.com"; sid:590160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for striveandsurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"striveandsurvivecovid19.com"; sid:590161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strivetosurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strivetosurvivecovid19.com"; sid:590162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stupiditypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stupiditypandemic.com"; sid:590163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suministroscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suministroscovid.com"; sid:590164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supportimmobiliercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supportimmobiliercovid19.com"; sid:590165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivor-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivor-covid19.com"; sid:590166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for taag-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"taag-coronavirus.com"; sid:590167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takepandemicsoffthemenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takepandemicsoffthemenu.com"; sid:590168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapabocascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapabocascovid.com"; sid:590169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecameretermichecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecameretermichecovid19.com"; sid:590170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testexam-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testexam-covid19.com"; sid:590171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovidnow.com"; sid:590172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testiowacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testiowacovid19.com"; sid:590173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testiowacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testiowacovid.com"; sid:590174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testpcrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testpcrcovid19.com"; sid:590175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-rapide-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-rapide-covid.com"; sid:590176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests-coronavirus-smartphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests-coronavirus-smartphone.com"; sid:590177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests-covid-smartphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests-covid-smartphone.com"; sid:590178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theaircovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theaircovidfree.com"; sid:590179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebranchcovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebranchcovidian.com"; sid:590180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebranchcovidianlovestrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebranchcovidianlovestrump.com"; sid:590181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebranchcovidians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebranchcovidians.com"; sid:590182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebranchcovidianslovetrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebranchcovidianslovetrump.com"; sid:590183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclown.com"; sid:590184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclowns.com"; sid:590185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainsanity.com"; sid:590186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamd.com"; sid:590187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapivot.com"; sid:590188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus-19.com"; sid:590189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19band.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19band.com"; sid:590190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19clown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19clown.com"; sid:590191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19coverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19coverup.com"; sid:590192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19depot.com"; sid:590193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19institute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19institute.com"; sid:590194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19protector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19protector.com"; sid:590195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19testdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19testdepot.com"; sid:590196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcharity.com"; sid:590197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclown.com"; sid:590198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclowns.com"; sid:590199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-consultants.com"; sid:590200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcowboys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcowboys.com"; sid:590201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidexperience.com"; sid:590202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhoax.com"; sid:590203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpak.com"; sid:590204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpivot.com"; sid:590205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidreports.com"; sid:590206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-great-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-great-pandemic.com"; sid:590207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelaughterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelaughterpandemic.com"; sid:590208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpanda.com"; sid:590209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpaper.com"; sid:590210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemicchurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemicchurch.com"; sid:590211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theshrinkshopkickingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theshrinkshopkickingcovid.com"; sid:590212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanbrand.com"; sid:590213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivethrucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivethrucoronavirus.com"; sid:590214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tigercoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tigercoronavirustesting.com"; sid:590215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tigercoronavirustesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tigercoronavirustesting.net"; sid:590216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tigercovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tigercovidtesting.com"; sid:590217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tigercovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tigercovidtesting.net"; sid:590218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tips4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tips4covid-19.com"; sid:590219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocovid19support.com"; sid:590220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todocovid19.com"; sid:590221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoencoronavirus.com"; sid:590222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toolsagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toolsagainstcovid-19.com"; sid:590223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocovid-19cleanupservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocovid-19cleanupservices.com"; sid:590224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalcovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalcovidkiller.com"; sid:590225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcovid19.net"; sid:590226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for traitement-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"traitement-covid19.com"; sid:590227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelpostcovid.com"; sid:590228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscoronaviruscoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscoronaviruscoronation.com"; sid:590229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tschusscoronacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tschusscoronacorona.com"; sid:590230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuempresacovidiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuempresacovidiana.com"; sid:590231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tunelescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tunelescovid19.com"; sid:590232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tutor4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tutor4covid.com"; sid:590233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for type2covidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"type2covidsupport.com"; sid:590234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubercontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubercontracovid.com"; sid:590235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultracoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultracoronamask.com"; sid:590236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19ppe.com"; sid:590237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19testkits.com"; sid:590238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19tracker.com"; sid:590239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidstories.com"; sid:590240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19testing.com"; sid:590241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uticacoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uticacoronachallenge.com"; sid:590242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacacionessincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacacionessincovid.com"; sid:590243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccicovid.com"; sid:590244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccovid.com"; sid:590245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacicovid.com"; sid:590246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunascovid.com"; sid:590247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vamonoscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vamonoscorona.com"; sid:590248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vamoscombaterocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vamoscombaterocorona.com"; sid:590249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for varadoscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"varadoscovid-19.com"; sid:590250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaxicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaxicovid.com"; sid:590251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veganapprovedessentialoilssurvivepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veganapprovedessentialoilssurvivepandemic.com"; sid:590252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veganmomskillingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veganmomskillingcovid19.com"; sid:590253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventamascarillascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventamascarillascoronavirus.com"; sid:590254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viewcoronacahomesforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viewcoronacahomesforsale.com"; sid:590255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viewcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viewcoronavirus.com"; sid:590256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visite-immo-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visite-immo-covid19.com"; sid:590257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vittimecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vittimecoronavirus.com"; sid:590258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vittimecoronavirusitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vittimecoronavirusitalia.com"; sid:590259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viveracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viveracovid19.com"; sid:590260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watercovid.com"; sid:590261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for watiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"watiscorona.com"; sid:590262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid-free.com"; sid:590263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovidfree.com"; sid:590264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefogcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefogcovid19.com"; sid:590265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westernmillingcovid19resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westernmillingcovid19resources.com"; sid:590266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatwillyoudoaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatwillyoudoaftercorona.com"; sid:590267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whithoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whithoutcovid.com"; sid:590268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscompcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscompcovid19.com"; sid:590269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscompcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscompcovid.com"; sid:590270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecovid19.com"; sid:590271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wpcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wpcovid-19.com"; sid:590272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanann.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanann.com"; sid:590273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbmjy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbmjy.com"; sid:590274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjan.com"; sid:590275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjjn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjjn.com"; sid:590276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusvictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusvictim.com"; sid:590277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusvictims.com"; sid:590278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanware.com"; sid:590279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxykdb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxykdb.com"; sid:590280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyes.com"; sid:590281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyewang.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyewang.net"; sid:590282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ww3covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ww3covid19.com"; sid:590283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--bersicht-corona-yvb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--bersicht-corona-yvb.com"; sid:590284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidfreespaa-tkb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidfreespaa-tkb.com"; sid:590285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yallgotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yallgotcorona.com"; sid:590286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yarlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yarlcorona.com"; sid:590287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19masks.com"; sid:590288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19masks.com"; sid:590289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19result.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19result.com"; sid:590290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19store.com"; sid:590291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19stories.com"; sid:590292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourmalagacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourmalagacovidfree.com"; sid:590293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youthagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youthagainstcovid19.com"; sid:590294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zaijiancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zaijiancorona.com"; sid:590295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zedfixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zedfixcovid19.com"; sid:590296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovidin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovidin.com"; sid:590297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zeuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zeuscovid.com"; sid:590298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 143corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"143corona.com"; sid:590299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covid.com"; sid:590300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid9-cerb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid9-cerb.com"; sid:590301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247corona.com"; sid:590302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4thcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4thcorona.com"; sid:590303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogados-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogados-covid.com"; sid:590304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actcovidtesting.com"; sid:590305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adlabcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adlabcovidtest.com"; sid:590306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affichagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affichagecoronavirus.com"; sid:590307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affichagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affichagecovid.com"; sid:590308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affordablecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affordablecovidmask.com"; sid:590309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affordablecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affordablecovidmasks.com"; sid:590310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona-19.com"; sid:590311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afthercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afthercovid-19.com"; sid:590312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afthercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afthercovid19.com"; sid:590313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanashopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanashopcovid.com"; sid:590314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycoronavirustesting.com"; sid:590315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbarrier.com"; sid:590316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprilcorona.com"; sid:590317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcadiacovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcadiacovidfund.com"; sid:590318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcocoronavirus.com"; sid:590319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidtest.com"; sid:590320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronaviruscleaners.com"; sid:590321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspcacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspcacorona.com"; sid:590322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atemschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atemschutz-corona.com"; sid:590323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecovid-19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecovid-19kit.com"; sid:590324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecovid-19test.com"; sid:590325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecovid19test.com"; sid:590326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-homecovid-19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-homecovid-19testkit.com"; sid:590327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestationcovid.com"; sid:590328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorney-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorney-covid.com"; sid:590329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for augustcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"augustcorona.com"; sid:590330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auxilioenergiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auxilioenergiacovid19.com"; sid:590331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid19almeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid19almeria.com"; sid:590332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronaviruscleaner.com"; sid:590333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azukcovidwebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azukcovidwebinar.com"; sid:590334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for balancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"balancecorona.com"; sid:590335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bands-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bands-gegen-corona.com"; sid:590336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barriereanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barriereanticovid19.com"; sid:590337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baseballcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baseballcorona.com"; sid:590338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for basketballcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"basketballcorona.com"; sid:590339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepandemicproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepandemicproof.com"; sid:590340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beratung-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beratung-corona.info"; sid:590341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beratungcorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beratungcorona.info"; sid:590342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidproducts.com"; sid:590343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betcovidrelief.com"; sid:590344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercovid19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercovid19data.com"; sid:590345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhaagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhaagcorona.com"; sid:590346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcoronalive.com"; sid:590347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcoronanews.com"; sid:590348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcoronanews.com"; sid:590349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btcpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btcpandemic.com"; sid:590350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulkcovid.com"; sid:590351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaweed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaweed.com"; sid:590352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinascovid19.com"; sid:590353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camarastermicascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camarastermicascoronavirus.com"; sid:590354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canoe4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canoe4covid.com"; sid:590355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cappadociacoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cappadociacoronasafe.com"; sid:590356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretacovid19.com"; sid:590357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carolebaskincausedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carolebaskincausedcovid19.com"; sid:590358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccrmccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccrmccovid.com"; sid:590359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdphcovid19reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdphcovid19reporting.com"; sid:590360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidtestedworkplace.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidtestedworkplace.info"; sid:590361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkupcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkupcovid19.com"; sid:590362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkupcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkupcovid.com"; sid:590363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chippinginforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chippinginforcovid.com"; sid:590364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chokeoutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chokeoutcovid-19.com"; sid:590365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christandcovid.com"; sid:590366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincodecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincodecorona.com"; sid:590367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleared4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleared4covid.com"; sid:590368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clungenecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clungenecovid19test.com"; sid:590369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cm-covid19.com"; sid:590370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colacorona.com"; sid:590371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for community-outofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"community-outofcovid.com"; sid:590372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityoutofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityoutofcovid.com"; sid:590373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityoutofcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityoutofcovid.info"; sid:590374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congratscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congratscorona.com"; sid:590375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona100x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona100x.com"; sid:590376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona143.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona143.com"; sid:590377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19facemask.com"; sid:590378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19facemasks.com"; sid:590379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19ppesuppliesuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19ppesuppliesuk.com"; sid:590380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4all.com"; sid:590381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona4th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona4th.com"; sid:590382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona666.com"; sid:590383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona80.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona80.com"; sid:590384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-acrylschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-acrylschutz.com"; sid:590385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapril.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapril.com"; sid:590386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-arbeidproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-arbeidproof.com"; sid:590387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatemmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatemmasken.com"; sid:590388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-atemschutzmasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-atemschutzmasken.info"; sid:590389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaugust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaugust.com"; sid:590390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabadcredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabadcredit.com"; sid:590391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabalance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabalance.com"; sid:590392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabangbang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabangbang.com"; sid:590393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegonnah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegonnah.com"; sid:590394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabgonna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabgonna.com"; sid:590395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabgonnah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabgonnah.com"; sid:590396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabotiwala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabotiwala.com"; sid:590397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanopy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanopy.com"; sid:590398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareforyou.com"; sid:590399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacastration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacastration.com"; sid:590400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachesed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachesed.com"; sid:590401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachrist.com"; sid:590402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachristian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachristian.com"; sid:590403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaim.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaim.biz"; sid:590404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanerco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanerco.com"; sid:590405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningtaskforce.com"; sid:590406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacln.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacln.com"; sid:590407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongrats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongrats.com"; sid:590408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstellation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstellation.com"; sid:590409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouponbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouponbooks.com"; sid:590410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreditscore.com"; sid:590411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacriminal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacriminal.com"; sid:590412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisbargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisbargains.com"; sid:590413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaalder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaalder.com"; sid:590414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazed.com"; sid:590415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecember.com"; sid:590416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefenseguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefenseguide.com"; sid:590417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmar-appliancerepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmar-appliancerepair.com"; sid:590418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadentalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadentalexpert.com"; sid:590419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetectives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetectives.com"; sid:590420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeths.com"; sid:590421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadex.com"; sid:590422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadid.com"; sid:590423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-disinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-disinfector.com"; sid:590424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadriver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadriver.com"; sid:590425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadwellers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadwellers.com"; sid:590426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeaster.com"; sid:590427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemail.com"; sid:590428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemails.com"; sid:590429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-enteignung.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-enteignung.info"; sid:590430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepic.com"; sid:590431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaequality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaequality.com"; sid:590432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaerror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaerror.com"; sid:590433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevict.com"; sid:590434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevicted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevicted.com"; sid:590435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexaminer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexaminer.com"; sid:590436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacilitair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacilitair.com"; sid:590437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafebruary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafebruary.com"; sid:590438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafico.com"; sid:590439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafightindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafightindia.com"; sid:590440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafissa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafissa.com"; sid:590441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforeclose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforeclose.com"; sid:590442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagamer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagamer.com"; sid:590443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageschichten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageschichten.info"; sid:590444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreat.com"; sid:590445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherinrichting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherinrichting.com"; sid:590446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe-er-erh.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe-er-erh.info"; sid:590447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaicon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaicon.com"; sid:590448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimage.com"; sid:590449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindica.com"; sid:590450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainrichting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainrichting.com"; sid:590451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsecure.com"; sid:590452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaipo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaipo.com"; sid:590453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisoverrated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisoverrated.com"; sid:590454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajanuary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajanuary.com"; sid:590455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuly.com"; sid:590456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajune.com"; sid:590457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknaak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknaak.com"; sid:590458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakommisjonen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakommisjonen.com"; sid:590459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaborday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaborday.com"; sid:590460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaunch.com"; sid:590461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaldev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaldev.com"; sid:590462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalex.com"; sid:590463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliberty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliberty.com"; sid:590464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalien.com"; sid:590465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliens.com"; sid:590466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdownusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdownusa.com"; sid:590467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalord.com"; sid:590468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.biz"; sid:590469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masken.info"; sid:590470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamay.com"; sid:590471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorynotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorynotes.com"; sid:590472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoonlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoonlight.com"; sid:590473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewyear.com"; sid:590474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewyears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewyears.com"; sid:590475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ni-makeruna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ni-makeruna.com"; sid:590476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanovember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanovember.com"; sid:590477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoctober.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoctober.com"; sid:590478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaog.com"; sid:590479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorg.com"; sid:590480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakblues.com"; sid:590481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicdeaths.com"; sid:590482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicquestions.com"; sid:590483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprodukte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprodukte.com"; sid:590484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofiting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofiting.com"; sid:590485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofkantoren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofkantoren.com"; sid:590486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-r.com"; sid:590487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregimen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregimen.com"; sid:590488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-regress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-regress.com"; sid:590489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregress.com"; sid:590490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareoagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareoagent.com"; sid:590491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareos.com"; sid:590492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepaircredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepaircredit.com"; sid:590493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaretire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaretire.com"; sid:590494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaronavirus.com"; sid:590495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasad.com"; sid:590496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeaparts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeaparts.com"; sid:590497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafehouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafehouses.com"; sid:590498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafescreen.com"; sid:590499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyscreen.com"; sid:590500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasativa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasativa.com"; sid:590501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schluckimpfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schluckimpfung.com"; sid:590502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschluckimpfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschluckimpfung.com"; sid:590503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseek.com"; sid:590504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseptember.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseptember.com"; sid:590505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shien.com"; sid:590506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shop.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shop.info"; sid:590507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmoke.com"; sid:590508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmp.com"; sid:590509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoon.com"; sid:590510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspam.com"; sid:590511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspca.com"; sid:590512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sucks.com"; sid:590513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasundae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasundae.com"; sid:590514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorkit.com"; sid:590515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivorkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivorkits.com"; sid:590516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalking.com"; sid:590517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatamilnadu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatamilnadu.com"; sid:590518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingservice.com"; sid:590519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.nyc"; sid:590520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathanksgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathanksgiving.com"; sid:590521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathc.com"; sid:590522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermometerindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermometerindia.com"; sid:590523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiomnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiomnb.com"; sid:590524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoke.com"; sid:590525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracking.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracking.info"; sid:590526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrumpedtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrumpedtrump.com"; sid:590527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauction.com"; sid:590528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauctions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauctions.com"; sid:590529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaus2020.com"; sid:590530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveilig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveilig.com"; sid:590531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavire.com"; sid:590532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19products.com"; sid:590533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabogados.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabogados.info"; sid:590534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisorsandconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisorsandconsultants.com"; sid:590535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagainst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagainst.com"; sid:590536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-atemschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-atemschutzmaske.com"; sid:590537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-atemschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-atemschutzmasken.com"; sid:590538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-atemschutzmasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-atemschutzmasken.info"; sid:590539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcybrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcybrisbane.com"; sid:590540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcymelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcymelbourne.com"; sid:590541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcynsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcynsw.com"; sid:590542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyperth.com"; sid:590543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyqld.com"; sid:590544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcyvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcyvic.com"; sid:590545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcywa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcywa.com"; sid:590546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7alabama.com"; sid:590547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7alaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7alaska.com"; sid:590548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7arizona.com"; sid:590549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7arkansas.com"; sid:590550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7california.com"; sid:590551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7colorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7colorado.com"; sid:590552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7connecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7connecticut.com"; sid:590553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7delaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7delaware.com"; sid:590554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7florida.com"; sid:590555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7georgia.com"; sid:590556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7hawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7hawaii.com"; sid:590557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7idaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7idaho.com"; sid:590558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7illinois.com"; sid:590559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7indiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7indiana.com"; sid:590560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7iowa.com"; sid:590561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7kansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7kansas.com"; sid:590562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7kentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7kentucky.com"; sid:590563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7louisiana.com"; sid:590564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7maine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7maine.com"; sid:590565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7maryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7maryland.com"; sid:590566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7massachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7massachusetts.com"; sid:590567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7michigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7michigan.com"; sid:590568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7minnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7minnesota.com"; sid:590569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7mississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7mississippi.com"; sid:590570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7missouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7missouri.com"; sid:590571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7montana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7montana.com"; sid:590572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7nebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7nebraska.com"; sid:590573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7nevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7nevada.com"; sid:590574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7newhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7newhampshire.com"; sid:590575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7newjersey.com"; sid:590576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7newmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7newmexico.com"; sid:590577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7newyork.com"; sid:590578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7northcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7northcarolina.com"; sid:590579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7northdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7northdakota.com"; sid:590580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7ohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7ohio.com"; sid:590581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7oklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7oklahoma.com"; sid:590582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7oregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7oregon.com"; sid:590583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7pennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7pennsylvania.com"; sid:590584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7rhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7rhodeisland.com"; sid:590585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7southcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7southcarolina.com"; sid:590586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7southdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7southdakota.com"; sid:590587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7tennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7tennessee.com"; sid:590588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7texas.com"; sid:590589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7utah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7utah.com"; sid:590590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7vermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7vermont.com"; sid:590591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7virginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7virginia.com"; sid:590592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimdenied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimdenied.com"; sid:590593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningarizona.com"; sid:590594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdelaware.com"; sid:590595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdirectory.com"; sid:590596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningillinois.com"; sid:590597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningindiana.com"; sid:590598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningoregon.com"; sid:590599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningpennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningpennsylvania.com"; sid:590600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtexas.com"; sid:590601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationbrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationbrisbane.com"; sid:590602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationmelbourne.com"; sid:590603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationnsw.com"; sid:590604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationperth.com"; sid:590605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationqld.com"; sid:590606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationvic.com"; sid:590607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyadministrationwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyadministrationwa.com"; sid:590608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyalabama.com"; sid:590609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyalaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyalaska.com"; sid:590610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyarizona.com"; sid:590611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyarkansas.com"; sid:590612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcybrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcybrisbane.com"; sid:590613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcycalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcycalifornia.com"; sid:590614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcycolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcycolorado.com"; sid:590615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyconnecticut.com"; sid:590616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcydelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcydelaware.com"; sid:590617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyflorida.com"; sid:590618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcygeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcygeorgia.com"; sid:590619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyhawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyhawaii.com"; sid:590620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyidaho.com"; sid:590621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyillinois.com"; sid:590622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyindiana.com"; sid:590623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyiowa.com"; sid:590624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcykansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcykansas.com"; sid:590625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcykentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcykentucky.com"; sid:590626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcylouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcylouisiana.com"; sid:590627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymaine.com"; sid:590628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymaryland.com"; sid:590629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymassachusetts.com"; sid:590630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymelbourne.com"; sid:590631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymichigan.com"; sid:590632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyminnesota.com"; sid:590633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymississippi.com"; sid:590634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymissouri.com"; sid:590635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcymontana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcymontana.com"; sid:590636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynebraska.com"; sid:590637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynevada.com"; sid:590638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynewhampshire.com"; sid:590639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynewjersey.com"; sid:590640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynewmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynewmexico.com"; sid:590641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynewyork.com"; sid:590642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynorthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynorthcarolina.com"; sid:590643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynorthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynorthdakota.com"; sid:590644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcynsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcynsw.com"; sid:590645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyohio.com"; sid:590646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyoklahoma.com"; sid:590647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyoregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyoregon.com"; sid:590648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcypennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcypennsylvania.com"; sid:590649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyperth.com"; sid:590650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyqld.com"; sid:590651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyrhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyrhodeisland.com"; sid:590652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcysouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcysouthcarolina.com"; sid:590653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcysouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcysouthdakota.com"; sid:590654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcysydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcysydney.com"; sid:590655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcytennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcytennessee.com"; sid:590656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcytexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcytexas.com"; sid:590657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyutah.com"; sid:590658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyvermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyvermont.com"; sid:590659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyvic.com"; sid:590660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcyvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcyvirginia.com"; sid:590661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanybankruptcywa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanybankruptcywa.com"; sid:590662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationbrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationbrisbane.com"; sid:590663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationmelbourne.com"; sid:590664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationnsw.com"; sid:590665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationperth.com"; sid:590666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationqld.com"; sid:590667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationsydney.com"; sid:590668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationvic.com"; sid:590669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompanyliquidationwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompanyliquidationwa.com"; sid:590670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscopingbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscopingbook.com"; sid:590671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantaz.com"; sid:590672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruserror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruserror.com"; sid:590673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruserrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruserrors.com"; sid:590674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusextra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusextra.com"; sid:590675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusface-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusface-masks.com"; sid:590676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfackmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfackmask.com"; sid:590677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfecaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfecaltest.com"; sid:590678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstresponders.com"; sid:590679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflutesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflutesting.com"; sid:590680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-handsanitizer.com"; sid:590681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancepolicy.com"; sid:590682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusirs.com"; sid:590683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusirsrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusirsrelief.com"; sid:590684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitv.com"; sid:590685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyer.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyer.nyc"; sid:590686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalresourcecenter.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalresourcecenter.info"; sid:590687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-mask.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-mask.info"; sid:590688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmediasources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmediasources.com"; sid:590689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusministry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusministry.com"; sid:590690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminusnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminusnineteen.com"; sid:590691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnayibbukele2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnayibbukele2020.com"; sid:590692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusobituary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusobituary.com"; sid:590693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ozono.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ozono.biz"; sid:590694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ozono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ozono.com"; sid:590695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppesupplies.com"; sid:590696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayer.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayer.download"; sid:590697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayerline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayerline.com"; sid:590698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionservice.com"; sid:590699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionservices.com"; sid:590700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protectionmasks.com"; sid:590701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotest.com"; sid:590702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestatenews.com"; sid:590703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreo.com"; sid:590704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-results.com"; sid:590705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusretire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusretire.com"; sid:590706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-schutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-schutzmasken.com"; sid:590707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-schutzmasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-schutzmasken.info"; sid:590708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstooltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstooltest.com"; sid:590709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesterkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesterkit.com"; sid:590710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest.nyc"; sid:590711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusus.biz"; sid:590712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswave2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswave2.com"; sid:590713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswavetwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswavetwo.com"; sid:590714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriorgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriorgame.com"; sid:590715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawidget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawidget.com"; sid:590716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayug.com"; sid:590717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazodiac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazodiac.com"; sid:590718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zwangsabgabe.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zwangsabgabe.info"; sid:590719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corsicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corsicovid.com"; sid:590720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coughforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coughforcovid.com"; sid:590721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10ts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10ts.com"; sid:590722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advisorsandconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advisorsandconsultants.com"; sid:590723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19agerisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19agerisk.com"; sid:590724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alibaba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alibaba.com"; sid:590725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-anon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-anon.com"; sid:590726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anon.com"; sid:590727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodynearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodynearme.com"; sid:590728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyrapidtestkit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyrapidtestkit.info"; sid:590729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytesting.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytesting.info"; sid:590730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-atemschutzmasken.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-atemschutzmasken.info"; sid:590731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19at-homekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19at-homekit.com"; sid:590732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19at-hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19at-hometest.com"; sid:590733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19at-hometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19at-hometesting.com"; sid:590734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19at-hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19at-hometestkit.com"; sid:590735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenessusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenessusa.com"; sid:590736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19babynames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19babynames.com"; sid:590737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcybrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcybrisbane.com"; sid:590738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcymelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcymelbourne.com"; sid:590739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcynsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcynsw.com"; sid:590740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcyperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcyperth.com"; sid:590741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcyqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcyqld.com"; sid:590742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcysydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcysydney.com"; sid:590743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcyvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcyvic.com"; sid:590744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bankruptcywa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bankruptcywa.com"; sid:590745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bets.com"; sid:590746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bf.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bf.info"; sid:590747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-brings-south-dakotas-total-to-90.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-brings-south-dakotas-total-to-90.com"; sid:590748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bulksupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bulksupplier.com"; sid:590749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19byebye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19byebye.com"; sid:590750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19candidates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19candidates.com"; sid:590751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19championsforcharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19championsforcharity.com"; sid:590752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11alabama.com"; sid:590753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11alaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11alaska.com"; sid:590754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11arizona.com"; sid:590755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11arkansas.com"; sid:590756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11california.com"; sid:590757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11connecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11connecticut.com"; sid:590758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11delaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11delaware.com"; sid:590759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11florida.com"; sid:590760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11georgia.com"; sid:590761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11hawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11hawaii.com"; sid:590762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11idaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11idaho.com"; sid:590763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11illinois.com"; sid:590764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11indiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11indiana.com"; sid:590765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11iowa.com"; sid:590766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11kansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11kansas.com"; sid:590767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11kentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11kentucky.com"; sid:590768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11louisiana.com"; sid:590769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11maine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11maine.com"; sid:590770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11maryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11maryland.com"; sid:590771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11massachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11massachusetts.com"; sid:590772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11michigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11michigan.com"; sid:590773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11minnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11minnesota.com"; sid:590774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11mississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11mississippi.com"; sid:590775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11missouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11missouri.com"; sid:590776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11montana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11montana.com"; sid:590777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11nebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11nebraska.com"; sid:590778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11nevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11nevada.com"; sid:590779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11newhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11newhampshire.com"; sid:590780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11newjersey.com"; sid:590781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11newmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11newmexico.com"; sid:590782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11newyork.com"; sid:590783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11northcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11northcarolina.com"; sid:590784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11northdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11northdakota.com"; sid:590785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11ohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11ohio.com"; sid:590786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11oklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11oklahoma.com"; sid:590787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11oregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11oregon.com"; sid:590788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11pennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11pennsylvania.com"; sid:590789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11rhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11rhodeisland.com"; sid:590790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11southcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11southcarolina.com"; sid:590791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11southdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11southdakota.com"; sid:590792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11texas.com"; sid:590793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11utah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11utah.com"; sid:590794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11vermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11vermont.com"; sid:590795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter11virginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter11virginia.com"; sid:590796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7alabama.com"; sid:590797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7alaska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7alaska.com"; sid:590798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7arizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7arizona.com"; sid:590799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7arkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7arkansas.com"; sid:590800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7california.com"; sid:590801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7colorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7colorado.com"; sid:590802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7connecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7connecticut.com"; sid:590803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7delaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7delaware.com"; sid:590804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7florida.com"; sid:590805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7georgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7georgia.com"; sid:590806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7hawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7hawaii.com"; sid:590807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7idaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7idaho.com"; sid:590808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7illinois.com"; sid:590809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7indiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7indiana.com"; sid:590810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7iowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7iowa.com"; sid:590811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7kansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7kansas.com"; sid:590812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7kentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7kentucky.com"; sid:590813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7louisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7louisiana.com"; sid:590814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7maine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7maine.com"; sid:590815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7maryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7maryland.com"; sid:590816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7massachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7massachusetts.com"; sid:590817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7michigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7michigan.com"; sid:590818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7mississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7mississippi.com"; sid:590819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7missouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7missouri.com"; sid:590820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7montana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7montana.com"; sid:590821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7nebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7nebraska.com"; sid:590822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7nevada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7nevada.com"; sid:590823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7newhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7newhampshire.com"; sid:590824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7newjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7newjersey.com"; sid:590825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7newmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7newmexico.com"; sid:590826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7newyork.com"; sid:590827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7northcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7northcarolina.com"; sid:590828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7northdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7northdakota.com"; sid:590829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7ohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7ohio.com"; sid:590830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7oklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7oklahoma.com"; sid:590831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7oregon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7oregon.com"; sid:590832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7pennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7pennsylvania.com"; sid:590833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7rhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7rhodeisland.com"; sid:590834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7southcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7southcarolina.com"; sid:590835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7tennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7tennessee.com"; sid:590836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7texas.com"; sid:590837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7utah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7utah.com"; sid:590838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7vermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7vermont.com"; sid:590839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chapter7virginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chapter7virginia.com"; sid:590840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkers.com"; sid:590841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chic.com"; sid:590842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-chicken-coop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-chicken-coop.com"; sid:590843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-chickencoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-chickencoop.com"; sid:590844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chickencoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chickencoop.com"; sid:590845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleared.com"; sid:590846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cocoon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cocoon.com"; sid:590847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationbrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationbrisbane.com"; sid:590848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationmelbourne.com"; sid:590849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationnsw.com"; sid:590850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationperth.com"; sid:590851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationqld.com"; sid:590852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationsydney.com"; sid:590853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationvic.com"; sid:590854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyadministrationwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyadministrationwa.com"; sid:590855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcybrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcybrisbane.com"; sid:590856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcymelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcymelbourne.com"; sid:590857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcynsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcynsw.com"; sid:590858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcyperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcyperth.com"; sid:590859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcyqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcyqld.com"; sid:590860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcysydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcysydney.com"; sid:590861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcyvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcyvic.com"; sid:590862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companybankruptcywa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companybankruptcywa.com"; sid:590863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationbrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationbrisbane.com"; sid:590864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationmelbourne.com"; sid:590865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationnsw.com"; sid:590866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationperth.com"; sid:590867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationqld.com"; sid:590868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationvic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationvic.com"; sid:590869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19companyliquidationwa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19companyliquidationwa.com"; sid:590870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cookbook.com"; sid:590871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creations.com"; sid:590872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruises.com"; sid:590873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ctapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ctapp.com"; sid:590874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.cymru"; sid:590875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dead.com"; sid:590876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dentalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dentalexpert.com"; sid:590877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalexpert.com"; sid:590878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingandcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingandcleaning.com"; sid:590879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epass.com"; sid:590880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fecaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fecaltest.com"; sid:590881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstresponders.com"; sid:590882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fldoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fldoc.com"; sid:590883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodaid.com"; sid:590884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-fr.com"; sid:590885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freearea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freearea.com"; sid:590886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freebiz.com"; sid:590887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freecertificate.com"; sid:590888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freehotel.com"; sid:590889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freeworld.com"; sid:590890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19future.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19future.com"; sid:590891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19golfcharity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19golfcharity.com"; sid:590892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19golfdonations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19golfdonations.com"; sid:590893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grant.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grant.world"; sid:590894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graphed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graphed.com"; sid:590895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19h2oscotlandsolutions.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19h2oscotlandsolutions.co.uk"; sid:590896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hardware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hardware.com"; sid:590897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hc.info"; sid:590898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebirths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebirths.com"; sid:590899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestin.com"; sid:590900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hookups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hookups.com"; sid:590901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhometesting.com"; sid:590902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insects.com"; sid:590903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intheusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intheusa.com"; sid:590904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investigations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investigations.com"; sid:590905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kiosks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kiosks.com"; sid:590906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kits-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kits-test.com"; sid:590907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kommisjonen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kommisjonen.com"; sid:590908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kommisjonen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kommisjonen.com"; sid:590909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-labs.com"; sid:590910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawca.com"; sid:590911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawla.com"; sid:590912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-life.com"; sid:590913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lifeinsurancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lifeinsurancenow.com"; sid:590914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live.info"; sid:590915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mascherinepoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mascherinepoint.com"; sid:590916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskn95.com"; sid:590917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-masks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-masks.info"; sid:590918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksn95.com"; sid:590919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maskspoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maskspoint.com"; sid:590920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksprotection.com"; sid:590921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19measurements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19measurements.com"; sid:590922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-medical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-medical.com"; sid:590923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicaldepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicaldepot.com"; sid:590924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memfoundation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memfoundation.info"; sid:590925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19names.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19names.com"; sid:590926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newschina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newschina.com"; sid:590927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsitaly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsitaly.com"; sid:590928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsnewyork.com"; sid:590929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onstatistics.com"; sid:590930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ordeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ordeal.com"; sid:590931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overview.com"; sid:590932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ozono.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ozono.biz"; sid:590933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ozono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ozono.com"; sid:590934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19patenteimmunita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19patenteimmunita.com"; sid:590935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pest.com"; sid:590936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photobook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photobook.com"; sid:590937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pilates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pilates.com"; sid:590938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19politicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19politicians.com"; sid:590939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeonline.com"; sid:590940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesupplier.com"; sid:590941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesupplies.com"; sid:590942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionservice.com"; sid:590943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionservices.com"; sid:590944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protection.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protection.info"; sid:590945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptf.com"; sid:590946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pups.com"; sid:590947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reopening.com"; sid:590948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcegroup.com"; sid:590949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19responsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19responsegroup.com"; sid:590950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rightslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rightslaw.com"; sid:590951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rna.com"; sid:590952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rna-extraction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rna-extraction.com"; sid:590953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rnaextraction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rnaextraction.com"; sid:590954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rtpcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rtpcr.com"; sid:590955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehotels.com"; sid:590956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysignages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysignages.com"; sid:590957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetysigns.com"; sid:590958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saga.com"; sid:590959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scholarship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scholarship.com"; sid:590960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seguridad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seguridad.com"; sid:590961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-selftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-selftests.com"; sid:590962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shokoren.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shokoren.info"; sid:590963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions-scotland.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions-scotland.co.uk"; sid:590964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsscotland.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsscotland.co.uk"; sid:590965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19state.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19state.com"; sid:590966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stooltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stooltest.com"; sid:590967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivorscholarship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivorscholarship.com"; sid:590968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomcheck.com"; sid:590969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tazam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tazam.com"; sid:590970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tele.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tele.com"; sid:590971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing4u.com"; sid:590972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testnetwork.com"; sid:590973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnetwork.com"; sid:590974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testpoint.com"; sid:590975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tests.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tests.life"; sid:590976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thewellspringway.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thewellspringway.email"; sid:590977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thewellspringway.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thewellspringway.info"; sid:590978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trace.com"; sid:590979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracing.info"; sid:590980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trending.com"; sid:590981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscontacttracing.com"; sid:590982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waivers.com"; sid:590983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wc.com"; sid:590984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellbeingsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellbeingsurvey.com"; sid:590985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellnesscenter.com"; sid:590986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19widespread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19widespread.com"; sid:590987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplace.com"; sid:590988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldfree.com"; sid:590989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wuhancenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wuhancenter.com"; sid:590990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019cases.com"; sid:590991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019doctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019doctor.com"; sid:590992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019gloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019gloves.com"; sid:590993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019maskn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019maskn95.com"; sid:590994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019masksn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019masksn95.com"; sid:590995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019retailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019retailers.com"; sid:590996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019sanitizer.com"; sid:590997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019shop.com"; sid:590998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019shops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019shops.com"; sid:590999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019switzerland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019switzerland.com"; sid:591000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019vaccination.com"; sid:591001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid757.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid757.com"; sid:591002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenaid.com"; sid:591003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenclaims.com"; sid:591004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teendamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teendamages.com"; sid:591005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teeninfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teeninfo.com"; sid:591006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenrelief.com"; sid:591007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9teen-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9teen-testing.com"; sid:591008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9teentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9teentesting.com"; sid:591009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teentracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teentracking.com"; sid:591010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida2020.com"; sid:591011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccidents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccidents.com"; sid:591012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadom.com"; sid:591013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafectados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafectados.com"; sid:591014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-agerisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-agerisk.com"; sid:591015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagerisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagerisk.com"; sid:591016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamin.com"; sid:591017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodynow.com"; sid:591018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbalharbour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbalharbour.com"; sid:591019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizclaims.com"; sid:591020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizinsurance.com"; sid:591021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizlaw.com"; sid:591022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboca.com"; sid:591023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbridgesurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbridgesurvey.com"; sid:591024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessimpact.com"; sid:591025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptionlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptionlawyers.com"; sid:591026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersnw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersnw.com"; sid:591027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcab.com"; sid:591028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaddi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaddi.com"; sid:591029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaddie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaddie.com"; sid:591030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaddy.com"; sid:591031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.mobi"; sid:591032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clean19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clean19.com"; sid:591033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancan.com"; sid:591034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancloths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancloths.com"; sid:591035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleankey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleankey.com"; sid:591036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantshirts.com"; sid:591037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearamerica.com"; sid:591038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.life"; sid:591039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearusa.com"; sid:591040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityday.com"; sid:591041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceexperts.com"; sid:591042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceservices.com"; sid:591043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectors.com"; sid:591044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverage.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverage.biz"; sid:591045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcum.com"; sid:591046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureidea.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureidea.info"; sid:591047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddataviz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddataviz.com"; sid:591048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathstoday.com"; sid:591049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorceattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorceattorney.com"; sid:591050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddome.com"; sid:591051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-edd-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-edd-ca.com"; sid:591052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemy.com"; sid:591053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencepro.com"; sid:591054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19memorial.com"; sid:591055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfase2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfase2.com"; sid:591056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfecaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfecaltest.com"; sid:591057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightforkids.com"; sid:591058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoil.com"; sid:591059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeperu.com"; sid:591060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgateway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgateway.com"; sid:591061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglove.com"; sid:591062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphing.com"; sid:591063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhardware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhardware.com"; sid:591064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpvancouver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpvancouver.com"; sid:591065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhitimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhitimpact.com"; sid:591066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhookup.com"; sid:591067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotels.com"; sid:591068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigationinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigationinc.com"; sid:591069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigationllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigationllc.com"; sid:591070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigationservices.com"; sid:591071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigationsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigationsystems.com"; sid:591072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigationtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigationtech.com"; sid:591073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpact.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpact.info"; sid:591074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspirations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspirations.com"; sid:591075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurance.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurance.biz"; sid:591076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot-45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot-45.com"; sid:591077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirsrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirsrelief.com"; sid:591078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisease.com"; sid:591079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity.life"; sid:591080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjuggler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjuggler.com"; sid:591081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillas.com"; sid:591082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawla.com"; sid:591083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuit.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuit.nyc"; sid:591084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyer.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyer.nyc"; sid:591085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleader.com"; sid:591086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalwatch.com"; sid:591087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivenow.com"; sid:591088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloantracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloantracer.com"; sid:591089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlockdowns.com"; sid:591090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlv.com"; sid:591091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmamma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmamma.com"; sid:591092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmamparas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmamparas.com"; sid:591093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-market.com"; sid:591094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask3m.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask3m.com"; sid:591095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksuk.com"; sid:591096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeasurements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeasurements.com"; sid:591097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigators.com"; sid:591098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobility.com"; sid:591099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenaid.com"; sid:591100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-none.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-none.com"; sid:591101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutservice.com"; sid:591102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassid.com"; sid:591103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesupplier.com"; sid:591104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofmeeting.com"; sid:591105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotecciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotecciones.com"; sid:591106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protected.com"; sid:591107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectop.com"; sid:591108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectsupplies.com"; sid:591109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryconference.com"; sid:591110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregimen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregimen.com"; sid:591111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieftoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieftoday.com"; sid:591112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepublic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepublic.com"; sid:591113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescuemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescuemasks.com"; sid:591114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourceguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourceguide.com"; sid:591115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcenetwork.com"; sid:591116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepros.com"; sid:591117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-result.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-result.com"; sid:591118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultsatprohealthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultsatprohealthcare.com"; sid:591119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemeasurements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemeasurements.com"; sid:591120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyfacemask.com"; sid:591121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyproduct.com"; sid:591122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetytraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetytraining.com"; sid:591123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyvideo.com"; sid:591124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsbimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsbimpact.com"; sid:591125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscrubbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscrubbers.com"; sid:591126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseproteger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseproteger.com"; sid:591127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop19.com"; sid:591128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids-metamorphoses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids-metamorphoses.com"; sid:591129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsniffdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsniffdogs.com"; sid:591130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspectrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspectrum.com"; sid:591131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsphere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsphere.com"; sid:591132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsteam.com"; sid:591133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstooltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstooltest.com"; sid:591134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoreusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoreusa.com"; sid:591135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesdirect.com"; sid:591136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesshop.com"; sid:591137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyhouse.com"; sid:591138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyshop.com"; sid:591139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteen.com"; sid:591140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesterkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesterkit.com"; sid:591141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmanager.com"; sid:591142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsnearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsnearyou.com"; sid:591143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttulsa.com"; sid:591144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthings.com"; sid:591145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoe.com"; sid:591146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtopstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtopstats.com"; sid:591147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracerexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracerexperts.com"; sid:591148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracers.com"; sid:591149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracjer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracjer.com"; sid:591150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerexperts.com"; sid:591151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingexperts.com"; sid:591152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransit.com"; sid:591153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveller.com"; sid:591154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduality.com"; sid:591155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetest.com"; sid:591156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetesting.com"; sid:591157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisits.com"; sid:591158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellnesscenter.com"; sid:591159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellnesscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellnesscenters.com"; sid:591160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldtracker.com"; sid:591161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx360.com"; sid:591162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditrepaircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditrepaircorona.com"; sid:591163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditscorecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditscorecorona.com"; sid:591164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crewcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crewcorona.com"; sid:591165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdfightthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdfightthepandemic.com"; sid:591166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushscorona.com"; sid:591167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronanyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronanyc.com"; sid:591168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronaweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronaweb.com"; sid:591169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid19nyc.com"; sid:591170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidamerica.com"; sid:591171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidconsortium.com"; sid:591172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dannocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dannocovid.com"; sid:591173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decembercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decembercorona.com"; sid:591174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denenationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denenationcovid19.com"; sid:591175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistcovid-19.com"; sid:591176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desafiouspcovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desafiouspcovid-19.life"; sid:591177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacoronavirusya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacoronavirusya.com"; sid:591178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectacovid19ya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectacovid19ya.com"; sid:591179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didcorona.com"; sid:591180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djs-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djs-gegen-corona.com"; sid:591181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmgcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmgcovidclear.com"; sid:591182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentcoronavirus.com"; sid:591183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentcovid19.com"; sid:591184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogssniffcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogssniffcovid.com"; sid:591185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovidtest.com"; sid:591186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedcovid19test.com"; sid:591187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domaincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domaincorona.com"; sid:591188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domainscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domainscorona.com"; sid:591189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus01.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus01.com"; sid:591190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus02.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus02.com"; sid:591191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus03.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus03.com"; sid:591192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus04.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus04.com"; sid:591193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus05.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus05.com"; sid:591194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19helpus06.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19helpus06.com"; sid:591195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drdcovidlibropr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drdcovidlibropr.com"; sid:591196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drdcovidlobropr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drdcovidlobropr.com"; sid:591197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drs4covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drs4covid19.net"; sid:591198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dz-stop-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dz-stop-covid19.com"; sid:591199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eastbaycovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eastbaycovid-19.info"; sid:591200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economycorona.com"; sid:591201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economyversuscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economyversuscovid.net"; sid:591202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectofcoronavirus.com"; sid:591203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminarcovid.com"; sid:591204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for embersofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"embersofcorona.com"; sid:591205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empirecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empirecorona.com"; sid:591206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enjoycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enjoycovidfree.com"; sid:591207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epiccorona.com"; sid:591208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdating.com"; sid:591209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemichealthnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemichealthnetwork.com"; sid:591210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eriecovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eriecovidclaims.com"; sid:591211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciocovidfree.com"; sid:591212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciofreecovid.com"; sid:591213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialscovid19.com"; sid:591214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for explaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"explaincovid.com"; sid:591215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofthepandemic.com"; sid:591216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncorona-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncorona-19.com"; sid:591217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcoronashop.com"; sid:591218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for februarycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"februarycorona.com"; sid:591219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for federalpandemicresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"federalpandemicresponders.com"; sid:591220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficocorona.com"; sid:591221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financecorona.com"; sid:591222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financescorona.com"; sid:591223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstpandemicresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstpandemicresponders.com"; sid:591224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flagcorona.com"; sid:591225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foerderung-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foerderung-corona.net"; sid:591226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foerderungcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foerderungcorona.net"; sid:591227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for footballcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"footballcorona.com"; sid:591228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19.net"; sid:591229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freezecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freezecorona.com"; sid:591230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19shirts.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19shirts.info"; sid:591231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19shirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19shirts.net"; sid:591232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fussball-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fussball-against-corona.com"; sid:591233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureofcovid-19.com"; sid:591234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futureofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futureofcovid19.com"; sid:591235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for get-coronavirus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"get-coronavirus-test.com"; sid:591236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for get-covid-19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"get-covid-19-test.com"; sid:591237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testingathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testingathome.com"; sid:591238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestingathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestingathome.com"; sid:591239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcovidmoney.com"; sid:591240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcovidmoney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcovidmoney.net"; sid:591241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gobluebeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gobluebeatcovid.com"; sid:591242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gobluebeatcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gobluebeatcovid.net"; sid:591243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godcorona.com"; sid:591244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goldpandemic.com"; sid:591245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodcovid.com"; sid:591246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for govcoronavius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"govcoronavius.com"; sid:591247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatamericancovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatamericancovidclaims.com"; sid:591248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for growyourbusinessaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"growyourbusinessaftercovid19.com"; sid:591249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtfightscorona.com"; sid:591250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for h2ocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"h2ocorona.com"; sid:591251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for h2oscotland-covid19.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"h2oscotland-covid19.co.uk"; sid:591252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for h2oscotland-covid19solutions.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"h2oscotland-covid19solutions.co.uk"; sid:591253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for halloweencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"halloweencorona.com"; sid:591254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hantaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hantaviruspandemic.com"; sid:591255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid19.info"; sid:591256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid19.net"; sid:591257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid.info"; sid:591258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid.net"; sid:591259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hartfordcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hartfordcovidclaims.com"; sid:591260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hgecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hgecovid.com"; sid:591261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hockeycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hockeycorona.com"; sid:591262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestcovid19.net"; sid:591263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotel-covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotel-covid-free.com"; sid:591264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtobeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtobeatcovid.com"; sid:591265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howwillthispandemicchangeus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howwillthispandemicchangeus.com"; sid:591266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iconcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iconcorona.com"; sid:591267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronawhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronawhere.com"; sid:591268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imagecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imagecorona.com"; sid:591269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inatimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inatimeofcovid.com"; sid:591270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indicacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indicacorona.com"; sid:591271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoviruscovid19.com"; sid:591272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insecurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insecurecorona.com"; sid:591273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intelservecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intelservecovid.com"; sid:591274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcoronavirusjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcoronavirusjournal.com"; sid:591275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ipocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ipocorona.com"; sid:591276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscovid19.com"; sid:591277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscovidrelief.com"; sid:591278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isafecovid19.com"; sid:591279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19scholarship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19scholarship.com"; sid:591280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivegotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivegotcovid19.com"; sid:591281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivegotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivegotcovid.com"; sid:591282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for januarycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"januarycorona.com"; sid:591283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for julycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"julycorona.com"; sid:591284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for junecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"junecorona.com"; sid:591285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenyacoronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenyacoronavirusdata.com"; sid:591286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killscovid-19.com"; sid:591287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovidpro.com"; sid:591288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labordaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labordaycorona.com"; sid:591289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ladypandemicsdragrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ladypandemicsdragrace.com"; sid:591290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for launchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"launchcorona.com"; sid:591291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcoronavirus.com"; sid:591292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcovid-19.com"; sid:591293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcovid19.com"; sid:591294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezacoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezacoronavirus.info"; sid:591295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezascovid-19.com"; sid:591296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdown-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdown-corona.com"; sid:591297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for locorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"locorona.com"; sid:591298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for london-business-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"london-business-covid19.com"; sid:591299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lordcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lordcorona.com"; sid:591300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luckcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luckcorona.com"; sid:591301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madcorona.com"; sid:591302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascorona.com"; sid:591303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasdeproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasdeproteccioncovid19.com"; sid:591304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marchcorona.com"; sid:591305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksafetycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksafetycovid-19.com"; sid:591306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-stopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-stopcovid.com"; sid:591307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masterstipsoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masterstipsoncovid-19.com"; sid:591308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalfacemaskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalfacemaskscovid.com"; sid:591309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialdaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialdaycorona.com"; sid:591310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metin2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metin2covid.com"; sid:591311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milanoforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milanoforcovid.com"; sid:591312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanasmallbusinessandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanasmallbusinessandcovid.com"; sid:591313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moriniprotezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moriniprotezionecovid.com"; sid:591314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundschutz-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundschutz-corona.info"; sid:591315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicbands-against-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicbands-against-corona.com"; sid:591316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musikbands-gegen-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musikbands-gegen-corona.com"; sid:591317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mybizcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mybizcovid.com"; sid:591318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoviddiary.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoviddiary.life"; sid:591319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidppe.com"; sid:591320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtestlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtestlasvegas.com"; sid:591321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovid.com"; sid:591322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claim.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claim.info"; sid:591323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claims.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claims.info"; sid:591324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicpros.com"; sid:591325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicresponders.com"; sid:591326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicresponsders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicresponsders.com"; sid:591327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcorona-taisaku.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcorona-taisaku.net"; sid:591328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newenglandcoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newenglandcoronacleaners.com"; sid:591329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyearcorona.com"; sid:591330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyearscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyearscorona.com"; sid:591331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidkey.com"; sid:591332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidonsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidonsite.com"; sid:591333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notengocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notengocovid.com"; sid:591334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novembercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novembercorona.com"; sid:591335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nurseswithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nurseswithcovid19.com"; sid:591336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nurseswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nurseswithcovid.com"; sid:591337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronaviruscleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronaviruscleaners.com"; sid:591338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidclean.com"; sid:591339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocorona-hilfe-er-erh.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocorona-hilfe-er-erh.info"; sid:591340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for octobercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"octobercorona.com"; sid:591341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officecorona.com"; sid:591342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidcoin.com"; sid:591343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omahacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omahacovid.com"; sid:591344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for openstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"openstopcovid.com"; sid:591345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcorona2020.com"; sid:591346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlifeaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlifeaftercoronavirus.com"; sid:591347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-coronavirus.com"; sid:591348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-covid19.com"; sid:591349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for padelcoronado.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"padelcoronado.net"; sid:591350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccosts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccosts.com"; sid:591351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoverup.com"; sid:591352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccx.com"; sid:591353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdesignvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdesignvt.com"; sid:591354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdown.com"; sid:591355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexp.com"; sid:591356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfightforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfightforkids.com"; sid:591357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforkids.com"; sid:591358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichronicles.com"; sid:591359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimpactsb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimpactsb.com"; sid:591360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinformatics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinformatics.com"; sid:591361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestingstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestingstrategies.com"; sid:591362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestmentstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestmentstrategies.com"; sid:591363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestorsstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestorsstrategies.com"; sid:591364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestorstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestorstrategies.com"; sid:591365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjewels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjewels.com"; sid:591366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnavigator.com"; sid:591367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpeopleandplaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpeopleandplaces.com"; sid:591368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpetportraits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpetportraits.com"; sid:591369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphotographer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphotographer.com"; sid:591370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphotographers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphotographers.com"; sid:591371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphotography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphotography.com"; sid:591372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-playlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-playlist.com"; sid:591373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-ppe.com"; sid:591374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprayer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprayer.net"; sid:591375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparation.net"; sid:591376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparationproducts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparationproducts.net"; sid:591377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproductsinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproductsinc.com"; sid:591378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofbook.com"; sid:591379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionproducts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionproducts.net"; sid:591380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpurchase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpurchase.com"; sid:591381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrace.com"; sid:591382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrating.com"; sid:591383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreinsurance.com"; sid:591384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelieffound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelieffound.com"; sid:591385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefnow.com"; sid:591386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefnow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefnow.info"; sid:591387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsetoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsetoolkit.com"; sid:591388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsauce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsauce.com"; sid:591389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshare.com"; sid:591390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-statistics.com"; sid:591391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicswag.com"; sid:591392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicup.com"; sid:591393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwave2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwave2.com"; sid:591394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patternsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patternsofcovid.com"; sid:591395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for percovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"percovid.com"; sid:591396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for philcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"philcovidtracker.com"; sid:591397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planetvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planetvscovid19.com"; sid:591398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadosporelcovidencentroscomercialesdeespana-pac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadosporelcovidencentroscomercialesdeespana-pac.com"; sid:591399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portalcovid.com"; sid:591400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poscovid.com"; sid:591401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronareboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronareboot.com"; sid:591402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronavirus2020.com"; sid:591403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona-virus.com"; sid:591404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.coach"; sid:591405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.coach"; sid:591406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcoach.com"; sid:591407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcoaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcoaches.com"; sid:591408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcoaching.com"; sid:591409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddating.com"; sid:591410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmalone.com"; sid:591411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidreboot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidreboot.com"; sid:591412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidweightloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidweightloss.com"; sid:591413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidworkforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidworkforce.com"; sid:591414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicforum.com"; sid:591415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for print4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"print4covid.com"; sid:591416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for produits-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"produits-covid-19.com"; sid:591417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for produits-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"produits-covid19.com"; sid:591418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionepidemica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionepidemica.com"; sid:591419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccovid.com"; sid:591420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection-covid.net"; sid:591421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-covid-19.com"; sid:591422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectiv-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectiv-covid19.com"; sid:591423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivepandemicproducts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivepandemicproducts.net"; sid:591424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectivepandemicprotection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectivepandemicprotection.net"; sid:591425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protestcovid19.com"; sid:591426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for queationingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"queationingcovid.com"; sid:591427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioningcovid19.com"; sid:591428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ranzhangwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ranzhangwuhan.com"; sid:591429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readcorona.com"; sid:591430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reficorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reficorona.com"; sid:591431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reficoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reficoronavirus.com"; sid:591432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for refinancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"refinancecorona.com"; sid:591433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for regimencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"regimencorona.com"; sid:591434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registres-communes-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registres-communes-coronavirus.com"; sid:591435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliablecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliablecovidtesting.com"; sid:591436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remisecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remisecovid19.com"; sid:591437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reocorona.com"; sid:591438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reocoronavirus.com"; sid:591439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for repaircreditcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"repaircreditcorona.com"; sid:591440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for researchersandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"researchersandcovid19.com"; sid:591441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restartcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restartcovid19.com"; sid:591442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcovid19claim.com"; sid:591443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantcovidclaim.com"; sid:591444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retirecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retirecorona.com"; sid:591445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retirecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retirecoronavirus.com"; sid:591446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reusablecoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reusablecoronavirusmask.com"; sid:591447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcovid19book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcovid19book.com"; sid:591448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimenticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimenticovid.com"; sid:591449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimentocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimentocovid.com"; sid:591450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rockcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rockcorona.com"; sid:591451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ruleoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ruleoutcovid.com"; sid:591452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runcovid-19.com"; sid:591453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for s4scovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"s4scovid19.com"; sid:591454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovidtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovidtrials.com"; sid:591455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancovid.com"; sid:591456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sandiegocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sandiegocovidtest.com"; sid:591457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanificazioneanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanificazioneanticovid.com"; sid:591458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sativacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sativacorona.com"; sid:591459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbcovidimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbcovidimpact.com"; sid:591460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sbpandemicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sbpandemicimpact.com"; sid:591461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchingcovid.com"; sid:591462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for self-screen-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"self-screen-coronavirus.com"; sid:591463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for self-screen-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"self-screen-covid-19.com"; sid:591464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seocorona.com"; sid:591465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seocoronavirus.com"; sid:591466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for septembercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"septembercorona.com"; sid:591467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19.info"; sid:591468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soccercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soccercorona.com"; sid:591469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for societycovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"societycovidclaims.com"; sid:591470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovid-19.com"; sid:591471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soluzionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soluzionicovid.com"; sid:591472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somalilandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somalilandcovid19.com"; sid:591473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sooncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sooncorona.com"; sid:591474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sosodontotecnicicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sosodontotecnicicovid19.com"; sid:591475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spcacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spcacorona.com"; sid:591476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportscorona.com"; sid:591477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stagwellcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stagwellcovid.com"; sid:591478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stagwellcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stagwellcovid.info"; sid:591479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stdscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stdscorona.com"; sid:591480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronafast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronafast.com"; sid:591481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidbarrier.com"; sid:591482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for superviviente-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"superviviente-covid19.com"; sid:591483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supervivientecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supervivientecovid19.com"; sid:591484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplies-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplies-for-covid19.com"; sid:591485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplies-for-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplies-for-covid19.info"; sid:591486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingthecvpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingthecvpandemic.com"; sid:591487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamcovidresponse.com"; sid:591488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthcovid.com"; sid:591489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicovida.com"; sid:591490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teleworkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teleworkcovid19.com"; sid:591491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teleworkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teleworkcovid.com"; sid:591492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thanksgivingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thanksgivingcorona.com"; sid:591493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebronxcovid19oralhistoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebronxcovid19oralhistoryproject.com"; sid:591494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabob.com"; sid:591495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaloveproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaloveproject.com"; sid:591496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaronavirus.com"; sid:591497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavire.com"; sid:591498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusprayer.download - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusprayer.download"; sid:591499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusprayer.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusprayer.email"; sid:591500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19experts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19experts.com"; sid:591501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19photo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19photo.com"; sid:591502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19prayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19prayer.com"; sid:591503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19quilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19quilt.com"; sid:591504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19s.com"; sid:591505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19shirt.com"; sid:591506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19survivorscholarship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19survivorscholarship.com"; sid:591507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19today.com"; sid:591508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19trail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19trail.com"; sid:591509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfiles.com"; sid:591510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidguru.com"; sid:591511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidlawfirm.com"; sid:591512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovids19.com"; sid:591513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtracers.com"; sid:591514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelastestnewsoncoronavirusandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelastestnewsoncoronavirusandcovid-19.com"; sid:591515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thematchcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thematchcovid19.com"; sid:591516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thematchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thematchcovid.com"; sid:591517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thematchtobenefitcovid-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thematchtobenefitcovid-19relief.com"; sid:591518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thematchtobenefitcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thematchtobenefitcovid19relief.com"; sid:591519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicrebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicrebound.com"; sid:591520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcoronavurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcoronavurus.com"; sid:591521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutthepandemic.com"; sid:591522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewordbeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewordbeforecovid19.com"; sid:591523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewordbeforecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewordbeforecovid.com"; sid:591524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidmasks.com"; sid:591525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcoronabd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcoronabd.com"; sid:591526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidnow.com"; sid:591527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for translatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"translatecovid19.com"; sid:591528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for translatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"translatecovid.com"; sid:591529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatment-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatment-covid.com"; sid:591530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedpandemicresponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedpandemicresponders.com"; sid:591531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidcorp.com"; sid:591532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv-corona.com"; sid:591533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronavirus19.com"; sid:591534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronavirusuyokeder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronavirusuyokeder.com"; sid:591535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viseracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viseracoronavirus.com"; sid:591536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wccovid19.com"; sid:591537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidclean.com"; sid:591538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webcovid19life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webcovid19life.com"; sid:591539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecleancorona.com"; sid:591540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weremembercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weremembercovid19.com"; sid:591541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whattodoaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whattodoaftercoronavirus.com"; sid:591542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatwillthispandemicchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatwillthispandemicchange.com"; sid:591543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoiscovid19.com"; sid:591544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoiscovid.com"; sid:591545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcompcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcompcoronavirus.com"; sid:591546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcompcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcompcovid.com"; sid:591547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscompcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscompcoronavirus.com"; sid:591548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlab.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlab.club"; sid:591549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlin.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlin.world"; sid:591550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus.club"; sid:591551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirustimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirustimeline.com"; sid:591552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--desinfeccincovid19-z1b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--desinfeccincovid19-z1b.com"; sid:591553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--mamparasproteccincovid-bgc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--mamparasproteccincovid-bgc.com"; sid:591554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--productoespaolcovid-63b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--productoespaolcovid-63b.com"; sid:591555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yomitanvill-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yomitanvill-covid.info"; sid:591556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youcovidtesting.com"; sid:591557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidneeds.com"; sid:591558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerozerocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerozerocovid.com"; sid:591559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 0covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"0covid-19.com"; sid:591560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidlaw.com"; sid:591561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidvirus.com"; sid:591562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19stimpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19stimpackage.com"; sid:591563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-supply.com"; sid:591564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20milesbeatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20milesbeatscovid19.com"; sid:591565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 26covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"26covid19.com"; sid:591566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360coronado.com"; sid:591567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 666corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"666corona.com"; sid:591568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronacleaning.com"; sid:591569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogados-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogados-coronavirus.com"; sid:591570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abrazoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abrazoscovid.com"; sid:591571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advertisingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advertisingcorona.com"; sid:591572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftcorona.com"; sid:591573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona-19.xn--mk1bu44c - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona-19.xn--mk1bu44c"; sid:591574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronasale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronasale.com"; sid:591575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid-19.xn--mk1bu44c - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid-19.xn--mk1bu44c"; sid:591576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidsale.com"; sid:591577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aide-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aide-coronavirus.com"; sid:591578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akcovid19tracker.codes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akcovid19tracker.codes"; sid:591579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alicantecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alicantecovidfree.com"; sid:591580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alonetogethercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alonetogethercovid19.com"; sid:591581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andypandemic.com"; sid:591582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apartamentocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apartamentocovidfree.com"; sid:591583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apartamentoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apartamentoscovidfree.com"; sid:591584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aretheycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aretheycovidclean.com"; sid:591585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ariscovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ariscovid19disinfecting.com"; sid:591586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arztpraxis-corona-zeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arztpraxis-corona-zeiten.info"; sid:591587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arztpraxis-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arztpraxis-coronazeiten.info"; sid:591588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciacovid.com"; sid:591589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspencovid19.com"; sid:591590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atestforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atestforcorona.com"; sid:591591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atestforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atestforcovid.com"; sid:591592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atomosferacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atomosferacovidfree.com"; sid:591593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for att-covidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"att-covidrelief.com"; sid:591594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auxilioenergiaacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auxilioenergiaacovid19.com"; sid:591595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidaftercovid.com"; sid:591596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcy4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcy4covid19.com"; sid:591597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcy-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcy-covid19.com"; sid:591598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barrieracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barrieracovid.com"; sid:591599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidng.com"; sid:591600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biotechcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biotechcovid19.com"; sid:591601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biotechcovid19limpieza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biotechcovid19limpieza.com"; sid:591602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bkkfightscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bkkfightscovid19.com"; sid:591603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid.com"; sid:591604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bornincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bornincovid.com"; sid:591605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boutique-coronastyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boutique-coronastyle.com"; sid:591606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcoronaproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcoronaproof.com"; sid:591607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcovid-19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcovid-19free.com"; sid:591608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcovid19free.com"; sid:591609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcovid19proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcovid19proof.com"; sid:591610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcovidproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcovidproof.com"; sid:591611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcoronavirus.info"; sid:591612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcovid19.info"; sid:591613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brscovid19archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brscovid19archive.com"; sid:591614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buckscountycovid19vote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buckscountycovid19vote.com"; sid:591615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscorona.com"; sid:591616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidsigns.com"; sid:591617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspandemic.com"; sid:591618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidppe.com"; sid:591619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmaftercovid.com"; sid:591620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campaigncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campaigncovid19.com"; sid:591621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campingscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campingscovidfree.com"; sid:591622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canariascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canariascovidfree.com"; sid:591623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercovidguide.com"; sid:591624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carinsurancecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carinsurancecorona.com"; sid:591625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carsforcovid.com"; sid:591626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccpthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccpthepandemic.com"; sid:591627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebratecovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebratecovidheroes.com"; sid:591628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadosanitariocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadosanitariocovid19.com"; sid:591629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidcleaning.com"; sid:591630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidtestedworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidtestedworkplace.com"; sid:591631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidfoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidfoggers.com"; sid:591632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidpros.com"; sid:591633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovid19.com"; sid:591634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovid.com"; sid:591635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claritycovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claritycovidsafe.com"; sid:591636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaning4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaning4covid19.com"; sid:591637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupaftercovid19.com"; sid:591638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidimaging.com"; sid:591639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidtracking.com"; sid:591640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearforcleaningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearforcleaningcovid19.com"; sid:591641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearlytrackingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearlytrackingcovid.com"; sid:591642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearreadcovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearreadcovidimaging.com"; sid:591643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearreadcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearreadcovidtracking.com"; sid:591644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clungenecovid19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clungenecovid19test.net"; sid:591645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnncoronavirusanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnncoronavirusanswers.com"; sid:591646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codeonecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codeonecoronavirus.com"; sid:591647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronacleaning.com"; sid:591648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronaviruscleaning.com"; sid:591649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comandocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comandocovid19.com"; sid:591650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comandocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comandocovid.com"; sid:591651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comerciolibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comerciolibredecovid19.com"; sid:591652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compike-corona-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compike-corona-tracker.com"; sid:591653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congocovid19.com"; sid:591654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovidla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovidla.com"; sid:591655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copcorona.com"; sid:591656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19safe.com"; sid:591657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaac.com"; sid:591658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-artist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-artist.com"; sid:591659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegonedfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegonedfw.com"; sid:591660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiden.com"; sid:591661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bier-virus.tel - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bier-virus.tel"; sid:591662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboyfriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboyfriend.com"; sid:591663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesscheck.com"; sid:591664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessinterruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessinterruptionclaim.com"; sid:591665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-mediation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-mediation.com"; sid:591666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-mediation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-mediation.info"; sid:591667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business-mediation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business-mediation.net"; sid:591668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinessprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinessprotect.com"; sid:591669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersdallas.com"; sid:591670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersdfw.com"; sid:591671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-certified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-certified.com"; sid:591672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannj.com"; sid:591673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearcertificate.com"; sid:591674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothingcompany.com"; sid:591675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compliance.com"; sid:591676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliancegroup.com"; sid:591677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compliant.com"; sid:591678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cooperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cooperation.com"; sid:591679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cooperation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cooperation.info"; sid:591680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cooperation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cooperation.net"; sid:591681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacredentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacredentials.com"; sid:591682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronad20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronad20.com"; sid:591683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensetoothpaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensetoothpaste.com"; sid:591684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelhi.com"; sid:591685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-depot.com"; sid:591686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-designs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-designs.com"; sid:591687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diabetes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diabetes.com"; sid:591688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectingexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectingexperts.com"; sid:591689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadnc.com"; sid:591690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadurgapur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadurgapur.com"; sid:591691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entschaedigungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entschaedigungen.com"; sid:591692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafantasybaseballleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafantasybaseballleague.com"; sid:591693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafdny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafdny.com"; sid:591694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeel.com"; sid:591695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafornication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafornication.com"; sid:591696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafortune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafortune.com"; sid:591697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreelicense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreelicense.com"; sid:591698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafrychicken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafrychicken.com"; sid:591699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelm.com"; sid:591700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeprotect.com"; sid:591701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hospitality.com"; sid:591702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotspots.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotspots.today"; sid:591703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahypestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahypestore.com"; sid:591704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-immobilien-muenchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-immobilien-muenchen.com"; sid:591705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainforapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainforapi.com"; sid:591706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvestor.com"; sid:591707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakensa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakensa.com"; sid:591708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersteam.com"; sid:591709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-labor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-labor.com"; sid:591710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalamps.com"; sid:591711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaughs.com"; sid:591712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessdentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessdentist.com"; sid:591713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloangov.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloangov.info"; sid:591714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluna.com"; sid:591715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaharashtra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaharashtra.com"; sid:591716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaitai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaitai.com"; sid:591717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskenkaufen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskenkaufen.com"; sid:591718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mediation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mediation.info"; sid:591719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mediation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mediation.net"; sid:591720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mobil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mobil.com"; sid:591721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-module.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-module.com"; sid:591722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamodule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamodule.com"; sid:591723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanegativedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanegativedentist.com"; sid:591724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nein-danke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nein-danke.com"; sid:591725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneindanke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneindanke.com"; sid:591726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanlm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanlm.com"; sid:591727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanypd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanypd.com"; sid:591728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapattern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapattern.com"; sid:591729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-poly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-poly.com"; sid:591730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofbowling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofbowling.com"; sid:591731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotect.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotect.life"; sid:591732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectorpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectorpro.com"; sid:591733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronar20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronar20.com"; sid:591734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponseplan.com"; sid:591735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartdress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartdress.com"; sid:591736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaftercorona.com"; sid:591737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasbox.com"; sid:591738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashack.com"; sid:591739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeck.com"; sid:591740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sports.com"; sid:591741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassports.com"; sid:591742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockmarket.com"; sid:591743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaterrorism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaterrorism.com"; sid:591744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsupplies.com"; sid:591745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesttoday.com"; sid:591746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimeinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimeinternational.com"; sid:591747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrends.net"; sid:591748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-und-du.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-und-du.info"; sid:591749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinemap.com"; sid:591750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinemaps.com"; sid:591751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccines.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccines.today"; sid:591752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus192020.com"; sid:591753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactu.com"; sid:591754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairlinerefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairlinerefund.com"; sid:591755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandadalimumab.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandadalimumab.info"; sid:591756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandbrand.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandbrand.info"; sid:591757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandgeneric.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandgeneric.info"; sid:591758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhumira.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhumira.info"; sid:591759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrinvoq.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrinvoq.info"; sid:591760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandskyrizi.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandskyrizi.info"; sid:591761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandupadacitinib.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandupadacitinib.info"; sid:591762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodybloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodybloodtest.com"; sid:591763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-apparel.com"; sid:591764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyca.com"; sid:591765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeerstraw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeerstraw.com"; sid:591766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter13.com"; sid:591767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschapter7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschapter7.com"; sid:591768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningproduct.com"; sid:591769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningshop.com"; sid:591770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningstore.com"; sid:591771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsupply.com"; sid:591772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19.center"; sid:591773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscreditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscreditscore.com"; sid:591774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscue.com"; sid:591775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-es.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-es.com"; sid:591776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesupplies.com"; sid:591777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarecompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarecompensation.com"; sid:591778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflightscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflightscompensation.com"; sid:591779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgarden.com"; sid:591780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-hokkaido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-hokkaido.com"; sid:591781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskaren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskaren.com"; sid:591782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerny.com"; sid:591783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslessdentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslessdentist.com"; sid:591784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitor.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitor.zone"; sid:591785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursinghomeny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursinghomeny.com"; sid:591786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicdreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicdreams.com"; sid:591787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparalegals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparalegals.com"; sid:591788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionessentials.com"; sid:591789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestateservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestateservices.com"; sid:591790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-refunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-refunds.com"; sid:591791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-safetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-safetysigns.com"; sid:591792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusssos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusssos.com"; sid:591793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatisticsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatisticsonline.com"; sid:591794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurcharge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurcharge.com"; sid:591795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaskforcebriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaskforcebriefing.com"; sid:591796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustech.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustech.info"; sid:591797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustech.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustech.net"; sid:591798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingkit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingkit.info"; sid:591799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingnationwide.com"; sid:591800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnationwide.com"; sid:591801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestsnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestsnationwide.com"; sid:591802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusticketsrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusticketsrefund.com"; sid:591803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvdisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvdisinfectant.com"; sid:591804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvsanitizer.com"; sid:591805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswearable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswearable.com"; sid:591806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswearables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswearables.com"; sid:591807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyozono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyozono.com"; sid:591808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlab.com"; sid:591809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavouchers.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavouchers.world"; sid:591810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-walks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-walks.com"; sid:591811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawallstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawallstreet.com"; sid:591812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawearusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawearusa.com"; sid:591813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweed.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweed.info"; sid:591814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawwjd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawwjd.com"; sid:591815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-007.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-007.com"; sid:591816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10mintest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10mintest.com"; sid:591817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984lies.com"; sid:591818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aerosol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aerosol.com"; sid:591819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aerosols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aerosols.com"; sid:591820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ai.com"; sid:591821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alertapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alertapp.com"; sid:591822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alonetogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alonetogether.com"; sid:591823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andsociety.com"; sid:591824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antiviralmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antiviralmeds.com"; sid:591825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antivirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antivirals.com"; sid:591826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19at68livingston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19at68livingston.com"; sid:591827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-awareness.com"; sid:591828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buddies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buddies.com"; sid:591829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessloss.com"; sid:591830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-businessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-businessloss.com"; sid:591831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business-loss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business-loss.com"; sid:591832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busters.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busters.info"; sid:591833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busters.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busters.mobi"; sid:591834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busters.net"; sid:591835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyer.com"; sid:591836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyers.com"; sid:591837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carpurifier.com"; sid:591838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19center.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19center.net"; sid:591839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19claiminfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19claiminfo.com"; sid:591840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claiminfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claiminfo.com"; sid:591841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanbusiness.com"; sid:591842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanpro.com"; sid:591843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanpros.com"; sid:591844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19comeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19comeback.com"; sid:591845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commemorative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commemorative.com"; sid:591846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commemorative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commemorative.com"; sid:591847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commune.com"; sid:591848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19communicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19communicate.com"; sid:591849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communicate.com"; sid:591850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communicate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communicate.net"; sid:591851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-compliance.com"; sid:591852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.training"; sid:591853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-compliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-compliant.com"; sid:591854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19creditreportboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19creditreportboost.com"; sid:591855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dashboardsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dashboardsurvey.com"; sid:591856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataplots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataplots.com"; sid:591857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dealz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dealz.com"; sid:591858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-debtrelief.com"; sid:591859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decons.com"; sid:591860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defiant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defiant.com"; sid:591861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dermatology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dermatology.com"; sid:591862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detectiondogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detectiondogs.com"; sid:591863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-devices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-devices.com"; sid:591864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diaries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diaries.net"; sid:591865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digitalscreeningrepository.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digitalscreeningrepository.com"; sid:591866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discountppe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discountppe.net"; sid:591867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectantsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectantsolutions.com"; sid:591868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfecting24hrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfecting24hrs.com"; sid:591869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinifectingmiami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinifectingmiami.com"; sid:591870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dividers.com"; sid:591871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19driveuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19driveuptesting.com"; sid:591872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ebusiness.com"; sid:591873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eleminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eleminator.com"; sid:591874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eleminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eleminator.com"; sid:591875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eleminator.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eleminator.info"; sid:591876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eleminator.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eleminator.info"; sid:591877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eleminator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eleminator.net"; sid:591878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eleminator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eleminator.net"; sid:591879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epi.com"; sid:591880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.fan - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.fan"; sid:591881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flushots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flushots.com"; sid:591882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fuck.com"; sid:591883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19futurereadyleader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19futurereadyleader.com"; sid:591884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalprayer.com"; sid:591885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalprayers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalprayers.com"; sid:591886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gta.com"; sid:591887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hcisurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hcisurvey.com"; sid:591888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heroesvillains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heroesvillains.com"; sid:591889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homebuyertips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homebuyertips.com"; sid:591890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesellertips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesellertips.com"; sid:591891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest4u.com"; sid:591892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunerace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunerace.com"; sid:591893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-immunerace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-immunerace.com"; sid:591894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19increasecreditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19increasecreditscore.com"; sid:591895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infected.com"; sid:591896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infector.com"; sid:591897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19install.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19install.com"; sid:591898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instantly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instantly.com"; sid:591899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19itremotesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19itremotesupport.com"; sid:591900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kau.com"; sid:591901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kau.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kau.info"; sid:591902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killers.net"; sid:591903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kmchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kmchallenge.com"; sid:591904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19knowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19knowledge.com"; sid:591905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.company"; sid:591906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyergeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyergeorgia.com"; sid:591907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyermaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyermaine.com"; sid:591908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyermichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyermichigan.com"; sid:591909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyernewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyernewjersey.com"; sid:591910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.solutions"; sid:591911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerwashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerwashington.com"; sid:591912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laywerlouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laywerlouisiana.com"; sid:591913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lessdentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lessdentist.com"; sid:591914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19libre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19libre.com"; sid:591915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lite.com"; sid:591916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live.world"; sid:591917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mandates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mandates.com"; sid:591918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskandmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskandmore.com"; sid:591919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meeting.com"; sid:591920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meetingplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meetingplace.com"; sid:591921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memfoundation.com"; sid:591922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19merchshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19merchshop.com"; sid:591923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19negativedentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19negativedentist.com"; sid:591924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newslive.com"; sid:591925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlineproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlineproducts.com"; sid:591926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlineshop.com"; sid:591927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-online-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-online-store.com"; sid:591928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlinestore.com"; sid:591929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19orders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19orders.com"; sid:591930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19organics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19organics.com"; sid:591931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19passport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19passport.net"; sid:591932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppe.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppe.world"; sid:591933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppp.com"; sid:591934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19printing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19printing.com"; sid:591935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prints.com"; sid:591936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proofbowling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proofbowling.com"; sid:591937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proofbowling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proofbowling.com"; sid:591938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocols.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocols.info"; sid:591939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocols.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocols.net"; sid:591940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quilts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quilts.com"; sid:591941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raj.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raj.info"; sid:591942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatesafety.com"; sid:591943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19realtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19realtime.com"; sid:591944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefresume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefresume.com"; sid:591945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19response.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19response.center"; sid:591946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sale.com"; sid:591947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saving.com"; sid:591948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scanners.com"; sid:591949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schutz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schutz.info"; sid:591950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scrub.com"; sid:591951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shamed.com"; sid:591952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s.info"; sid:591953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smallbusinesslosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smallbusinesslosses.com"; sid:591954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soaps.com"; sid:591955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soluciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soluciones.com"; sid:591956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19southafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19southafrica.com"; sid:591957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spary.com"; sid:591958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stat.com"; sid:591959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stay.com"; sid:591960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stay.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stay.info"; sid:591961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stay.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stay.net"; sid:591962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplies2u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplies2u.com"; sid:591963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surcharge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surcharge.com"; sid:591964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivors.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivors.info"; sid:591965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfordso.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfordso.net"; sid:591966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingnationwide.com"; sid:591967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnationwide.com"; sid:591968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testnationwide.com"; sid:591969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnationwide.com"; sid:591970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsfordentists.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsfordentists.net"; sid:591971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testsnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testsnationwide.com"; sid:591972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsnationwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsnationwide.com"; sid:591973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststation.com"; sid:591974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackingdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackingdatabase.com"; sid:591975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trained.com"; sid:591976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trained.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trained.net"; sid:591977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tww.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tww.com"; sid:591978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatenews.com"; sid:591979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvlite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvlite.com"; sid:591980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedevelopment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedevelopment.com"; sid:591981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedevelopmentgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedevelopmentgroup.com"; sid:591982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedevelopments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedevelopments.com"; sid:591983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinegroup.com"; sid:591984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinepatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinepatch.com"; sid:591985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinepatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinepatch.com"; sid:591986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vax-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vax-in.com"; sid:591987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusremoval.com"; sid:591988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-visuals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-visuals.com"; sid:591989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellnessgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellnessgroup.com"; sid:591990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellnessgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellnessgroups.com"; sid:591991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19windowsticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19windowsticker.com"; sid:591992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldchat.com"; sid:591993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xxl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xxl.com"; sid:591994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019china.com"; sid:591995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019questions.com"; sid:591996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-20.com"; sid:591997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020kid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020kid.com"; sid:591998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid50facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid50facts.com"; sid:591999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9kleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9kleen.com"; sid:592000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenlitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenlitigation.com"; sid:592001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccessory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccessory.com"; sid:592002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaerosol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaerosol.com"; sid:592003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaerosols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaerosols.com"; sid:592004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidair.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidair.info"; sid:592005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.life"; sid:592006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbadness.com"; sid:592007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandits.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandits.info"; sid:592008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbandits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbandits.net"; sid:592009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbang.com"; sid:592010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiologics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiologics.com"; sid:592011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizprotection.com"; sid:592012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizratings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizratings.com"; sid:592013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizscore.com"; sid:592014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbnb.com"; sid:592015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrokers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrokers.com"; sid:592016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbully.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbully.com"; sid:592017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbus.com"; sid:592018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessassist.com"; sid:592019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptionclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptionclaims.com"; sid:592020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessscore.com"; sid:592021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssignage.com"; sid:592022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersdfw.com"; sid:592023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.info"; sid:592024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.mobi"; sid:592025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalcs.com"; sid:592026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanceled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanceled.com"; sid:592027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancerguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancerguide.com"; sid:592028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcards.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcards.net"; sid:592029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashflowsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashflowsurvey.com"; sid:592030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcel.com"; sid:592031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedcre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedcre.com"; sid:592032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharitytournament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharitytournament.com"; sid:592033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcirclepledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcirclepledge.com"; sid:592034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanbiz.com"; sid:592035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancertificate.com"; sid:592036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.company"; sid:592037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleaned.com"; sid:592038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninggroup.com"; sid:592039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleankit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleankit.com"; sid:592040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleannewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleannewyork.com"; sid:592041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleannj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleannj.com"; sid:592042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanok.com"; sid:592043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanpro.com"; sid:592044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantraining.com"; sid:592045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantx.com"; sid:592046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorcode.com"; sid:592047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackkits.com"; sid:592048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommitmentpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommitmentpledge.com"; sid:592049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanyscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanyscore.com"; sid:592050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancesignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancesignage.com"; sid:592051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancesigns.com"; sid:592052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance.training"; sid:592053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnector2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnector2020.com"; sid:592054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontactsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontactsolutions.com"; sid:592055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurveball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurveball.com"; sid:592056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomsignage.com"; sid:592057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutlery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutlery.com"; sid:592058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefiant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefiant.com"; sid:592059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddelray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddelray.com"; sid:592060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiary.net"; sid:592061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddining.com"; sid:592062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectants.com"; sid:592063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddividers.com"; sid:592064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveuptesting.com"; sid:592065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddx.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddx.info"; sid:592066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidem-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidem-19.com"; sid:592067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidengue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidengue.com"; sid:592068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19productions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19productions.com"; sid:592069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemaskshop.com"; sid:592070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilystudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilystudy.com"; sid:592071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfifteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfifteen.com"; sid:592072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfight19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfight19.com"; sid:592073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilter.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilter.life"; sid:592074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-flights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-flights.com"; sid:592075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrance.info"; sid:592076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapartment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapartment.com"; sid:592077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebiz.com"; sid:592078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeboat.com"; sid:592079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebusiness.com"; sid:592080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecamping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecamping.com"; sid:592081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecountries.com"; sid:592082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeeworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeeworkers.com"; sid:592083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehostel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehostel.com"; sid:592084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehostels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehostels.com"; sid:592085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesearch.com"; sid:592086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeworkforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeworkforce.net"; sid:592087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrychicken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrychicken.com"; sid:592088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamesonline.com"; sid:592089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrade.com"; sid:592090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrader.com"; sid:592091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrau.com"; sid:592092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguyz.com"; sid:592093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-happyculture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-happyculture.com"; sid:592094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroawards.com"; sid:592095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecleaner.com"; sid:592096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecleaners.com"; sid:592097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimagingohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimagingohio.com"; sid:592098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimagingtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimagingtracker.com"; sid:592099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimagingtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimagingtracking.com"; sid:592100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunotesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunotesting.com"; sid:592101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impact.com"; sid:592102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspectors.com"; sid:592103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstanttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstanttests.com"; sid:592104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancerecoveryprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancerecoveryprogram.com"; sid:592105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancerisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancerisk.com"; sid:592106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintegrative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintegrative.com"; sid:592107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot-distancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot-distancing.com"; sid:592108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisahoax.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisahoax.info"; sid:592109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisinfecting.com"; sid:592110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid.info"; sid:592111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-killers.com"; sid:592112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleener.com"; sid:592113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawfirms.com"; sid:592114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidledger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidledger.com"; sid:592115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalgroup.com"; sid:592116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlibre19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlibre19.com"; sid:592117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlite.com"; sid:592118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanforgiveness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanforgiveness.com"; sid:592119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmandates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmandates.com"; sid:592120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskplus.com"; sid:592121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.info"; sid:592122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksplus.com"; sid:592123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaszk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaszk.com"; sid:592124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmed19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmed19.com"; sid:592125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedinfo.com"; sid:592126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsolutions.com"; sid:592127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodification.com"; sid:592128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mt2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mt2.com"; sid:592129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutual.com"; sid:592130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews247.com"; sid:592131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnsw.com"; sid:592132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficesignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficesignage.com"; sid:592133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidolmayanescort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidolmayanescort.com"; sid:592134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpilot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpilot.com"; sid:592135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirin.com"; sid:592136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpneumonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpneumonia.com"; sid:592137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolicyclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolicyclaim.com"; sid:592138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesale.com"; sid:592139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductivity.com"; sid:592140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofincome.com"; sid:592141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect19.com"; sid:592142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquaranteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquaranteen.com"; sid:592143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadykit.com"; sid:592144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehabcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehabcare.com"; sid:592145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehabresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehabresults.com"; sid:592146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelease.com"; sid:592147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefapp.com"; sid:592148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefglobal.com"; sid:592149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremedy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremedy.net"; sid:592150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreportcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreportcard.com"; sid:592151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresilience.com"; sid:592152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantsignage.com"; sid:592153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safecare.com"; sid:592154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecare.com"; sid:592155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safecare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safecare.net"; sid:592156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecare.net"; sid:592157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedirectory.com"; sid:592158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepaths.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepaths.net"; sid:592159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafereturn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafereturn.com"; sid:592160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyambassador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyambassador.com"; sid:592161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyambassadors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyambassadors.com"; sid:592162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscanners.com"; sid:592163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschermen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschermen.com"; sid:592164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschutz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschutz.info"; sid:592165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeners.com"; sid:592166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscrubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscrubs.com"; sid:592167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseal.com"; sid:592168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsellerprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsellerprotectionplan.com"; sid:592169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshamed.com"; sid:592170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldmask.com"; sid:592171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldtech.com"; sid:592172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignage.net"; sid:592173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignstore.com"; sid:592174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsniffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsniffer.com"; sid:592175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsniffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsniffers.com"; sid:592176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoluciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoluciones.com"; sid:592177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspary.com"; sid:592178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspreadfromperson2person.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspreadfromperson2person.exposed"; sid:592179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.net"; sid:592180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyndrome.com"; sid:592181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtally.com"; sid:592182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tea.com"; sid:592183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtears.com"; sid:592184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemple.com"; sid:592185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtempscannh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtempscannh.com"; sid:592186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidten.com"; sid:592187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpack.com"; sid:592188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpack.net"; sid:592189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpacks.com"; sid:592190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpacks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpacks.net"; sid:592191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsfl.com"; sid:592192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermometers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermometers.com"; sid:592193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherona.com"; sid:592194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelpack.com"; sid:592195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtunnel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtunnel.com"; sid:592196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtx.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtx.info"; sid:592197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidude.com"; sid:592198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdatenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdatenews.com"; sid:592199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxeen30.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxeen30.com"; sid:592200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxeen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxeen.com"; sid:592201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualclinic.com"; sid:592202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusbusinessloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusbusinessloss.com"; sid:592203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusclean.com"; sid:592204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisiere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisiere.com"; sid:592205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwallet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwallet.com"; sid:592206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellnessgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellnessgroup.com"; sid:592207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellnessgroups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellnessgroups.com"; sid:592208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-worksafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-worksafe.com"; sid:592209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldorder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldorder.com"; sid:592210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.info"; sid:592211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxs.com"; sid:592212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditscorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditscorecoronavirus.com"; sid:592213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditscorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditscorecovid19.com"; sid:592214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cupcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cupcovid19.info"; sid:592215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currentcovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currentcovid-19news.com"; sid:592216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currentcovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currentcovid19news.com"; sid:592217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currentpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currentpandemicnews.com"; sid:592218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidsignage.com"; sid:592219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidsigns.com"; sid:592220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cv-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cv-19pandemic.com"; sid:592221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for d20corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"d20corona.com"; sid:592222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dallascovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dallascovidcleaning.com"; sid:592223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid-19.com"; sid:592224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid-19.info"; sid:592225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid-19.net"; sid:592226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathbycovid19.com"; sid:592227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathbycovid.com"; sid:592228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathcorona.com"; sid:592229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debunkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debunkcovid-19.com"; sid:592230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debunkcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debunkcovid-19.net"; sid:592231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debunkingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debunkingcovid-19.com"; sid:592232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for debunkingcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"debunkingcovid-19.net"; sid:592233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deeppandemicpizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deeppandemicpizza.com"; sid:592234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirus.info"; sid:592235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronavirusmadrid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronavirusmadrid.info"; sid:592236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid19.info"; sid:592237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid.info"; sid:592238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecta-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecta-covid.com"; sid:592239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectayacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectayacovid.com"; sid:592240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dicovid19.com"; sid:592241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disastercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disastercorona.com"; sid:592242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnccorona.com"; sid:592243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcoronavirustest.com"; sid:592244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcoronavirustesting.com"; sid:592245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcoronavirustests.com"; sid:592246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid19.com"; sid:592247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid-19test.com"; sid:592248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid19test.com"; sid:592249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid-19testing.com"; sid:592250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid19testing.com"; sid:592251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid-19tests.com"; sid:592252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doityourselfcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doityourselfcovid19tests.com"; sid:592253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcovidclaim.com"; sid:592254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for domesticcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"domesticcovidclaims.com"; sid:592255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcoronacleaning.com"; sid:592256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drinkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drinkcovid.com"; sid:592257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovid-19testing.com"; sid:592258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drunkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drunkcovid.com"; sid:592259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duhacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duhacovidrelief.com"; sid:592260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duniyacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duniyacovid19.com"; sid:592261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earlyviewcountriesimpactofthepandemicin5charts.reisen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earlyviewcountriesimpactofthepandemicin5charts.reisen"; sid:592262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycoronatests.com"; sid:592263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19lab.com"; sid:592264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovidantibodytest.com"; sid:592265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovidtests.com"; sid:592266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecran-barriere-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecran-barriere-covid19.com"; sid:592267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecuadorlibredecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecuadorlibredecovid.com"; sid:592268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecovidtesting.com"; sid:592269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19-mail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19-mail.com"; sid:592270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entiemposdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entiemposdecovid.com"; sid:592271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipmentforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipmentforcovid19.com"; sid:592272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equiposcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equiposcovid19.com"; sid:592273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equiposdeproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equiposdeproteccioncovid19.com"; sid:592274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espantaelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espantaelcovid19.com"; sid:592275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examenescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examenescoronavirus.com"; sid:592276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask4corona.com"; sid:592277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factorycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factorycovid.com"; sid:592278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashioncovid19.com"; sid:592279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcovid19.com"; sid:592280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcovid19.net"; sid:592281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid19test.com"; sid:592282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdnycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdnycorona.com"; sid:592283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofpandemic.com"; sid:592284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feelcorona.com"; sid:592285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid19.info"; sid:592286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for f--kyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"f--kyoucovid.com"; sid:592287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flattenthecovidcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flattenthecovidcurve.com"; sid:592288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formulairecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formulairecovid.com"; sid:592289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortunecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortunecorona.com"; sid:592290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francecovid.info"; sid:592291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19shirts.com"; sid:592292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid.clothing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid.clothing"; sid:592293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid.graphics"; sid:592294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovidmusic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovidmusic.info"; sid:592295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid.singles"; sid:592296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gardenessaysinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gardenessaysinthetimesofcorona.com"; sid:592297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcoronavirus.info"; sid:592298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcovid19.info"; sid:592299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacoronatestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacoronatestnow.com"; sid:592300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getbacktoworkduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getbacktoworkduringcovid.com"; sid:592301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testingathome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testingathome.net"; sid:592302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestingathome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestingathome.net"; sid:592303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globelpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globelpandemicnews.com"; sid:592304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gnyada-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gnyada-covid19.com"; sid:592305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbycovid19.com"; sid:592306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid19.com"; sid:592307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harlemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harlemcovid.com"; sid:592308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpepidemic.com"; sid:592309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homeless-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homeless-covid19.com"; sid:592310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstonfightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstonfightscovid.com"; sid:592311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracoronavirus.info"; sid:592312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracovid19.info"; sid:592313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidtracker.com"; sid:592314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscovidtruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscovidtruth.com"; sid:592315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imaginecovid-19backwards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imaginecovid-19backwards.com"; sid:592316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunstark-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunstark-coronazeiten.info"; sid:592317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidincible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidincible.com"; sid:592318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for increasecreditscorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"increasecreditscorecovid19.com"; sid:592319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectedcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectedcovid-19.com"; sid:592320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecoronavirustests.com"; sid:592321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovid-19test.com"; sid:592322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovid-19testing.com"; sid:592323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomecovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomecovid19testing.com"; sid:592324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insolcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insolcovid19.com"; sid:592325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irscorona.com"; sid:592326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for it-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"it-coronavirus.com"; sid:592327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jgrcovidinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jgrcovidinsights.com"; sid:592328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karsforcovid.com"; sid:592329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaufencoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaufencoronamask.com"; sid:592330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscorona.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscorona.cat"; sid:592331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscorona.com"; sid:592332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsfightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsfightcoronavirus.com"; sid:592333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercovidclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercovidclothes.com"; sid:592334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercovidclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercovidclothing.com"; sid:592335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kleincoronadiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kleincoronadiary.com"; sid:592336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwait-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwait-covid19.com"; sid:592337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorp-coronavirus.com"; sid:592338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorp-coronavirus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorp-coronavirus-test.com"; sid:592339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawuhan.com"; sid:592340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libresdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libresdecovid.com"; sid:592341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostcoronavirus.com"; sid:592342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifepostcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifepostcovid.net"; sid:592343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19free.com"; sid:592344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronatesting.com"; sid:592345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ltcovid19buyerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ltcovid19buyerplan.com"; sid:592346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeinchina-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeinchina-covid19.com"; sid:592347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makemoneyduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makemoneyduringcorona.com"; sid:592348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaprotectoracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaprotectoracovid.com"; sid:592349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascovid19.net"; sid:592350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasanticovid.com"; sid:592351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacoronavirusonline.com"; sid:592352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcoronavirusonline.com"; sid:592353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcovidonline.com"; sid:592354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcanadacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcanadacovid19.com"; sid:592355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialusacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialusacovid19.com"; sid:592356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexcovid19.com"; sid:592357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicorona.com"; sid:592358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for misscovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"misscovid2020.com"; sid:592359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mmtcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mmtcovid19kit.com"; sid:592360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobicorona.com"; sid:592361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monecrancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monecrancovid.com"; sid:592362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movingforwardaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movingforwardaftercovid19.com"; sid:592363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movingpastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movingpastcovid19.com"; sid:592364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for movingpastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"movingpastcovid.com"; sid:592365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muertealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muertealcovid.com"; sid:592366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundgesundheit-corona-zeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundgesundheit-corona-zeiten.info"; sid:592367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundgesundheit-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundgesundheit-coronazeiten.info"; sid:592368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.group"; sid:592369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.today"; sid:592370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaviruscreditscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaviruscreditscore.com"; sid:592371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19abtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19abtest.com"; sid:592372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcheckup.com"; sid:592373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfree.com"; sid:592374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidiq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidiq.com"; sid:592375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycreditscorecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycreditscorecovid19.com"; sid:592376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronamask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronamask.net"; sid:592377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidclaim.com"; sid:592378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigating-postcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigating-postcorona.net"; sid:592379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccoronaviruscleaning.com"; sid:592380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19disinfecting.com"; sid:592381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcoronavirus.info"; sid:592382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicovideo-jp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicovideo-jp.com"; sid:592383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcoronacleaning.com"; sid:592384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidabuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidabuse.com"; sid:592385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidworkers.com"; sid:592386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascovid.com"; sid:592387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronacleaning.com"; sid:592388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusoutbreak.com"; sid:592389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusoutbreak.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusoutbreak.info"; sid:592390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusoutbreak.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusoutbreak.net"; sid:592391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovid-19vaccine.com"; sid:592392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidhelp.com"; sid:592393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidimaging.com"; sid:592394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidtracking.com"; sid:592395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiotrackingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiotrackingcovid.com"; sid:592396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organics-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organics-covid.com"; sid:592397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organicscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organicscovid.com"; sid:592398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidheroes.com"; sid:592399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronanews.com"; sid:592400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacovid-19.net"; sid:592401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-1.com"; sid:592402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic20-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic20-20.com"; sid:592403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-analytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-analytics.com"; sid:592404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandpractice.com"; sid:592405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicas.com"; sid:592406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbreakdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbreakdown.com"; sid:592407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbuckets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbuckets.com"; sid:592408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccompliantsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccompliantsignage.com"; sid:592409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-debtrelief.com"; sid:592410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdetectiondogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdetectiondogs.com"; sid:592411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-entertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-entertainment.com"; sid:592412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicface.com"; sid:592413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflight.com"; sid:592414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjuice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjuice.com"; sid:592415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicleanse.com"; sid:592416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-media.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-media.com"; sid:592417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoffearorvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoffearorvirus.com"; sid:592418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofuncertainty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofuncertainty.com"; sid:592419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofvirus.com"; sid:592420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanties.com"; sid:592421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pictures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pictures.com"; sid:592422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpot.com"; sid:592423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprincess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprincess.com"; sid:592424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofincome.com"; sid:592425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpudge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpudge.com"; sid:592426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-puzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-puzzle.com"; sid:592427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreadygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreadygear.com"; sid:592428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresistantdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresistantdesign.com"; sid:592429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsedash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsedash.com"; sid:592430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsedata.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsedata.info"; sid:592431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsedb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsedb.com"; sid:592432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsedd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsedd.com"; sid:592433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponse.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponse.events"; sid:592434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseevents.com"; sid:592435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscale.com"; sid:592436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsignsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsignsolutions.com"; sid:592437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsleeptips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsleeptips.com"; sid:592438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsphere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsphere.com"; sid:592439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstat.com"; sid:592440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurcharge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurcharge.com"; sid:592441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestingsolutions.com"; sid:592442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictraveler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictraveler.com"; sid:592443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwear.net"; sid:592444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandocovid.com"; sid:592445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantalla-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantalla-covid.com"; sid:592446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallacovid.com"; sid:592447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pantallascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pantallascovid.com"; sid:592448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patasycoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patasycoronas.com"; sid:592449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paypalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paypalcovid-19.com"; sid:592450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paypalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paypalcovid19.com"; sid:592451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penmarchcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penmarchcovid.com"; sid:592452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phuketcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phuketcovidfree.com"; sid:592453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19economynyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19economynyc.com"; sid:592454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpartners.com"; sid:592455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpr.com"; sid:592456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrecovery.com"; sid:592457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrehab.com"; sid:592458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.solutions"; sid:592459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicboom.com"; sid:592460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic-con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic-con.com"; sid:592461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsalon.com"; sid:592462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicsignage.com"; sid:592463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-corona.com"; sid:592464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid19stockphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid19stockphotos.com"; sid:592465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prioritycovid19antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prioritycovid19antibodytesting.com"; sid:592466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prioritycovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prioritycovid-19testing.com"; sid:592467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prioritycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prioritycovid19testing.com"; sid:592468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prodottianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prodottianticovid.com"; sid:592469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productscovid19.com"; sid:592470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for professionalcovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"professionalcovidsigns.com"; sid:592471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promotionalcovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promotionalcovidproducts.com"; sid:592472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecciondecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecciondecoronavirus.com"; sid:592473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionescoronavirushomologadas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionescoronavirushomologadas.com"; sid:592474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionescovid.com"; sid:592475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionforcovid19.com"; sid:592476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionianticovid.com"; sid:592477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycovid.info"; sid:592478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qcovid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qcovid-test.com"; sid:592479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qcovidtest.com"; sid:592480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questdiagnostics-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questdiagnostics-coronavirus.com"; sid:592481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questdiagnostics-coronavirus-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questdiagnostics-coronavirus-test.com"; sid:592482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questdiagnostics-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questdiagnostics-covid-19.com"; sid:592483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questionnairecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questionnairecovid.com"; sid:592484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for r20corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"r20corona.com"; sid:592485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raleighcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raleighcovid19.com"; sid:592486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidrelief.com"; sid:592487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtimecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtimecovid-19.com"; sid:592488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-covid-19.com"; sid:592489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-covid19.com"; sid:592490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-securite-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-securite-coronavirus.com"; sid:592491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-securite-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-securite-covid-19.com"; sid:592492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-securite-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-securite-covid19.com"; sid:592493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for response-to-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"response-to-covid.com"; sid:592494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcoronavirus.info"; sid:592495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcovid19.info"; sid:592496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacoronavirus.info"; sid:592497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacovid19.info"; sid:592498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimento-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimento-covid.com"; sid:592499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riveraincovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riveraincovidimaging.com"; sid:592500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riveraincovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riveraincovidtracking.com"; sid:592501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rnccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rnccorona.com"; sid:592502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roesleincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roesleincovid19.com"; sid:592503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rpccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rpccovid19.com"; sid:592504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtheycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtheycovidclean.com"; sid:592505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rucovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rucovidclean.com"; sid:592506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sabeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sabeatcovid-19.com"; sid:592507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid-19.com"; sid:592508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid-19.info"; sid:592509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovid-19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovid-19survivors.com"; sid:592510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sacovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sacovidguide.com"; sid:592511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saddlebackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saddlebackcorona.com"; sid:592512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saludmentalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saludmentalcovid.com"; sid:592513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycoronavirusantibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycoronavirusantibodytesting.com"; sid:592514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycovid-19antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycovid-19antibodytesting.com"; sid:592515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycovid19antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycovid19antibodytesting.com"; sid:592516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seasonalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seasonalcovid19.com"; sid:592517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecovidclearly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecovidclearly.com"; sid:592518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segurocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segurocovid-19.com"; sid:592519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcoronavirustesting.com"; sid:592520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcoronavirustests.com"; sid:592521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid-19test.com"; sid:592522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid-19testing.com"; sid:592523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid19testing.com"; sid:592524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid-19tests.com"; sid:592525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcovid19tests.com"; sid:592526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorscorona.com"; sid:592527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-covid19.com"; sid:592528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicedesignforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicedesignforcovid.com"; sid:592529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for servicioscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"servicioscovid.com"; sid:592530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplecovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplecovidantibodytest.com"; sid:592531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sitiofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sitiofreecovid.com"; sid:592532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for situationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"situationcovid.com"; sid:592533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicoronavirus.info"; sid:592534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicovid19.info"; sid:592535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sn3dcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sn3dcovid19.com"; sid:592536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solicitudsec42covid19bs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solicitudsec42covid19bs.com"; sid:592537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solicitudsec42covid19bs.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solicitudsec42covid19bs.info"; sid:592538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solicitudsec42covid19bs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solicitudsec42covid19bs.net"; sid:592539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stockmarketcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stockmarketcorona.com"; sid:592540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19.today"; sid:592541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidsigns.com"; sid:592542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentatheletesagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentatheletesagainstcovid19.com"; sid:592543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamilcorona.com"; sid:592544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terrorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terrorcorona.com"; sid:592545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terrorismcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terrorismcorona.com"; sid:592546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19here.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19here.com"; sid:592547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19test.com"; sid:592548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thailandcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thailandcovidfree.com"; sid:592549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestofcovid.com"; sid:592550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaorganization.com"; sid:592551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronashack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronashack.com"; sid:592552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19passport.com"; sid:592553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19supply.com"; sid:592554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19virushoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19virushoax.com"; sid:592555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidaccountant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidaccountant.com"; sid:592556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcoordinator.com"; sid:592557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid-game.com"; sid:592558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinsurance.com"; sid:592559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidletters.com"; sid:592560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmodel.com"; sid:592561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpass.com"; sid:592562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidready.com"; sid:592563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwatch.com"; sid:592564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidweddingcoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidweddingcoordinator.com"; sid:592565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicarchive.com"; sid:592566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicclub.com"; sid:592567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpuzzle.com"; sid:592568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timelinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timelinecorona.com"; sid:592569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todocoronavirus.net"; sid:592570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomorrowcity-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomorrowcity-covid.com"; sid:592571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidclearly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidclearly.com"; sid:592572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidimaging.com"; sid:592573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidprogress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidprogress.com"; sid:592574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidprogression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidprogression.com"; sid:592575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovidclearly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovidclearly.com"; sid:592576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovidimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovidimaging.com"; sid:592577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingepidemics.com"; sid:592578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trazabilidadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trazabilidadcovid19.com"; sid:592579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trentinocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trentinocovid.com"; sid:592580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpbeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpbeatcovid-19.com"; sid:592581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovid-19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovid-19stories.com"; sid:592582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turismocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turismocovidfree.com"; sid:592583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ultravioletkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ultravioletkillscorona.com"; sid:592584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscovid.com"; sid:592585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovidclaim.com"; sid:592586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescovidclaims.com"; sid:592587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcoronavirus.info"; sid:592588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcovid19.info"; sid:592589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatcovid-19.com"; sid:592590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidclean.com"; sid:592591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19.info"; sid:592592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19survivors.com"; sid:592593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19survivors.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19survivors.info"; sid:592594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19victims.com"; sid:592595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidclaim.com"; sid:592596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidclaims.com"; sid:592597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidlab.com"; sid:592598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv4ucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv4ucovid19.com"; sid:592599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronalight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronalight.com"; sid:592600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronalight.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronalight.info"; sid:592601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronalight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronalight.net"; sid:592602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillscovid.com"; sid:592603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvlitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvlitecovid19.com"; sid:592604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-corona.com"; sid:592605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veggingthroughcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veggingthroughcorona.com"; sid:592606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viajarcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viajarcovidfree.com"; sid:592607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visierecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visierecoronavirus.com"; sid:592608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visierescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visierescoronavirus.com"; sid:592609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualcoronabd.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualcoronabd.info"; sid:592610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viviendacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viviendacovidfree.com"; sid:592611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicecorona.com"; sid:592612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wallstreetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wallstreetcorona.com"; sid:592613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecanbeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecanbeatcovid.com"; sid:592614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotcovid.com"; sid:592615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatilearnedinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatilearnedinthepandemic.com"; sid:592616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whoiscovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whoiscovidclean.com"; sid:592617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for widespreadcoronary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"widespreadcoronary.com"; sid:592618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winning-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winning-covid19.com"; sid:592619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for winningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"winningcovid19.com"; sid:592620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workplacecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workplacecovidtesting.com"; sid:592621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldbeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldbeatcovid-19.com"; sid:592622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan163.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan163.net"; sid:592623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-520.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-520.com"; sid:592624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbandits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbandits.com"; sid:592625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbandits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbandits.net"; sid:592626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmeinian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmeinian.com"; sid:592627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirustesting.com"; sid:592628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwjdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwjdcorona.com"; sid:592629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xmcovid.com"; sid:592630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-immobilien-mnchen-etc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-immobilien-mnchen-etc.com"; sid:592631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yacovid-19.com"; sid:592632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19legalresource.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19legalresource.center"; sid:592633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidsafehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidsafehome.com"; sid:592634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zahnarzt-corona-zeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zahnarzt-corona-zeiten.info"; sid:592635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zahnarzt-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zahnarzt-coronazeiten.info"; sid:592636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zahnmedizin-corona-zeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zahnmedizin-corona-zeiten.info"; sid:592637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zahnmedizin-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zahnmedizin-coronazeiten.info"; sid:592638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovid-19.com"; sid:592639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zm-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zm-corona.info"; sid:592640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zm-corona-zeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zm-corona-zeiten.info"; sid:592641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zm-coronazeiten.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zm-coronazeiten.info"; sid:592642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10milforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10milforcovid.com"; sid:592643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covid19.com"; sid:592644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gpandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gpandemic.info"; sid:592645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcoronavirus.com"; sid:592646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcoronavirusinfo.com"; sid:592647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcoronavirusinfo.net"; sid:592648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcoronavirus.net"; sid:592649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcovid19.com"; sid:592650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcovid19.net"; sid:592651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcovidresponse.com"; sid:592652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adalimumabcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adalimumabcovidresponse.net"; sid:592653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventuresinpandemicdating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventuresinpandemicdating.com"; sid:592654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacoronavirus.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacoronavirus.expert"; sid:592655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacoronavirus.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacoronavirus.holiday"; sid:592656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.team"; sid:592657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aide-sociale-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aide-sociale-covid.com"; sid:592658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alhambracovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alhambracovidfree.com"; sid:592659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidlivesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidlivesmatter.com"; sid:592660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidlivesmatter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidlivesmatter.net"; sid:592661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amdcorona.com"; sid:592662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelscovid.com"; sid:592663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovidtesting.com"; sid:592664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronawall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronawall.com"; sid:592665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidessential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidessential.com"; sid:592666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidtest.com"; sid:592667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artepandemico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artepandemico.com"; sid:592668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asentamientoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asentamientoscovid19.com"; sid:592669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atmosferacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atmosferacovidfree.com"; sid:592670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyscovid.com"; sid:592671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autonomoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autonomoscovid19.com"; sid:592672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-covid.com"; sid:592673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidingcovid.com"; sid:592674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcovid-19.com"; sid:592675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best2020pandemicbabyshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best2020pandemicbabyshirts.com"; sid:592676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bgicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bgicovid19.com"; sid:592677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackfridaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackfridaycoronavirus.com"; sid:592678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackfridaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackfridaycovid19.com"; sid:592679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackfridaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackfridaycovid.com"; sid:592680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloccacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloccacovid19.com"; sid:592681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowlingcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowlingcoronafree.com"; sid:592682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcoronavirus.com"; sid:592683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcoronavirusinfo.com"; sid:592684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcoronavirusinfo.net"; sid:592685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcoronavirus.net"; sid:592686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcovid19.com"; sid:592687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcovid19.net"; sid:592688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcovidresponse.com"; sid:592689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandcovidresponse.net"; sid:592690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotherscovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotherscovidcleaning.com"; sid:592691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidmodel.com"; sid:592692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19testkit.com"; sid:592693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovidclean.com"; sid:592694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camarastermicascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camarastermicascovid.com"; sid:592695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camarastermicascovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camarastermicascovid.net"; sid:592696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cansunlightkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cansunlightkillcoronavirus.com"; sid:592697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cansunlightkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cansunlightkillcovid19.com"; sid:592698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribbeanpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribbeanpandemic.com"; sid:592699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casecovid19.com"; sid:592700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebritycovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebritycovidclub.com"; sid:592701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmycovidtest.com"; sid:592702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiromedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiromedcovid19.com"; sid:592703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciaocovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciaocovid.club"; sid:592704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cinnaholiccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cinnaholiccorona.com"; sid:592705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanedforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanedforcovid.com"; sid:592706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningaftercovid.com"; sid:592707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid19.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid19.expert"; sid:592708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegiatecovidcovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegiatecovidcovers.com"; sid:592709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comebackfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comebackfromcovid.com"; sid:592710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcovidclean.com"; sid:592711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comokickscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comokickscovid.com"; sid:592712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontingcovid.com"; sid:592713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingduringcovid.com"; sid:592714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquestcovid19.com"; sid:592715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultoracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultoracovid19.com"; sid:592716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consumersaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consumersaftercovid.com"; sid:592717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contain-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contain-covid19.com"; sid:592718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contain-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contain-covid.com"; sid:592719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona16.com"; sid:592720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020baby.com"; sid:592721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairchina.com"; sid:592722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairfrance.com"; sid:592723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairspray.com"; sid:592724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalarmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalarmen.com"; sid:592725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaall.com"; sid:592726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaloha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaloha.com"; sid:592727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamericanairlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamericanairlines.com"; sid:592728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamericanexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamericanexpress.com"; sid:592729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamputation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamputation.com"; sid:592730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandsunlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandsunlight.com"; sid:592731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antibody-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antibody-home-test.com"; sid:592732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antibody-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antibody-test.com"; sid:592733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawe.com"; sid:592734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaayurveda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaayurveda.com"; sid:592735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaayurvedic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaayurvedic.com"; sid:592736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeep.com"; sid:592737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablow.com"; sid:592738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreach.com"; sid:592739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-busters.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-busters.services"; sid:592740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalcs.com"; sid:592741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamels.com"; sid:592742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cannon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cannon.com"; sid:592743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-caps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-caps.com"; sid:592744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-card.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-card.com"; sid:592745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasino.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasino.club"; sid:592746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacattle.com"; sid:592747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachinasouthern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachinasouthern.com"; sid:592748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachinesefood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachinesefood.com"; sid:592749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachinesenewyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachinesenewyear.com"; sid:592750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclothingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclothingco.com"; sid:592751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompliancetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompliancetraining.com"; sid:592752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacongestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacongestion.com"; sid:592753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacost.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacost.info"; sid:592754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaculinary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaculinary.com"; sid:592755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadays.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadays.club"; sid:592756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtconsolidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtconsolidation.com"; sid:592757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtsettlement.com"; sid:592758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelta.com"; sid:592759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiarrhea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiarrhea.com"; sid:592760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadipity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadipity.com"; sid:592761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado365.com"; sid:592762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dodiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dodiaries.com"; sid:592763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonate.net"; sid:592764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrohne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrohne.com"; sid:592765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadysport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadysport.com"; sid:592766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaembassy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaembassy.com"; sid:592767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemirates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemirates.com"; sid:592768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaespn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaespn.com"; sid:592769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafax.com"; sid:592770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeet.com"; sid:592771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflex.com"; sid:592772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoot.com"; sid:592773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeprovder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeprovder.com"; sid:592774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeserviceprovider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeserviceprovider.com"; sid:592775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeserviceproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeserviceproviders.com"; sid:592776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-tourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-tourism.com"; sid:592777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-tours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-tours.com"; sid:592778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafromchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafromchina.com"; sid:592779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagamezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagamezone.com"; sid:592780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gesundheit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gesundheit.com"; sid:592781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglassshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglassshield.com"; sid:592782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilton.com"; sid:592783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahive.com"; sid:592784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahola.com"; sid:592785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-home-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-home-test.com"; sid:592786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahurts.com"; sid:592787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidentification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidentification.com"; sid:592788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaigg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaigg.com"; sid:592789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitea.com"; sid:592790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainbox.com"; sid:592791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformer.com"; sid:592792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfoworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfoworld.com"; sid:592793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuvederm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuvederm.com"; sid:592794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakansen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakansen.com"; sid:592795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerflashlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerflashlight.com"; sid:592796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerflashlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerflashlights.com"; sid:592797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerlight.com"; sid:592798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.solutions"; sid:592799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakill.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakill.pro"; sid:592800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kritik.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kritik.net"; sid:592801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalapd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalapd.com"; sid:592802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatinamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatinamerica.com"; sid:592803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalatin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalatin.com"; sid:592804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivetracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivetracking.com"; sid:592805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalufthansa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalufthansa.com"; sid:592806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyft.com"; sid:592807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarriott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarriott.com"; sid:592808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskcontest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskcontest.com"; sid:592809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masque.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masque.info"; sid:592810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masque.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masque.net"; sid:592811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamastercard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamastercard.com"; sid:592812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerchstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerchstore.com"; sid:592813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiljonair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiljonair.com"; sid:592814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiljonairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiljonairs.com"; sid:592815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamix.com"; sid:592816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamondmasker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamondmasker.com"; sid:592817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamultivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamultivitamin.com"; sid:592818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamultivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamultivitamins.com"; sid:592819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanasdaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanasdaq.com"; sid:592820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-navi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-navi.com"; sid:592821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanbc.com"; sid:592822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews24.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews24.net"; sid:592823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoir.com"; sid:592824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanug.com"; sid:592825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanugs.com"; sid:592826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanyse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanyse.com"; sid:592827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganicstea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganicstea.com"; sid:592828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganicsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganicsus.com"; sid:592829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganictea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganictea.com"; sid:592830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbox.com"; sid:592831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparentingcall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparentingcall.com"; sid:592832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparentingworkshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparentingworkshop.com"; sid:592833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapiepers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapiepers.com"; sid:592834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplaystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplaystore.com"; sid:592835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapodiatrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapodiatrist.com"; sid:592836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositiveconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositiveconcerts.com"; sid:592837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositiveevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositiveevents.com"; sid:592838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositiveevents.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositiveevents.net"; sid:592839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotec.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotec.cat"; sid:592840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqueenkitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqueenkitchen.com"; sid:592841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaradisson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaradisson.com"; sid:592842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareflex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareflex.com"; sid:592843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarenewal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarenewal.com"; sid:592844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepellents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepellents.com"; sid:592845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzartikel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzartikel.com"; sid:592846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreenstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreenstore.com"; sid:592847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasensitivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasensitivity.com"; sid:592848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shirts.net"; sid:592849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasixteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasixteen.com"; sid:592850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthafrica.com"; sid:592851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthamerica.com"; sid:592852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasouthwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasouthwest.com"; sid:592853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastroke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastroke.com"; sid:592854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastupidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastupidity.com"; sid:592855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplies.biz"; sid:592856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatap.com"; sid:592857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmvy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmvy.com"; sid:592858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestscotland.com"; sid:592859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathebear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathebear.com"; sid:592860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatopten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatopten.com"; sid:592861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatopten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatopten.net"; sid:592862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrumpingtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrumpingtrump.com"; sid:592863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauber.com"; sid:592864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdated.com"; sid:592865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vest.com"; sid:592866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveus20.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveus20.cat"; sid:592867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveus.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveus.cat"; sid:592868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-adalimumab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-adalimumab.com"; sid:592869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalone.com"; sid:592870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandadalimumab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandadalimumab.com"; sid:592871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandadalimumab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandadalimumab.net"; sid:592872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandbrand.com"; sid:592873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandbrand.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandbrand.net"; sid:592874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandgeneric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandgeneric.com"; sid:592875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandgeneric.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandgeneric.net"; sid:592876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhumira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhumira.com"; sid:592877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandhumira.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandhumira.net"; sid:592878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandlight.com"; sid:592879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrinvoq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrinvoq.com"; sid:592880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrinvoq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrinvoq.net"; sid:592881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrisankizumab-rzaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrisankizumab-rzaa.com"; sid:592882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandrisankizumab-rzaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandrisankizumab-rzaa.net"; sid:592883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandskyrizi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandskyrizi.net"; sid:592884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandsunlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandsunlight.com"; sid:592885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandupadacitinib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandupadacitinib.com"; sid:592886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandupadacitinib.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandupadacitinib.net"; sid:592887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-antibody-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-antibody-testing.com"; sid:592888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbirthday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbirthday.com"; sid:592889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblackfriday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblackfriday.com"; sid:592890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblessings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblessings.com"; sid:592891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-brand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-brand.com"; sid:592892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrasil2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrasil2020.com"; sid:592893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbullshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbullshit.com"; sid:592894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatmask.com"; sid:592895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscopper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscopper.net"; sid:592896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrazies.com"; sid:592897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectingnyc.com"; sid:592898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusends.com"; sid:592899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfeeding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfeeding.com"; sid:592900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-foundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-foundation.com"; sid:592901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfraudlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfraudlawyer.com"; sid:592902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-generic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-generic.com"; sid:592903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-home-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-home-testing.com"; sid:592904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-humira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-humira.com"; sid:592905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hypoxemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hypoxemia.com"; sid:592906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitea.com"; sid:592907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslast.com"; sid:592908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyersgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyersgroup.com"; sid:592909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyers.legal - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyers.legal"; sid:592910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslighting.com"; sid:592911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslights.com"; sid:592912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslimpiezaydesinfeccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslimpiezaydesinfeccion.com"; sid:592913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmultivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmultivitamin.com"; sid:592914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmultivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmultivitamins.com"; sid:592915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspapertrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspapertrail.com"; sid:592916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusport.com"; sid:592917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspositive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspositive.net"; sid:592918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspresent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspresent.com"; sid:592919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrepellents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrepellents.com"; sid:592920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rinvoq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rinvoq.com"; sid:592921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-risankizumab-rzaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-risankizumab-rzaa.com"; sid:592922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeworkplaceprinciples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeworkplaceprinciples.com"; sid:592923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussingle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussingle.com"; sid:592924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-skyrizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-skyrizi.com"; sid:592925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-termination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-termination.com"; sid:592926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcost.com"; sid:592927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthegame.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthegame.net"; sid:592928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustickets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustickets.com"; sid:592929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrategy.com"; sid:592930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelling.com"; sid:592931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-upadacitinib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-upadacitinib.com"; sid:592932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususvaccines.com"; sid:592933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacunas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacunas.net"; sid:592934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswedding.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswedding.today"; sid:592935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyears.com"; sid:592936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoid.com"; sid:592937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoluma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoluma.com"; sid:592938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoodoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoodoo.com"; sid:592939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijewerkplek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijewerkplek.com"; sid:592940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijwerken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijwerken.com"; sid:592941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawayoflife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawayoflife.com"; sid:592942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawe.com"; sid:592943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhat.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhat.info"; sid:592944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawhy.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawhy.info"; sid:592945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wirtschaft.ruhr - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wirtschaft.ruhr"; sid:592946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithak.com"; sid:592947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxinhua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxinhua.com"; sid:592948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaycuentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaycuentos.com"; sid:592949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zukunft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zukunft.com"; sid:592950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costadelsolcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costadelsolcovidfree.com"; sid:592951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-act.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-act.com"; sid:592952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adalimumab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adalimumab.com"; sid:592953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adalimumab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adalimumab.net"; sid:592954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aftermathwhitepaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aftermathwhitepaper.com"; sid:592955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aicep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aicep.com"; sid:592956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alone.com"; sid:592957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analysiscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analysiscenter.com"; sid:592958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andadalimumab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andadalimumab.com"; sid:592959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andadalimumab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andadalimumab.net"; sid:592960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andbrand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andbrand.com"; sid:592961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andbrand.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andbrand.net"; sid:592962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andgeneric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andgeneric.com"; sid:592963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andgeneric.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andgeneric.net"; sid:592964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhumira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhumira.com"; sid:592965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhumira.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhumira.net"; sid:592966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrinvoq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrinvoq.com"; sid:592967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrinvoq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrinvoq.net"; sid:592968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrisankizumab-rzaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrisankizumab-rzaa.com"; sid:592969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andrisankizumab-rzaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andrisankizumab-rzaa.net"; sid:592970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andskyrizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andskyrizi.com"; sid:592971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andskyrizi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andskyrizi.net"; sid:592972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andupadacitinib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andupadacitinib.com"; sid:592973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andupadacitinib.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andupadacitinib.net"; sid:592974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodysupply.com"; sid:592975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19asisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19asisi.com"; sid:592976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-awareness.com"; sid:592977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19birthday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19birthday.com"; sid:592978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bk.com"; sid:592979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blackfriday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blackfriday.com"; sid:592980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blackfriday.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blackfriday.info"; sid:592981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brand.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brand.net"; sid:592982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19business-safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19business-safety.com"; sid:592983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19busters.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19busters.biz"; sid:592984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cagov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cagov.com"; sid:592985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19catmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19catmask.com"; sid:592986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catmask.com"; sid:592987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clarity.com"; sid:592988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clarity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clarity.com"; sid:592989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classactionlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classactionlaws.com"; sid:592990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleancars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleancars.com"; sid:592991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleancars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleancars.com"; sid:592992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complaint.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complaint.net"; sid:592993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliancetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliancetraining.com"; sid:592994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliancetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliancetraining.com"; sid:592995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consumertrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consumertrends.com"; sid:592996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlled.com"; sid:592997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19copper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19copper.com"; sid:592998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corproatememoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corproatememoryproject.com"; sid:592999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crazies.com"; sid:593000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19croatia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19croatia.com"; sid:593001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datingera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datingera.com"; sid:593002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deepclean.com"; sid:593003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desinfeccionylimpieza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desinfeccionylimpieza.com"; sid:593004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dettol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dettol.com"; sid:593005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19discountppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19discountppe.com"; sid:593006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19discountppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19discountppe.com"; sid:593007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-discrimination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-discrimination.com"; sid:593008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dsr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dsr.com"; sid:593009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eeuu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eeuu.com"; sid:593010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ffee.com"; sid:593011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forward.com"; sid:593012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forward.com"; sid:593013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fraudlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fraudlawyers.com"; sid:593014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeclothes.com"; sid:593015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.tours - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.tours"; sid:593016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.vacations - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.vacations"; sid:593017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gapyear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gapyear.com"; sid:593018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19generic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19generic.com"; sid:593019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19generic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19generic.net"; sid:593020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19government.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19government.com"; sid:593021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guarded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guarded.com"; sid:593022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcarecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcarecenter.com"; sid:593023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthview.com"; sid:593024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hookup.com"; sid:593025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hrvatska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hrvatska.com"; sid:593026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humira.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humira.com"; sid:593027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19humira.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19humira.net"; sid:593028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jobloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jobloss.com"; sid:593029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19johnson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19johnson.com"; sid:593030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kenya.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kenya.today"; sid:593031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitforhome.com"; sid:593032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitprice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitprice.com"; sid:593033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.biz"; sid:593034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legals.com"; sid:593035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lemoneucalyptus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lemoneucalyptus.com"; sid:593036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19life.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19life.biz"; sid:593037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maldives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maldives.com"; sid:593038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskesi.com"; sid:593039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mister.com"; sid:593040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moodtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moodtracker.com"; sid:593041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19multivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19multivitamin.com"; sid:593042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19multivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19multivitamins.com"; sid:593043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nyc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nyc.info"; sid:593044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinecenter.com"; sid:593045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrtest.net"; sid:593046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pet.com"; sid:593047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petdr.com"; sid:593048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petmd.com"; sid:593049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19petrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19petrx.com"; sid:593050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petrx.com"; sid:593051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pets.com"; sid:593052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19petvet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19petvet.com"; sid:593053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-photos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-photos.com"; sid:593054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-photos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-photos.net"; sid:593055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-plan.com"; sid:593056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19present.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19present.com"; sid:593057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procleaner.com"; sid:593058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procleaning.com"; sid:593059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocols.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocols.biz"; sid:593060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-public.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-public.com"; sid:593061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverysummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverysummit.com"; sid:593062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryzone.com"; sid:593063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19repellents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19repellents.com"; sid:593064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-retaliation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-retaliation.com"; sid:593065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rinvoq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rinvoq.com"; sid:593066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rinvoq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rinvoq.net"; sid:593067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risankizumab-rzaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risankizumab-rzaa.com"; sid:593068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risankizumab-rzaa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risankizumab-rzaa.net"; sid:593069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safescreens.com"; sid:593070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safetyscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safetyscreens.com"; sid:593071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyscreens.com"; sid:593072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysupplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysupplies.net"; sid:593073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19samples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19samples.com"; sid:593074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-s.com"; sid:593075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selflog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selflog.com"; sid:593076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sign.com"; sid:593077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signsolutions.com"; sid:593078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signstore.com"; sid:593079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simplified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simplified.com"; sid:593080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19single.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19single.com"; sid:593081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skyrizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skyrizi.com"; sid:593082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skyrizi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skyrizi.net"; sid:593083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19special.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19special.com"; sid:593084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19special.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19special.com"; sid:593085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19specials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19specials.com"; sid:593086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specials.com"; sid:593087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steamclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steamclean.com"; sid:593088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steamcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steamcleaners.com"; sid:593089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steamcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steamcleaning.com"; sid:593090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stressball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stressball.com"; sid:593091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportcenter.com"; sid:593092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalbox.com"; sid:593093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19swag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19swag.com"; sid:593094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-termination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-termination.com"; sid:593095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testantibody.com"; sid:593096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing.net"; sid:593097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tigertoptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tigertoptest.com"; sid:593098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerke.com"; sid:593099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tradeshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tradeshow.com"; sid:593100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelling.com"; sid:593101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unintendedconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unintendedconsequences.com"; sid:593102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upadacitinib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upadacitinib.com"; sid:593103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upadacitinib.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upadacitinib.net"; sid:593104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecenter.com"; sid:593105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinesites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinesites.com"; sid:593106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccines.net"; sid:593107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19v.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19v.info"; sid:593108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruskillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruskillers.com"; sid:593109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacesigns.com"; sid:593110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19years.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19years.com"; sid:593111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019kit.com"; sid:593112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019kits.com"; sid:593113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020baby.com"; sid:593114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20hk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20hk.com"; sid:593115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid33154.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid33154.com"; sid:593116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidallclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidallclean.com"; sid:593117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidallclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidallclear.com"; sid:593118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibody-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibody-test.com"; sid:593119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibodytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibodytesting.com"; sid:593120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestmatch.com"; sid:593121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapi.net"; sid:593122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasap.com"; sid:593123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidata.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidata.cloud"; sid:593124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-avocat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-avocat.com"; sid:593125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavocat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavocat.com"; sid:593126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaltimore.com"; sid:593127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-biologics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-biologics.com"; sid:593128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackfriday.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackfriday.club"; sid:593129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackfriday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackfriday.com"; sid:593130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbodies.com"; sid:593131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbranch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbranch.com"; sid:593132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburner.com"; sid:593133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterdrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterdrink.com"; sid:593134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatchup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatchup.com"; sid:593135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificates.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificates.life"; sid:593136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchemmaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchemmaster.com"; sid:593137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanbusiness.com"; sid:593138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleandining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleandining.com"; sid:593139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerservices.com"; sid:593140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleangym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleangym.com"; sid:593141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleangyms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleangyms.com"; sid:593142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanretail.com"; sid:593143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansalons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansalons.com"; sid:593144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanservice.com"; sid:593145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanservices.com"; sid:593146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanstore.com"; sid:593147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantechs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantechs.com"; sid:593148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.training"; sid:593149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearly.com"; sid:593150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosureclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosureclaims.com"; sid:593151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialclean.com"; sid:593152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialcleaners.com"; sid:593153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancetraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancetraining.com"; sid:593154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcertification.com"; sid:593155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliants.com"; sid:593156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplications.com"; sid:593157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconso.com"; sid:593158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumertrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumertrends.com"; sid:593159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractcounsel.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractcounsel.biz"; sid:593160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractcounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractcounsel.com"; sid:593161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractlawyer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractlawyer.biz"; sid:593162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractlawyer.com"; sid:593163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopper.net"; sid:593164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-covers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-covers.com"; sid:593165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtconsidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtconsidation.com"; sid:593166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensetea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensetea.com"; sid:593167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeterrence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeterrence.com"; sid:593168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dz.com"; sid:593169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedu.com"; sid:593170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideeuu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideeuu.com"; sid:593171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidegypt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidegypt.com"; sid:593172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlawyer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlawyer.biz"; sid:593173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendgame.com"; sid:593174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepis.com"; sid:593175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexwipes.com"; sid:593176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceart.com"; sid:593177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceart.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceart.info"; sid:593178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceart.net"; sid:593179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeeding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeeding.com"; sid:593180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfefe2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfefe2020.com"; sid:593181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightingtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightingtea.com"; sid:593182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeathome.com"; sid:593183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertificado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertificado.com"; sid:593184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecine.com"; sid:593185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecines.com"; sid:593186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeclothes.com"; sid:593187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecoats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecoats.com"; sid:593188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecruceros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecruceros.com"; sid:593189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecruices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecruices.com"; sid:593190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeflight.com"; sid:593191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeflights.com"; sid:593192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegear.com"; sid:593193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegranada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegranada.com"; sid:593194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepub.com"; sid:593195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepubs.com"; sid:593196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerestaurantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerestaurantes.com"; sid:593197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesportswear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesportswear.com"; sid:593198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthtest.com"; sid:593199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.world"; sid:593200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhn.com"; sid:593201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhonduras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhonduras.com"; sid:593202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhrm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhrm.net"; sid:593203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hypoxemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hypoxemia.com"; sid:593204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhypoxemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhypoxemia.com"; sid:593205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiandays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiandays.com"; sid:593206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianera.com"; sid:593207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidica.com"; sid:593208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicine.com"; sid:593209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididbracelet.com"; sid:593210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididbracelet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididbracelet.net"; sid:593211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunebooster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunebooster.com"; sid:593212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitea.com"; sid:593213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiarelief.com"; sid:593214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisahoax.com"; sid:593215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisahoax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisahoax.net"; sid:593216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkid.biz"; sid:593217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidcare.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidcare.biz"; sid:593218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidcare.com"; sid:593219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidcare.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidcare.info"; sid:593220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidcare.net"; sid:593221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitforhome.com"; sid:593222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlandia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlandia.com"; sid:593223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyer.biz"; sid:593224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanlawyer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanlawyer.biz"; sid:593225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-manager.com"; sid:593226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingconnect.com"; sid:593227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsupply.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsupply.biz"; sid:593228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemoir.com"; sid:593229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemoirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemoirs.com"; sid:593230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmister.com"; sid:593231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletests.com"; sid:593232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmulti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmulti.com"; sid:593233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnaturals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnaturals.com"; sid:593234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnavng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnavng.com"; sid:593235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewholocaust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewholocaust.com"; sid:593236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorm.com"; sid:593237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofcolor.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofcolor.info"; sid:593238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicstea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicstea.com"; sid:593239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicsusa.com"; sid:593240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicsus.com"; sid:593241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganictea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganictea.com"; sid:593242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpal.com"; sid:593243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidperventative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidperventative.com"; sid:593244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppegear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppegear.com"; sid:593245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppegear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppegear.net"; sid:593246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpresent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpresent.com"; sid:593247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprocleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprocleaner.com"; sid:593248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprocleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprocleaners.com"; sid:593249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproteccion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproteccion.net"; sid:593250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionscreens.com"; sid:593251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectkit.com"; sid:593252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickresponse.com"; sid:593253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdt.com"; sid:593254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregard.com"; sid:593255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.nyc"; sid:593256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepellent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepellent.com"; sid:593257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestrictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestrictor.com"; sid:593258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevenuecyclebridgesurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevenuecyclebridgesurvey.com"; sid:593259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskcalculator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskcalculator.net"; sid:593260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrxnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrxnow.com"; sid:593261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safecare.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safecare.biz"; sid:593262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeclothes.com"; sid:593263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyclothes.com"; sid:593264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanificazioni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanificazioni.com"; sid:593265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseg.com"; sid:593266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseguridad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseguridad.com"; sid:593267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsellerworkshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsellerworkshop.com"; sid:593268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshepherd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshepherd.com"; sid:593269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldusa.com"; sid:593270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageandscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageandscreens.com"; sid:593271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartwatch.com"; sid:593272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstratagies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstratagies.com"; sid:593273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswipers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswipers.com"; sid:593274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtermination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtermination.com"; sid:593275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestandprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestandprotection.com"; sid:593276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestflorida.com"; sid:593277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingathome.com"; sid:593278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingfl.com"; sid:593279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkorea.com"; sid:593280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestparty.com"; sid:593281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsandprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsandprotection.com"; sid:593282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreatindex.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreatindex.info"; sid:593283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeseries.com"; sid:593284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtory.com"; sid:593285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingtool.com"; sid:593286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelling.com"; sid:593287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-up.com"; sid:593288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvcleaner.com"; sid:593289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvlight.com"; sid:593290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacunas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacunas.com"; sid:593291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviptesting.com"; sid:593292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusprevenative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusprevenative.com"; sid:593293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvue.com"; sid:593294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingcollective.com"; sid:593295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhileblack.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhileblack.info"; sid:593296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhilebrown.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhilebrown.info"; sid:593297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhilewhite.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhilewhite.info"; sid:593298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wholesale.com"; sid:593299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixclaim.com"; sid:593300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzuil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzuil.com"; sid:593301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpwrcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpwrcoronavirus.com"; sid:593302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpwrcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpwrcoronavirus.net"; sid:593303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpwrcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpwrcovid19.com"; sid:593304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cpwrcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cpwrcovid19.net"; sid:593305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidgolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidgolf.com"; sid:593306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutecovidmask.com"; sid:593307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damncovid19.com"; sid:593308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringapandemic.com"; sid:593309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcovid-19.com"; sid:593310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depoisdocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depoisdocovid.com"; sid:593311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descorona19.com"; sid:593312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncoronaviruscovid19.com"; sid:593313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid19.net"; sid:593314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionporcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionporcovid.net"; sid:593315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroyerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroyerscovid19.com"; sid:593316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecoronavirus.com"; sid:593317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectioncovid-19.com"; sid:593318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingthefightagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingthefightagainstcovid-19.com"; sid:593319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingthefightagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingthefightagainstcovid19.com"; sid:593320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedcovidtest.com"; sid:593321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldcovidtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldcovidtrump.com"; sid:593322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doneedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doneedacovid19test.com"; sid:593323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynixcovid19.com"; sid:593324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynixcovid.com"; sid:593325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynixdiagnostixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynixdiagnostixcovid19.com"; sid:593326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynixdiagnostixcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynixdiagnostixcovid.com"; sid:593327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergencia-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergencia-covid.com"; sid:593328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entretodoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entretodoscovidfree.com"; sid:593329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for episcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"episcovid.com"; sid:593330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escovid19.com"; sid:593331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espacioscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espacioscovidfree.com"; sid:593332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for extinguishcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"extinguishcovid.com"; sid:593333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid.net"; sid:593334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcoronatests.com"; sid:593335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcovidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcovidsyndrome.com"; sid:593336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcovidsyndrome.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcovidsyndrome.info"; sid:593337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcovidsyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcovidsyndrome.net"; sid:593338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingacuretocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingacuretocorona.com"; sid:593339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for food4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"food4covid19.com"; sid:593340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foughtbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foughtbycorona.com"; sid:593341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeofcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeofcorona19.com"; sid:593342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ftf-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ftf-wuhan.com"; sid:593343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.life"; sid:593344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid2019.com"; sid:593345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovidmusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovidmusic.com"; sid:593346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucovid.net"; sid:593347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gafcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gafcovidcare.com"; sid:593348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gcovid-19.com"; sid:593349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcoronavirus.com"; sid:593350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcoronavirusinfo.com"; sid:593351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcoronavirusinfo.net"; sid:593352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcoronavirus.net"; sid:593353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcovid19.com"; sid:593354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcovid19.net"; sid:593355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcovidresponse.com"; sid:593356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genericcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genericcovidresponse.net"; sid:593357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacovidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacovidtesttoday.com"; sid:593358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid-19tests.com"; sid:593359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycoronatest.com"; sid:593360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19pharmacy.com"; sid:593361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidcoalition.com"; sid:593362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidtest.com"; sid:593363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemiccoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemiccoalition.com"; sid:593364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronafree.com"; sid:593365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graficacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graficacovid-19.com"; sid:593366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for granadacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"granadacovidfree.com"; sid:593367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guidetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guidetocovid.com"; sid:593368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gujcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gujcovid19.com"; sid:593369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gujcovidfirm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gujcovidfirm.net"; sid:593370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcovid-19.com"; sid:593371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healfromcovid.com"; sid:593372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcurecovid19.com"; sid:593373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historicpandemicplates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historicpandemicplates.com"; sid:593374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historypandemicplates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historypandemicplates.com"; sid:593375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid-19.com"; sid:593376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid-19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid-19kit.com"; sid:593377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitcovid-19.com"; sid:593378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitcovid.com"; sid:593379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homekitforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homekitforcovid-19.com"; sid:593380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodateduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodateduringapandemic.com"; sid:593381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracoronavirus.com"; sid:593382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracoronavirusinfo.com"; sid:593383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracoronavirusinfo.net"; sid:593384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracoronavirus.net"; sid:593385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracovid19.com"; sid:593386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracovid19.net"; sid:593387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracovidresponse.com"; sid:593388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humiracovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humiracovidresponse.net"; sid:593389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypoxemia-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypoxemia-coronavirus.com"; sid:593390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypoxemiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypoxemiacoronavirus.com"; sid:593391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i19covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i19covid.com"; sid:593392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidsafe.com"; sid:593393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamnotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamnotcovid19.com"; sid:593394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibizacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibizacovidfree.com"; sid:593395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-covid.info"; sid:593396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid.info"; sid:593397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inaweofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inaweofcorona.com"; sid:593398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incoronaawe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incoronaawe.com"; sid:593399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidencer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidencer.com"; sid:593400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incovidiandays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incovidiandays.com"; sid:593401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianfightcovid.com"; sid:593402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtestathome.com"; sid:593403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurancecoveredcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurancecoveredcovid-19test.com"; sid:593404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intakecovid19ftp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intakecovid19ftp.com"; sid:593405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iovercamecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iovercamecorona.com"; sid:593406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcoronagood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcoronagood.com"; sid:593407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsnotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsnotcorona.com"; sid:593408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kcovid-19.com"; sid:593409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19texas.com"; sid:593410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kmccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kmccovidtest.com"; sid:593411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for konaicecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"konaicecoronado.com"; sid:593412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycovid19signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycovid19signs.com"; sid:593413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycovidsigns.com"; sid:593414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascoronavirusattorney.com"; sid:593415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerscovid.com"; sid:593416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirus.info"; sid:593417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinsidecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinsidecovid19.com"; sid:593418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinsidecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinsidecovid2020.com"; sid:593419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limecorona.com"; sid:593420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinginapandemic.com"; sid:593421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostjobtocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostjobtocoronavirus.com"; sid:593422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macoronas.com"; sid:593423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeiracovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeiracovidfree.com"; sid:593424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madridcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madridcovidfree.com"; sid:593425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mailmycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mailmycovid19test.com"; sid:593426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecovidhistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecovidhistory.com"; sid:593427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-covid.com"; sid:593428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-protectora-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-protectora-coronavirus.com"; sid:593429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marbellacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marbellacovidfree.com"; sid:593430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-lavable-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-lavable-covid19.com"; sid:593431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mcovid-19.com"; sid:593432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdpreventcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdpreventcovid.com"; sid:593433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidascovid-19.com"; sid:593434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocorona.com"; sid:593435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milliondollarsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milliondollarsforcovid.com"; sid:593436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for msmecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"msmecoronavirus.com"; sid:593437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronasafetykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronasafetykit.com"; sid:593438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronatales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronatales.com"; sid:593439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusattorneys.com"; sid:593440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19.club"; sid:593441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19testing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19testing.info"; sid:593442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidarchive.com"; sid:593443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbiclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbiclaim.com"; sid:593444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcut.com"; sid:593445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidgears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidgears.com"; sid:593446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstore.com"; sid:593447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidwear.com"; sid:593448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidxixclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidxixclaim.com"; sid:593449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myfloridacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myfloridacovidlawyer.com"; sid:593450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhomecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhomecovidtest.com"; sid:593451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidcoalition.com"; sid:593452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemiccoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemiccoalition.com"; sid:593453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovid19law.com"; sid:593454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncpacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncpacovid-19.com"; sid:593455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negocioscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negocioscovidfree.com"; sid:593456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidinsight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidinsight.com"; sid:593457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidtest.com"; sid:593458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidtests.com"; sid:593459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for non-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"non-covid.com"; sid:593460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normativacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normativacovid-19.com"; sid:593461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronaclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronaclear.com"; sid:593462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcovidclear.com"; sid:593463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novidtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novidtocovid.com"; sid:593464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for numberscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"numberscoronavirus.com"; sid:593465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19disinfecting.com"; sid:593466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocovid-19.com"; sid:593467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidcure.com"; sid:593468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidvaccine.com"; sid:593469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxfordcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxfordcovidtest.com"; sid:593470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecovid19.net"; sid:593471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonegeneratorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonegeneratorcoronavirus.com"; sid:593472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocoronavirus.com"; sid:593473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocovid-19.com"; sid:593474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic4thofjulyideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic4thofjulyideas.com"; sid:593475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicahelp.com"; sid:593476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbirthdayideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbirthdayideas.com"; sid:593477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdebt.com"; sid:593478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdebtconsolidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdebtconsolidation.com"; sid:593479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdebtsettlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdebtsettlement.com"; sid:593480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-delivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-delivery.com"; sid:593481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfathersdayideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfathersdayideas.com"; sid:593482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfightingsupplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfightingsupplys.com"; sid:593483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfightingsupplys.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfightingsupplys.net"; sid:593484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfraudlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfraudlawyer.com"; sid:593485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfraudlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfraudlawyers.com"; sid:593486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglovesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglovesupply.com"; sid:593487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinternational.com"; sid:593488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclaughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclaughs.com"; sid:593489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmothersdayideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmothersdayideas.com"; sid:593490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanicking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanicking.com"; sid:593491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaybook.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaybook.info"; sid:593492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pops.com"; sid:593493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpottery.com"; sid:593494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofjob.com"; sid:593495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectioncanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectioncanada.com"; sid:593496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicq.com"; sid:593497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseinc.com"; sid:593498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrestaurantsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrestaurantsolutions.com"; sid:593499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliespr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliespr.com"; sid:593500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupplypr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupplypr.com"; sid:593501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscatmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscatmask.com"; sid:593502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwellness.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwellness.expert"; sid:593503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pannellianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pannellianticovid.com"; sid:593504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcgacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcgacovid19.com"; sid:593505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcovid-19.com"; sid:593506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofcovid.net"; sid:593507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phmcovid19.com"; sid:593508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poppyspizza-covid-19-challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poppyspizza-covid-19-challenge.com"; sid:593509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaband.com"; sid:593510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadating.com"; sid:593511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapledge.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapledge.info"; sid:593512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronatravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronatravel.com"; sid:593513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronatravel.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronatravel.expert"; sid:593514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronatravel.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronatravel.holiday"; sid:593515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidnycclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidnycclub.com"; sid:593516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidptsd.com"; sid:593517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.life"; sid:593518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiclife.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiclife.net"; sid:593519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemics.com"; sid:593520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppae-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppae-covid.com"; sid:593521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preemptcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preemptcovid.com"; sid:593522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciongraficacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciongraficacovid-19.com"; sid:593523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proskauercoronavirusinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proskauercoronavirusinsights.com"; sid:593524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolocovid19.net"; sid:593525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebadecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebadecovid19.com"; sid:593526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebadecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebadecovid.com"; sid:593527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacovid.com"; sid:593528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasdecovid19.com"; sid:593529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebasrapidascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebasrapidascovid.com"; sid:593530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovidencia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovidencia.net"; sid:593531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puntocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puntocovidfree.com"; sid:593532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raceandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raceandcoronavirus.com"; sid:593533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ramadaninthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ramadaninthetimeofcovid.com"; sid:593534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rcovid-19.com"; sid:593535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamacionxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamacionxcovid19.com"; sid:593536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recurrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recurrecovid.com"; sid:593537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recurrecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recurrecovid.net"; sid:593538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for registerforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"registerforcovid19.com"; sid:593539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcoronavirus.com"; sid:593540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcoronavirusinfo.com"; sid:593541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcoronavirusinfo.net"; sid:593542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcoronavirus.net"; sid:593543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcovid19.com"; sid:593544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcovid19.net"; sid:593545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcovidresponse.com"; sid:593546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rinvoqcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rinvoqcovidresponse.net"; sid:593547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacoronavirus.com"; sid:593548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacoronavirusinfo.com"; sid:593549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacoronavirusinfo.net"; sid:593550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacoronavirus.net"; sid:593551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacovid19.com"; sid:593552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacovid19.net"; sid:593553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risankizumab-rzaacovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risankizumab-rzaacovidresponse.net"; sid:593554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeflightcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeflightcoronakit.com"; sid:593555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safeflycoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safeflycoronakit.com"; sid:593556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetocovid19.com"; sid:593557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salinascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salinascovid.com"; sid:593558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saynovidtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saynovidtocovid.com"; sid:593559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovid-19.com"; sid:593560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcovidclean.com"; sid:593561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for service-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"service-covid.com"; sid:593562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid-19stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid-19stickers.com"; sid:593563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovid19stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovid19stickers.com"; sid:593564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidguards.com"; sid:593565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincoronavirusco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincoronavirusco.com"; sid:593566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sisocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sisocovid.com"; sid:593567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicoronavirus.com"; sid:593568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicoronavirusinfo.com"; sid:593569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicoronavirusinfo.net"; sid:593570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicoronavirus.net"; sid:593571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicovid19.com"; sid:593572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicovid19.net"; sid:593573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicovidresponse.com"; sid:593574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skyrizicovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skyrizicovidresponse.net"; sid:593575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessesbeatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessesbeatcovid-19.com"; sid:593576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sobreviviendoelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sobreviviendoelcoronavirus.com"; sid:593577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincovidfree.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincovidfree.info"; sid:593578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaincovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaincovidfree.net"; sid:593579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spaniencovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spaniencovidfree.com"; sid:593580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for squashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"squashcorona.com"; sid:593581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for squashcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"squashcovid.com"; sid:593582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycoronaclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycoronaclear.com"; sid:593583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidclear.com"; sid:593584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19world.com"; sid:593585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovid-19.com"; sid:593586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strikeoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strikeoutcovid19.com"; sid:593587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sunlightandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sunlightandcoronavirus.com"; sid:593588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takeacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takeacovidtest.com"; sid:593589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingadalimumabduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingadalimumabduringcovid19.com"; sid:593590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingbrandduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingbrandduringcovid19.com"; sid:593591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takinggenericduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takinggenericduringcovid19.com"; sid:593592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takinghumiraduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takinghumiraduringcovid19.com"; sid:593593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingrinvoqduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingrinvoqduringcovid19.com"; sid:593594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingrisankizumab-rzaaduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingrisankizumab-rzaaduringcovid19.com"; sid:593595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingskyriziduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingskyriziduringcovid19.com"; sid:593596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takingupadacitinibduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takingupadacitinibduringcovid19.com"; sid:593597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamponecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamponecovid19.com"; sid:593598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testecovidangola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testecovidangola.com"; sid:593599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testflcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testflcovid.com"; sid:593600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testfloridacorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testfloridacorona19.com"; sid:593601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testparacovid19.com"; sid:593602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testparacovid.com"; sid:593603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaart.com"; sid:593604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafacemasks.com"; sid:593605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaspiracy.com"; sid:593606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19curve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19curve.com"; sid:593607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19detox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19detox.com"; sid:593608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19lbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19lbs.com"; sid:593609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19mall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19mall.com"; sid:593610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcolab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcolab.com"; sid:593611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcures.com"; sid:593612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidianera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidianera.com"; sid:593613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidiantimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidiantimes.com"; sid:593614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmind.com"; sid:593615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidnotebooks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidnotebooks.net"; sid:593616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsolution.com"; sid:593617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsurvey.com"; sid:593618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidweather.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidweather.com"; sid:593619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronanormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronanormal.com"; sid:593620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcoronavirusnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcoronavirusnormal.com"; sid:593621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenovelcovidnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenovelcovidnormal.com"; sid:593622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thesecovidiantimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thesecovidiantimes.com"; sid:593623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalcoronashield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalcoronashield.com"; sid:593624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovidnow.com"; sid:593625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelingaftercovid.com"; sid:593626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trjcovid19buyerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trjcovid19buyerplan.com"; sid:593627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trjcovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trjcovid19sellerplan.com"; sid:593628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovidfails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovidfails.com"; sid:593629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucovid-19.com"; sid:593630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uni2xcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uni2xcovid-19.com"; sid:593631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporcovid-19.com"; sid:593632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcoronavirus.com"; sid:593633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcoronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcoronavirusinfo.com"; sid:593634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcoronavirusinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcoronavirusinfo.net"; sid:593635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcoronavirus.net"; sid:593636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcovid19.com"; sid:593637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcovid19.net"; sid:593638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcovidresponse.com"; sid:593639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upadacitinibcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upadacitinibcovidresponse.net"; sid:593640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidfree.com"; sid:593641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtestcenter.com"; sid:593642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtestcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtestcenters.com"; sid:593643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidclean.com"; sid:593644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidcleaner.com"; sid:593645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidlight.com"; sid:593646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidsterilizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidsterilizer.com"; sid:593647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvkillsbugsandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvkillsbugsandcovid.com"; sid:593648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacoronaviruscovid19.com"; sid:593649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunaparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunaparacovid.com"; sid:593650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for validatedcovid19inhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"validatedcovid19inhometest.com"; sid:593651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for validcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"validcovid19test.com"; sid:593652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for validcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"validcovidtest.com"; sid:593653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vetcovid.com"; sid:593654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for videofourcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"videofourcoronavirus.info"; sid:593655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualcovid-19.com"; sid:593656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wcovid-19.com"; sid:593657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidsafeaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidsafeaware.com"; sid:593658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidsafe.com"; sid:593659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecovid-19cleancars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecovid-19cleancars.com"; sid:593660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecovid19cleancars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecovid19cleancars.com"; sid:593661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecovid19cleanyourcar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecovid19cleanyourcar.com"; sid:593662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wolrdpandemicsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wolrdpandemicsupplies.com"; sid:593663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronadays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronadays.com"; sid:593664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan0123.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan0123.run"; sid:593665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan2020.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan2020.run"; sid:593666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancountryclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancountryclub.com"; sid:593667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandonald.com"; sid:593668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandonaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandonaldtrump.com"; sid:593669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhan.club"; sid:593670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlite.com"; sid:593671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmlzb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmlzb.com"; sid:593672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-national.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-national.com"; sid:593673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansglobalgift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansglobalgift.com"; sid:593674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantrumpvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantrumpvirus.com"; sid:593675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--espaacovidfree-tnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--espaacovidfree-tnb.com"; sid:593676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--jourdaprscovid19-0pb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--jourdaprscovid19-0pb.com"; sid:593677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ycovid-19.com"; sid:593678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid-19.com"; sid:593679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidsource.com"; sid:593680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidstory.com"; sid:593681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidx.com"; sid:593682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid19news.com"; sid:593683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavirus19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavirus19pandemic.com"; sid:593684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covdpandemic.com"; sid:593685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemiccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemiccovid19.com"; sid:593686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemiccv19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemiccv19.com"; sid:593687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpivot.com"; sid:593688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3t4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3t4corona.com"; sid:593689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4thjulycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4thjulycorona.com"; sid:593690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gpandemic.net"; sid:593691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6coronas.com"; sid:593692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcsofcovid19.com"; sid:593693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africa-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africa-covid.com"; sid:593694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.club"; sid:593695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronafestival.com"; sid:593696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afthercovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afthercovid-19.net"; sid:593697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afthercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afthercovid19.net"; sid:593698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovid.net"; sid:593699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airbornecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airbornecorona.com"; sid:593700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alerte-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alerte-covid19.com"; sid:593701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecovid19.info"; sid:593702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alerte-covid19-ne.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alerte-covid19-ne.net"; sid:593703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alerte-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alerte-covid.com"; sid:593704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecovid.com"; sid:593705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alquilerescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alquilerescovidfree.com"; sid:593706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibacterialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibacterialcorona.com"; sid:593707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticontagiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticontagiocovid.com"; sid:593708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaclubshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaclubshop.com"; sid:593709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidglove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidglove.com"; sid:593710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apartamentosturisticoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apartamentosturisticoscovidfree.com"; sid:593711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for articlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"articlecorona.com"; sid:593712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attcorona.com"; sid:593713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attcovid19.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attcovid19.solutions"; sid:593714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for audicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"audicorona.com"; sid:593715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aunconcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aunconcovid.com"; sid:593716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avab-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avab-corona.net"; sid:593717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirushelp.com"; sid:593718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bacteriacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bacteriacorona.com"; sid:593719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronawarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronawarrior.com"; sid:593720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid19.net"; sid:593721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronavirus.info"; sid:593722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronavirus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronavirus.life"; sid:593723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid.info"; sid:593724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackoutcovid.com"; sid:593725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodcorona.com"; sid:593726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bmwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bmwcorona.com"; sid:593727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bollywoodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bollywoodcorona.com"; sid:593728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botox-despite-covid19-sydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botox-despite-covid19-sydney.com"; sid:593729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business-postcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business-postcovid.com"; sid:593730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronasupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronasupplies.com"; sid:593731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidrapidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidrapidantibodytest.com"; sid:593732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirusassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirusassistance.com"; sid:593733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirushelp.com"; sid:593734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cadizcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cadizcovidfree.com"; sid:593735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camerathermiquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camerathermiquecovid.com"; sid:593736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidshields.com"; sid:593737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careervscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careervscovid.com"; sid:593738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casaruralcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casaruralcovidfree.com"; sid:593739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casosdecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casosdecoronavirus.net"; sid:593740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdcorona.com"; sid:593741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cerocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cerocovid.com"; sid:593742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19test.com"; sid:593743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidtestedworkplace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidtestedworkplace.net"; sid:593744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cgcoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cgcoronaupdate.com"; sid:593745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chargethroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chargethroughcovid.com"; sid:593746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chargethrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chargethrucovid.com"; sid:593747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmatingcovid.com"; sid:593748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiclanacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiclanacovidfree.com"; sid:593749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinamobilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinamobilecorona.com"; sid:593750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cinemacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cinemacorona.com"; sid:593751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closetocovid.com"; sid:593752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorsofcovid19.com"; sid:593753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloursofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloursofcovid19.com"; sid:593754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for community-outofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"community-outofcovid.net"; sid:593755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityoutofcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityoutofcovid.net"; sid:593756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compliancecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compliancecovidfree.com"; sid:593757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for complicationscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"complicationscorona.com"; sid:593758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conilcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conilcovidfree.com"; sid:593759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2030.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2030.com"; sid:593760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona20g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona20g.com"; sid:593761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-26cm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-26cm.com"; sid:593762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona360.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona360.info"; sid:593763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaairborne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaairborne.com"; sid:593764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaallah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaallah.com"; sid:593765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamazon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamazon.com"; sid:593766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamericans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamericans.com"; sid:593767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-analytica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-analytica.com"; sid:593768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalytics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalytics.net"; sid:593769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibacterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibacterial.com"; sid:593770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaasians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaasians.com"; sid:593771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaatt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaatt.com"; sid:593772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaudi.com"; sid:593773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabacktaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabacktaxes.com"; sid:593774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeschermingsmiddelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeschermingsmiddelen.com"; sid:593775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabmw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabmw.com"; sid:593776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabollywood.com"; sid:593777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboti.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboti.net"; sid:593778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddha.com"; sid:593779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddhism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddhism.com"; sid:593780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddhist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddhist.com"; sid:593781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bussgeld.nrw - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bussgeld.nrw"; sid:593782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checking.com"; sid:593783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachefs.com"; sid:593784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachinamobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachinamobile.com"; sid:593785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachristianity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachristianity.com"; sid:593786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningatl.com"; sid:593787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleartest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleartest.com"; sid:593788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplications.com"; sid:593789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconquerors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconquerors.com"; sid:593790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsultmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsultmd.com"; sid:593791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-couture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-couture.com"; sid:593792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurecafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurecafe.com"; sid:593793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurehelp.com"; sid:593794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretreatment.com"; sid:593795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadayofthedead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadayofthedead.com"; sid:593796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeutsche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeutsche.com"; sid:593797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevirus.com"; sid:593798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasenyc.com"; sid:593799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistribution.com"; sid:593800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadistrict.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadistrict.info"; sid:593801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiwali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiwali.com"; sid:593802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoarbitration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoarbitration.com"; sid:593803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohearingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohearingcenter.com"; sid:593804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohearingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohearingcenters.com"; sid:593805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohearing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohearing.com"; sid:593806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonline.com"; sid:593807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoroad.com"; sid:593808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaduh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaduh.com"; sid:593809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-eg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-eg.com"; sid:593810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-erklaermalbuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-erklaermalbuch.com"; sid:593811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaex.net"; sid:593812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafastcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafastcheck.com"; sid:593813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeeantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeeantivirus.com"; sid:593814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafight.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafight.info"; sid:593815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreepayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreepayments.com"; sid:593816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fucker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fucker.club"; sid:593817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafucker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafucker.club"; sid:593818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafucker.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafucker.info"; sid:593819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagenz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagenz.com"; sid:593820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahanukkah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahanukkah.com"; sid:593821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.info"; sid:593822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahindu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahindu.com"; sid:593823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahinduism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahinduism.com"; sid:593824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahollywood.com"; sid:593825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahope.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahope.net"; sid:593826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitycard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitycard.com"; sid:593827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitycards.com"; sid:593828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitypass.com"; sid:593829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitypassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitypassport.com"; sid:593830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitypassport.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitypassport.info"; sid:593831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindependence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindependence.com"; sid:593832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsta.com"; sid:593833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaislam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaislam.com"; sid:593834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuly4th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuly4th.com"; sid:593835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakleenco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakleenco.com"; sid:593836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kleen.com"; sid:593837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleave.com"; sid:593838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-lifes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-lifes.com"; sid:593839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalists.com"; sid:593840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-magazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-magazine.com"; sid:593841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskwatch.com"; sid:593842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatik.com"; sid:593843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatik.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatik.net"; sid:593844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-med.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-med.info"; sid:593845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-med.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-med.net"; sid:593846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerican.com"; sid:593847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamericans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamericans.com"; sid:593848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiddleeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiddleeast.com"; sid:593849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillennial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillennial.com"; sid:593850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamillennials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamillennials.com"; sid:593851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mundschutz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mundschutz.info"; sid:593852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamutualfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamutualfunds.com"; sid:593853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaname.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaname.com"; sid:593854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ni-makeruna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ni-makeruna.net"; sid:593855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanippon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanippon.com"; sid:593856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-note.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-note.com"; sid:593857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ok.com"; sid:593858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ok.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ok.net"; sid:593859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaole.com"; sid:593860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakcomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakcomedy.com"; sid:593861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassover.com"; sid:593862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonalinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonalinjuryattorney.com"; sid:593863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolonaise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolonaise.com"; sid:593864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionproducts.com"; sid:593865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapsyhoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapsyhoz.com"; sid:593866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaramadan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaramadan.com"; sid:593867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarash.com"; sid:593868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareducers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareducers.com"; sid:593869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-remedies.com"; sid:593870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareosales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareosales.com"; sid:593871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarticle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarticle.com"; sid:593872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltestkit.com"; sid:593873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasertifikalioteller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasertifikalioteller.com"; sid:593874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield101.com"; sid:593875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasian.com"; sid:593876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasizalanlar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasizalanlar.com"; sid:593877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiztatil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiztatil.com"; sid:593878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiztermal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiztermal.com"; sid:593879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoftbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoftbank.com"; sid:593880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolid.com"; sid:593881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspittest.com"; sid:593882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprint.com"; sid:593883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastate.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastate.info"; sid:593884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopsign.com"; sid:593885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalkit.net"; sid:593886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tagebuch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tagebuch.net"; sid:593887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelecom.com"; sid:593888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelefonica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelefonica.com"; sid:593889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesla.com"; sid:593890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation.investments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation.investments"; sid:593891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracing-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracing-app.com"; sid:593892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracingapp.com"; sid:593893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverizon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverizon.com"; sid:593894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveus20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveus20.com"; sid:593895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveus.com"; sid:593896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavijfje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavijfje.com"; sid:593897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19data.com"; sid:593898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19plague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19plague.com"; sid:593899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19quarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19quarantine2020.com"; sid:593900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19vaccination.com"; sid:593901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19vaccinations.com"; sid:593902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisorsandconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisorsandconsultants.net"; sid:593903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalytics.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalytics.info"; sid:593904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandcollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandcollege.com"; sid:593905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandcollegeconversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandcollegeconversation.com"; sid:593906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanovel.com"; sid:593907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarmenia.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarmenia.info"; sid:593908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninggeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninggeorgia.com"; sid:593909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningkentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningkentucky.com"; sid:593910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninglouisianna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninglouisianna.com"; sid:593911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaning.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaning.mobi"; sid:593912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningrhodeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningrhodeisland.com"; sid:593913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsouthcarolina.com"; sid:593914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtennesee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtennesee.com"; sid:593915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningvermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningvermont.com"; sid:593916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounselinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounselinggroup.com"; sid:593917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurrency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurrency.com"; sid:593918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathslawsuit.com"; sid:593919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexhibit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexhibit.com"; sid:593920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfase2.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfase2.club"; sid:593921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushallofshame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushallofshame.com"; sid:593922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthy.com"; sid:593923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjection.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjection.support"; sid:593924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjhu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjhu.com"; sid:593925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruskiller.com"; sid:593926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarriage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarriage.com"; sid:593927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskstore.com"; sid:593928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovosibirsk.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovosibirsk.info"; sid:593929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutbreakcomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutbreakcomedy.com"; sid:593930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ozono.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ozono.info"; sid:593931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ozono.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ozono.net"; sid:593932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplandemic.com"; sid:593933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionservice.net"; sid:593934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionservices.net"; sid:593935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectiongroup.com"; sid:593936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionservices.com"; sid:593937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyinspectors.com"; sid:593938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussave.com"; sid:593939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecondopinion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecondopinion.com"; sid:593940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecondopinion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecondopinion.net"; sid:593941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthenovella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthenovella.com"; sid:593942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapyhelp.com"; sid:593943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineupdates.com"; sid:593944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswed.com"; sid:593945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruswedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruswedding.com"; sid:593946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavius411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavius411.com"; sid:593947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoces20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoces20.com"; sid:593948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoces.com"; sid:593949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavodafone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavodafone.com"; sid:593950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vyrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vyrus.com"; sid:593951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxian.com"; sid:593952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazero.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazero.net"; sid:593953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covdpandemic.com"; sid:593954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advisorsandconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advisorsandconsultants.net"; sid:593955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodyvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodyvaccine.com"; sid:593956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyvaccine.com"; sid:593957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antitoxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antitoxin.com"; sid:593958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antitoxins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antitoxins.com"; sid:593959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antitoxinvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antitoxinvaccine.com"; sid:593960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirusvaccine.com"; sid:593961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attenuatedvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attenuatedvaccine.com"; sid:593962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19avoided.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19avoided.com"; sid:593963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awareness.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awareness.info"; sid:593964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarenessusa.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarenessusa.info"; sid:593965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biosensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biosensor.com"; sid:593966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biosensors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biosensors.com"; sid:593967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19botoxsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19botoxsydney.com"; sid:593968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessinspectors.com"; sid:593969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinspectors.com"; sid:593970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19califonia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19califonia.com"; sid:593971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chinasgifttotheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chinasgifttotheworld.com"; sid:593972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19choice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19choice.com"; sid:593973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.life"; sid:593974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comply.com"; sid:593975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-condolence.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-condolence.net"; sid:593976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttrackers.com"; sid:593977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coronavirushealthpandemic2020update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coronavirushealthpandemic2020update.com"; sid:593978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19counsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19counsel.com"; sid:593979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-counseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-counseling.com"; sid:593980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curehelp.com"; sid:593981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curehelp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curehelp.info"; sid:593982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curenow.com"; sid:593983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curenow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curenow.info"; sid:593984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curenow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curenow.net"; sid:593985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dancemachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dancemachine.com"; sid:593986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathslawsuit.com"; sid:593987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathslawsuit.com"; sid:593988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfectant.com"; sid:593989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.info"; sid:593990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exhibit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exhibit.com"; sid:593991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exhitbit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exhitbit.com"; sid:593992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-exit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-exit.com"; sid:593993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.cruises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.cruises"; sid:593994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.flights"; sid:593995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.holiday - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.holiday"; sid:593996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freeworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freeworld.net"; sid:593997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goods.trade - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goods.trade"; sid:593998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graficos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graficos.com"; sid:593999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graphicaltrends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graphicaltrends.net"; sid:594000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpdesk.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpdesk.info"; sid:594001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helper.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helper.net"; sid:594002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.expert"; sid:594003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpnow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpnow.info"; sid:594004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herdimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herdimmunity.com"; sid:594005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heros.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heros.info"; sid:594006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitypass.com"; sid:594007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunizationvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunizationvaccine.com"; sid:594008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incubationperiod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incubationperiod.com"; sid:594009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innepal.com"; sid:594010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19innoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19innoculation.com"; sid:594011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inspector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inspector.com"; sid:594012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspector.com"; sid:594013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kenya.com"; sid:594014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kill.com"; sid:594015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killed.com"; sid:594016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killed.net"; sid:594017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-life.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-life.info"; sid:594018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-life.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-life.net"; sid:594019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-locator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-locator.com"; sid:594020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masacre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masacre.com"; sid:594021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks.mobi"; sid:594022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maxout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maxout.com"; sid:594023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meet.com"; sid:594024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memfoundation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memfoundation.net"; sid:594025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mentalhealth.com"; sid:594026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitors.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitors.info"; sid:594027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mss.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mss.info"; sid:594028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19musings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19musings.com"; sid:594029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newslatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newslatest.com"; sid:594030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsvid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsvid.com"; sid:594031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oil.com"; sid:594032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ozono.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ozono.info"; sid:594033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ozono.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ozono.net"; sid:594034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicquarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicquarantine2020.com"; sid:594035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plandemic.com"; sid:594036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmatesting.com"; sid:594037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmatests.com"; sid:594038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poctest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poctest.com"; sid:594039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19precheck.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19precheck.info"; sid:594040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preneurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preneurs.com"; sid:594041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionservice.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionservice.net"; sid:594042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionservices.net"; sid:594043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-proof.com"; sid:594044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectivemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectivemasks.com"; sid:594045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quaranteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quaranteen.com"; sid:594046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantine2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantine2020.com"; sid:594047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantineprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantineprotocol.com"; sid:594048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.center"; sid:594049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reopening.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reopening.net"; sid:594050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19response.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19response.world"; sid:594051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rightslaw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rightslaw.net"; sid:594052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rna.net"; sid:594053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rna.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rna.net"; sid:594054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-roadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-roadmap.com"; sid:594055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyinspectors.com"; sid:594056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyinspectors.com"; sid:594057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salute.com"; sid:594058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitationstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitationstation.com"; sid:594059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19signing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19signing.com"; sid:594060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-signing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-signing.com"; sid:594061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signing.com"; sid:594062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19snapshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19snapshot.com"; sid:594063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spittest.com"; sid:594064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sports.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sports.info"; sid:594065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.vision"; sid:594066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-strategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-strategy.com"; sid:594067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strength.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strength.com"; sid:594068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supermarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supermarket.com"; sid:594069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testca.com"; sid:594070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testca.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testca.net"; sid:594071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing4u.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing4u.info"; sid:594072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing4u.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing4u.net"; sid:594073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnv.com"; sid:594074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnv.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnv.net"; sid:594075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19timeline.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19timeline.watch"; sid:594076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tracing.com"; sid:594077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travels.com"; sid:594078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turismo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turismo.info"; sid:594079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinehumantrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinehumantrials.com"; sid:594080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineinnoculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineinnoculation.com"; sid:594081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinenews.com"; sid:594082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinesideeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinesideeffects.com"; sid:594083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesideeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesideeffects.com"; sid:594084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaers.com"; sid:594085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virucide.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virucide.info"; sid:594086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusinformation.com"; sid:594087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vivid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vivid.com"; sid:594088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vivid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vivid.com"; sid:594089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vivid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vivid.info"; sid:594090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vivid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vivid.net"; sid:594091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-warning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-warning.com"; sid:594092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wena.com"; sid:594093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workstation.com"; sid:594094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020pandemic.com"; sid:594095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20peru.com"; sid:594096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2x1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2x1.com"; sid:594097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacide.com"; sid:594098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidad.com"; sid:594099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagogo.com"; sid:594100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamin.net"; sid:594101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandthecity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandthecity.com"; sid:594102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodycruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodycruise.com"; sid:594103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidao.com"; sid:594104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasskickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasskickers.com"; sid:594105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbluetooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbluetooth.com"; sid:594106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbodydefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbodydefense.com"; sid:594107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbros.com"; sid:594108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuster.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuster.club"; sid:594109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandidsatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandidsatl.com"; sid:594110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremasks.com"; sid:594111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarriers.com"; sid:594112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchat.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchat.info"; sid:594113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicals.com"; sid:594114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassic.com"; sid:594115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanuk.com"; sid:594116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleartest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleartest.com"; sid:594117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomicrelief.com"; sid:594118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconflict.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconflict.com"; sid:594119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttrackers.com"; sid:594120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvertor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvertor.com"; sid:594121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatebankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatebankruptcy.com"; sid:594122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-counseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-counseling.com"; sid:594123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazymomster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazymomster.com"; sid:594124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditpros.com"; sid:594125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditreports.com"; sid:594126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditservice.com"; sid:594127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cure-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cure-now.com"; sid:594128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cure-now.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cure-now.net"; sid:594129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustoms.com"; sid:594130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenoted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenoted.com"; sid:594131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-digital-maroc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-digital-maroc.com"; sid:594132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivingmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivingmask.com"; sid:594133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddolls.com"; sid:594134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-e.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-e.com"; sid:594135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidempresas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidempresas.com"; sid:594136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideology.com"; sid:594137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo.today"; sid:594138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideox.com"; sid:594139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidery.com"; sid:594140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexposures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexposures.com"; sid:594141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeeantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeeantivirus.com"; sid:594142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfee.com"; sid:594143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfellows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfellows.com"; sid:594144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprint.com"; sid:594145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprinting.com"; sid:594146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprinting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprinting.net"; sid:594147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprint.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprint.net"; sid:594148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprints.com"; sid:594149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfingerprints.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfingerprints.net"; sid:594150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfondbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfondbox.com"; sid:594151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertified.net"; sid:594152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecompliance.com"; sid:594153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemenorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemenorca.com"; sid:594154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreespain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreespain.net"; sid:594155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.travel - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.travel"; sid:594156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfresh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfresh.com"; sid:594157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidget.com"; sid:594158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgo.info"; sid:594159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads2020.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads2020.info"; sid:594160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads.info"; sid:594161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreenzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreenzone.com"; sid:594162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreenzones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreenzones.com"; sid:594163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthnow.com"; sid:594164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp123.com"; sid:594165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.care"; sid:594166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherdimmunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherdimmunity.com"; sid:594167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotels.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotels.info"; sid:594168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotels.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotels.net"; sid:594169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianusa.com"; sid:594170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpact.net"; sid:594171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinspirations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinspirations.net"; sid:594172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurance.info"; sid:594173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidios.com"; sid:594174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots2020.com"; sid:594175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotsworld.com"; sid:594176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiquette.com"; sid:594177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiquette.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiquette.info"; sid:594178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity.fund"; sid:594179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs2020.com"; sid:594180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobshelp.com"; sid:594181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillcrew.com"; sid:594182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilled.com"; sid:594183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilled.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilled.net"; sid:594184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknow.com"; sid:594185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkook.com"; sid:594186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlatepayments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlatepayments.com"; sid:594187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigation.net"; sid:594188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanlawyer.com"; sid:594189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlover.com"; sid:594190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanpower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanpower.com"; sid:594191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasacre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasacre.com"; sid:594192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks4all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks4all.com"; sid:594193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksart.com"; sid:594194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskseguridad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskseguridad.com"; sid:594195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskus.com"; sid:594196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.men - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.men"; sid:594197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmost.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmost.info"; sid:594198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnatural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnatural.com"; sid:594199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnear.com"; sid:594200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewscenter.com"; sid:594201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nexus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nexus.com"; sid:594202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnexus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnexus.com"; sid:594203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotifications.com"; sid:594204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofcolor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofcolor.com"; sid:594205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ok.com"; sid:594206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ok.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ok.net"; sid:594207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidone9.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidone9.info"; sid:594208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutfits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutfits.com"; sid:594209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemichistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemichistory.com"; sid:594210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemiclife.com"; sid:594211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicmuseum.com"; sid:594212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpedsimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpedsimulation.com"; sid:594213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalbankruptcy.com"; sid:594214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirina.com"; sid:594215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpixel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpixel.com"; sid:594216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmatests.com"; sid:594217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheck.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheck.info"; sid:594218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreop.com"; sid:594219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidabtest.com"; sid:594220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryhack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryhack.com"; sid:594221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryhack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryhack.net"; sid:594222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresiliencyfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresiliencyfund.com"; sid:594223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsecu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsecu.com"; sid:594224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrid.life"; sid:594225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrio.com"; sid:594226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskassessment.com"; sid:594227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidros.com"; sid:594228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaf.com"; sid:594229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeapp.com"; sid:594230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevaccine.com"; sid:594231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalute.com"; sid:594232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationnotes.com"; sid:594233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizingcompany.com"; sid:594234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshack.com"; sid:594235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshoppers.com"; sid:594236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitterny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitterny.com"; sid:594237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsittersnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsittersnj.com"; sid:594238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsittersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsittersnyc.com"; sid:594239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sitters-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sitters-ny.com"; sid:594240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsittersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsittersny.com"; sid:594241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspittest.com"; sid:594242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidssafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidssafe.com"; sid:594243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.today"; sid:594244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopdating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopdating.com"; sid:594245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabs.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabs.healthcare"; sid:594246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteas.com"; sid:594247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcenterswfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcenterswfl.com"; sid:594248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingalliance.com"; sid:594249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingalliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingalliance.net"; sid:594250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.network"; sid:594251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.nyc"; sid:594252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsydney.com"; sid:594253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapyforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapyforyou.com"; sid:594254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreatindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreatindex.com"; sid:594255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreatindex.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreatindex.net"; sid:594256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrails.com"; sid:594257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtranslations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtranslations.com"; sid:594258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveltips.com"; sid:594259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrips.com"; sid:594260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtu.com"; sid:594261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtunes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtunes.com"; sid:594262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussupport.com"; sid:594263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusvaccine.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusvaccine.world"; sid:594264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarheroes.com"; sid:594265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarriorsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarriorsindia.com"; sid:594266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.info"; sid:594267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhileblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhileblack.com"; sid:594268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhilebrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhilebrown.com"; sid:594269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhilewhite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhilewhite.com"; sid:594270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxo.com"; sid:594271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxo.net"; sid:594272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-z.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-z.vision"; sid:594273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov-pandemic.com"; sid:594274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowncoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowncoronation.com"; sid:594275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidadocoronavirus.com"; sid:594276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid-19.info"; sid:594277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid.care"; sid:594278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidconsortium.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidconsortium.info"; sid:594279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidconsortium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidconsortium.net"; sid:594280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvdpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvdpandemic.com"; sid:594281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathtocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathtocovid.com"; sid:594282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deconcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deconcovid-19.com"; sid:594283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronafied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronafied.com"; sid:594284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccion-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccion-coronavirus.net"; sid:594285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantecoronavirus.net"; sid:594286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deutschecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deutschecorona.com"; sid:594287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diybeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diybeatcovid19.com"; sid:594288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedcovidtesting.com"; sid:594289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpicovid19.net"; sid:594290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duetocovid.com"; sid:594291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecm-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecm-covid19.com"; sid:594292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eldesafiocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eldesafiocorona.com"; sid:594293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elementoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elementoscovid19.com"; sid:594294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elementosproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elementosproteccioncovid19.com"; sid:594295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eppcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eppcovid19.com"; sid:594296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventocovid.com"; sid:594297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.fund"; sid:594298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidcorps.com"; sid:594299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidcorps.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidcorps.info"; sid:594300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidcorps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidcorps.net"; sid:594301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidbusinessbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidbusinessbankruptcy.com"; sid:594302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidbusinessbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidbusinessbankruptcy.com"; sid:594303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidpersonalbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidpersonalbankruptcy.com"; sid:594304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidx.com"; sid:594305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formenteracovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formenteracovidfree.net"; sid:594306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19.info"; sid:594307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumicoronavirus.com"; sid:594308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncovid.com"; sid:594309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gardensinthetimesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gardensinthetimesofcorona.com"; sid:594310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geauxawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geauxawaycovid19.com"; sid:594311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generationzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generationzcorona.com"; sid:594312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genzcorona.com"; sid:594313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19testingathome.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19testingathome.info"; sid:594314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidcheck.com"; sid:594315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidfree.com"; sid:594316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidjobs.com"; sid:594317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestingathome.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestingathome.info"; sid:594318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovidtest.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovidtest.info"; sid:594319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gibcoronakeinechance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gibcoronakeinechance.com"; sid:594320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemicbakeoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemicbakeoff.com"; sid:594321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicovid19testing.com"; sid:594322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heroesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heroesofcovid-19.com"; sid:594323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hollywoodcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hollywoodcorona.com"; sid:594324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homesellerscovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homesellerscovid19help.com"; sid:594325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometestkitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometestkitcovid-19.com"; sid:594326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalcoronavirustest.com"; sid:594327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesandalucialibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesandalucialibrecovid19.com"; sid:594328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesandalucialibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesandalucialibrecovid.com"; sid:594329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteleslibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteleslibrecovid19.com"; sid:594330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteleslibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteleslibrecovid.com"; sid:594331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesmallorcacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesmallorcacovidfree.com"; sid:594332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesmallorcafreecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesmallorcafreecovid19.com"; sid:594333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesmallorcafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesmallorcafreecovid.com"; sid:594334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesmallorcalibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesmallorcalibrecovid19.com"; sid:594335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelesmallorcalibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelesmallorcalibrecovid.com"; sid:594336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelessanctipetrilibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelessanctipetrilibrecovid19.com"; sid:594337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelessanctipetrilibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelessanctipetrilibrecovid.com"; sid:594338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelessincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelessincovid19.com"; sid:594339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotellibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotellibrecovid19.com"; sid:594340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotellibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotellibrecovid.com"; sid:594341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelmallorcacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelmallorcacovidfree.com"; sid:594342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelmallorcafreecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelmallorcafreecovid19.com"; sid:594343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelmallorcafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelmallorcafreecovid.com"; sid:594344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelmallorcalibrecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelmallorcalibrecovid19.com"; sid:594345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelmallorcalibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelmallorcalibrecovid.com"; sid:594346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdoescovidaffectme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdoescovidaffectme.com"; sid:594347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibizacovidfree.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibizacovidfree.net"; sid:594348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imdbcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imdbcorona.com"; sid:594349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunitacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunitacovid19.com"; sid:594350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for independencecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"independencecorona.com"; sid:594351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcovidrelief.com"; sid:594352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instanttestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instanttestcovid-19.com"; sid:594353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intellipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intellipandemic.com"; sid:594354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iradicatecovid.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iradicatecovid.foundation"; sid:594355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iradicatecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iradicatecovid.info"; sid:594356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iradicatecovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iradicatecovid.world"; sid:594357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthereaglobalpandemicrightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthereaglobalpandemicrightnow.com"; sid:594358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isyourdrycleanercovid19proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isyourdrycleanercovid19proof.com"; sid:594359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itg-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itg-covid.com"; sid:594360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsduringcovid.com"; sid:594361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice4covid19.com"; sid:594362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice4covid19victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice4covid19victims.com"; sid:594363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justice4covidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justice4covidvictims.com"; sid:594364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9coronavirus.com"; sid:594365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickoutcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickoutcovid.net"; sid:594366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona-virus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona-virus-19.com"; sid:594367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid.info"; sid:594368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcorona.net"; sid:594369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcoronavirus.net"; sid:594370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcovid-19.net"; sid:594371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawinthetimeofcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawinthetimeofcovid19.net"; sid:594372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leavecorona.com"; sid:594373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19pandemic.com"; sid:594374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifebeyondthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifebeyondthecoronavirus.com"; sid:594375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiarcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiarcovid.net"; sid:594376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidaid.com"; sid:594377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lolcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lolcorona.com"; sid:594378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losethecovid19.com"; sid:594379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeamericacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeamericacovidfree.com"; sid:594380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mallorcacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mallorcacovidfree.com"; sid:594381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascoronavirus.biz"; sid:594382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasdealuminiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasdealuminiocoronavirus.com"; sid:594383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasstopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasstopcoronavirus.com"; sid:594384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maquinadeozonocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maquinadeozonocoronavirus.com"; sid:594385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maske-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maske-coronavirus.com"; sid:594386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid19.net"; sid:594387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mauicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mauicovid-19.com"; sid:594388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mauicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mauicovid19.com"; sid:594389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicalcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicalcoronavirustest.com"; sid:594390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidascovid19.com"; sid:594391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medidascovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medidascovid19.net"; sid:594392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menorcacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menorcacovidfree.com"; sid:594393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for millennialcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"millennialcorona.com"; sid:594394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for millennialscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"millennialscorona.com"; sid:594395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernpandemicplaybook.com"; sid:594396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncoronacare.cymru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncoronacare.cymru"; sid:594397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moncoronacare.wales - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moncoronacare.wales"; sid:594398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanasmallbusinessandcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanasmallbusinessandcovid.net"; sid:594399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mucoronaviruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mucoronaviruz.com"; sid:594400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mutualfundscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mutualfundscorona.com"; sid:594401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-coronaface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-coronaface.com"; sid:594402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaface.com"; sid:594403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-virus-experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-virus-experience.com"; sid:594404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19claims.com"; sid:594405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlabtest.com"; sid:594406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidlabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidlabtests.com"; sid:594407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeoncovidia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeoncovidia.com"; sid:594408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for namecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"namecorona.com"; sid:594409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claim.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claim.net"; sid:594410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19claims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19claims.net"; sid:594411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcovid19.com"; sid:594412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcovid.com"; sid:594413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemicplaybook.com"; sid:594414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemicsplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemicsplaybook.com"; sid:594415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsoncovid.com"; sid:594416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nipponcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nipponcorona.com"; sid:594417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nixallcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nixallcorona.com"; sid:594418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nursinghomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nursinghomecoronavirus.com"; sid:594419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocovidx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocovidx.com"; sid:594420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oilcoronavirus.com"; sid:594421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercovidtest.com"; sid:594422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcamecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcamecoronavirus.com"; sid:594423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonemachinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonemachinecovid19.com"; sid:594424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-coronavirus.net"; sid:594425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-covid19.net"; sid:594426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiadeenfermedadporcoronavirusde2019-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiadeenfermedadporcoronavirusde2019-2020.com"; sid:594427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoalition.com"; sid:594428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccx.net"; sid:594429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdashboard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdashboard.net"; sid:594430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdatahunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdatahunter.com"; sid:594431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdecal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdecal.com"; sid:594432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfacts.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfacts.info"; sid:594433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfortune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfortune.com"; sid:594434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfortunes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfortunes.com"; sid:594435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclegacy.com"; sid:594436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmentalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmentalhealth.com"; sid:594437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplug.com"; sid:594438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicponderings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicponderings.com"; sid:594439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofits.net"; sid:594440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseunit.com"; sid:594441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.show - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.show"; sid:594442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsign.com"; sid:594443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsigning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsigning.com"; sid:594444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsilverlining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsilverlining.com"; sid:594445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsilverlinings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsilverlinings.com"; sid:594446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsplaybook.com"; sid:594447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportstore.com"; sid:594448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-usa.com"; sid:594449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusdeathslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusdeathslawsuit.com"; sid:594450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwellnessexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwellnessexpert.com"; sid:594451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pbacovid19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pbacovid19relieffund.com"; sid:594452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for picassobarcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"picassobarcoronado.com"; sid:594453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pixelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pixelcovid.com"; sid:594454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadosporelcovidencentroscomercialesdeespana-pac.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadosporelcovidencentroscomercialesdeespana-pac.net"; sid:594455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playbook4pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playbook4pandemics.com"; sid:594456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronageopolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronageopolitics.com"; sid:594457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapledge.com"; sid:594458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronapledge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronapledge.net"; sid:594459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.coach"; sid:594460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcoaching.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcoaching.net"; sid:594461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcoach.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcoach.net"; sid:594462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddepot.com"; sid:594463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidgeopolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidgeopolitics.com"; sid:594464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpledge.com"; sid:594465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpledge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpledge.net"; sid:594466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicalpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicalpandemicplaybook.com"; sid:594467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for practicalpandemicplaybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"practicalpandemicplaybook.net"; sid:594468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pragmaticpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pragmaticpandemicplaybook.com"; sid:594469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pragmaticpandemicplaybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pragmaticpandemicplaybook.net"; sid:594470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pragmaticpandemicsplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pragmaticpandemicsplaybook.com"; sid:594471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevencionvisualcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevencionvisualcovid-19.com"; sid:594472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protestcovid.com"; sid:594473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioncovid19.com"; sid:594474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questiongcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questiongcovid.com"; sid:594475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quicktestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quicktestcovid.com"; sid:594476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rebelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rebelcovid.com"; sid:594477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reisen-trotz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reisen-trotz-corona.com"; sid:594478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for revoltcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"revoltcovid19.com"; sid:594479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for russiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"russiacorona.com"; sid:594480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rutherfordcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rutherfordcovid.com"; sid:594481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salecovid.com"; sid:594482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sancovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sancovid.net"; sid:594483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovidvirus.com"; sid:594484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sardegnacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sardegnacovidfree.com"; sid:594485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovidsafe.com"; sid:594486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattletechcovidimpacted.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattletechcovidimpacted.net"; sid:594487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sevillacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sevillacovidfree.com"; sid:594488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovidsupplies.com"; sid:594489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidppe.com"; sid:594490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signal-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signal-covid19.com"; sid:594491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalcovid19.com"; sid:594492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signal-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signal-covid.com"; sid:594493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalement-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalement-covid19.com"; sid:594494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalementcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalementcovid.com"; sid:594495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialstationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialstationcovid19.com"; sid:594496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for softbankcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"softbankcorona.com"; sid:594497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soldcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soldcorona.com"; sid:594498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solidcorona.com"; sid:594499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sosnejapacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sosnejapacovid19.com"; sid:594500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speakcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speakcovid19.com"; sid:594501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sprintcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sprintcorona.com"; sid:594502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stagwellcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stagwellcovid.net"; sid:594503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for startingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"startingaftercovid.com"; sid:594504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stcoronalivemass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stcoronalivemass.net"; sid:594505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steamkillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steamkillscovid19.com"; sid:594506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stompcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stompcovid.com"; sid:594507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcovidnow.com"; sid:594508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supplies-for-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supplies-for-covid19.net"; sid:594509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecovid.net"; sid:594510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swflcovidtestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swflcovidtestcenter.com"; sid:594511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamponicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamponicovid19.com"; sid:594512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tantra-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tantra-covid.com"; sid:594513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tapabocascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tapabocascovid19.com"; sid:594514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tattooingbeyondcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tattooingbeyondcovid19.com"; sid:594515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamupagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamupagainstcovid.com"; sid:594516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecomcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecomcorona.com"; sid:594517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telefonicacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telefonicacorona.com"; sid:594518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teslacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teslacorona.com"; sid:594519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.pro"; sid:594520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19antibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19antibodies.com"; sid:594521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19antibody.com"; sid:594522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testsierologicicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testsierologicicovid19.com"; sid:594523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcovidmask.com"; sid:594524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcoronavirus19.com"; sid:594525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorofcoronavirus.com"; sid:594526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolorsofcovid19.com"; sid:594527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolourofcoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolourofcoronavirus19.com"; sid:594528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecolourofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecolourofcoronavirus.com"; sid:594529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoloursofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoloursofcovid19.com"; sid:594530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona-busters.com"; sid:594531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabusters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabusters.net"; sid:594532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanug.com"; sid:594533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19care.com"; sid:594534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcoalition.com"; sid:594535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcupid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcupid.info"; sid:594536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidexpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidexpress.com"; sid:594537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhygiene.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhygiene.report"; sid:594538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinfo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinfo.info"; sid:594539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidopoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidopoly.com"; sid:594540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid.report"; sid:594541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidwarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidwarriors.com"; sid:594542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefacesofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefacesofcovid-19.com"; sid:594543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegreatcovidhoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegreatcovidhoax.com"; sid:594544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thenewpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thenewpandemicplaybook.com"; sid:594545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicrebound.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicrebound.info"; sid:594546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsplaybook.com"; sid:594547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepracticalpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepracticalpandemicplaybook.com"; sid:594548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepracticalpandemicplaybook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepracticalpandemicplaybook.net"; sid:594549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepragmaticpandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepragmaticpandemicplaybook.com"; sid:594550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for toescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"toescorona.com"; sid:594551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for translatecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"translatecovid19.info"; sid:594552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for translatecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"translatecovid.info"; sid:594553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcovidnow.com"; sid:594554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcovidweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcovidweb.com"; sid:594555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpbeatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpbeatcovid.com"; sid:594556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcovidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcovidcures.com"; sid:594557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatecoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatecoronavirus.info"; sid:594558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for up-yours-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"up-yours-covid.com"; sid:594559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urlaub-trotz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urlaub-trotz-corona.com"; sid:594560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19payback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19payback.com"; sid:594561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19payback.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19payback.net"; sid:594562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usaid-covid19.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usaid-covid19.us"; sid:594563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcleanercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcleanercovid.com"; sid:594564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid19.com"; sid:594565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventascovid.com"; sid:594566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verizoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verizoncorona.com"; sid:594567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vocesfrentealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vocesfrentealcovid.com"; sid:594568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vodafonecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vodafonecorona.com"; sid:594569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voidcovid19.com"; sid:594570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vscoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vscoronavirus.info"; sid:594571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-corona.club"; sid:594572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcorona.club"; sid:594573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-corona.com"; sid:594574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-corona.info"; sid:594575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcorona.info"; sid:594576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-corona.net"; sid:594577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wefightcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wefightcorona.net"; sid:594578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipesthatkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipesthatkillcoronavirus.com"; sid:594579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipesthatkillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipesthatkillcovid.com"; sid:594580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for woodfieldschoolcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"woodfieldschoolcovid19.info"; sid:594581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for world-covid19-dataplatform.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"world-covid19-dataplatform.world"; sid:594582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidfree.com"; sid:594583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlin.cool - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlin.cool"; sid:594584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdeathslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdeathslawsuit.com"; sid:594585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusinformation.com"; sid:594586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirus-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirus-usa.com"; sid:594587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xiancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xiancorona.com"; sid:594588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--dsinfectioncovid19-bwb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--dsinfectioncovid19-bwb.com"; sid:594589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronavirushelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronavirushelp.com"; sid:594590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourpandemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourpandemicguide.com"; sid:594591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yummycoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yummycoronado.com"; sid:594592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapthatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapthatcovid19.com"; sid:594593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100goodthingsaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100goodthingsaboutcorona.com"; sid:594594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronapandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronapandemie.com"; sid:594595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123pandemic.com"; sid:594596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3covid-19.com"; sid:594597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5covid-19.com"; sid:594598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6covid-19.com"; sid:594599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 7covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"7covid-19.com"; sid:594600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 8covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"8covid-19.com"; sid:594601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 9covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"9covid-19.com"; sid:594602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid19story.com"; sid:594603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for addictioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"addictioncorona.com"; sid:594604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadoscoronavirusesp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadoscoronavirusesp.com"; sid:594605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcoholismcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcoholismcorona.com"; sid:594606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alerte-covid19-mali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alerte-covid19-mali.com"; sid:594607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertscorona.com"; sid:594608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alojamientoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alojamientoscovidfree.com"; sid:594609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altolacoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altolacoronavirus.net"; sid:594610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmenu.com"; sid:594611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidrestaurantmenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidrestaurantmenu.com"; sid:594612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemiclife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemiclife.com"; sid:594613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcodesinfeccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcodesinfeccioncovid.com"; sid:594614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arquitectojcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arquitectojcorona.com"; sid:594615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artagainstcoronavirus.com"; sid:594616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aseocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aseocoronavirus.com"; sid:594617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aseocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aseocovid19.com"; sid:594618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-stop-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-stop-covid.com"; sid:594619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangkokcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangkokcovidfree.com"; sid:594620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantaycovid19.com"; sid:594621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantinmuacovid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantinmuacovid.team"; sid:594622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batscorona.com"; sid:594623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovid19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovid19nyc.com"; sid:594624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beridcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beridcovid.com"; sid:594625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocovid.net"; sid:594626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizaftercovid19.com"; sid:594627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronavirus.com"; sid:594628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronavirus.net"; sid:594629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boholcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boholcovid19.com"; sid:594630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brccovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brccovidclean.com"; sid:594631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspandemicguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspandemicguide.com"; sid:594632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buybackcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buybackcovidvaccine.com"; sid:594633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-19healthgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-19healthgear.com"; sid:594634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19healthgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19healthgear.com"; sid:594635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cal-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cal-corona.com"; sid:594636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadamaskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadamaskscovid.com"; sid:594637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canaryislandscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canaryislandscovidfree.com"; sid:594638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercorona.com"; sid:594639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantabriapostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantabriapostcovid.com"; sid:594640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casasruralescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casasruralescovidfree.com"; sid:594641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocovidfree.com"; sid:594642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscovid.com"; sid:594643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cercacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cercacovid.com"; sid:594644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificacioncovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificacioncovidfree.com"; sid:594645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chaptercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chaptercovid19.com"; sid:594646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chasingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chasingcovid-19.com"; sid:594647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoricovid.com"; sid:594648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovidcompliancekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovidcompliancekit.com"; sid:594649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercoronaboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercoronaboutique.com"; sid:594650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.center"; sid:594651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.net"; sid:594652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.one"; sid:594653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.team"; sid:594654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.tips"; sid:594655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.world"; sid:594656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controldelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controldelcoronavirus.com"; sid:594657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controllacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controllacovid.com"; sid:594658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copdcovid19.com"; sid:594659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cora-covid.fr - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cora-covid.fr"; sid:594660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cordobalibredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cordobalibredecoronavirus.com"; sid:594661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cordobalibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cordobalibredecovid19.com"; sid:594662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona10minutetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona10minutetests.com"; sid:594663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19-disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19-disinfectionservice.com"; sid:594664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19disinfectionservice.com"; sid:594665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19disinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19disinfectionservices.com"; sid:594666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona24x7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona24x7.com"; sid:594667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaddiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaddiction.com"; sid:594668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-airways.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-airways.com"; sid:594669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalbum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalbum.com"; sid:594670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalcoholism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalcoholism.com"; sid:594671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaball.toys - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaball.toys"; sid:594672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanine.com"; sid:594673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanine.net"; sid:594674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanines.com"; sid:594675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanines.net"; sid:594676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checkup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checkup.com"; sid:594677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanerscacom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanerscacom.com"; sid:594678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersma.com"; sid:594679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersny.com"; sid:594680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comm.com"; sid:594681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comm.net"; sid:594682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrimenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrimenews.com"; sid:594683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisdienst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisdienst.com"; sid:594684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacritics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacritics.com"; sid:594685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseline.com"; sid:594686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactors.com"; sid:594687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurefreebewarm11mins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurefreebewarm11mins.com"; sid:594688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadance.net"; sid:594689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadances.com"; sid:594690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadances.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadances.net"; sid:594691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexploit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexploit.com"; sid:594692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforfutures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforfutures.com"; sid:594693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fucker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fucker.com"; sid:594694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafucker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafucker.com"; sid:594695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagasoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagasoil.com"; sid:594696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalwarming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalwarming.com"; sid:594697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreatcleaningtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreatcleaningtx.com"; sid:594698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahooks.com"; sid:594699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidied.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidied.com"; sid:594700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidweb.com"; sid:594701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfstoff.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfstoff.net"; sid:594702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaio.com"; sid:594703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalane.com"; sid:594704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mampara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mampara.com"; sid:594705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamars.com"; sid:594706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasking.com"; sid:594707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-matome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-matome.com"; sid:594708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemes420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemes420.com"; sid:594709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoilgas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoilgas.com"; sid:594710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicabc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicabc.com"; sid:594711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapercapita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapercapita.com"; sid:594712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapersonaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapersonaltest.com"; sid:594713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapictograph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapictograph.com"; sid:594714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapmdservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapmdservices.com"; sid:594715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-portal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-portal.net"; sid:594716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprojekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprojekt.com"; sid:594717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionproductshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionproductshop.com"; sid:594718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionproductsshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionproductsshop.com"; sid:594719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionproductsstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionproductsstore.com"; sid:594720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectivemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectivemasks.net"; sid:594721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicktestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicktestkits.com"; sid:594722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarp.com"; sid:594723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaruler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaruler.com"; sid:594724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascamming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascamming.com"; sid:594725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashelterfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashelterfun.com"; sid:594726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashild.com"; sid:594727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasorucevap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasorucevap.com"; sid:594728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasstuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasstuff.com"; sid:594729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatlive.com"; sid:594730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stop-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stop-shop.com"; sid:594731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastracker.com"; sid:594732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportdesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportdesk.com"; sid:594733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimeshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimeshare.com"; sid:594734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatirus.com"; sid:594735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineinus.com"; sid:594736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavailable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavailable.com"; sid:594737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaksin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaksin.net"; sid:594738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavationnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavationnation.com"; sid:594739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19day.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19day.mobi"; sid:594740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapparel2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapparel2020.com"; sid:594741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesspackage.com"; sid:594742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatfacemask.com"; sid:594743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoup.com"; sid:594744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoveredcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoveredcalifornia.com"; sid:594745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscracker.com"; sid:594746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecoded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecoded.com"; sid:594747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestoday.com"; sid:594748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhibitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhibitors.com"; sid:594749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjection.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjection.ltd"; sid:594750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliabilityclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliabilityclaims.com"; sid:594751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmallorca.com"; sid:594752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskswholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskswholesale.com"; sid:594753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmds.com"; sid:594754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedmasks.com"; sid:594755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichigan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichigan.net"; sid:594756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmrnavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmrnavaccine.com"; sid:594757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnbs.com"; sid:594758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-news-and-views.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-news-and-views.com"; sid:594759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicoffear.com"; sid:594760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-reopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-reopening.com"; sid:594761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreopening.com"; sid:594762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrnavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrnavaccine.com"; sid:594763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysupplyhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysupplyhouse.com"; sid:594764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-store.com"; sid:594765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrak.com"; sid:594766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacinecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacinecenters.com"; sid:594767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacinesites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacinesites.com"; sid:594768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvivid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvivid.com"; sid:594769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkerscompensationattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkerscompensationattorney.com"; sid:594770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warehouse.com"; sid:594771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawealthy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawealthy.com"; sid:594772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazation.com"; sid:594773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid11thhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid11thhour.com"; sid:594774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-abogado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-abogado.com"; sid:594775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19after.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19after.com"; sid:594776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19annihilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19annihilator.com"; sid:594777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19annihilator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19annihilator.net"; sid:594778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azclaims.com"; sid:594779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aziendasicura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aziendasicura.com"; sid:594780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bahia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bahia.com"; sid:594781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biometrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biometrics.com"; sid:594782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19black.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19black.com"; sid:594783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caclaims.com"; sid:594784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-camostat-trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-camostat-trial.com"; sid:594785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canine.com"; sid:594786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canines.net"; sid:594787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cardeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cardeals.com"; sid:594788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carspecials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carspecials.com"; sid:594789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casts.com"; sid:594790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19catfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19catfacemask.com"; sid:594791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19catfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19catfacemask.com"; sid:594792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chadox1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chadox1.com"; sid:594793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-chatbot.com"; sid:594794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19chatbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19chatbot.com"; sid:594795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningindenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningindenver.com"; sid:594796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningspecialist.com"; sid:594797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanuptoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanuptoday.com"; sid:594798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closeout.com"; sid:594799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closeouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closeouts.com"; sid:594800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coclaims.com"; sid:594801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.net"; sid:594802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-conspiracytheories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-conspiracytheories.com"; sid:594803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultingcompany.com"; sid:594804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crimes.com"; sid:594805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisismap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisismap.com"; sid:594806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ctclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ctclaims.com"; sid:594807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curtain.com"; sid:594808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decon.com"; sid:594809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designerfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designerfacemasks.com"; sid:594810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dettol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dettol.com"; sid:594811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dmtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dmtest.com"; sid:594812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19door.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19door.com"; sid:594813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drapery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drapery.com"; sid:594814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19entrepreneurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19entrepreneurs.com"; sid:594815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equipos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equipos.com"; sid:594816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19equityreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19equityreport.com"; sid:594817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eventcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eventcoalition.com"; sid:594818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19extra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19extra.com"; sid:594819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fabrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fabrics.com"; sid:594820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemask.net"; sid:594821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19f.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19f.com"; sid:594822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flclaims.com"; sid:594823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forms.com"; sid:594824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freepatchwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freepatchwork.com"; sid:594825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeteam.com"; sid:594826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gaclaims.com"; sid:594827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19g.com"; sid:594828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19h.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19h.com"; sid:594829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoax.net"; sid:594830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19i.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19i.com"; sid:594831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ilamptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ilamptest.com"; sid:594832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ilclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ilclaims.com"; sid:594833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impfstoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impfstoff.com"; sid:594834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhibitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhibitors.com"; sid:594835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inject.com"; sid:594836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19investor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19investor.com"; sid:594837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isahoax.com"; sid:594838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19k9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19k9.com"; sid:594839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keepaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keepaway.com"; sid:594840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keys.com"; sid:594841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laclaims.com"; sid:594842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalnews.com"; sid:594843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liabilityclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liabilityclaims.com"; sid:594844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lstrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lstrain.com"; sid:594845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maclaims.com"; sid:594846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mapped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mapped.com"; sid:594847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mapped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mapped.com"; sid:594848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maschera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maschera.com"; sid:594849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masken.com"; sid:594850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskes.com"; sid:594851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masque.com"; sid:594852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-matome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-matome.com"; sid:594853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mean.com"; sid:594854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicpro.com"; sid:594855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-memorial.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-memorial.team"; sid:594856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19michigan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19michigan.net"; sid:594857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitors.com"; sid:594858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitors.net"; sid:594859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mrnavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mrnavaccine.com"; sid:594860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nafamostat-trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nafamostat-trial.com"; sid:594861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nbs.com"; sid:594862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19njclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19njclaims.com"; sid:594863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nvclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nvclaims.com"; sid:594864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nyclaims.com"; sid:594865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nyclawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nyclawyer.com"; sid:594866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oarsoaldea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oarsoaldea.com"; sid:594867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ohclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ohclaims.com"; sid:594868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paclaims.com"; sid:594869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19p.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19p.com"; sid:594870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeclaims.com"; sid:594871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19probe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19probe.com"; sid:594872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proforma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proforma.com"; sid:594873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proforma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proforma.com"; sid:594874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proformas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proformas.com"; sid:594875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proformas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proformas.com"; sid:594876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pro.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pro.support"; sid:594877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19q.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19q.com"; sid:594878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktestkits.com"; sid:594879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidkits.com"; sid:594880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidkitusa.com"; sid:594881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapidtestkit.com"; sid:594882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapidtestkits.com"; sid:594883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestresults.com"; sid:594884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapidtests.com"; sid:594885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestusa.com"; sid:594886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtimetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtimetest.com"; sid:594887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-reopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-reopening.com"; sid:594888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantcompliance.com"; sid:594889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantcompliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantcompliance.net"; sid:594890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restaurantform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restaurantform.com"; sid:594891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantform.com"; sid:594892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restaurantforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restaurantforms.com"; sid:594893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantforms.com"; sid:594894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restingplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restingplace.com"; sid:594895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rnatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rnatest.com"; sid:594896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rnavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rnavaccine.com"; sid:594897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rnavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rnavaccine.com"; sid:594898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedistance.com"; sid:594899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safes.com"; sid:594900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycompliance.com"; sid:594901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scclaims.com"; sid:594902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seguro.com"; sid:594903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfscreener.com"; sid:594904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sheild.com"; sid:594905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19simulators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19simulators.com"; sid:594906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sports.net"; sid:594907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19startup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19startup.com"; sid:594908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19superat.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19superat.cat"; sid:594909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testimonials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testimonials.com"; sid:594910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theaftermath.com"; sid:594911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19totalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19totalcare.com"; sid:594912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trader.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trader.net"; sid:594913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveldeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveldeal.com"; sid:594914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trendone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trendone.com"; sid:594915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19u.com"; sid:594916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ufficiosicuro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ufficiosicuro.com"; sid:594917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uktest.com"; sid:594918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19up.com"; sid:594919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usatest.com"; sid:594920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-uv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-uv.com"; sid:594921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinecenters.com"; sid:594922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ve.com"; sid:594923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virucide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virucide.com"; sid:594924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virucide.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virucide.net"; sid:594925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waclaims.com"; sid:594926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-warehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-warehouse.com"; sid:594927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wearables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wearables.com"; sid:594928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatnext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatnext.com"; sid:594929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcompclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcompclaim.com"; sid:594930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wraps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wraps.com"; sid:594931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19z.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19z.com"; sid:594932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid911protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid911protection.com"; sid:594933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccessories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccessories.com"; sid:594934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidachillesheel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidachillesheel.com"; sid:594935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidageriskcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidageriskcalculator.com"; sid:594936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertas.com"; sid:594937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannihilator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannihilator.com"; sid:594938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannihilator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannihilator.net"; sid:594939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarms.com"; sid:594940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatoz.com"; sid:594941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatoz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatoz.net"; sid:594942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatyourownrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatyourownrisk.com"; sid:594943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakingnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakingnews.com"; sid:594944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandy.com"; sid:594945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanine.net"; sid:594946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanines.net"; sid:594947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecompact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecompact.com"; sid:594948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.nyc"; sid:594949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareshop.com"; sid:594950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarsales.com"; sid:594951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasecount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasecount.com"; sid:594952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasts.com"; sid:594953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedclean.com"; sid:594954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchasing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchasing.com"; sid:594955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcida.com"; sid:594956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanershawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanershawaii.com"; sid:594957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningcalifornia.com"; sid:594958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninghi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninghi.com"; sid:594959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninghonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninghonolulu.com"; sid:594960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningkauai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningkauai.com"; sid:594961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningmaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningmaui.com"; sid:594962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningoahu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningoahu.com"; sid:594963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningspecialists.com"; sid:594964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupnow.com"; sid:594965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclot.com"; sid:594966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclots.com"; sid:594967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclotting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclotting.com"; sid:594968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollectiongifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollectiongifts.com"; sid:594969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancegraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancegraphics.com"; sid:594970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancegraphicskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancegraphicskit.com"; sid:594971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancekit.com"; sid:594972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancesignkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancesignkit.com"; sid:594973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultingcompany.com"; sid:594974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolled.com"; sid:594975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoverageb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoverageb.com"; sid:594976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazed.com"; sid:594977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrime.com"; sid:594978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimenews.com"; sid:594979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimereport.com"; sid:594980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimesreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimesreport.com"; sid:594981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployerliability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployerliability.com"; sid:594982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidequipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidequipments.com"; sid:594983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidet.com"; sid:594984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetescouilles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetescouilles.com"; sid:594985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshield.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshield.net"; sid:594986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshields.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshields.net"; sid:594987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflu-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflu-vaccine.com"; sid:594988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluvaccines.com"; sid:594989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforge.com"; sid:594990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforms.com"; sid:594991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecasino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecasino.com"; sid:594992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuck.com"; sid:594993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgestion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgestion.com"; sid:594994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads2020.com"; sid:594995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads2020.net"; sid:594996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads.com"; sid:594997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrads.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrads.net"; sid:594998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreece.com"; sid:594999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthquest.com"; sid:595000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpkit.com"; sid:595001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalsafety.com"; sid:595002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmersion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmersion.com"; sid:595003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmuneprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmuneprotection.com"; sid:595004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-index.com"; sid:595005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhibitors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhibitors.com"; sid:595006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinject.com"; sid:595007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryattorneys.com"; sid:595008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthegitract.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthegitract.com"; sid:595009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthegut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthegut.com"; sid:595010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintyg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintyg.com"; sid:595011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiseeyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiseeyou.com"; sid:595012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkase.com"; sid:595013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillercleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillercleaners.com"; sid:595014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkingdom.com"; sid:595015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknives.com"; sid:595016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlatina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlatina.com"; sid:595017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlatino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlatino.com"; sid:595018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalnews.com"; sid:595019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlink.net"; sid:595020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagicbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagicbullet.com"; sid:595021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmates.com"; sid:595022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessageboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessageboard.com"; sid:595023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmodelarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmodelarchive.com"; sid:595024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmost.com"; sid:595025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghomeinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghomeinjury.com"; sid:595026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffsanitizante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffsanitizante.com"; sid:595027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoloum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoloum.com"; sid:595028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorange.com"; sid:595029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorbust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorbust.com"; sid:595030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidosage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidosage.com"; sid:595031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoximeters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoximeters.com"; sid:595032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientsafety.com"; sid:595033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplans.com"; sid:595034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplexi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplexi.com"; sid:595035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplexi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplexi.net"; sid:595036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpmdservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpmdservices.com"; sid:595037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpng.com"; sid:595038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesolutions.com"; sid:595039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprobe.com"; sid:595040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproforma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproforma.com"; sid:595041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproformas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproformas.com"; sid:595042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublicsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublicsafety.com"; sid:595043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidral.com"; sid:595044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreams.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreams.world"; sid:595045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resistance.com"; sid:595046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrink.com"; sid:595047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrm.com"; sid:595048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrol.com"; sid:595049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrp.com"; sid:595050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrugs.com"; sid:595051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrugstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrugstore.com"; sid:595052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeatwork.com"; sid:595053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehomeinspections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehomeinspections.com"; sid:595054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehospital.com"; sid:595055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehospitals.com"; sid:595056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafelocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafelocation.com"; sid:595057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafelocations.com"; sid:595058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyequipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyequipments.com"; sid:595059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeworkplace.com"; sid:595060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolsafety.com"; sid:595061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsegur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsegur.com"; sid:595062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfscreener.com"; sid:595063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshitbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshitbag.com"; sid:595064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shoudoku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shoudoku.com"; sid:595065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignin.com"; sid:595066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsimulators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsimulators.com"; sid:595067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartphone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartphone.com"; sid:595068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmiths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmiths.com"; sid:595069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnewnormal.com"; sid:595070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolucion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolucion.com"; sid:595071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-soluciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-soluciones.com"; sid:595072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolving.com"; sid:595073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstockpile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstockpile.com"; sid:595074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopped.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopped.com"; sid:595075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriesbyus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriesbyus.com"; sid:595076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriesus.com"; sid:595077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstracker.com"; sid:595078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrokes.com"; sid:595079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest2you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest2you.com"; sid:595080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestla.com"; sid:595081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestongsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestongsa.com"; sid:595082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtonsac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtonsac.com"; sid:595083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraceapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraceapp.com"; sid:595084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurl.com"; sid:595085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinator.com"; sid:595086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-valet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-valet.com"; sid:595087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvalets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvalets.com"; sid:595088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusvaccine.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusvaccine.ltd"; sid:595089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviusalizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviusalizer.com"; sid:595090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoc.com"; sid:595091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-warehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-warehouse.com"; sid:595092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatching.com"; sid:595093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatching.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatching.net"; sid:595094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhy.com"; sid:595095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhy.net"; sid:595096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinnersandlosers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinnersandlosers.com"; sid:595097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkinjuryattorney.com"; sid:595098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkinjuryattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkinjuryattorneys.com"; sid:595099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworksafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworksafety.com"; sid:595100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyoudidnt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyoudidnt.com"; sid:595101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzoico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzoico.com"; sid:595102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingcovidhoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingcovidhoes.com"; sid:595103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscoronavirustest.com"; sid:595104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscoronavirustesting.com"; sid:595105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscoronavirustests.com"; sid:595106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid-19test.com"; sid:595107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid19test.com"; sid:595108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid-19testing.com"; sid:595109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid19testing.com"; sid:595110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid-19tests.com"; sid:595111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid19tests.com"; sid:595112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cybercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cybercovid.com"; sid:595113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cybercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cybercovid.net"; sid:595114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19houston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19houston.com"; sid:595115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccion-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccion-covid.com"; sid:595116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectamoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectamoscoronavirus.com"; sid:595117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectar-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectar-covid.com"; sid:595118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectecovid19.com"; sid:595119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destinocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destinocovidfree.com"; sid:595120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticocovid.com"; sid:595121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidpros.com"; sid:595122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distanciascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distanciascovid.com"; sid:595123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedcovid19testing.com"; sid:595124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpx-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpx-covid-19.com"; sid:595125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpxcovid19.com"; sid:595126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringandaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringandaftercovid.com"; sid:595127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebolacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebolacorona.com"; sid:595128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edu-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edu-covid19.com"; sid:595129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-entertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-entertainment.com"; sid:595130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemictimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemictimes.com"; sid:595131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eracovid.com"; sid:595132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for establecimientolibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"establecimientolibredecovid19.com"; sid:595133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventspostcovid.com"; sid:595134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exploitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exploitcorona.com"; sid:595135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastmmjcardcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastmmjcardcorona.com"; sid:595136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid.today"; sid:595137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightpastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightpastcovid.com"; sid:595138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingthecovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingthecovidcure.com"; sid:595139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for find-your-corona-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"find-your-corona-equipment.com"; sid:595140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findyourcoronaequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findyourcoronaequipment.com"; sid:595141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for find-your-covid19-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"find-your-covid19-equipment.com"; sid:595142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findyourcovid19equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findyourcovid19equipment.com"; sid:595143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firsatsizlereozelsosyalkoronacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firsatsizlereozelsosyalkoronacovid19.com"; sid:595144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondosolidariocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondosolidariocovid19.com"; sid:595145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusmadrid.com"; sid:595146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusrestaurants.com"; sid:595147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirusspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirusspain.com"; sid:595148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidapartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidapartments.com"; sid:595149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidbarcelona.com"; sid:595150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidcity.com"; sid:595151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidhotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidhotels.com"; sid:595152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidmadrid.com"; sid:595153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidrestaurants.com"; sid:595154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidshops.com"; sid:595155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidspain.com"; sid:595156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuerteventuracovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuerteventuracovidfree.com"; sid:595157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycoronamemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycoronamemes.com"; sid:595158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamecovidrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamecovidrun.com"; sid:595159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gasoilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gasoilcorona.com"; sid:595160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gastrocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gastrocoronavirus.com"; sid:595161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geodesic-i-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geodesic-i-covid.com"; sid:595162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtruth.com"; sid:595163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovid19test.com"; sid:595164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovidtest.com"; sid:595165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getyourcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getyourcovidtest.com"; sid:595166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghdccovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghdccovidrelief.com"; sid:595167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gimnasiolibredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gimnasiolibredecoronavirus.com"; sid:595168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gimnasiolibredecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gimnasiolibredecovid19.com"; sid:595169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaday.com"; sid:595170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronalife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronalife.com"; sid:595171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidday.com"; sid:595172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalwarmingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalwarmingcorona.com"; sid:595173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for golazos-vs-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"golazos-vs-corona.com"; sid:595174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grancanariacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grancanariacovidfree.com"; sid:595175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for halte-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"halte-covid.com"; sid:595176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizercorona.com"; sid:595177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for happy-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"happy-epidemic.com"; sid:595178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herdimmunitytocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herdimmunitytocovid.com"; sid:595179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyinthetimeofcovid.com"; sid:595180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostalescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostalescovidfree.com"; sid:595181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronavirusfree.com"; sid:595182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcovidfreemadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcovidfreemadrid.com"; sid:595183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelsfreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelsfreecovid.com"; sid:595184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humanitycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humanitycorona.com"; sid:595185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicoronavirus.com"; sid:595186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicoronavirus.net"; sid:595187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicovid-19.com"; sid:595188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicovid19.com"; sid:595189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunicovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunicovid-19.net"; sid:595190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocoronavirus.com"; sid:595191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocoronavirus.net"; sid:595192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocovid-19.com"; sid:595193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocovid-19.net"; sid:595194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedacovid19test.com"; sid:595195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inepidemic.com"; sid:595196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infcovid.com"; sid:595197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovation4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovation4covid.com"; sid:595198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iradicatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iradicatecovid.com"; sid:595199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iradicatecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iradicatecovid.net"; sid:595200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscovidsafesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscovidsafesafe.com"; sid:595201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for islascanariascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"islascanariascovidfree.com"; sid:595202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscovid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscovid19travel.com"; sid:595203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jhucovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jhucovidtracker.com"; sid:595204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joincoronapd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joincoronapd.com"; sid:595205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joint4covidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joint4covidcure.com"; sid:595206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for julez-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"julez-corona.com"; sid:595207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawasakipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawasakipandemic.com"; sid:595208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lanzarotecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lanzarotecovidfree.com"; sid:595209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laspalmascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laspalmascovidfree.com"; sid:595210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libresdecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libresdecoronavirus.com"; sid:595211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libresdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libresdecovid19.com"; sid:595212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limitcovid19.com"; sid:595213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for londoncovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"londoncovidfree.com"; sid:595214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinapandemic.com"; sid:595215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvwa-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvwa-wuhan.com"; sid:595216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaproteccionescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaproteccionescoronavirus.com"; sid:595217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaseparacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaseparacioncoronavirus.com"; sid:595218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasprotectorascoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasprotectorascoronavirus.net"; sid:595219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manag3mentscovid19soluti0ns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manag3mentscovid19soluti0ns.com"; sid:595220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marscorona.com"; sid:595221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherepercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherepercovid19.com"; sid:595222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherinepercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherinepercovid19.com"; sid:595223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskingcovid.com"; sid:595224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maspalomascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maspalomascovidfree.com"; sid:595225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materialescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materialescovid19.com"; sid:595226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mbst-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mbst-corona.com"; sid:595227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mecovid.com"; sid:595228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediapandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediapandemics.com"; sid:595229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medsancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medsancovid.com"; sid:595230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for merscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"merscorona.com"; sid:595231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for metin2covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"metin2covid.net"; sid:595232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milancovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milancovidfree.com"; sid:595233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ml4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ml4covid.com"; sid:595234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multecovid.com"; sid:595235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicbeatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicbeatscorona.com"; sid:595236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycreativecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycreativecorona.com"; sid:595237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypersonalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypersonalpandemic.com"; sid:595238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negativecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negativecovid19.com"; sid:595239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettic-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettic-covid.com"; sid:595240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neutralizecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neutralizecovid.com"; sid:595241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newnormalpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newnormalpostcovid.com"; sid:595242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscovid19today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscovid19today.com"; sid:595243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsonecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsonecoronavirus.com"; sid:595244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcitybeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcitybeforecovid19.com"; sid:595245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidfree.com"; sid:595246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscovid-19heroesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscovid-19heroesfund.com"; sid:595247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicovidtine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicovidtine.com"; sid:595248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidusa.com"; sid:595249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noval-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noval-coronavirus.com"; sid:595250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nucorona.com"; sid:595251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycaftercovid19.com"; sid:595252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycbeforecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycbeforecovid19.com"; sid:595253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycduringcovid19.com"; sid:595254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidfree.com"; sid:595255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycpostcovid19.com"; sid:595256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycpostcovid.com"; sid:595257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycprecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycprecovid19.com"; sid:595258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for o3covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"o3covid.com"; sid:595259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oilgascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oilgascorona.com"; sid:595260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovidtesting.net"; sid:595261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercovidmasks.com"; sid:595262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orientacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orientacovid.com"; sid:595263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonecorona.com"; sid:595264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-coronavirus.biz"; sid:595265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-covid19.biz"; sid:595266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for palmacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"palmacovidfree.com"; sid:595267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic666.com"; sid:595268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalcoholic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalcoholic.com"; sid:595269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicart.net"; sid:595270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdreams.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdreams.world"; sid:595271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfather.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfather.com"; sid:595272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgym.com"; sid:595273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicma.com"; sid:595274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmama.com"; sid:595275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmen.com"; sid:595276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmother.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmother.com"; sid:595277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofear.com"; sid:595278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofears.com"; sid:595279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoffears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoffears.com"; sid:595280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicofvirusorpandemicoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicofvirusorpandemicoffear.com"; sid:595281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpa.com"; sid:595282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-pivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-pivot.com"; sid:595283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreboundpodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreboundpodcast.com"; sid:595284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-relief-art.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-relief-art.com"; sid:595285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefart.com"; sid:595286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-relief-art.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-relief-art.net"; sid:595287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefart.net"; sid:595288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-response-organisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-response-organisation.com"; sid:595289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseorganisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseorganisation.com"; sid:595290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-response-organisation.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-response-organisation.world"; sid:595291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponseorganisation.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponseorganisation.world"; sid:595292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsoffear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsoffear.com"; sid:595293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivorsguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivorsguide.com"; sid:595294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestingalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestingalliance.com"; sid:595295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestingalliance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestingalliance.net"; sid:595296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictravels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictravels.com"; sid:595297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscatfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscatfacemask.com"; sid:595298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwoman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwoman.com"; sid:595299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwomen.com"; sid:595300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panneau-information-entreprise-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panneau-information-entreprise-covid-19.com"; sid:595301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pariscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pariscovidfree.com"; sid:595302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmaceuticalscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmaceuticalscorona.com"; sid:595303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pilatespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pilatespandemic.com"; sid:595304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivotingduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivotingduringapandemic.com"; sid:595305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playitcovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playitcovid19safe.com"; sid:595306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playitcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playitcovidsafe.com"; sid:595307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooponcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooponcovid19.com"; sid:595308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona.party"; sid:595309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19festival.com"; sid:595310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-business.com"; sid:595311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfestival.com"; sid:595312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidstrategy.com"; sid:595313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovidpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovidpostcovid.com"; sid:595314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preparingtosurvivecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preparingtosurvivecovid-19.com"; sid:595315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidicoronavirus.com"; sid:595316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidclean.com"; sid:595317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidfaceshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidfaceshields.com"; sid:595318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidmasks.com"; sid:595319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidshields.com"; sid:595320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncontracoronavirus.com"; sid:595321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionmedicacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionmedicacovid.com"; sid:595322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protekcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protekcovid.com"; sid:595323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid.net"; sid:595324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psdcovid19tkd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psdcovid19tkd.com"; sid:595325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcorona.com"; sid:595326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtests.com"; sid:595327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reading-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reading-corona.com"; sid:595328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reading-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reading-corona.net"; sid:595329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidshields.com"; sid:595330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcoronacrimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcoronacrimes.com"; sid:595331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid19crimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid19crimes.com"; sid:595332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovidcrimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovidcrimes.com"; sid:595333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for returntoworkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"returntoworkcovid-19.com"; sid:595334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for returntoworkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"returntoworkcovid19.com"; sid:595335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsimultecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsimultecovid.com"; sid:595336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsisanzionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsisanzionicovid.com"; sid:595337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsomultacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsomultacovid.com"; sid:595338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsomultecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsomultecovid.com"; sid:595339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsosanzionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsosanzionecovid.com"; sid:595340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ricorsosanzionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ricorsosanzionicovid.com"; sid:595341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for romacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"romacovidfree.com"; sid:595342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rtwaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rtwaftercovid-19.com"; sid:595343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safepandemictravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safepandemictravel.com"; sid:595344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santillanacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santillanacovidfree.com"; sid:595345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanzionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanzionicovid.com"; sid:595346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scamcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scamcorona.com"; sid:595347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scamscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scamscorona.com"; sid:595348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scheiss-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scheiss-corona.com"; sid:595349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scheisscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scheisscorona.com"; sid:595350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcovidblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcovidblack.com"; sid:595351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securite-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securite-covid19.com"; sid:595352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segnaleticacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segnaleticacovid19.com"; sid:595353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidsupplies.com"; sid:595354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalementcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalementcovid19.com"; sid:595355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalement-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalement-covid.com"; sid:595356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signaletiquecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signaletiquecoronavirus.com"; sid:595357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signaletiquecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signaletiquecovid-19.com"; sid:595358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slcovid.com"; sid:595359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smokingandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smokingandcovid.com"; sid:595360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for somoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"somoscovidfree.com"; sid:595361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sorucevapcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sorucevapcorona.com"; sid:595362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-contrat-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-contrat-covid19.com"; sid:595363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19pro.com"; sid:595364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidpro.com"; sid:595365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for strikebackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"strikebackcovid19.com"; sid:595366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suddenlycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suddenlycovid-19.com"; sid:595367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for temporary-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"temporary-covid19.com"; sid:595368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenerifecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenerifecovidfree.com"; sid:595369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcoronavirus.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcoronavirus.cat"; sid:595370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidfree.com"; sid:595371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovids19.com"; sid:595372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcovidfree.com"; sid:595373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testmeforcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testmeforcovid19virus.com"; sid:595374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testviruscovid.com"; sid:595375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovidgardens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovidgardens.com"; sid:595376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacurtain.com"; sid:595377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronafighters.com"; sid:595378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19aftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19aftermath.com"; sid:595379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19closure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19closure.com"; sid:595380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19-conspiracy.com"; sid:595381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19gone.com"; sid:595382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19travel.com"; sid:595383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcleanse.com"; sid:595384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcollapse.com"; sid:595385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid.com"; sid:595386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcorner.com"; sid:595387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcupid.com"; sid:595388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcupid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcupid.net"; sid:595389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcurtain.com"; sid:595390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfighters.com"; sid:595391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid.net"; sid:595392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpro.com"; sid:595393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstopper.com"; sid:595394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tokyocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tokyocovidfree.com"; sid:595395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackmycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackmycovid19.com"; sid:595396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackmycovid.com"; sid:595397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tripcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tripcovid.com"; sid:595398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscovidwallmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscovidwallmemorial.com"; sid:595399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuempresacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuempresacovidfree.com"; sid:595400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twittercovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twittercovidhelp.com"; sid:595401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uk-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uk-covid19.com"; sid:595402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upcorona.com"; sid:595403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatecovid.com"; sid:595404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uracovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uracovidiot.com"; sid:595405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaviruslawyer.com"; sid:595406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usa-covid-19rapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usa-covid-19rapidtestkit.com"; sid:595407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidlawyer.com"; sid:595408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronacure.com"; sid:595409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid-19.net"; sid:595410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valenciacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valenciacovidfree.com"; sid:595411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valleynewslive-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valleynewslive-covid19.com"; sid:595412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vescovidisicilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vescovidisicilia.com"; sid:595413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viclankacovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viclankacovidaid.com"; sid:595414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victimes-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victimes-covid19.com"; sid:595415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for victorycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"victorycovid.com"; sid:595416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wealthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wealthcorona.com"; sid:595417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wealthycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wealthycorona.com"; sid:595418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-covid19.com"; sid:595419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wmh-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wmh-pandemic.com"; sid:595420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcompcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcompcovid19.com"; sid:595421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workcompcovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workcompcovidclaim.com"; sid:595422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid19pandemic.com"; sid:595423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbiaoshipai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbiaoshipai.com"; sid:595424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhaole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhaole.com"; sid:595425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruscatfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruscatfacemask.com"; sid:595426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--espaacovidfree-tnb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--espaacovidfree-tnb.net"; sid:595427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-corona-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-corona-business.com"; sid:595428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidshop.com"; sid:595429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcovid19.com"; sid:595430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20covid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20covid20.com"; sid:595431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 222killscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"222killscorona.com"; sid:595432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1coronamask.com"; sid:595433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a29covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a29covid.com"; sid:595434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronafood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronafood.com"; sid:595435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronanyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronanyc.com"; sid:595436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronany.com"; sid:595437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-coronas-choice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-coronas-choice.com"; sid:595438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftermarketcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftermarketcovid19.com"; sid:595439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthepandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthepandemic.info"; sid:595440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agevolazionicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agevolazionicovid.com"; sid:595441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a-great-coronarydisease.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a-great-coronarydisease.zone"; sid:595442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportpandemic.com"; sid:595443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anonymouscovid19surveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anonymouscovid19surveys.com"; sid:595444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidcoalition.com"; sid:595445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-epidemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-epidemicfund.com"; sid:595446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applications-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applications-coronavirus.com"; sid:595447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for appli-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"appli-coronavirus.com"; sid:595448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivonacionalcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivonacionalcovid.cat"; sid:595449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argcovid19.com"; sid:595450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argcovid.com"; sid:595451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arlingtoncoviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arlingtoncoviddiaries.com"; sid:595452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arpandemicpedagogy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arpandemicpedagogy.com"; sid:595453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidclean.com"; sid:595454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bandagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bandagainstcovid.com"; sid:595455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcelonacovidfree.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcelonacovidfree.cat"; sid:595456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bashthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bashthepandemic.com"; sid:595457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batoutofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batoutofwuhan.com"; sid:595458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbcovid.com"; sid:595459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdacovid.com"; sid:595460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronablues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronablues.com"; sid:595461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcorona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcorona.world"; sid:595462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bebecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bebecovid.com"; sid:595463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beblacoronata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beblacoronata.com"; sid:595464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidclear.com"; sid:595465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestpandemicbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestpandemicbusiness.com"; sid:595466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betteraftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betteraftercovid19.com"; sid:595467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bibleandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bibleandcovid.com"; sid:595468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcoincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcoincovid.com"; sid:595469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blog-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blog-corona.info"; sid:595470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathebettercovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathebettercovidmask.com"; sid:595471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for builtduringthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"builtduringthepandemic.com"; sid:595472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingrealestateincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingrealestateincovid19.com"; sid:595473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cache-bouche-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cache-bouche-covid.com"; sid:595474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerandcoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerandcoronablog.com"; sid:595475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancuncovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancuncovidfree.com"; sid:595476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caps4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caps4covid.com"; sid:595477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capsforcovid.com"; sid:595478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careaftercovid.com"; sid:595479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebratecovidvictory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebratecovidvictory.com"; sid:595480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cellexcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cellexcovid19test.com"; sid:595481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cellexcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cellexcovidtest.com"; sid:595482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chandigarhcoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chandigarhcoronatracker.com"; sid:595483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchofcovid19.com"; sid:595484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciudadcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciudadcovidfree.com"; sid:595485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claims4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claims4covid19.com"; sid:595486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classaction-china-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classaction-china-corona.com"; sid:595487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanawaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanawaycovid19.com"; sid:595488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanfromcovid.com"; sid:595489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorbycovid.com"; sid:595490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorcovid19.com"; sid:595491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comfortablecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comfortablecovidmasks.com"; sid:595492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communityandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communityandcovid19.com"; sid:595493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comoprevenirelocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comoprevenirelocoronavirus.com"; sid:595494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comopuedoprevenirelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comopuedoprevenirelcoronavirus.com"; sid:595495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constat-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constat-covid.com"; sid:595496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.club"; sid:595497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contracorona.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contracorona.group"; sid:595498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contributicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contributicovid.com"; sid:595499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contribution4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contribution4corona.com"; sid:595500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contributionforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contributionforcorona.com"; sid:595501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coping-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coping-covid.com"; sid:595502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19day.com"; sid:595503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19day.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19day.info"; sid:595504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-abgabe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-abgabe.com"; sid:595505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaabgabe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaabgabe.com"; sid:595506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advies.com"; sid:595507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-analyser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-analyser.com"; sid:595508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartgallery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartgallery.com"; sid:595509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachildwood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachildwood.com"; sid:595510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-classaction-china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-classaction-china.com"; sid:595511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-classaction.com"; sid:595512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensatie.com"; sid:595513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouplesxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouplesxxx.com"; sid:595514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid-19masks.com"; sid:595515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrsa.com"; sid:595516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-einzelhandel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-einzelhandel.com"; sid:595517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpact24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpact24.com"; sid:595518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-j-net.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-j-net.com"; sid:595519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak-9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak-9.com"; sid:595520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakasse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakasse.com"; sid:595521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeyreplacement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeyreplacement.com"; sid:595522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsmask.com"; sid:595523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskandshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskandshield.com"; sid:595524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-masken-deutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-masken-deutschland.com"; sid:595525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasken-werbeschutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasken-werbeschutzmasken.com"; sid:595526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasker.com"; sid:595527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-monster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-monster.com"; sid:595528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanocasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanocasa.com"; sid:595529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-notfonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-notfonds.com"; sid:595530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanotfonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanotfonds.com"; sid:595531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaobituary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaobituary.com"; sid:595532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonmyplate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonmyplate.com"; sid:595533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicbusinesstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicbusinesstestkit.com"; sid:595534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicdogfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicdogfacemask.com"; sid:595535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplumbingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplumbingservices.com"; sid:595536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelief20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelief20.com"; sid:595537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieflaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieflaw.com"; sid:595538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sammelklage-china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sammelklage-china.com"; sid:595539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasil.com"; sid:595540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasomes.com"; sid:595541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomsmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomsmaps.com"; sid:595542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmixtape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmixtape.com"; sid:595543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiles.com"; sid:595544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaversus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaversus.com"; sid:595545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavillechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavillechina.com"; sid:595546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19day.com"; sid:595547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19day.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19day.info"; sid:595548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19kits.com"; sid:595549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-all.com"; sid:595550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibodykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibodykits.com"; sid:595551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-boycotter-livelihood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-boycotter-livelihood.com"; sid:595552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesstestkit.com"; sid:595553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesstraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesstraining.com"; sid:595554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-classaction.com"; sid:595555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19info.com"; sid:595556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-credit-repair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-credit-repair.com"; sid:595557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure.business"; sid:595558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdetection.com"; sid:595559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogfacemask.com"; sid:595560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamotidine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamotidine.com"; sid:595561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfree.travel - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfree.travel"; sid:595562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushippa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushippa.com"; sid:595563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjection.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjection.guru"; sid:595564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjection.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjection.life"; sid:595565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurypros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurypros.com"; sid:595566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillersnyc.com"; sid:595567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-life.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-life.com"; sid:595568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusozono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusozono.com"; sid:595569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrisktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrisktest.com"; sid:595570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmallbusinessloanscheme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmallbusinessloanscheme.com"; sid:595571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support-service.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support-service.com"; sid:595572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-take-my-livelihood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-take-my-livelihood.com"; sid:595573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustt.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustt.info"; sid:595574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldtimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldtimeline.com"; sid:595575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusymptomchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusymptomchecker.com"; sid:595576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav-live.com"; sid:595577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawahnsinn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawahnsinn.com"; sid:595578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov-19pandemic.com"; sid:595579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covcovid.com"; sid:595580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coverforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coverforcovid.com"; sid:595581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coversforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coversforcovid.com"; sid:595582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2021nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2021nyc.com"; sid:595583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aidtracking.com"; sid:595584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestkits.com"; sid:595585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankers.com"; sid:595586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bescherming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bescherming.com"; sid:595587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bitcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bitcoin.com"; sid:595588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breathtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breathtest.com"; sid:595589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathtest.com"; sid:595590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19br.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19br.info"; sid:595591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bumpersticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bumpersticker.com"; sid:595592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bumperstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bumperstickers.com"; sid:595593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesstestkit.com"; sid:595594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesstestkit.com"; sid:595595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canvas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canvas.com"; sid:595596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservice.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservice.info"; sid:595597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covering.com"; sid:595598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coverings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coverings.com"; sid:595599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cowboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cowboy.com"; sid:595600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-day.com"; sid:595601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19derm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19derm.com"; sid:595602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19desinfeccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19desinfeccion.com"; sid:595603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-detection.com"; sid:595604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionequip.com"; sid:595605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionsupplies.com"; sid:595606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dogfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dogfacemask.com"; sid:595607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dogfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dogfacemask.com"; sid:595608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dolor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dolor.com"; sid:595609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19drone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19drone.com"; sid:595610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dronepatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dronepatrol.com"; sid:595611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19droneservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19droneservice.com"; sid:595612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19droneservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19droneservices.com"; sid:595613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dronesurveilance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dronesurveilance.com"; sid:595614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeehealthscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeehealthscreening.com"; sid:595615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.energy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.energy"; sid:595616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.engineering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.engineering"; sid:595617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.enterprises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.enterprises"; sid:595618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evil.com"; sid:595619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19famotidine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19famotidine.com"; sid:595620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19famotidine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19famotidine.com"; sid:595621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fashionfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fashionfacemasks.com"; sid:595622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financials.com"; sid:595623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19france.com"; sid:595624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fullform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fullform.com"; sid:595625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.gmbh"; sid:595626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gofund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gofund.com"; sid:595627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guardusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guardusa.com"; sid:595628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthandsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthandsafety.com"; sid:595629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-healthandsafetygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-healthandsafetygroup.com"; sid:595630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthandsafetygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthandsafetygroup.com"; sid:595631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heathandsafty-group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heathandsafty-group.com"; sid:595632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-help360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-help360.com"; sid:595633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hilfspaket.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hilfspaket.info"; sid:595634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hippa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hippa.com"; sid:595635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19income247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19income247.com"; sid:595636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19injurypros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19injurypros.com"; sid:595637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killerspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killerspray.com"; sid:595638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killspray.com"; sid:595639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manhattanproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manhattanproject.com"; sid:595640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mapa.com"; sid:595641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mapa.com"; sid:595642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingplatform.com"; sid:595643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19markt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19markt.com"; sid:595644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medispa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medispa.com"; sid:595645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19metric.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19metric.info"; sid:595646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mobilelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mobilelab.com"; sid:595647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-paris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-paris.com"; sid:595648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payment.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payment.info"; sid:595649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pivotfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pivotfund.com"; sid:595650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppedelivery.com"; sid:595651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppe.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppe.support"; sid:595652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesupport.com"; sid:595653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procectionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procectionmasks.com"; sid:595654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procedures.com"; sid:595655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projectnightingale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projectnightingale.com"; sid:595656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protected.com"; sid:595657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protectie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protectie.com"; sid:595658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectusa.com"; sid:595659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raleighcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raleighcleaning.com"; sid:595660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapid-testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapid-testkits.com"; sid:595661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkits.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkits.tips"; sid:595662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkits.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkits.tips"; sid:595663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reactions.com"; sid:595664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverysite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverysite.com"; sid:595665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reentryresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reentryresults.com"; sid:595666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reopenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reopenings.com"; sid:595667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchfoundation.com"; sid:595668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantcompliance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantcompliance.info"; sid:595669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailsignage.com"; sid:595670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-review.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-review.com"; sid:595671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19roadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19roadmap.com"; sid:595672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtkits.com"; sid:595673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.solutions"; sid:595674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysolutions.com"; sid:595675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safezone.com"; sid:595676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitising.com"; sid:595677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sms-bb-client.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sms-bb-client.com"; sid:595678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sms-bb-clt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sms-bb-clt.com"; sid:595679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sniffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sniffer.com"; sid:595680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-software.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-software.com"; sid:595681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19somes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19somes.com"; sid:595682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-sri-lanka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-sri-lanka.com"; sid:595683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surgicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surgicals.com"; sid:595684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sy.com"; sid:595685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-symptoms.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-symptoms.info"; sid:595686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-taisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-taisaku.com"; sid:595687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testet.com"; sid:595688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlasvegas.com"; sid:595689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-tracker.com"; sid:595690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.trading - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.trading"; sid:595691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trillions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trillions.com"; sid:595692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19turfspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19turfspray.com"; sid:595693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesignup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesignup.com"; sid:595694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinum.com"; sid:595695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-update.com"; sid:595696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19waiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19waiver.com"; sid:595697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19webcountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19webcountdown.com"; sid:595698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacesolutions.com"; sid:595699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workspace.com"; sid:595700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldinfo.com"; sid:595701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020journey.com"; sid:595702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020safe.com"; sid:595703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3x.com"; sid:595704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid555.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid555.com"; sid:595705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9000.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9000.world"; sid:595706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagecalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagecalculator.com"; sid:595707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamnation.com"; sid:595708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodykits.com"; sid:595709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingcenters.com"; sid:595710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingkit.com"; sid:595711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingkits.com"; sid:595712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidart-agora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidart-agora.com"; sid:595713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidask.com"; sid:595714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassess.com"; sid:595715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassociation.com"; sid:595716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatoz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatoz.info"; sid:595717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-au-vide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-au-vide.com"; sid:595718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-barcelos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-barcelos.com"; sid:595719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarcelos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarcelos.com"; sid:595720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbikeshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbikeshow.com"; sid:595721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiosensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiosensor.com"; sid:595722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblow.com"; sid:595723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooster.com"; sid:595724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbumpersticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbumpersticker.com"; sid:595725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbumperstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbumperstickers.com"; sid:595726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.pro"; sid:595727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcali.com"; sid:595728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanineusa.com"; sid:595729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarclean.com"; sid:595730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarefund.com"; sid:595731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasecount.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasecount.info"; sid:595732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildwood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildwood.com"; sid:595733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean321.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean321.com"; sid:595734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanspain.com"; sid:595735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearservices.com"; sid:595736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearteam.com"; sid:595737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommute.com"; sid:595738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfirmation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfirmation.com"; sid:595739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consciousbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consciousbusiness.com"; sid:595740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consciousbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consciousbusinesses.com"; sid:595741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsciousbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsciousbusinesses.com"; sid:595742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-conscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-conscious.com"; sid:595743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-conspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-conspiracy.com"; sid:595744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-constat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-constat.com"; sid:595745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultants.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultants.info"; sid:595746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.info"; sid:595747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolcrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolcrew.com"; sid:595748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorrespondence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorrespondence.com"; sid:595749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurse.com"; sid:595750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeep.com"; sid:595751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeep.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeep.info"; sid:595752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectpro.com"; sid:595753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisplaycase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisplaycase.com"; sid:595754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisplaycases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisplaycases.com"; sid:595755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisplay.com"; sid:595756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddomain.com"; sid:595757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-economics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-economics.com"; sid:595758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-economics.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-economics.info"; sid:595759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-endothelite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-endothelite.com"; sid:595760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetec.com"; sid:595761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidextstep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidextstep.com"; sid:595762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfabrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfabrics.com"; sid:595763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree19.travel - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree19.travel"; sid:595764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegreene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegreene.com"; sid:595765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemedellin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemedellin.com"; sid:595766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesardegna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesardegna.com"; sid:595767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetextiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetextiles.com"; sid:595768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendly.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendly.club"; sid:595769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-funds.com"; sid:595770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgarage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgarage.com"; sid:595771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgodo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgodo.com"; sid:595772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgovtloans.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgovtloans.info"; sid:595773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealight.com"; sid:595774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealth.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealth.chat"; sid:595775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhemp.com"; sid:595776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhobby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhobby.com"; sid:595777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecleaningequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecleaningequipment.com"; sid:595778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecleaningtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecleaningtools.com"; sid:595779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-i.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-i.com"; sid:595780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunized.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunized.com"; sid:595781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots2020.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots2020.world"; sid:595782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidityone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidityone.com"; sid:595783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidityplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidityplus.com"; sid:595784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobscorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobscorp.com"; sid:595785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9usa.com"; sid:595786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkey19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkey19.com"; sid:595787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidkits.com"; sid:595788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-killing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-killing.com"; sid:595789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilling.com"; sid:595790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkinder.com"; sid:595791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidklear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidklear.com"; sid:595792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabtestsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabtestsonline.com"; sid:595793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleaks.com"; sid:595794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliquor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliquor.com"; sid:595795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaid.com"; sid:595796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapa.com"; sid:595797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mask.express - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mask.express"; sid:595798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskwithfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskwithfilter.com"; sid:595799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatched.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatched.com"; sid:595800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-metrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-metrics.com"; sid:595801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmls.com"; sid:595802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmuseum.com"; sid:595803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnater.com"; sid:595804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnumberscalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnumberscalifornia.com"; sid:595805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnumberstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnumberstoday.com"; sid:595806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnumbersworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnumbersworldwide.com"; sid:595807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nyenzo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nyenzo.com"; sid:595808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoxi.com"; sid:595809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoxy.com"; sid:595810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpackaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpackaging.com"; sid:595811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpas.com"; sid:595812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpetshampoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpetshampoo.com"; sid:595813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpivotfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpivotfund.com"; sid:595814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectusa.com"; sid:595815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickclean.com"; sid:595816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebuildnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebuildnow.com"; sid:595817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefband.com"; sid:595818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreparation.com"; sid:595819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-reprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-reprise.com"; sid:595820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-research-papers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-research-papers.com"; sid:595821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretailsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretailsignage.com"; sid:595822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisktest.com"; sid:595823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroom.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroom.club"; sid:595824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroyalties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroyalties.com"; sid:595825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19-cdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19-cdc.com"; sid:595826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafely.com"; sid:595827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaviour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaviour.com"; sid:595828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreenprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreenprotection.com"; sid:595829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseating.com"; sid:595830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseq.com"; sid:595831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageforbusiness.com"; sid:595832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageideas.com"; sid:595833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageusa.com"; sid:595834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionindia.com"; sid:595835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsomes.com"; sid:595836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecial.com"; sid:595837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoreshillong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoreshillong.com"; sid:595838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsunrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsunrise.com"; sid:595839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsureapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsureapp.com"; sid:595840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivallongview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivallongview.com"; sid:595841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-swab-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-swab-research.com"; sid:595842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswan.com"; sid:595843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsx.com"; sid:595844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechs.com"; sid:595845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.clinic"; sid:595846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglv.com"; sid:595847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsocal.com"; sid:595848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmate.com"; sid:595849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-research.com"; sid:595850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestwilmington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestwilmington.com"; sid:595851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermalscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermalscan.com"; sid:595852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthon.com"; sid:595853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidth-today.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidth-today.com"; sid:595854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-toes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-toes.com"; sid:595855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransfer.com"; sid:595856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelpak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelpak.com"; sid:595857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviducate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviducate.com"; sid:595858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdatenepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdatenepal.com"; sid:595859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine19.com"; sid:595860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesignup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesignup.com"; sid:595861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinum.com"; sid:595862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19day.com"; sid:595863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19days.com"; sid:595864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19days.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19days.info"; sid:595865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviz.info"; sid:595866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweeddelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweeddelivery.com"; sid:595867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweedonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweedonline.com"; sid:595868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhitepaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhitepaper.com"; sid:595869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhitepaper.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhitepaper.info"; sid:595870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxfiles.com"; sid:595871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.foundation"; sid:595872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxppe.com"; sid:595873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxprotection.com"; sid:595874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxsafe.com"; sid:595875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxsafety.com"; sid:595876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covscovid.com"; sid:595877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cramercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cramercovid19.com"; sid:595878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedcovid.com"; sid:595879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curedcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curedcovid.info"; sid:595880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for d-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"d-covid-19.com"; sid:595881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalhelpduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalhelpduringcovid19.com"; sid:595882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistryaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistryaftercorona.com"; sid:595883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depistage-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depistage-covid.com"; sid:595884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecovid.com"; sid:595885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuescovid19.com"; sid:595886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetes-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetes-covid.com"; sid:595887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetesecovid19webinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetesecovid19webinar.com"; sid:595888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diecoronadie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diecoronadie.com"; sid:595889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcovid.com"; sid:595890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diseasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diseasecovid19.com"; sid:595891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doessunlightkillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doessunlightkillcovid19.com"; sid:595892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doindeedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doindeedacovid19test.com"; sid:595893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19.com"; sid:595894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dorsetcoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dorsetcoronacleaners.com"; sid:595895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatingoutaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatingoutaftercorona.com"; sid:595896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-corona-aidat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-corona-aidat.com"; sid:595897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-coronaaidat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-coronaaidat.com"; sid:595898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecran-protection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecran-protection-covid19.com"; sid:595899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for efectocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"efectocoronavirus.com"; sid:595900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectivecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectivecovidmasks.com"; sid:595901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercoviddata.com"; sid:595902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdeals.com"; sid:595903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eppcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eppcovid.com"; sid:595904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evaluarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evaluarcovid.com"; sid:595905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facetocovid.com"; sid:595906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for festivalautoralpandemico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"festivalautoralpandemico.com"; sid:595907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightbackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightbackcovid19.com"; sid:595908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcovidjustice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcovidjustice.com"; sid:595909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcleanfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcleanfromcovid.com"; sid:595910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19shots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19shots.com"; sid:595911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidgone.com"; sid:595912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getsafefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getsafefromcovid.com"; sid:595913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronafighters.com"; sid:595914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronagogame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronagogame.com"; sid:595915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godocovid.com"; sid:595916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groceriesduringcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groceriesduringcovid19.info"; sid:595917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guardiancoronacide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guardiancoronacide.com"; sid:595918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gusiagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gusiagainstcorona.com"; sid:595919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackcovid.team - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackcovid.team"; sid:595920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healightcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healightcovid19.com"; sid:595921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthpostcovid.com"; sid:595922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herosofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herosofcovid.com"; sid:595923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hicovid-19.com"; sid:595924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holybreathmantraforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holybreathmantraforcoronavirus.com"; sid:595925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homepandemicbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homepandemicbusiness.com"; sid:595926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtodateaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtodateaftercorona.com"; sid:595927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivethepandemic.com"; sid:595928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-covidpmmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-covidpmmt.com"; sid:595929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idnowcovid19.com"; sid:595930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilostsomeonetocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilostsomeonetocovid19.com"; sid:595931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactofcorona.com"; sid:595932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investigatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investigatingcovid.com"; sid:595933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iodineforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iodineforcovid.com"; sid:595934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iqicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iqicovid.com"; sid:595935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irs-covid19.com"; sid:595936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itestedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itestedcovidfree.com"; sid:595937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jocovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jocovideo.com"; sid:595938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justiciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justiciacovid.com"; sid:595939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsfightingcovid.com"; sid:595940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kilcovid.com"; sid:595941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycorona.com"; sid:595942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laaftercorona.com"; sid:595943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidsitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidsitters.com"; sid:595944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latiendacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latiendacovid.com"; sid:595945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for learnfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"learnfromcovid19.com"; sid:595946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leaseplan-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leaseplan-covid19.com"; sid:595947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leovcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leovcovid.com"; sid:595948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leovscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leovscovid.com"; sid:595949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leycovid19.com"; sid:595950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovids.com"; sid:595951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredelcoronavirus.com"; sid:595952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid-19.info"; sid:595953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaidcovid19.com"; sid:595954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveaidcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveaidcovid19.info"; sid:595955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love4covid19needs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love4covid19needs.com"; sid:595956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lualaba-infocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lualaba-infocovid19.com"; sid:595957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeamericacoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeamericacoronafree.com"; sid:595958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makewuhanpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makewuhanpay.com"; sid:595959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-anticovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-anticovid-19.com"; sid:595960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-anticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-anticovid19.com"; sid:595961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-anticovid.com"; sid:595962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mampara-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mampara-covid19.com"; sid:595963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascontracovid.com"; sid:595964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasparacovid.com"; sid:595965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarascovid-19.com"; sid:595966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascorona.info"; sid:595967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covid-bg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covid-bg.com"; sid:595968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covidbg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covidbg.com"; sid:595969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-pro-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-pro-covid19.com"; sid:595970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-protection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-protection-covid.com"; sid:595971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materialcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materialcovid19.com"; sid:595972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materiel-protection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materiel-protection-covid.com"; sid:595973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid19.net"; sid:595974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menacorona.com"; sid:595975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for merrimaccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"merrimaccovid19.com"; sid:595976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meteocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meteocovid.com"; sid:595977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexcovid.com"; sid:595978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mh13covidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mh13covidtracker.com"; sid:595979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronatests.com"; sid:595980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19lab.com"; sid:595981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcoronaviruslaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcoronaviruslaw.com"; sid:595982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcovidlaw.com"; sid:595983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-coronavirus-story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-coronavirus-story.com"; sid:595984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidsupplies.com"; sid:595985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nailseacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nailseacovid-19.com"; sid:595986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19relief.com"; sid:595987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19relieffund.com"; sid:595988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronarelief.com"; sid:595989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextcovid.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextcovid.gmbh"; sid:595990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for niaidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"niaidcovid-19.com"; sid:595991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusfamotidine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusfamotidine.com"; sid:595992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirussafetykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirussafetykits.com"; sid:595993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycaftercorona.com"; sid:595994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycfoodaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycfoodaftercorona.com"; sid:595995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid.com"; sid:595996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcovidsigns.com"; sid:595997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinepandemicbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinepandemicbusiness.com"; sid:595998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onthecoronafrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onthecoronafrontline.com"; sid:595999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onthecovid19frontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onthecovid19frontline.com"; sid:596000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onthecovidfrontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onthecovidfrontline.com"; sid:596001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osteoporosisandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osteoporosisandcovid.com"; sid:596002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbros.com"; sid:596003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfashionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfashionmasks.com"; sid:596004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfriend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfriend.com"; sid:596005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgraphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgraphics.com"; sid:596006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguards.com"; sid:596007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclawfirms.com"; sid:596008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmade.com"; sid:596009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmate.com"; sid:596010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpastime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpastime.com"; sid:596011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaintiffs.com"; sid:596012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpr.com"; sid:596013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpricingmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpricingmodel.com"; sid:596014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofjobs.com"; sid:596015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofonlineincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofonlineincome.com"; sid:596016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrecords.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrecords.net"; sid:596017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspirit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspirit.com"; sid:596018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspirit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspirit.net"; sid:596019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictheaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictheaters.com"; sid:596020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictops.com"; sid:596021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwines.com"; sid:596022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcovid.com"; sid:596023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcovid.net"; sid:596024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for physiciancovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"physiciancovid19survey.com"; sid:596025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronabody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronabody.com"; sid:596026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronafears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronafears.com"; sid:596027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaliving.com"; sid:596028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronaposts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronaposts.com"; sid:596029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronastrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronastrategy.com"; sid:596030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidbranding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidbranding.com"; sid:596031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidguide.com"; sid:596032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covidworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covidworkplace.com"; sid:596033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiccx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiccx.com"; sid:596034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicevents.com"; sid:596035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemictheatre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemictheatre.com"; sid:596036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for povcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"povcovid.com"; sid:596037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for povscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"povscovid.com"; sid:596038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for powerovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"powerovercovid.com"; sid:596039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnancycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnancycovid.com"; sid:596040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepandemic.info"; sid:596041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepandemic.net"; sid:596042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciondecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciondecovid.com"; sid:596043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciondecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciondecovid.net"; sid:596044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princetoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princetoncovid19.com"; sid:596045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productsforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productsforpandemic.com"; sid:596046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncorona.com"; sid:596047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionescoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionescoronavirus.net"; sid:596048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionparacoronavirus.com"; sid:596049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protected-by-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protected-by-covid-19.com"; sid:596050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protected-by-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protected-by-covid19.com"; sid:596051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectedbycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectedbycovid-19.com"; sid:596052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protected-by-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protected-by-covid.com"; sid:596053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectedbycovid.com"; sid:596054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ptsdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ptsdcovid.com"; sid:596055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publicovid.com"; sid:596056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publicovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publicovid.net"; sid:596057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for r8covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"r8covid.com"; sid:596058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestkitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestkitforcovid19.com"; sid:596059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rcfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rcfcovid19.com"; sid:596060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ready4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ready4covid.com"; sid:596061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidsupplies.com"; sid:596062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remove-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remove-corona.com"; sid:596063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rephrasingcovid.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rephrasingcovid.digital"; sid:596064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reprise-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reprise-covid.com"; sid:596065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rifacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rifacovid19.com"; sid:596066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for riocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"riocovidfree.com"; sid:596067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roadtowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roadtowuhan.com"; sid:596068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rollup-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rollup-covid.com"; sid:596069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sardiniacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sardiniacovidfree.com"; sid:596070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scientiststostopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scientiststostopcovid19.com"; sid:596071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguridadcovid19peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguridadcovid19peru.com"; sid:596072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguroscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguroscovid19.com"; sid:596073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingrealestateincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingrealestateincovid19.com"; sid:596074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shamecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shamecorona.com"; sid:596075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shamingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shamingcorona.com"; sid:596076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shots4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shots4covid.com"; sid:596077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sigapcovid19-rengasdengklok.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sigapcovid19-rengasdengklok.info"; sid:596078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sigmacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sigmacorona.com"; sid:596079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sigmacoronamedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sigmacoronamedical.com"; sid:596080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signsforcovid.com"; sid:596081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smitecovid.com"; sid:596082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snatchgamecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snatchgamecovid19.com"; sid:596083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovid.info"; sid:596084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soluzionianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soluzionianticovid.com"; sid:596085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spielerfrau-lady-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spielerfrau-lady-corona.club"; sid:596086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona222.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona222.com"; sid:596087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.center"; sid:596088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19shop.com"; sid:596089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.foundation - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.foundation"; sid:596090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.fund"; sid:596091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for storiedicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"storiedicovid.com"; sid:596092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studentencoronahilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studentencoronahilfe.com"; sid:596093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sundaydinnerscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sundaydinnerscorona.com"; sid:596094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takenbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takenbycovid.com"; sid:596095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for talkcovidhuh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"talkcovidhuh.com"; sid:596096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tasacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tasacovid.com"; sid:596097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teamupagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teamupagainstcorona.com"; sid:596098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid19.cat"; sid:596099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidadomiciliosevilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidadomiciliosevilla.com"; sid:596100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkits4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkits4coronavirus.com"; sid:596101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testkits4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testkits4covid.com"; sid:596102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-pcr-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-pcr-coronavirus.com"; sid:596103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-pcr-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-pcr-covid19.com"; sid:596104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-pcr-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-pcr-covid.com"; sid:596105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-serologique-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-serologique-coronavirus.com"; sid:596106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-serologique-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-serologique-covid19.com"; sid:596107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-serologique-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-serologique-covid.com"; sid:596108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronacrisisisover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronacrisisisover.com"; sid:596109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusfiles.com"; sid:596110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19busters.com"; sid:596111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19manifesto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19manifesto.com"; sid:596112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19police.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19police.com"; sid:596113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19pros.com"; sid:596114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19solutions.com"; sid:596115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchart.com"; sid:596116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfirewall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfirewall.com"; sid:596117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-covid.info"; sid:596118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecraicepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecraicepidemic.com"; sid:596119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-pandemic-journal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-pandemic-journal.com"; sid:596120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostpandemicsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostpandemicsolution.com"; sid:596121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoparacovid19.com"; sid:596122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totalcoronavirusclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totalcoronavirusclean.com"; sid:596123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tougherthancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tougherthancovid19.com"; sid:596124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tougherthancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tougherthancovid.com"; sid:596125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovidcases.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovidcases.fyi"; sid:596126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracking-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracking-covid.com"; sid:596127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronaguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronaguard.com"; sid:596128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidproducts.com"; sid:596129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidresponse.com"; sid:596130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidstats.com"; sid:596131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidsupply.com"; sid:596132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtrace.com"; sid:596133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvacovid.com"; sid:596134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvacovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvacovidcure.com"; sid:596135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacancesportugalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacancesportugalcovid.com"; sid:596136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacci-nocovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacci-nocovid19.club"; sid:596137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccino-covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccino-covid19.club"; sid:596138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid-19.club"; sid:596139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovidtesting.com"; sid:596140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunacontraelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunacontraelcovid19.com"; sid:596141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vencemosalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vencemosalcovid.com"; sid:596142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventatestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventatestcoronavirus.com"; sid:596143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventatestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventatestcovid19.com"; sid:596144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vfxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vfxcovid.com"; sid:596145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for videoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"videoscovid.com"; sid:596146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visitpanamacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visitpanamacoronado.com"; sid:596147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivir-en-tiempos-de-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivir-en-tiempos-de-covid.com"; sid:596148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for walgreenscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"walgreenscoronavirus.com"; sid:596149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wavecovid19.com"; sid:596150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for web-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"web-covid.com"; sid:596151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weplayitcovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weplayitcovid19safe.com"; sid:596152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weplayitcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weplayitcovidsafe.com"; sid:596153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wewillsurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wewillsurvivethecoronavirus.com"; sid:596154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for womenandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"womenandcovid19.com"; sid:596155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wtfcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wtfcovid.com"; sid:596156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanheibao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanheibao.com"; sid:596157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhaninvaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhaninvaders.com"; sid:596158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhannc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhannc.com"; sid:596159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshoeshine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshoeshine.com"; sid:596160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansujiao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansujiao.com"; sid:596161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzuokang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzuokang.com"; sid:596162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--memorialvctimascovid19-5bc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--memorialvctimascovid19-5bc.com"; sid:596163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessaftercorona.com"; sid:596164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19lawyer.com"; sid:596165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidmedicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidmedicalsupplies.com"; sid:596166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidsupplies.com"; sid:596167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourfutureaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourfutureaftercorona.com"; sid:596168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidkit.com"; sid:596169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 417covidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"417covidhelp.com"; sid:596170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 417covidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"417covidrelief.com"; sid:596171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcoronavirusfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcoronavirusfacts.com"; sid:596172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcovid-19facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcovid-19facts.com"; sid:596173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affichage-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affichage-covid19.com"; sid:596174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahappypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahappypandemic.com"; sid:596175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allxcovid.com"; sid:596176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-kongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-kongress.com"; sid:596177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-messe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-messe.com"; sid:596178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaschermbalie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaschermbalie.com"; sid:596179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronascherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronascherm.com"; sid:596180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaschermhoreca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaschermhoreca.com"; sid:596181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaschermkantoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaschermkantoor.com"; sid:596182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaschermreceptie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaschermreceptie.com"; sid:596183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaschermrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaschermrestaurant.com"; sid:596184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19-scherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19-scherm.com"; sid:596185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidhotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidhotel.com"; sid:596186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidplus.com"; sid:596187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidprotection.com"; sid:596188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidshops.com"; sid:596189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivirus-for-coronavirus-free-download.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivirus-for-coronavirus-free-download.com"; sid:596190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a-prime-coronarydisease.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a-prime-coronarydisease.fyi"; sid:596191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivocovid19.com"; sid:596192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivocovid.com"; sid:596193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivofotocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivofotocovid.com"; sid:596194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archivonacionalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archivonacionalcovid.com"; sid:596195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a-snag-coronarydisease.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a-snag-coronarydisease.fyi"; sid:596196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurcovid19.com"; sid:596197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidantibodytest.com"; sid:596198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidtesting.com"; sid:596199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocovidrecovery.com"; sid:596200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocatcovid19.com"; sid:596201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocatcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocatcovid19.net"; sid:596202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocats-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocats-covid19.com"; sid:596203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for balearcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"balearcovidfree.com"; sid:596204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bashthepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bashthepandemic.net"; sid:596205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for basmicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"basmicovid.com"; sid:596206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beacoronasmartbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beacoronasmartbusiness.com"; sid:596207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronasmartbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronasmartbusiness.com"; sid:596208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioseguridadcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioseguridadcovid-19.com"; sid:596209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidsurvey.com"; sid:596210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidsurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidsurvey.net"; sid:596211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bleachcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bleachcoronaviruscure.com"; sid:596212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockcovidkit.com"; sid:596213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bthcovid19.com"; sid:596214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronamaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronamaskonline.com"; sid:596215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyyourcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyyourcoronamask.com"; sid:596216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camaracovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camaracovid.net"; sid:596217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerinthetimeofcorona.com"; sid:596218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascontracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascontracorona.com"; sid:596219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartoonsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartoonsagainstcorona.com"; sid:596220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catcoronavirus.com"; sid:596221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cazacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cazacovid.com"; sid:596222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chapmancovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chapmancovidrefund.com"; sid:596223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidlab.com"; sid:596224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidlabs.com"; sid:596225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidlabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidlabtest.com"; sid:596226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidlabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidlabtesting.com"; sid:596227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidlabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidlabtests.com"; sid:596228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidtest.com"; sid:596229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidtesting.com"; sid:596230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidtestresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidtestresult.com"; sid:596231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidtestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidtestresults.com"; sid:596232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcovidtests.com"; sid:596233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovidmask.com"; sid:596234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cinescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cinescovid.com"; sid:596235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citapreviacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citapreviacovid.com"; sid:596236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickforcovid.com"; sid:596237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closingthecovidgap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closingthecovidgap.com"; sid:596238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidplan.com"; sid:596239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidrefund.com"; sid:596240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidupdates.com"; sid:596241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid-19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid-19virus.com"; sid:596242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19virus.com"; sid:596243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidclean.com"; sid:596244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comcovid19.com"; sid:596245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovidaccesos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovidaccesos.com"; sid:596246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19day.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19day.net"; sid:596247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-age.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-age.com"; sid:596248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandvirus.com"; sid:596249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartmuseum.com"; sid:596250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabescherming.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabescherming.net"; sid:596251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeschermingscherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeschermingscherm.com"; sid:596252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabetrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabetrug.com"; sid:596253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningnj.com"; sid:596254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanroom.com"; sid:596255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclearsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclearsolutions.com"; sid:596256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-clip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-clip.com"; sid:596257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoco.com"; sid:596258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoder.com"; sid:596259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtrelief.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtrelief.info"; sid:596260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebtrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebtrelief.net"; sid:596261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesignmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesignmitigation.com"; sid:596262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeuda.com"; sid:596263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadirect.vlaanderen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadirect.vlaanderen"; sid:596264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-display.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-display.com"; sid:596265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-don.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-don.com"; sid:596266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoniakitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoniakitchen.com"; sid:596267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaengine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaengine.com"; sid:596268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaersatz.schule - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaersatz.schule"; sid:596269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-essential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-essential.com"; sid:596270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagamez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagamez.com"; sid:596271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaberleri.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaberleri.net"; sid:596272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-herbals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-herbals.com"; sid:596273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbals.com"; sid:596274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainformationonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainformationonline.com"; sid:596275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaingaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaingaftercorona.com"; sid:596276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaingdopocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaingdopocorona.com"; sid:596277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaingpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaingpostcorona.com"; sid:596278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajokin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajokin.com"; sid:596279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajokin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajokin.net"; sid:596280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajusticect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajusticect.com"; sid:596281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronak-9.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronak-9.net"; sid:596282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakey.net"; sid:596283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakits1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakits1.com"; sid:596284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krisenhilfe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krisenhilfe.net"; sid:596285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloco.com"; sid:596286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-marathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-marathon.com"; sid:596287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatje.com"; sid:596288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameubel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameubel.com"; sid:596289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mona.com"; sid:596290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.museum - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.museum"; sid:596291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronani-makenai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronani-makenai.com"; sid:596292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanoah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanoah.com"; sid:596293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaomc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaomc.com"; sid:596294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapens.com"; sid:596295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rea.com"; sid:596296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecht.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecht.net"; sid:596297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaryarteries.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaryarteries.net"; sid:596298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaryartery.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaryartery.net"; sid:596299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-self-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-self-quarantine.com"; sid:596300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashopnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashopnow.com"; sid:596301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop.today"; sid:596302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolutionscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolutionscleaning.com"; sid:596303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastationery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastationery.com"; sid:596304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-staysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-staysafe.com"; sid:596305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoreonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoreonline.com"; sid:596306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplyteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplyteam.com"; sid:596307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswear.com"; sid:596308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymtoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymtoms.net"; sid:596309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatafel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatafel.com"; sid:596310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatargettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatargettest.com"; sid:596311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tent.com"; sid:596312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-urlaub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-urlaub.com"; sid:596313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinefree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinefree.com"; sid:596314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavar.com"; sid:596315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaveiligoprestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaveiligoprestaurant.com"; sid:596316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavine.com"; sid:596317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19day.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19day.biz"; sid:596318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19day.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19day.net"; sid:596319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2021.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2021.nyc"; sid:596320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafterefforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafterefforts.com"; sid:596321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermath.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermath.info"; sid:596322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaftermath.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaftermath.life"; sid:596323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarexam.com"; sid:596324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeauty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeauty.com"; sid:596325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-chronicles.com"; sid:596326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounseling.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounseling.info"; sid:596327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscursos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscursos.com"; sid:596328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-deathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-deathtoll.com"; sid:596329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdecember19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdecember19.com"; sid:596330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdude.com"; sid:596331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilylawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilylawyer.com"; sid:596332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilys.com"; sid:596333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeandbusinessprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeandbusinessprotection.com"; sid:596334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunity.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunity.info"; sid:596335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillingcan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillingcan.com"; sid:596336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslidigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslidigation.com"; sid:596337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-maroc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-maroc.info"; sid:596338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksshop.com"; sid:596339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonitor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonitor.net"; sid:596340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-museum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-museum.com"; sid:596341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsforblackfolks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsforblackfolks.com"; sid:596342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspepcid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspepcid.com"; sid:596343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionprayer.com"; sid:596344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-screens.com"; sid:596345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionscreens.com"; sid:596346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-services.com"; sid:596347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-systems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-systems.com"; sid:596348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionsystems.com"; sid:596349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protective-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protective-screens.com"; sid:596350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectivescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectivescreens.com"; sid:596351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protective-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protective-services.com"; sid:596352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectiveservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectiveservices.com"; sid:596353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrescue.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrescue.info"; sid:596354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-signaletique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-signaletique.com"; sid:596355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuperbugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuperbugs.com"; sid:596356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportgroup.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportgroup.info"; sid:596357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestservices.com"; sid:596358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveliceland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveliceland.com"; sid:596359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusultravioletlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusultravioletlight.com"; sid:596360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvclight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvclight.com"; sid:596361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinecenters.com"; sid:596362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinesites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinesites.com"; sid:596363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvivid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvivid.net"; sid:596364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisiere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisiere.com"; sid:596365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriorsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriorsonline.com"; sid:596366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawillneverconquer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawillneverconquer.com"; sid:596367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayasam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayasam.com"; sid:596368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid191and2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid191and2.com"; sid:596369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19afterefforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19afterefforts.com"; sid:596370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afterefforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afterefforts.com"; sid:596371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aftermath.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aftermath.info"; sid:596372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alliancezw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alliancezw.com"; sid:596373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestkits.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestkits.info"; sid:596374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestkits.net"; sid:596375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bangla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bangla.com"; sid:596376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barexam.com"; sid:596377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-belarus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-belarus.com"; sid:596378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtesting.com"; sid:596379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19camara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19camara.com"; sid:596380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canine.net"; sid:596381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningco.com"; sid:596382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19color.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19color.com"; sid:596383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-community.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-community.com"; sid:596384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contained.com"; sid:596385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corona.info"; sid:596386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19courses.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19courses.world"; sid:596387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deathtoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deathtoll.com"; sid:596388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrelief.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrelief.info"; sid:596389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defeater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defeater.com"; sid:596390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-deneg.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-deneg.net"; sid:596391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designmitigation.com"; sid:596392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19destroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19destroyer.com"; sid:596393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectantinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectantinstitute.com"; sid:596394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectantinstitute.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectantinstitute.info"; sid:596395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfect.net"; sid:596396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.engineering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.engineering"; sid:596397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faruvclight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faruvclight.com"; sid:596398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fines.com"; sid:596399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forgetting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forgetting.com"; sid:596400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fumigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fumigator.com"; sid:596401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fumigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fumigators.com"; sid:596402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalpandemicsongs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalpandemicsongs.com"; sid:596403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globinfo.com"; sid:596404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.gmbh"; sid:596405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grief.com"; sid:596406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halal.com"; sid:596407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handle.com"; sid:596408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthchats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthchats.com"; sid:596409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpfrombisw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpfrombisw.com"; sid:596410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalcare.com"; sid:596411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iggrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iggrapidtesting.com"; sid:596412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19igmiggrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19igmiggrapidtest.com"; sid:596413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igmiggrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igmiggrapidtest.com"; sid:596414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igmiggrapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igmiggrapidtestkit.com"; sid:596415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igmiggrapidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igmiggrapidtest.net"; sid:596416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igmrapidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igmrapidtestkits.com"; sid:596417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspectionservices.com"; sid:596418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspectionservicesnorthwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspectionservicesnorthwest.com"; sid:596419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-istikar-iade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-istikar-iade.com"; sid:596420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19keychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19keychain.com"; sid:596421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lidigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lidigation.com"; sid:596422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lidigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lidigation.com"; sid:596423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liesexposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liesexposed.com"; sid:596424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lostjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lostjobs.com"; sid:596425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19manager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19manager.com"; sid:596426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingconsulting.com"; sid:596427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingplatform.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingplatform.info"; sid:596428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19marketingplatform.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19marketingplatform.net"; sid:596429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigation.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigation.pro"; sid:596430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19modi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19modi.com"; sid:596431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsnetwork.com"; sid:596432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19opx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19opx.com"; sid:596433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pepcid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pepcid.com"; sid:596434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19permit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19permit.com"; sid:596435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pmmodi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pmmodi.com"; sid:596436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19point.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19point.info"; sid:596437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppedeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppedeliveries.com"; sid:596438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prayerline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prayerline.com"; sid:596439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionmasks.net"; sid:596440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionsupplies.com"; sid:596441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protection.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protection.world"; sid:596442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection.world"; sid:596443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proteinportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proteinportal.com"; sid:596444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raleigh.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raleigh.net"; sid:596445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkit.biz"; sid:596446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkit.net"; sid:596447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkits.biz"; sid:596448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkits.biz"; sid:596449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkits.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkits.info"; sid:596450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestkits.net"; sid:596451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefsupplies.com"; sid:596452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescue.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescue.info"; sid:596453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.restaurant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.restaurant"; sid:596454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-review.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-review.net"; sid:596455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19riskmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19riskmanagement.com"; sid:596456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeworkers.com"; sid:596457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safezone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safezone.net"; sid:596458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitzers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitzers.com"; sid:596459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19secure.com"; sid:596460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-stats.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-stats.net"; sid:596461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stemfair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stemfair.com"; sid:596462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sucksass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sucksass.com"; sid:596463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superbio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superbio.com"; sid:596464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superbugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superbugs.com"; sid:596465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suplly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suplly.com"; sid:596466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surfacetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surfacetesting.com"; sid:596467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surg.com"; sid:596468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19terminated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19terminated.com"; sid:596469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tookmyincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tookmyincome.com"; sid:596470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-transportation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-transportation.com"; sid:596471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tshirt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tshirt.net"; sid:596472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ultravioletlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ultravioletlight.com"; sid:596473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uniform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uniform.com"; sid:596474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvclight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvclight.com"; sid:596475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19videosurveillancecamera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19videosurveillancecamera.com"; sid:596476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus-disease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus-disease.com"; sid:596477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscompensationattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscompensationattorneys.com"; sid:596478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wristlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wristlet.com"; sid:596479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1and2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1and2.com"; sid:596480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019antibody.com"; sid:596481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019antibody.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019antibody.net"; sid:596482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20watch.com"; sid:596483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid303.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid303.com"; sid:596484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9000.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9000.com"; sid:596485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaid.info"; sid:596486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibody-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibody-diagnostics.com"; sid:596487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodydiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodydiagnostics.com"; sid:596488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-antibody-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-antibody-testing.com"; sid:596489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartmuseo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartmuseo.com"; sid:596490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailout.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailout.info"; sid:596491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeholder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeholder.com"; sid:596492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooze.com"; sid:596493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbride.com"; sid:596494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-busters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-busters.net"; sid:596495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcam19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcam19.com"; sid:596496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcamara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcamara.com"; sid:596497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanineusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanineusa.net"; sid:596498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarechats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarechats.com"; sid:596499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarpetcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarpetcleaner.com"; sid:596500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarpetcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarpetcleaners.com"; sid:596501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchart.net"; sid:596502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chats.com"; sid:596503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chip.com"; sid:596504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimattorney.com"; sid:596505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersandmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersandmore.com"; sid:596506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersoc.com"; sid:596507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersorangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersorangecounty.com"; sid:596508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnj.com"; sid:596509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningny.com"; sid:596510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsystems.com"; sid:596511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearcleaning.com"; sid:596512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearservices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearservices.net"; sid:596513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicalupload.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicalupload.net"; sid:596514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoat.com"; sid:596515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktailhappyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktailhappyhour.com"; sid:596516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrol.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrol.biz"; sid:596517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-corona-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-corona-protect.com"; sid:596518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coronaprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coronaprotect.com"; sid:596519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatetesting.com"; sid:596520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeadnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeadnow.com"; sid:596521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeep.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeep.biz"; sid:596522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeep.net"; sid:596523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dezinfekce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dezinfekce.com"; sid:596524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrivethrutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrivethrutest.com"; sid:596525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveuptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveuptest.com"; sid:596526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecure.com"; sid:596527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideliminators.com"; sid:596528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployerimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployerimpact.com"; sid:596529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidengine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidengine.com"; sid:596530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidensure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidensure.com"; sid:596531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo.nyc"; sid:596532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-epi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-epi.com"; sid:596533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestates.com"; sid:596534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfair.com"; sid:596535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fast-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fast-test.com"; sid:596536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-flex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-flex.com"; sid:596537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflex.com"; sid:596538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfotos.com"; sid:596539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecheckin.com"; sid:596540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-hotelcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-hotelcertification.com"; sid:596541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeibiza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeibiza.com"; sid:596542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.madrid"; sid:596543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemap.com"; sid:596544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemaps.com"; sid:596545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemexico.com"; sid:596546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeparty.com"; sid:596547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepass.com"; sid:596548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeqr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeqr.com"; sid:596549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesardinia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesardinia.com"; sid:596550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeturismo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeturismo.com"; sid:596551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunds.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunds.net"; sid:596552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenetest.com"; sid:596553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreedy.com"; sid:596554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthchats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthchats.com"; sid:596555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.biz"; sid:596556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-herbals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-herbals.com"; sid:596557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherbals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherbals.com"; sid:596558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-herbals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-herbals.net"; sid:596559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherbals.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherbals.net"; sid:596560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometesting.net"; sid:596561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhotelsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhotelsupplies.com"; sid:596562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididcard.com"; sid:596563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancegroup.com"; sid:596564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobscorp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobscorp.info"; sid:596565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobscorp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobscorp.net"; sid:596566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk-9.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk-9.net"; sid:596567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidk9usa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidk9usa.net"; sid:596568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkill.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkill.net"; sid:596569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitlife.com"; sid:596570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkl.com"; sid:596571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kleen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kleen.com"; sid:596572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw4u.com"; sid:596573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw4you.com"; sid:596574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawforyou.com"; sid:596575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogo.com"; sid:596576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingrecovery.com"; sid:596577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasc.com"; sid:596578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskpros.com"; sid:596579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskspro.com"; sid:596580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalsupplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalsupplies.biz"; sid:596581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicares.com"; sid:596582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialfund.com"; sid:596583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorial.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorial.info"; sid:596584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilescreens.com"; sid:596585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletesting.net"; sid:596586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilityrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilityrace.com"; sid:596587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovement.com"; sid:596588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovements.com"; sid:596589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsworldwide.com"; sid:596590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteensolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteensolution.com"; sid:596591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteensolution.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteensolution.net"; sid:596592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobserver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobserver.com"; sid:596593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocare.com"; sid:596594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidometer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidometer.net"; sid:596595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoxide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoxide.com"; sid:596596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartitions.com"; sid:596597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartitionscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartitionscreens.com"; sid:596598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatients1and2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatients1and2.com"; sid:596599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpermitting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpermitting.com"; sid:596600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplace.com"; sid:596601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesource.com"; sid:596602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesourcing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesourcing.com"; sid:596603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prc.com"; sid:596604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepnow.com"; sid:596605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protech.com"; sid:596606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionshields.com"; sid:596607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidptsd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidptsd.net"; sid:596608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadycollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadycollege.com"; sid:596609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadycolleges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadycolleges.com"; sid:596610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyschool.com"; sid:596611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyschools.com"; sid:596612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverymarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverymarketing.com"; sid:596613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryresource.com"; sid:596614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryresources.com"; sid:596615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembrance.com"; sid:596616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembrance.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembrance.info"; sid:596617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrulesandrestrictionscompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrulesandrestrictionscompliant.com"; sid:596618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecare.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecare.biz"; sid:596619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-protection.com"; sid:596620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeworkers.com"; sid:596621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safezone.com"; sid:596622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseattle.com"; sid:596623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-signaletique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-signaletique.com"; sid:596624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smart.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smart.solutions"; sid:596625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnaija.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnaija.com"; sid:596626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.biz"; sid:596627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsome.com"; sid:596628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspaces.com"; sid:596629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurfacetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurfacetesting.com"; sid:596630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswept.com"; sid:596631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterminated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterminated.com"; sid:596632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingathome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingathome.net"; sid:596633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingatwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingatwork.net"; sid:596634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsandiego.com"; sid:596635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthat.com"; sid:596636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoesnyc.com"; sid:596637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoopen.com"; sid:596638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrainingmoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrainingmoh.com"; sid:596639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsupplies.com"; sid:596640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrump.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrump.net"; sid:596641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinjury.com"; sid:596642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccineshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccineshot.com"; sid:596643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictims2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictims2020.com"; sid:596644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictims.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictims.info"; sid:596645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19days.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19days.biz"; sid:596646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus19days.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus19days.net"; sid:596647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvmessage19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvmessage19.com"; sid:596648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vr.com"; sid:596649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalks.com"; sid:596650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcoronarun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcoronarun.com"; sid:596651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cultureaftercovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cultureaftercovid.info"; sid:596652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingmedicinesforcorona.fail - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingmedicinesforcorona.fail"; sid:596653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customerexperiencecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customerexperiencecovid.com"; sid:596654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cx-covid19-checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cx-covid19-checklist.com"; sid:596655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for da-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"da-covid-19.com"; sid:596656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desescaladacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desescaladacovid19.com"; sid:596657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designcoronascherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designcoronascherm.com"; sid:596658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecovid.net"; sid:596659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destinoscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destinoscovidfree.com"; sid:596660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dev-rca-coronaapp-fd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dev-rca-coronaapp-fd.net"; sid:596661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagcorona.com"; sid:596662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diag-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diag-covid19.com"; sid:596663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagcovid19.com"; sid:596664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diag-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diag-covid.com"; sid:596665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagcovid.com"; sid:596666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticcorona.com"; sid:596667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticcovid.com"; sid:596668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecovid.com"; sid:596669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositividiprotezionecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositividiprotezionecovid19.com"; sid:596670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divisorimobilicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divisorimobilicovid.com"; sid:596671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dodcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dodcovid19.info"; sid:596672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eattobeatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eattobeatcovid19.com"; sid:596673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-devletcoronaaidat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-devletcoronaaidat.com"; sid:596674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eivissacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eivissacovidfree.com"; sid:596675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elementosproteccioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elementosproteccioncovid-19.com"; sid:596676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenza-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenza-covid.com"; sid:596677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovidcheck.com"; sid:596678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercoviddata.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercoviddata.net"; sid:596679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovidmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovidmonitor.com"; sid:596680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovidsurveillance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovidsurveillance.com"; sid:596681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresascoronavirus.com"; sid:596682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eppcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eppcovid-19.com"; sid:596683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eppcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eppcovid-19.net"; sid:596684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovidsupplies.com"; sid:596685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask-covid.com"; sid:596686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallimentidaacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallimentidaacovid.com"; sid:596687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famigliacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famigliacovid.com"; sid:596688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastestcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastestcovidtesting.com"; sid:596689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastestcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastestcovidtests.com"; sid:596690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid-19.info"; sid:596691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid19.info"; sid:596692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid-19.net"; sid:596693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid19.net"; sid:596694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcoronavirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcoronavirushometestkit.com"; sid:596695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcoronavirustestkit.com"; sid:596696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid-19antibioticshometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid-19antibioticshometestkit.com"; sid:596697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid19antibioticshometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid19antibioticshometestkit.com"; sid:596698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid-19antibioticstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid-19antibioticstestkit.com"; sid:596699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid19antibioticstestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid19antibioticstestkit.com"; sid:596700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid-19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid-19hometestkit.com"; sid:596701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid-19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid-19testkit.com"; sid:596702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid-19virustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid-19virustestkit.com"; sid:596703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedcovid19virustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedcovid19virustestkit.com"; sid:596704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedwuhanvirushometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedwuhanvirushometestkit.com"; sid:596705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedwuhanvirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedwuhanvirustestkit.com"; sid:596706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for festivalcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"festivalcovidfree.com"; sid:596707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiestacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiestacovidfree.com"; sid:596708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoviddharwad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoviddharwad.com"; sid:596709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingpandemickoreanstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingpandemickoreanstyle.com"; sid:596710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fondoaudiovisualcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fondoaudiovisualcovid19.com"; sid:596711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formenteracovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formenteracovidfree.com"; sid:596712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fotocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fotocovid19.com"; sid:596713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fotocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fotocovid.com"; sid:596714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidflag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidflag.com"; sid:596715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fromcovidtoopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fromcovidtoopen.com"; sid:596716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid-19.info"; sid:596717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.info"; sid:596718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fukuokacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fukuokacovid.info"; sid:596719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavaccines.com"; sid:596720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19essential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19essential.com"; sid:596721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getthecoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getthecoronavaccine.com"; sid:596722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for givecovidback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"givecovidback.com"; sid:596723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusadvocacyresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusadvocacyresource.com"; sid:596724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19advocacyresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19advocacyresource.com"; sid:596725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19advocacyresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19advocacyresource.com"; sid:596726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19resource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19resource.com"; sid:596727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovidcouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovidcouncil.com"; sid:596728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for good-corona-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"good-corona-news.com"; sid:596729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatcovidrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatcovidrecession.com"; sid:596730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greedcovid.com"; sid:596731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greedycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greedycovid.com"; sid:596732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guardcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guardcorona.com"; sid:596733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guardcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guardcovid.com"; sid:596734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harrods-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harrods-covid.com"; sid:596735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthsystempandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthsystempandemicrecovery.com"; sid:596736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hireaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hireaftercovid.com"; sid:596737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hirepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hirepostcovid.com"; sid:596738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horecacoronascherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horecacoronascherm.com"; sid:596739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horsecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horsecoronavirus.com"; sid:596740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelescovid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelescovid-free.com"; sid:596741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelsfreecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelsfreecovid19.com"; sid:596742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icelandtravelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icelandtravelcoronavirus.com"; sid:596743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocovid19.com"; sid:596744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacoronaupdates.com"; sid:596745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcovidrelief.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcovidrelief.biz"; sid:596746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infosaludcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infosaludcovid19.com"; sid:596747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidresult.com"; sid:596748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidresults.com"; sid:596749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for investigatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"investigatecovid.com"; sid:596750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inwuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inwuhan.net"; sid:596751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jbcovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jbcovid19ppe.com"; sid:596752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsaftercovid.com"; sid:596753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingcovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingcovideo.com"; sid:596754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kittencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kittencoronavirus.com"; sid:596755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kreweofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kreweofcovid.com"; sid:596756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycorona.net"; sid:596757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lafamigliacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lafamigliacovid.com"; sid:596758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latiendacontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latiendacontraelcovid.com"; sid:596759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonsfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonsfromcovid.com"; sid:596760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiezascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiezascovid.com"; sid:596761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for literatureinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"literatureinthetimeofcovid.com"; sid:596762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirus.info"; sid:596763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19stats.com"; sid:596764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidtest.com"; sid:596765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidtesting.com"; sid:596766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidtests.com"; sid:596767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loja-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loja-covid.com"; sid:596768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mallcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mallcovid19.com"; sid:596769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasanticontagiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasanticontagiocovid.com"; sid:596770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparas-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparas-anticovid.com"; sid:596771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovidfree.com"; sid:596772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasparacovid.com"; sid:596773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covid.net"; sid:596774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanti-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanti-coronavirus.com"; sid:596775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticoronaviruspascher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticoronaviruspascher.com"; sid:596776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanti-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanti-covid19.com"; sid:596777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticovid-19.com"; sid:596778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueanticovid19pascher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueanticovid19pascher.com"; sid:596779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecovid-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecovid-france.com"; sid:596780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquescovid-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquescovid-france.com"; sid:596781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-stop-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-stop-covid.com"; sid:596782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicicovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicicovid19response.com"; sid:596783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for menucovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"menucovidfree.com"; sid:596784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocovidfree.com"; sid:596785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicovscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicovscovid.com"; sid:596786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mieuxvivrelecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mieuxvivrelecovid.com"; sid:596787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricovidhelp.com"; sid:596788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mistercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mistercovid19.com"; sid:596789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19testinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19testinglab.com"; sid:596790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocovidhelp.com"; sid:596791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacovidvaccine.com"; sid:596792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyaftercoronabook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyaftercoronabook.com"; sid:596793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneyaftercorona.com"; sid:596794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidlabresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidlabresult.com"; sid:596795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidlabresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidlabresults.com"; sid:596796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidlabtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidlabtest.com"; sid:596797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidlabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidlabtesting.com"; sid:596798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidlabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidlabtests.com"; sid:596799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidresult.com"; sid:596800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidresults.com"; sid:596801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidtest.com"; sid:596802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidtesting.com"; sid:596803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidtestresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidtestresult.com"; sid:596804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidtestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidtestresults.com"; sid:596805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mostaccuratecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mostaccuratecovidtests.com"; sid:596806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcovidsv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcovidsv.com"; sid:596807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrnacoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrnacoronavaccine.com"; sid:596808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrnacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrnacoronavirus.com"; sid:596809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrnacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrnacoronavirusvaccine.com"; sid:596810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrnacovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrnacovid19vaccine.com"; sid:596811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrnacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrnacovidvaccine.com"; sid:596812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavideo.com"; sid:596813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19sellerplan.com"; sid:596814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidkey.com"; sid:596815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicpivot.com"; sid:596816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mystopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mystopcovid19.com"; sid:596817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nailsaloncoronavirusconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nailsaloncoronavirusconsulting.com"; sid:596818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19day.com"; sid:596819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19test.com"; sid:596820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidcouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidcouncil.com"; sid:596821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newlifeaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newlifeaftercovid19.com"; sid:596822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronalisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronalisa.com"; sid:596823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovidtest.com"; sid:596824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencovidscreen.com"; sid:596825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovidsupplies.com"; sid:596826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxfordcoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxfordcoronachronicles.com"; sid:596827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessconsulting.com"; sid:596828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplanning.com"; sid:596829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessstrategy.com"; sid:596830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinesstransformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinesstransformation.com"; sid:596831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchaser.com"; sid:596832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchasers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchasers.com"; sid:596833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccouncil.com"; sid:596834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccounseling.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccounseling.info"; sid:596835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemployerimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemployerimpact.com"; sid:596836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-movie.com"; sid:596837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmusthaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmusthaves.com"; sid:596838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-network.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-network.com"; sid:596839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpaymentrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpaymentrelief.com"; sid:596840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefmasks.com"; sid:596841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefservices.com"; sid:596842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrelieftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrelieftests.com"; sid:596843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrestructuring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrestructuring.com"; sid:596844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicskinlotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicskinlotions.com"; sid:596845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspeak.com"; sid:596846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthroatspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthroatspray.com"; sid:596847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictransformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictransformation.com"; sid:596848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracovid19.com"; sid:596849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paretimobilicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paretimobilicovid.com"; sid:596850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paretiprotezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paretiprotezionecovid.com"; sid:596851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passportcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passportcovid.info"; sid:596852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perrycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perrycovidtracker.com"; sid:596853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for photocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"photocovid19.com"; sid:596854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for photocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"photocovid.com"; sid:596855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pos-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pos-covid.com"; sid:596856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalondon.com"; sid:596857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19law.com"; sid:596858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidla.com"; sid:596859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidmd.com"; sid:596860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.house - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.house"; sid:596861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemictravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemictravel.com"; sid:596862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-pandemic.net"; sid:596863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidenttrumpscoronavirusguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidenttrumpscoronavirusguidelines.com"; sid:596864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for presidenttrumpscoronavirusguidelinesforamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"presidenttrumpscoronavirusguidelinesforamerica.com"; sid:596865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prosperacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prosperacovid.com"; sid:596866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseoutcovid.com"; sid:596867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puppycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puppycoronavirus.com"; sid:596868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qrcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qrcovidfree.com"; sid:596869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questcovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questcovidantibodytest.com"; sid:596870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtesting.net"; sid:596871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcoronatestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcoronatestkits.com"; sid:596872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realtorcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realtorcovidsupplies.com"; sid:596873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircorona.com"; sid:596874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restartaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restartaftercovid.com"; sid:596875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantesincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantesincovid.com"; sid:596876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantessincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantessincoronavirus.com"; sid:596877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for returncovid19money.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"returncovid19money.com"; sid:596878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for returncovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"returncovidmoney.com"; sid:596879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saludmentalpostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saludmentalpostcovid19.com"; sid:596880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schermicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schermicovid19.com"; sid:596881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sciencetheshitoutofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sciencetheshitoutofcovid.com"; sid:596882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scotia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scotia-covid19.com"; sid:596883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcovid.com"; sid:596884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secondarycostsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secondarycostsofcovid.com"; sid:596885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segnaletica-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segnaletica-covid19.com"; sid:596886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segnaletica-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segnaletica-covid.com"; sid:596887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for segnaleticacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"segnaleticacovid.com"; sid:596888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorsofcovid19.com"; sid:596889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecoronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecoronachronicles.com"; sid:596890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sharecoronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sharecoronastory.com"; sid:596891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sheerpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sheerpandemic.com"; sid:596892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidsupply.com"; sid:596893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbusinessepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbusinessepidemic.com"; sid:596894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcovidcleaning.com"; sid:596895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solapurcoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solapurcoronatracker.com"; sid:596896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucionescovidpanama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucionescovidpanama.com"; sid:596897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soluzioni-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soluzioni-covid.com"; sid:596898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for songs4thecovid19globalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"songs4thecovid19globalpandemic.com"; sid:596899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for songs4thecovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"songs4thecovid19pandemic.com"; sid:596900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for songsforthecovid19globalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"songsforthecovid19globalpandemic.com"; sid:596901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soyoscarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soyoscarcorona.com"; sid:596902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spasaloncoronavirusconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spasaloncoronavirusconsulting.com"; sid:596903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stanfordcovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stanfordcovidrefund.com"; sid:596904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona.vlaanderen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona.vlaanderen"; sid:596905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronaco.com"; sid:596906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teatroscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teatroscovid.com"; sid:596907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid19now.com"; sid:596908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testedcovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testedcovid19safe.com"; sid:596909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testy-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testy-covid.info"; sid:596910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadivorce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadivorce.com"; sid:596911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruswall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruswall.com"; sid:596912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidartmuseum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidartmuseum.com"; sid:596913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcarekit.com"; sid:596914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshieldppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshieldppe.com"; sid:596915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecraicepidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecraicepidemic.net"; sid:596916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehappywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehappywuhan.com"; sid:596917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for themaskagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"themaskagainstcovid.com"; sid:596918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpublisher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpublisher.com"; sid:596919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tonmasquecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tonmasquecovid.com"; sid:596920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tourismandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tourismandcovid-19.com"; sid:596921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracingcovid.net"; sid:596922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for travelandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"travelandcovid-19.com"; sid:596923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turismoanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turismoanticoronavirus.com"; sid:596924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uccovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uccovidrefund.com"; sid:596925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for umanomedicalvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"umanomedicalvscovid.com"; sid:596926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for umanovscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"umanovscovid.com"; sid:596927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for united4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"united4corona.com"; sid:596928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgence-protection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgence-protection-covid.com"; sid:596929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicresponse.com"; sid:596930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usccovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usccovidrefund.com"; sid:596931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidata.com"; sid:596932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidcouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidcouncil.com"; sid:596933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoviddata.com"; sid:596934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usecovidsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usecovidsense.com"; sid:596935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronaprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronaprotect.com"; sid:596936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccovidcine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccovidcine.com"; sid:596937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vakcovidzine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vakcovidzine.com"; sid:596938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visiere-protection-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visiere-protection-covid-19.com"; sid:596939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visiereprotectioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visiereprotectioncovid19.com"; sid:596940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivachekcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivachekcovid-19.com"; sid:596941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivachekcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivachekcovid19.com"; sid:596942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivacovid-19.com"; sid:596943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivacovid19.com"; sid:596944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivacovid19test.com"; sid:596945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivadiagcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivadiagcovid-19.com"; sid:596946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivadiagcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivadiagcovid19test.com"; sid:596947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for welcometowuhanland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"welcometowuhanland.com"; sid:596948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsnextcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsnextcovid.com"; sid:596949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wholesalecovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wholesalecovidsupplies.com"; sid:596950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workandlifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workandlifeaftercovid.com"; sid:596951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaphoto.com"; sid:596952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronaupdate.com"; sid:596953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidphoto.com"; sid:596954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldsincecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldsincecovid-19.com"; sid:596955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanguiguanjia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanguiguanjia.com"; sid:596956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjuewei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjuewei.com"; sid:596957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanland.com"; sid:596958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmajiang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmajiang.com"; sid:596959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanoriental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanoriental.com"; sid:596960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshoufa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshoufa.com"; sid:596961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusafterefforts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusafterefforts.com"; sid:596962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwilly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwilly.com"; sid:596963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wyattcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wyattcoronavirusnews.com"; sid:596964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--archivocovidespaa-uxb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--archivocovidespaa-uxb.com"; sid:596965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronahjlpen-ncb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronahjlpen-ncb.com"; sid:596966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidsker-02a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidsker-02a.com"; sid:596967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessaftercorona.net"; sid:596968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourfutureaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourfutureaftercorona.net"; sid:596969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourmoneyaftercoronabook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourmoneyaftercoronabook.com"; sid:596970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourmoneyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourmoneyaftercorona.com"; sid:596971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovid.com"; sid:596972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovidcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovidcr.com"; sid:596973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1v1covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1v1covid.com"; sid:596974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 23409trescoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"23409trescoronas.com"; sid:596975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2craa-covidrelief.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2craa-covidrelief.info"; sid:596976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360covidclean.com"; sid:596977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 365covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"365covidclean.com"; sid:596978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99coronas.com"; sid:596979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidgamenight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidgamenight.com"; sid:596980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actioncovid.com"; sid:596981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona-world-vision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona-world-vision.com"; sid:596982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anewcoronavirusbusinessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anewcoronavirusbusinessinsurance.com"; sid:596983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronabox.com"; sid:596984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaprojects.com"; sid:596985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.life"; sid:596986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidcoalition.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidcoalition.net"; sid:596987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidprojects.com"; sid:596988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsolution.com"; sid:596989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid.net"; sid:596990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artsagainstcovid.com"; sid:596991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aturacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aturacovid.com"; sid:596992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusinsurance.com"; sid:596993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bordersinmotion-coronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bordersinmotion-coronablog.com"; sid:596994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brl-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brl-covid19.com"; sid:596995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for broadwayaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"broadwayaftercovid19.com"; sid:596996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bxbizcovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bxbizcovidresources.com"; sid:596997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascoronavirus.com"; sid:596998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cazacoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cazacoronas.com"; sid:596999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centercorona.com"; sid:597000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidcleaner.com"; sid:597001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classicalmusicaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classicalmusicaftercovid19.com"; sid:597002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicovid.com"; sid:597003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubmedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubmedcovid.com"; sid:597004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubpandemic19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubpandemic19.com"; sid:597005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrariacoronaciodespines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrariacoronaciodespines.com"; sid:597006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlaccesocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlaccesocovid.com"; sid:597007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlpuertacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlpuertacovid.com"; sid:597008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscorona.com"; sid:597009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cases.com"; sid:597010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-acties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-acties.com"; sid:597011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartist.gallery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartist.gallery"; sid:597012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster.info"; sid:597013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleankey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleankey.com"; sid:597014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombinat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombinat.com"; sid:597015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrimebusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrimebusters.com"; sid:597016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrown-management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrown-management.com"; sid:597017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-debriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-debriefing.com"; sid:597018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiary2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiary2020.com"; sid:597019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadorealestateagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadorealestateagents.com"; sid:597020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafabrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafabrics.com"; sid:597021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafauci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafauci.com"; sid:597022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflair.com"; sid:597023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafloor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafloor.com"; sid:597024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fuckyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fuckyourself.com"; sid:597025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealers.com"; sid:597026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahunger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahunger.com"; sid:597027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakingtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakingtrump.com"; sid:597028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitsforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitsforyou.com"; sid:597029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-knaak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-knaak.com"; sid:597030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleff.com"; sid:597031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronam2.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronam2.net"; sid:597032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-massnahmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-massnahmen.com"; sid:597033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorialwalk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorialwalk.com"; sid:597034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanatural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanatural.com"; sid:597035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanemesis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanemesis.com"; sid:597036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanormal.com"; sid:597037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphase.com"; sid:597038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofrestaurant.com"; sid:597039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofworkplace.com"; sid:597040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protocol.com"; sid:597041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresorts.com"; sid:597042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresourceusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresourceusa.com"; sid:597043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarousai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarousai.com"; sid:597044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafevacationrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafevacationrentals.com"; sid:597045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schermen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schermen.com"; sid:597046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservicesfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservicesfl.com"; sid:597047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservicesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservicesusa.com"; sid:597048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop.center"; sid:597049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassmart.com"; sid:597050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopshop.com"; sid:597051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplyandservicesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplyandservicesusa.com"; sid:597052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurfacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurfacetest.com"; sid:597053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatak.com"; sid:597054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathaler.com"; sid:597055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatip.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatip.info"; sid:597056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccine.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccine.life"; sid:597057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-valuation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-valuation.com"; sid:597058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidany.com"; sid:597059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris-coivd-19measeaea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris-coivd-19measeaea.com"; sid:597060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusan.com"; sid:597061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusayudalegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusayudalegal.com"; sid:597062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarexam.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarexam.info"; sid:597063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbikemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbikemasks.com"; sid:597064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessadvisorsandconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessadvisorsandconsultants.com"; sid:597065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanines.com"; sid:597066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruscare.com"; sid:597067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscathometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscathometestkit.com"; sid:597068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscattestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscattestkit.com"; sid:597069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanness.com"; sid:597070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure2021.com"; sid:597071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscure2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscure2022.com"; sid:597072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenselawyers.com"; sid:597073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoghometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoghometestkit.com"; sid:597074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogtestkit.com"; sid:597075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdude.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdude.net"; sid:597076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-exterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-exterminator.com"; sid:597077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelmet.com"; sid:597078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushistory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushistory.net"; sid:597079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushood.com"; sid:597080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousingassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousingassistance.com"; sid:597081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinspectors.com"; sid:597082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurance.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurance.agency"; sid:597083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurancebrokers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurancebrokers.com"; sid:597084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks19.com"; sid:597085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturals.com"; sid:597086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nemesis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nemesis.com"; sid:597087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnemesis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnemesis.com"; sid:597088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnowfox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnowfox.com"; sid:597089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicinsurance.com"; sid:597090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicvaccine.com"; sid:597091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofiteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofiteers.com"; sid:597092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreconditioning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreconditioning.com"; sid:597093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchdatacenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchdatacenter.com"; sid:597094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshop.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshop.cat"; sid:597095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminated.com"; sid:597096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestmanager.com"; sid:597097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentremdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentremdesivir.com"; sid:597098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswins.com"; sid:597099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawholesalesupplyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawholesalesupplyusa.com"; sid:597100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corsicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corsicovid19.com"; sid:597101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984watch.com"; sid:597102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accountonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accountonline.com"; sid:597103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airtravel.com"; sid:597104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alliancezw.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alliancezw.net"; sid:597105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19azclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19azclassaction.com"; sid:597106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barexam.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barexam.info"; sid:597107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-blogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-blogs.com"; sid:597108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bolivia.com"; sid:597109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-business-insurance-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-business-insurance-lawsuits.com"; sid:597110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bycountrycomparison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bycountrycomparison.com"; sid:597111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19callcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19callcenter.com"; sid:597112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19capsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19capsule.com"; sid:597113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cattestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cattestkit.com"; sid:597114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cattestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cattestkit.com"; sid:597115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaned.com"; sid:597116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19connections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19connections.com"; sid:597117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracer.com"; sid:597118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracers.com"; sid:597119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruskillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruskillers.com"; sid:597120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19couples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19couples.com"; sid:597121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crimebusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crimebusters.com"; sid:597122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisissupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisissupport.com"; sid:597123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cures.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cures.mobi"; sid:597124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19date.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19date.com"; sid:597125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dispensary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dispensary.com"; sid:597126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doghometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doghometestkit.com"; sid:597127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doghometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doghometestkit.com"; sid:597128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dogtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dogtestkit.com"; sid:597129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dogtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dogtestkit.com"; sid:597130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19driveuptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19driveuptest.com"; sid:597131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eire.com"; sid:597132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentassistance.com"; sid:597133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exploiters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exploiters.com"; sid:597134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exterminator.com"; sid:597135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forensics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forensics.com"; sid:597136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-guide.com"; sid:597137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hawaiicleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hawaiicleaners.com"; sid:597138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19headquarters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19headquarters.com"; sid:597139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthstores.com"; sid:597140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helmets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helmets.com"; sid:597141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help4perthamboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help4perthamboy.com"; sid:597142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help.world"; sid:597143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesolutions.com"; sid:597144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoods.com"; sid:597145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalitytraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalitytraining.com"; sid:597146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunity.net"; sid:597147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunitytaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunitytaskforce.com"; sid:597148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-index.com"; sid:597149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-index.com"; sid:597150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inspectors.com"; sid:597151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspectors.com"; sid:597152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kuathletics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kuathletics.com"; sid:597153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19laois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19laois.com"; sid:597154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livenow.com"; sid:597155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksworldwide.com"; sid:597156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19match.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19match.com"; sid:597157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memotree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memotree.com"; sid:597158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-milano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-milano.com"; sid:597159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigation.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigation.life"; sid:597160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mxinfo.com"; sid:597161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oddity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oddity.com"; sid:597162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oxygenhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oxygenhood.com"; sid:597163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicmasks.com"; sid:597164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemicmemorial.com"; sid:597165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19permit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19permit.info"; sid:597166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plexiglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plexiglass.com"; sid:597167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plexiglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plexiglass.com"; sid:597168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeuk.com"; sid:597169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectme.com"; sid:597170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-r.com"; sid:597171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realtimetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realtimetracker.com"; sid:597172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reconditioning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reconditioning.com"; sid:597173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reponsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reponsegroup.com"; sid:597174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researchuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researchuk.com"; sid:597175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responcegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responcegroup.com"; sid:597176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roatanvillages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roatanvillages.com"; sid:597177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.academy"; sid:597178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.center"; sid:597179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyglass.com"; sid:597180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyglass.com"; sid:597181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.institute - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.institute"; sid:597182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolsupport.com"; sid:597183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scouting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scouting.net"; sid:597184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-selbsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-selbsttest.com"; sid:597185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shopnl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shopnl.com"; sid:597186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-signaletiques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-signaletiques.com"; sid:597187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19silverlinings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19silverlinings.com"; sid:597188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19silverlinings.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19silverlinings.guru"; sid:597189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-smart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-smart.com"; sid:597190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19studentdeliveryaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19studentdeliveryaid.com"; sid:597191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syringe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syringe.com"; sid:597192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcentres.com"; sid:597193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.club"; sid:597194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testy.com"; sid:597195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tobeachbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tobeachbody.com"; sid:597196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-topol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-topol.com"; sid:597197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracerjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracerjobs.com"; sid:597198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-training.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-training.info"; sid:597199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trapcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trapcity.com"; sid:597200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tza.com"; sid:597201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tz.com"; sid:597202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usadecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usadecontamination.com"; sid:597203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usadecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usadecontamination.com"; sid:597204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zaragoza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zaragoza.com"; sid:597205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zinc.com"; sid:597206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019antibody.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019antibody.info"; sid:597207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20strong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20strong.com"; sid:597208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2beachbod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2beachbod.com"; sid:597209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2beachbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2beachbody.com"; sid:597210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenppe.com"; sid:597211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvocacyexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvocacyexchange.com"; sid:597212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairtravel.com"; sid:597213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-allein-zuhaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-allein-zuhaus.com"; sid:597214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanitbodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanitbodytest.com"; sid:597215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantitest.com"; sid:597216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.care"; sid:597217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassay.com"; sid:597218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassholeparent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassholeparent.com"; sid:597219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbadfaithlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbadfaithlawyer.com"; sid:597220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiotest.com"; sid:597221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbirthday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbirthday.com"; sid:597222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblues.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblues.care"; sid:597223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuilders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuilders.com"; sid:597224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscheck.com"; sid:597225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersllp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersllp.com"; sid:597226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersnj.com"; sid:597227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbutopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbutopen.com"; sid:597228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbye.com"; sid:597229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareadvocates.com"; sid:597230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareinfo.com"; sid:597231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcargobooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcargobooking.com"; sid:597232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaselaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaselaw.com"; sid:597233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcastofcharacters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcastofcharacters.com"; sid:597234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedcompany.com"; sid:597235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchaplain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchaplain.com"; sid:597236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckclear.com"; sid:597237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanbaja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanbaja.com"; sid:597238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanbusinessbureau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanbusinessbureau.com"; sid:597239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanscotland.com"; sid:597240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompendium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompendium.com"; sid:597241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceadvocates.com"; sid:597242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantbusiness.com"; sid:597243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcorp.com"; sid:597244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcorporation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcorporation.com"; sid:597245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnecters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnecters.com"; sid:597246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consent.com"; sid:597247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconspiracymovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconspiracymovie.com"; sid:597248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracker.com"; sid:597249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontroldoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontroldoor.com"; sid:597250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatetesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatetesting.net"; sid:597251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-couille.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-couille.com"; sid:597252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-couilles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-couilles.com"; sid:597253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimebusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimebusters.com"; sid:597254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisissupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisissupport.com"; sid:597255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiselines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiselines.com"; sid:597256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushersusa.com"; sid:597257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-d.com"; sid:597258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecisions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecisions.com"; sid:597259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetect.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetect.info"; sid:597260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilityrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilityrights.com"; sid:597261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisposal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisposal.com"; sid:597262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddss.com"; sid:597263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-education.com"; sid:597264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencia.com"; sid:597265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.engineering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.engineering"; sid:597266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-environmental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-environmental.com"; sid:597267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepp.com"; sid:597268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideserve.com"; sid:597269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfathersday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfathersday.com"; sid:597270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightersbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightersbd.com"; sid:597271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloorsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloorsigns.com"; sid:597272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehandyman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehandyman.com"; sid:597273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemaui.com"; sid:597274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfumigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfumigator.com"; sid:597275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamer.com"; sid:597276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobaltracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobaltracker.com"; sid:597277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardcheck.com"; sid:597278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardhouse.com"; sid:597279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hair.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hair.net"; sid:597280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaul.com"; sid:597281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhauler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhauler.com"; sid:597282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaven.com"; sid:597283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealers.com"; sid:597284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealingtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealingtea.com"; sid:597285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthytips.com"; sid:597286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididentity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididentity.com"; sid:597287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmigrationproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmigrationproblems.com"; sid:597288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfung.net"; sid:597289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknowwhen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknowwhen.com"; sid:597290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlights.com"; sid:597291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlrg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlrg.com"; sid:597292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagician.com"; sid:597293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagicians.com"; sid:597294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksri.com"; sid:597295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedassist.com"; sid:597296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicaltesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicaltesting.com"; sid:597297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmothersday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmothersday.com"; sid:597298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnat.com"; sid:597299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnicetees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnicetees.com"; sid:597300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenproject.com"; sid:597301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteeshirts.com"; sid:597302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoddity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoddity.com"; sid:597303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficesolutions.com"; sid:597304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoor.com"; sid:597305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanels.com"; sid:597306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpbc.com"; sid:597307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalprotectionequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalprotectionequipment.com"; sid:597308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprintto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprintto.com"; sid:597309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprisonrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprisonrelease.com"; sid:597310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofmasks.com"; sid:597311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsy.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsy.care"; sid:597312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsy.com"; sid:597313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuzzle.com"; sid:597314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqktest.com"; sid:597315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquiltproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquiltproject.com"; sid:597316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtest.net"; sid:597317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidready.joburg - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidready.joburg"; sid:597318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreailtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreailtools.com"; sid:597319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverytoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverytoolkit.com"; sid:597320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremembrance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremembrance.net"; sid:597321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-reporting.com"; sid:597322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestoration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestoration.com"; sid:597323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretailtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretailtools.com"; sid:597324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrulesandrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrulesandrestrictions.com"; sid:597325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafechurch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafechurch.com"; sid:597326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeconcerts.com"; sid:597327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeevents.com"; sid:597328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafermall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafermall.com"; sid:597329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferstore.com"; sid:597330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesystem.com"; sid:597331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyshop.com"; sid:597332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeworship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeworship.com"; sid:597333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsavealife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsavealife.com"; sid:597334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sg.com"; sid:597335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitetest.com"; sid:597336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smart.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smart.center"; sid:597337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smart.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smart.info"; sid:597338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartshopping.com"; sid:597339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smartsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smartsolutions.com"; sid:597340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartsolutions.com"; sid:597341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smartsolutions.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smartsolutions.info"; sid:597342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatementofintent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatementofintent.com"; sid:597343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreadz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreadz.com"; sid:597344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker.life"; sid:597345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtts.com"; sid:597346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduganda.com"; sid:597347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidug.com"; sid:597348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualevents.com"; sid:597349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirtualwedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirtualwedding.com"; sid:597350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdecontamination.com"; sid:597351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicesproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicesproject.com"; sid:597352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalks.info"; sid:597353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacehygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacehygiene.com"; sid:597354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacerights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacerights.com"; sid:597355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursoscovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursoscovid19.club"; sid:597356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvacovid-19.com"; sid:597357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuscofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuscofreecovid.com"; sid:597358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for custommadecovid19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"custommadecovid19facemask.com"; sid:597359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dementia-covid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dementia-covid19.care"; sid:597360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccion-covid19.com"; sid:597361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecovid.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecovid.madrid"; sid:597362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccovid19.com"; sid:597363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deteccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deteccioncovid.com"; sid:597364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for distanciacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"distanciacovid.com"; sid:597365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for divcommpunecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"divcommpunecovid.com"; sid:597366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesheatkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesheatkillcoronavirus.com"; sid:597367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesheatkillthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesheatkillthecoronavirus.com"; sid:597368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doessunlightkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doessunlightkillcoronavirus.com"; sid:597369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesuvlightkillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesuvlightkillcoronavirus.com"; sid:597370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihaveacovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihaveacovidcase.com"; sid:597371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid-19test.com"; sid:597372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatetocoronavirusvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatetocoronavirusvictims.com"; sid:597373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for driveupcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"driveupcovidtest.com"; sid:597374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duckcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duckcovid19.com"; sid:597375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e2covidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e2covidrelief.com"; sid:597376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endorsecovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endorsecovidsafe.com"; sid:597377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-love.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-love.com"; sid:597378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsymptoms.com"; sid:597379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsystems.com"; sid:597380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ercovidretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ercovidretail.com"; sid:597381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espoircovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espoircovid.com"; sid:597382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estorescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estorescovid.com"; sid:597383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famigliacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famigliacovid.net"; sid:597384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedpandemichometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedpandemichometestkit.com"; sid:597385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovedpandemictestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovedpandemictestkit.com"; sid:597386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.care"; sid:597387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightpandemic.net"; sid:597388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightwithcorona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightwithcorona.life"; sid:597389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincovid-19.com"; sid:597390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formazionepfizer-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formazionepfizer-covid19.com"; sid:597391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fr-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fr-coronavirus.com"; sid:597392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavaccine.net"; sid:597393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidbb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidbb.com"; sid:597394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidflag.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidflag.info"; sid:597395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freedomfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freedomfromcovid.com"; sid:597396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurecoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurecoronavirusinsurance.com"; sid:597397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getawaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getawaycoronavirus.com"; sid:597398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmobilecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmobilecovidtest.com"; sid:597399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusadvocacyresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusadvocacyresource.net"; sid:597400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19advocacyresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19advocacyresource.net"; sid:597401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19advocacyresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19advocacyresource.net"; sid:597402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19resource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19resource.net"; sid:597403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for golfcovidbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"golfcovidbarrier.com"; sid:597404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greedycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greedycovid19.com"; sid:597405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gt-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gt-covid19.com"; sid:597406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handlecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handlecovid.com"; sid:597407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harwhitcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harwhitcovidsupplies.com"; sid:597408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthsystemcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthsystemcovidrecovery.com"; sid:597409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hebacovidstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hebacovidstop.com"; sid:597410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-stopcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-stopcovid-19.com"; sid:597411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herocovid19.net"; sid:597412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hertscovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hertscovidsupplies.com"; sid:597413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higienizantecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higienizantecovid.com"; sid:597414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidayscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidayscovidfree.com"; sid:597415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hospitalitycovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hospitalitycovidsupplies.com"; sid:597416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelscovidfree.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelscovidfree.cat"; sid:597417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostaysafefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostaysafefromcoronavirus.com"; sid:597418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovidclear.com"; sid:597419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-bite-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-bite-corona.com"; sid:597420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihecovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihecovidsurvey.com"; sid:597421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunocovid19.net"; sid:597422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incapacidadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incapacidadcovid19.com"; sid:597423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianscovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianscovidhelp.com"; sid:597424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcoronavirusbusinessinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcoronavirusbusinessinsurance.com"; sid:597425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ineedcoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ineedcoronavirusinsurance.com"; sid:597426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-covid-19.com"; sid:597427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instintocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instintocovid19.com"; sid:597428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalmedicalhealthoperationtoendpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalmedicalhealthoperationtoendpandemics.com"; sid:597429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for islandpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"islandpandemic.com"; sid:597430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona2020.net"; sid:597431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.life"; sid:597432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivehadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivehadcoronavirus.com"; sid:597433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juntoscontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juntoscontracovid.com"; sid:597434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawasaki-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawasaki-coronavirus.com"; sid:597435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawasakicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawasakicoronavirus.com"; sid:597436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenyacovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenyacovidtracker.com"; sid:597437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidtexas.com"; sid:597438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for komeshacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"komeshacorona.com"; sid:597439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labelcovidproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labelcovidproof.com"; sid:597440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-corona-del-daiquiri.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-corona-del-daiquiri.club"; sid:597441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laresistenciacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laresistenciacovid19.com"; sid:597442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lebanontwpcovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lebanontwpcovidhelp.com"; sid:597443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libertymutualcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libertymutualcovid19.com"; sid:597444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinsurancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinsurancecovid19.com"; sid:597445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeofcorona.com"; sid:597446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithoutcoronavirus.com"; sid:597447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifewithoutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifewithoutcovid19.com"; sid:597448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livincorona.com"; sid:597449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for m4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"m4covid.com"; sid:597450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for machupicchufreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"machupicchufreecovid.com"; sid:597451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managingaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managingaftercovid19.com"; sid:597452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcovid19clean.com"; sid:597453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marriottcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marriottcovidclean.com"; sid:597454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillaanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillaanticovid.com"; sid:597455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasanticovid.com"; sid:597456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskcovids19.com"; sid:597457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-barriere-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-barriere-covid.com"; sid:597458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetmeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetmeaftercovid.com"; sid:597459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memocovid.com"; sid:597460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid19disinfecting.com"; sid:597461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecoronapass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecoronapass.com"; sid:597462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidpass.com"; sid:597463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtestnow.com"; sid:597464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mpcoronavirus.com"; sid:597465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mquestcovidtest.com"; sid:597466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrcovidclean.com"; sid:597467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtquestcovidtest.com"; sid:597468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for muquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"muquestcovidtest.com"; sid:597469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for musicaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"musicaftercovid19.com"; sid:597470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19testing.com"; sid:597471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19tests.com"; sid:597472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-ppe.com"; sid:597473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtests.com"; sid:597474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myglobalpandemicinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myglobalpandemicinsurance.com"; sid:597475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhomecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhomecoronatest.com"; sid:597476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhometestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhometestcoronavirus.com"; sid:597477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqestcovidtest.com"; sid:597478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqeustcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqeustcovidtest.com"; sid:597479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqiestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqiestcovidtest.com"; sid:597480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqueatcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqueatcovidtest.com"; sid:597481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquedtcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquedtcovidtest.com"; sid:597482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquescovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquescovidtest.com"; sid:597483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquesrcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquesrcovidtest.com"; sid:597484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovid-19test.com"; sid:597485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovid19test.com"; sid:597486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidest.com"; sid:597487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidrest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidrest.com"; sid:597488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidteat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidteat.com"; sid:597489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtedt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtedt.com"; sid:597490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtes.com"; sid:597491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtesr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtesr.com"; sid:597492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtests.com"; sid:597493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtesy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtesy.com"; sid:597494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtet.com"; sid:597495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtrst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtrst.com"; sid:597496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtst.com"; sid:597497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtwst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtwst.com"; sid:597498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidyest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidyest.com"; sid:597499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquesycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquesycovidtest.com"; sid:597500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquetcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquetcovidtest.com"; sid:597501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqurstcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqurstcovidtest.com"; sid:597502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqusetcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqusetcovidtest.com"; sid:597503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqustcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqustcovidtest.com"; sid:597504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquwstcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquwstcovidtest.com"; sid:597505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqyestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqyestcovidtest.com"; sid:597506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myuestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myuestcovidtest.com"; sid:597507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mywildfitcovid19journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mywildfitcovid19journey.com"; sid:597508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mywuestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mywuestcovidtest.com"; sid:597509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid-19day.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid-19day.com"; sid:597510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovidclaims.com"; sid:597511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neocovidfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neocovidfl.com"; sid:597512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for network-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"network-pandemic.com"; sid:597513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for networkpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"networkpandemic.com"; sid:597514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-corona.net"; sid:597515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusinsurance.com"; sid:597516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19vaccine.com"; sid:597517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovid19disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovid19disinfecting.com"; sid:597518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidtaskforce.com"; sid:597519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for njcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"njcovidtesting.com"; sid:597520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronavirususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronavirususa.com"; sid:597521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncorona.net"; sid:597522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nosmokingnocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nosmokingnocovid.com"; sid:597523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirusresponse.com"; sid:597524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusresponse.com"; sid:597525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyquestcovidtest.com"; sid:597526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obscontencovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obscontencovid.info"; sid:597527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid19-ochealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid19-ochealthinfo.com"; sid:597528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocean4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocean4covid.com"; sid:597529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for office365voicemailcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"office365voicemailcovid19.com"; sid:597530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidtestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidtestcenter.com"; sid:597531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovidteststation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovidteststation.com"; sid:597532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecorona2019.com"; sid:597533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for overcovidrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"overcovidrun.com"; sid:597534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapothecary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapothecary.com"; sid:597535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccounselinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccounselinggroup.com"; sid:597536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdoctorandnursedolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdoctorandnursedolls.com"; sid:597537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-earth.com"; sid:597538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicevolution.com"; sid:597539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexcuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexcuses.com"; sid:597540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfiltermasks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfiltermasks.info"; sid:597541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-forecaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-forecaster.com"; sid:597542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforefaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforefaster.com"; sid:597543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-free.com"; sid:597544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicguard.net"; sid:597545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmentalhealthsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmentalhealthsupport.com"; sid:597546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-network.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-network.net"; sid:597547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnotions.com"; sid:597548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicophrenia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicophrenia.com"; sid:597549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphoto.com"; sid:597550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-photography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-photography.com"; sid:597551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpressure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpressure.com"; sid:597552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprinting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprinting.com"; sid:597553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpublicrelations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpublicrelations.com"; sid:597554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-puppies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-puppies.com"; sid:597555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuppyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuppyclub.com"; sid:597556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-puppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-puppy.com"; sid:597557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpuppyschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpuppyschool.com"; sid:597558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponsebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponsebox.com"; sid:597559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrevolution.com"; sid:597560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-19.com"; sid:597561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-20.com"; sid:597562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-safeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-safeguard.com"; sid:597563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicschoolsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicschoolsupport.com"; sid:597564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsgroup.com"; sid:597565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupportgroup.com"; sid:597566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivalplaninc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivalplaninc.com"; sid:597567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscathometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscathometestkit.com"; sid:597568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicviruscattestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicviruscattestkit.com"; sid:597569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusdoghometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusdoghometestkit.com"; sid:597570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusdogtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusdogtestkit.com"; sid:597571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passcovid.info"; sid:597572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passcovid.net"; sid:597573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedidoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedidoscovid.com"; sid:597574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for performingartsaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"performingartsaftercovid19.com"; sid:597575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phoenixandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phoenixandcovid19.com"; sid:597576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivotwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivotwithcovid.com"; sid:597577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plataformaafectadosporelcovidencentroscomercialesdeespana-pac.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plataformaafectadosporelcovidencentroscomercialesdeespana-pac.biz"; sid:597578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poignee-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poignee-covid.com"; sid:597579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for popmaxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"popmaxcovid.com"; sid:597580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronabusinesspartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronabusinesspartner.com"; sid:597581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.guide"; sid:597582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidservice.com"; sid:597583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidsolution.com"; sid:597584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicdesign.com"; sid:597585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpolitics.com"; sid:597586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for powerfood-for-covid19-fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"powerfood-for-covid19-fighters.com"; sid:597587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenciondecovid.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenciondecovid.madrid"; sid:597588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovid19.net"; sid:597589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productosanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productosanticoronavirus.com"; sid:597590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocovid-19.net"; sid:597591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovid.net"; sid:597592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcovids19.com"; sid:597593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protections-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protections-covid.info"; sid:597594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectorfacialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectorfacialcovid.com"; sid:597595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectorfacilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectorfacilcovid.com"; sid:597596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolocovidfree.com"; sid:597597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacoronavirusparaguay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacoronavirusparaguay.com"; sid:597598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questcovidtest.com"; sid:597599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19screening.com"; sid:597600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamarcoronavirus.com"; sid:597601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recurrirmultacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recurrirmultacoronavirus.com"; sid:597602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircoronavirusvaccine.com"; sid:597603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircovid-19.com"; sid:597604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for remdesivircovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"remdesivircovid.com"; sid:597605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retraitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retraitecovid.com"; sid:597606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ruralcovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ruralcovidlife.com"; sid:597607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rxcoronashot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rxcoronashot.com"; sid:597608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safemobilecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safemobilecovidtest.com"; sid:597609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid19vaccine.com"; sid:597610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19vaccine.com"; sid:597611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-vaccinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-vaccinecovid19.com"; sid:597612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarsvaccinecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarsvaccinecovid19.com"; sid:597613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for save-viralepidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"save-viralepidemic.net"; sid:597614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sayonaracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sayonaracorona.com"; sid:597615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scmbdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scmbdacovid19.com"; sid:597616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitefinancierecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitefinancierecovid.com"; sid:597617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seemeseeyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seemeseeyoucovid19.com"; sid:597618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for separadoresdecristalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"separadoresdecristalcovid.com"; sid:597619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shieldsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shieldsforcovid.com"; sid:597620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcovidclassof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcovidclassof2020.com"; sid:597621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signaletique-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signaletique-covid-19.com"; sid:597622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signaletique-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signaletique-covid19.com"; sid:597623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signaletique-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signaletique-covid.com"; sid:597624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalisation-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalisation-covid19.com"; sid:597625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signalisation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signalisation-covid.com"; sid:597626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simcovidresponse.com"; sid:597627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for simplifyingcovid19charts101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"simplifyingcovid19charts101.com"; sid:597628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for singleandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"singleandcovid.com"; sid:597629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smackcovid.com"; sid:597630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sococovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sococovid.com"; sid:597631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedypandemictees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedypandemictees.com"; sid:597632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronashop.com"; sid:597633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19chaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19chaos.com"; sid:597634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidchaos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidchaos.com"; sid:597635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suffolkcountycovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suffolkcountycovidrecovery.com"; sid:597636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teackingcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teackingcovidnow.com"; sid:597637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tech4covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tech4covid.info"; sid:597638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencovidlife.com"; sid:597639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellmecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellmecovid19.com"; sid:597640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for termoscannercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"termoscannercoronavirus.com"; sid:597641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tessiespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tessiespandemic.com"; sid:597642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testencasacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testencasacoronavirus.com"; sid:597643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing4corona.com"; sid:597644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidoscovid19.com"; sid:597645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidoscovid.com"; sid:597646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tevanewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tevanewscovid19.com"; sid:597647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thechroniclesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thechroniclesofcovid.com"; sid:597648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruspandemic.net"; sid:597649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19facemask.com"; sid:597650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19kids.com"; sid:597651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidantibody.com"; sid:597652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcup.com"; sid:597653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmagician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmagician.com"; sid:597654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmagicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmagicians.com"; sid:597655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpassport.com"; sid:597656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidshift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidshift.com"; sid:597657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefightagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefightagainstcovid.com"; sid:597658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehappywuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehappywuhan.net"; sid:597659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccounselinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccounselinggroup.com"; sid:597660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thwcorona.com"; sid:597661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tocovidprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tocovidprint.com"; sid:597662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trabajoycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trabajoycovid.com"; sid:597663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackingcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackingcovid19.info"; sid:597664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tsekcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tsekcorona.com"; sid:597665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turismocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turismocoronavirus.com"; sid:597666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uccovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uccovidstudy.com"; sid:597667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatscorona.com"; sid:597668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovidlaw.com"; sid:597669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicresponse.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicresponse.info"; sid:597670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicresponse.net"; sid:597671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usasealing-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usasealing-covid.com"; sid:597672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcoronaviruslight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcoronaviruslight.com"; sid:597673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinscovid-19.com"; sid:597674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinscovid19.com"; sid:597675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacovidcommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacovidcommunity.com"; sid:597676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viajardespuesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viajardespuesdelcoronavirus.com"; sid:597677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for villascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"villascovid19.com"; sid:597678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtualcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtualcovid-19.com"; sid:597679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-coronas19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-coronas19.com"; sid:597680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visiere-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visiere-covid.com"; sid:597681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for votecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"votecovid.com"; sid:597682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-covid.com"; sid:597683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for windsorcovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"windsorcovid19sellerplan.com"; sid:597684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjuili.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjuili.com"; sid:597685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansibu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansibu.com"; sid:597686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruscathometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruscathometestkit.com"; sid:597687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruscattestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruscattestkit.com"; sid:597688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdoghometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdoghometestkit.com"; sid:597689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdogtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdogtestkit.com"; sid:597690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwildwings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwildwings.com"; sid:597691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwmyquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwmyquestcovidtest.com"; sid:597692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youthagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youthagainstcovid-19.com"; sid:597693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovidcr.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovidcr.info"; sid:597694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovidcr.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovidcr.net"; sid:597695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovid.info"; sid:597696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zimcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zimcovid.net"; sid:597697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zoom-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zoom-pandemic.com"; sid:597698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19corona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19corona19.com"; sid:597699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 907covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"907covidlaw.com"; sid:597700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1coronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1coronamasks.com"; sid:597701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actemracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actemracovid-19.com"; sid:597702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actemracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actemracovid19.com"; sid:597703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afem-covid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afem-covid-19.info"; sid:597704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid19.info"; sid:597705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for age-reversal-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"age-reversal-covid.net"; sid:597706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovidtreatment.com"; sid:597707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovidtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovidtreatments.com"; sid:597708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronacare.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronacare.one"; sid:597709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19gate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19gate.com"; sid:597710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antisocialcovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antisocialcovidclub.com"; sid:597711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asicovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asicovidfree.com"; sid:597712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atualizacao-emergencial-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atualizacao-emergencial-covid-19.com"; sid:597713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid19.net"; sid:597714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacrisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacrisiscovid19.com"; sid:597715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascrisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascrisiscovid19.com"; sid:597716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantaycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantaycovid.net"; sid:597717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcovid2020.com"; sid:597718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigcoronadiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigcoronadiet.com"; sid:597719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcoronavirus.biz"; sid:597720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovid.biz"; sid:597721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid19app.com"; sid:597722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid-19.com"; sid:597723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid19.com"; sid:597724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bornecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bornecovid.com"; sid:597725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bring-corona-nicht-zur-oma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bring-corona-nicht-zur-oma.com"; sid:597726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bringcoronanichtzuroma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bringcoronanichtzuroma.com"; sid:597727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusrapidtest.com"; sid:597728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidrapidtest.com"; sid:597729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidsign.com"; sid:597730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidsigns.com"; sid:597731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuscovid19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuscovid19support.com"; sid:597732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuspandemicsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuspandemicsupport.com"; sid:597733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpaybillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpaybillscovid19.com"; sid:597734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cantpayrentcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cantpayrentcovid19.com"; sid:597735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascovid19todito.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascovid19todito.com"; sid:597736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeofcovid19.com"; sid:597737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chariotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chariotcovid.com"; sid:597738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovid19sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovid19sign.com"; sid:597739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovid19test.com"; sid:597740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovidtest.com"; sid:597741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid20.com"; sid:597742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid.net"; sid:597743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidsolutions.com"; sid:597744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquer-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquer-corona.com"; sid:597745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerorofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerorofcovid.com"; sid:597746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquerorofcovidxix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquerorofcovidxix.com"; sid:597747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid.net"; sid:597748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corevision-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corevision-covid19.com"; sid:597749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19virusmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19virusmasks.net"; sid:597750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa10.com"; sid:597751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa1.com"; sid:597752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa2.com"; sid:597753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa3.com"; sid:597754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa4.com"; sid:597755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa5.com"; sid:597756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa6.com"; sid:597757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa7.com"; sid:597758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa8.com"; sid:597759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa9.com"; sid:597760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaacai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaacai.com"; sid:597761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaart2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaart2020.com"; sid:597762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandit.com"; sid:597763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabandits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabandits.com"; sid:597764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-blasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-blasters.com"; sid:597765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablend.com"; sid:597766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster.world"; sid:597767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecompany.com"; sid:597768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachina.com"; sid:597769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclown.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclown.net"; sid:597770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclowns.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclowns.net"; sid:597771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconquer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconquer.com"; sid:597772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conqueror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conqueror.com"; sid:597773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrate.com"; sid:597774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadailies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadailies.com"; sid:597775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazeprofessionaldevelopment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazeprofessionaldevelopment.com"; sid:597776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazeprofessionaldevelopment.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazeprofessionaldevelopment.info"; sid:597777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadazeprofessionaldevelopment.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadazeprofessionaldevelopment.net"; sid:597778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeadline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeadline.com"; sid:597779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeadline.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeadline.info"; sid:597780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeadline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeadline.net"; sid:597781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadieet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadieet.com"; sid:597782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado.cloud"; sid:597783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonation.info"; sid:597784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashionmasks.com"; sid:597785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-foerderung.nrw - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-foerderung.nrw"; sid:597786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoerderung.nrw - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoerderung.nrw"; sid:597787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-frei.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-frei.info"; sid:597788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrapher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrapher.com"; sid:597789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagray.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagray.net"; sid:597790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardga.com"; sid:597791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardpro.com"; sid:597792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfen.info"; sid:597793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmuntest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmuntest.com"; sid:597794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindia.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindia.life"; sid:597795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-inshoku.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-inshoku.club"; sid:597796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairaqs.com"; sid:597797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-joho.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-joho.net"; sid:597798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerz.com"; sid:597799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakon.com"; sid:597800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagician.com"; sid:597801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagician.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagician.net"; sid:597802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagicians.com"; sid:597803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagicians.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagicians.net"; sid:597804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsandviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsandviews.com"; sid:597805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewscenter.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewscenter.info"; sid:597806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoplossing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoplossing.com"; sid:597807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapolitie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapolitie.com"; sid:597808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprenuer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprenuer.com"; sid:597809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprenuer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprenuer.net"; sid:597810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronardx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronardx.com"; sid:597811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarem.com"; sid:597812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarescuega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarescuega.com"; sid:597813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarx.com"; sid:597814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafega.com"; sid:597815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreen.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreen.biz"; sid:597816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldsolutions.com"; sid:597817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolo.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolo.run"; sid:597818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-support2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-support2020.com"; sid:597819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesttaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesttaxi.com"; sid:597820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavac.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavac.net"; sid:597821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtuality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtuality.com"; sid:597822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirtual.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirtual.life"; sid:597823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-advisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-advisors.com"; sid:597824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusa.net"; sid:597825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiohazardremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiohazardremoval.com"; sid:597826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessadvisorsandconsultants.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessadvisorsandconsultants.net"; sid:597827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-clean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-clean-up.com"; sid:597828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19attorneys.com"; sid:597829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurrentnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurrentnews.com"; sid:597830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathclaimattorney.com"; sid:597831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathclaimattorneys.com"; sid:597832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathclaimlawyer.com"; sid:597833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathclaimlawyers.com"; sid:597834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebitcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebitcard.com"; sid:597835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-deep-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-deep-cleaning.com"; sid:597836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialexperiencestudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialexperiencestudy.com"; sid:597837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinancialstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinancialstudy.com"; sid:597838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsurance.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsurance.services"; sid:597839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-japan.com"; sid:597840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-japan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-japan.net"; sid:597841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskaletra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskaletra.com"; sid:597842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmobiletesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmobiletesting.net"; sid:597843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nashville.com"; sid:597844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventives.com"; sid:597845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradx.com"; sid:597846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidaccelerateddiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidaccelerateddiagnostics.com"; sid:597847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoverysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoverysystem.com"; sid:597848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopstore.com"; sid:597849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sign.com"; sid:597850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrains.com"; sid:597851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineforfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineforfree.com"; sid:597852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvouchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvouchers.com"; sid:597853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaimattorney.com"; sid:597854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaimattorneys.com"; sid:597855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaim.com"; sid:597856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaimlawyer.com"; sid:597857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaimlawyers.com"; sid:597858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathclaims.com"; sid:597859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirx.com"; sid:597860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavlife.com"; sid:597861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawellness.com"; sid:597862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wissen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wissen.info"; sid:597863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayemen.com"; sid:597864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costofcovid19.com"; sid:597865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-10minutefdatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-10minutefdatest.com"; sid:597866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-10minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-10minutetest.com"; sid:597867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19asia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19asia.com"; sid:597868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assetsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assetsale.com"; sid:597869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19balls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19balls.com"; sid:597870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barcelona.com"; sid:597871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biohazardremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biohazardremoval.com"; sid:597872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careprogram.com"; sid:597873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caretv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caretv.com"; sid:597874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cascavel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cascavel.com"; sid:597875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-central.com"; sid:597876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19check.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19check.net"; sid:597877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clean.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clean.solutions"; sid:597878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clearinghouse.com"; sid:597879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clearinghouse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clearinghouse.net"; sid:597880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothingcompany.com"; sid:597881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conciergeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conciergeservice.com"; sid:597882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conciergeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conciergeservices.com"; sid:597883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connecticut.com"; sid:597884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultancy.com"; sid:597885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coverageb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coverageb.com"; sid:597886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cureonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cureonline.com"; sid:597887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cures.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cures.biz"; sid:597888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19databases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19databases.com"; sid:597889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19day.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19day.info"; sid:597890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathclaimattorney.com"; sid:597891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaimattorney.com"; sid:597892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathclaimattorneys.com"; sid:597893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaimattorneys.com"; sid:597894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathclaim.com"; sid:597895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaim.com"; sid:597896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathclaimlawyer.com"; sid:597897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaimlawyer.com"; sid:597898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deathclaimlawyers.com"; sid:597899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deathclaimlawyers.com"; sid:597900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19decontaminationcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19decontaminationcleaning.com"; sid:597901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-deep-cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-deep-cleaning.com"; sid:597902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donationbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donationbox.com"; sid:597903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerliabilityattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerliabilityattorneys.com"; sid:597904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epid.com"; sid:597905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-equipement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-equipement.com"; sid:597906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-equipement.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-equipement.net"; sid:597907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-equipements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-equipements.com"; sid:597908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-equipements.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-equipements.net"; sid:597909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19erradication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19erradication.com"; sid:597910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19escapes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19escapes.com"; sid:597911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19escapes.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19escapes.info"; sid:597912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19escapes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19escapes.net"; sid:597913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19et.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19et.com"; sid:597914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19favipiravir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19favipiravir.com"; sid:597915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialclaims.com"; sid:597916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financing.com"; sid:597917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floordecal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floordecal.com"; sid:597918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floorsticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floorsticker.com"; sid:597919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flordia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flordia.com"; sid:597920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forecasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forecasting.com"; sid:597921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forecasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forecasting.com"; sid:597922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19forecasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19forecasts.com"; sid:597923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forecast.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forecast.today"; sid:597924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosurelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosurelaw.com"; sid:597925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genome.com"; sid:597926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19genomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19genomics.com"; sid:597927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19handsanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19handsanitizers.com"; sid:597928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19holidayclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19holidayclaims.com"; sid:597929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesolution.com"; sid:597930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incub.com"; sid:597931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infodemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infodemic.com"; sid:597932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infodemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infodemic.com"; sid:597933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttestingkit.com"; sid:597934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttestingkit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttestingkit.info"; sid:597935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19investigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19investigation.com"; sid:597936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19investment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19investment.com"; sid:597937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kaletra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kaletra.com"; sid:597938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kart.com"; sid:597939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kits.biz"; sid:597940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kits.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kits.info"; sid:597941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kits.net"; sid:597942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19landlordhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19landlordhelp.com"; sid:597943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19linewaiters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19linewaiters.com"; sid:597944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loans.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loans.company"; sid:597945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19losssale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19losssale.com"; sid:597946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lugina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lugina.com"; sid:597947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19managment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19managment.com"; sid:597948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19massachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19massachusetts.com"; sid:597949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milano.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milano.net"; sid:597950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigationplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigationplatform.com"; sid:597951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mrna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mrna.com"; sid:597952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutations.com"; sid:597953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mycsr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mycsr.com"; sid:597954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nearby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nearby.com"; sid:597955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19normal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19normal.com"; sid:597956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19northcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19northcarolina.com"; sid:597957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officesupplies.com"; sid:597958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsitescreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsitescreening.com"; sid:597959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsitescreenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsitescreenings.com"; sid:597960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pennsylvania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pennsylvania.com"; sid:597961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plug.com"; sid:597962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poorhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poorhelp.com"; sid:597963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppequip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppequip.com"; sid:597964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppequipment.com"; sid:597965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppequpiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppequpiment.com"; sid:597966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prevention.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prevention.net"; sid:597967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radx.com"; sid:597968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverysystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverysystem.com"; sid:597969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19removalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19removalusa.com"; sid:597970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19removalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19removalusa.com"; sid:597971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restructering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restructering.com"; sid:597972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restructuring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restructuring.com"; sid:597973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.expert"; sid:597974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safe.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safe.guru"; sid:597975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safekits.com"; sid:597976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.company"; sid:597977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.directory"; sid:597978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.education"; sid:597979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.guru"; sid:597980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.services"; sid:597981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.systems"; sid:597982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.technology - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.technology"; sid:597983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.today"; sid:597984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.training - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.training"; sid:597985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sanitizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sanitizing.com"; sid:597986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seguros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seguros.com"; sid:597987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellmyhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellmyhome.com"; sid:597988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sign.com"; sid:597989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signs.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signs.biz"; sid:597990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilizationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilizationservice.com"; sid:597991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilizationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilizationservices.com"; sid:597992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stoppen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stoppen.com"; sid:597993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19streetart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19streetart.com"; sid:597994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strike.com"; sid:597995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supercleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supercleaners.com"; sid:597996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tas.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tas.info"; sid:597997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxloss.com"; sid:597998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-taxloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-taxloss.com"; sid:597999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxlosses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxlosses.com"; sid:598000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxsolution.com"; sid:598001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingtruck.com"; sid:598002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtruck.com"; sid:598003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.biz"; sid:598004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teszt.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teszt.info"; sid:598005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelclaim.com"; sid:598006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updatenow.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updatenow.info"; sid:598007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineaz.com"; sid:598008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-water-supply-operations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-water-supply-operations.com"; sid:598009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workforcesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workforcesolutions.com"; sid:598010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacesupply.com"; sid:598011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeathclaimattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeathclaimattorney.com"; sid:598012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeathclaimattorneys.com"; sid:598013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathclaimattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathclaimattorneys.com"; sid:598014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeathclaim.com"; sid:598015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathclaim.com"; sid:598016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathclaimlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathclaimlawyer.com"; sid:598017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeathclaimlawyers.com"; sid:598018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathclaimlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathclaimlawyers.com"; sid:598019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wrongfuldeathclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wrongfuldeathclaims.com"; sid:598020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21ppe.com"; sid:598021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid420.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid420.net"; sid:598022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid89.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid89.com"; sid:598023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvocacyexchange.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvocacyexchange.net"; sid:598024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidago.com"; sid:598025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidscore.com"; sid:598026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaloca.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaloca.net"; sid:598027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandclean.com"; sid:598028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyscreening.com"; sid:598029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassays.com"; sid:598030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-audit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-audit.com"; sid:598031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-audits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-audits.com"; sid:598032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyfiling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyfiling.com"; sid:598033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyfiling.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyfiling.info"; sid:598034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyfiling.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyfiling.net"; sid:598035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-barrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-barrier.com"; sid:598036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-barriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-barriers.com"; sid:598037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet.bet - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet.bet"; sid:598038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiosys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiosys.com"; sid:598039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboxmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboxmx.com"; sid:598040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesshelp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesshelp.info"; sid:598041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandles.com"; sid:598042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardhouse.com"; sid:598043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicle.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicle.net"; sid:598044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupproject.com"; sid:598045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnector.net"; sid:598046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuarentena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuarentena.com"; sid:598047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidearloops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidearloops.com"; sid:598048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideluxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideluxe.com"; sid:598049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentregas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentregas.com"; sid:598050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoparty.com"; sid:598051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosafesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosafesets.com"; sid:598052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosafesets.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosafesets.info"; sid:598053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosafesets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosafesets.net"; sid:598054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covider.com"; sid:598055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfc.com"; sid:598056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloordecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloordecals.com"; sid:598057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoto.com"; sid:598058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapartmentscordoba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapartmentscordoba.com"; sid:598059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapartmentsestepona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapartmentsestepona.com"; sid:598060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapartmentsmalaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapartmentsmalaga.com"; sid:598061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecancun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecancun.com"; sid:598062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehawaii.com"; sid:598063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehi.com"; sid:598064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeincentives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeincentives.com"; sid:598065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-mexico.com"; sid:598066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeplayadelcarmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeplayadelcarmen.com"; sid:598067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerivieramaya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerivieramaya.com"; sid:598068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetomorrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetomorrow.com"; sid:598069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.travel - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.travel"; sid:598070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevents.com"; sid:598071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunding.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunding.net"; sid:598072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgest.com"; sid:598073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreenclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreenclean.com"; sid:598074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreencleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreencleaners.com"; sid:598075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-guards.com"; sid:598076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhopecatchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhopecatchers.com"; sid:598077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunestatus.com"; sid:598078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinize.com"; sid:598079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinize.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinize.net"; sid:598080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeeper.com"; sid:598081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiss.com"; sid:598082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecare.com"; sid:598083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lighting.com"; sid:598084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinewaiters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinewaiters.com"; sid:598085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanmodifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanmodifications.com"; sid:598086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlornabreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlornabreen.com"; sid:598087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagician.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagician.net"; sid:598088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagicians.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagicians.net"; sid:598089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mallorca.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mallorca.info"; sid:598090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidman19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidman19.com"; sid:598091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskproject.com"; sid:598092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskprotec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskprotec.com"; sid:598093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasquerade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasquerade.com"; sid:598094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasquerade.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasquerade.info"; sid:598095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasquerade.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasquerade.net"; sid:598096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedecide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedecide.com"; sid:598097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicare.net"; sid:598098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotme.com"; sid:598099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientform.com"; sid:598100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayoll.com"; sid:598101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprokitperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprokitperu.com"; sid:598102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectoinservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectoinservices.com"; sid:598103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotegido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotegido.com"; sid:598104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotegido.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotegido.net"; sid:598105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsyop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsyop.com"; sid:598106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsyop.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsyop.info"; sid:598107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickpass.com"; sid:598108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradx.com"; sid:598109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidscreeningtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidscreeningtest.com"; sid:598110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidscreeningtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidscreeningtests.com"; sid:598111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdc.com"; sid:598112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidready.durban - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidready.durban"; sid:598113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidready.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidready.info"; sid:598114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehub.com"; sid:598115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremovalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremovalusa.com"; sid:598116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesca.com"; sid:598117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretail.com"; sid:598118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrulesandregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrulesandregulations.com"; sid:598119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrus.com"; sid:598120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeset.com"; sid:598121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesets.com"; sid:598122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyoperatingprocedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyoperatingprocedures.com"; sid:598123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsampling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsampling.com"; sid:598124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen.biz"; sid:598125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseguros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseguros.com"; sid:598126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shields.com"; sid:598127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitter.com"; sid:598128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsop.com"; sid:598129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilizationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilizationservice.com"; sid:598130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilizationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilizationservices.com"; sid:598131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoppen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoppen.com"; sid:598132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstreetart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstreetart.com"; sid:598133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstuffnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstuffnow.com"; sid:598134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-suit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-suit.com"; sid:598135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtapabocas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtapabocas.com"; sid:598136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidte.com"; sid:598137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingalabama.com"; sid:598138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcenters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcenters.net"; sid:598139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtomorrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtomorrow.com"; sid:598140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracerteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracerteam.com"; sid:598141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingne.com"; sid:598142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracker-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracker-nj.com"; sid:598143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracker-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracker-nyc.com"; sid:598144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracker-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracker-ny.com"; sid:598145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerteam.com"; sid:598146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerteamnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerteamnj.com"; sid:598147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerteamnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerteamnyc.com"; sid:598148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinefacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinefacts.com"; sid:598149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinecure.com"; sid:598150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinery.com"; sid:598151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscovid19help.com"; sid:598152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csr-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csr-corona.net"; sid:598153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daycorona.com"; sid:598154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defensacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defensacovid.com"; sid:598155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescovid.com"; sid:598156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositif-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositif-covid19.com"; sid:598157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositifcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositifcovid19.com"; sid:598158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositifs-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositifs-covid19.com"; sid:598159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositifscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositifscovid19.com"; sid:598160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for docorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"docorona.com"; sid:598161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingcovid19.com"; sid:598162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingcovid19.net"; sid:598163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovidbreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovidbreen.com"; sid:598164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drlornabreencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drlornabreencovid.com"; sid:598165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for durangocapital-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"durangocapital-covid19.com"; sid:598166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicriskconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicriskconsulting.com"; sid:598167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipementcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipementcovid19.com"; sid:598168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecovid-19.info"; sid:598169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecovid-19.net"; sid:598170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialpandemicprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialpandemicprotection.com"; sid:598171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esterilizacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esterilizacioncoronavirus.com"; sid:598172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estoresproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estoresproteccioncovid19.com"; sid:598173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everything-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everything-covid19.com"; sid:598174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evil-coronavirus-scam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evil-coronavirus-scam.com"; sid:598175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exitcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exitcovid19.biz"; sid:598176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyelistencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyelistencovid19.com"; sid:598177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyelistencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyelistencovid.com"; sid:598178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facialescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facialescorona.com"; sid:598179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.net"; sid:598180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-back-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-back-covid-19.com"; sid:598181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidmasks.com"; sid:598182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcorona.net"; sid:598183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid-19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid-19together.com"; sid:598184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialcovid19trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialcovid19trauma.com"; sid:598185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialcovid-trauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialcovid-trauma.com"; sid:598186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for financialcovidtrauma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"financialcovidtrauma.com"; sid:598187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for follow-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"follow-covid19.info"; sid:598188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freseniuskabi-nutritionandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freseniuskabi-nutritionandcovid19.com"; sid:598189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthiscoronavirus.com"; sid:598190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fvckcovidapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fvckcovidapparel.com"; sid:598191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for genalytecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"genalytecovid19.com"; sid:598192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19cure.com"; sid:598193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidkits.com"; sid:598194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidready.com"; sid:598195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidready.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidready.info"; sid:598196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidready.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidready.net"; sid:598197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsupply.com"; sid:598198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemictracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemictracing.com"; sid:598199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glycovid-19.com"; sid:598200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glycovid.com"; sid:598201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidordie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidordie.com"; sid:598202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovidresponse.com"; sid:598203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gonecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gonecorona.com"; sid:598204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gruender-soforthilfe-corona.nrw - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gruender-soforthilfe-corona.nrw"; sid:598205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gsicovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gsicovidcare.com"; sid:598206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcrisiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcrisiscovid19.com"; sid:598207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpuscovid19.com"; sid:598208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hepsagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hepsagainstcovid19.com"; sid:598209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hetgrotecoronadieet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hetgrotecoronadieet.com"; sid:598210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidayscovidfree.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidayscovidfree.info"; sid:598211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honey4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honey4covid.com"; sid:598212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelfreecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelfreecovid-19.com"; sid:598213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirusattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirusattorney.com"; sid:598214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncoronavirusattorney.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncoronavirusattorney.net"; sid:598215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iams-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iams-covid-19.com"; sid:598216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ich-esse-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ich-esse-corona.com"; sid:598217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ich-fresse-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ich-fresse-corona.com"; sid:598218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imprimerie-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imprimerie-covid19.com"; sid:598219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indonesiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indonesiacovid19.com"; sid:598220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-covid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-covid19.life"; sid:598221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inmemoriamcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inmemoriamcovid-19.com"; sid:598222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instintocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instintocovid19.net"; sid:598223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for integrativecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"integrativecovidcare.com"; sid:598224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcoronaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcoronaart.com"; sid:598225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iquit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iquit-covid19.com"; sid:598226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iquitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iquitcovid19.com"; sid:598227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iquitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iquitcovid.com"; sid:598228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid1thru19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid1thru19.com"; sid:598229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid5k.com"; sid:598230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona19.net"; sid:598231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona.today"; sid:598232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid.info"; sid:598233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kindhumancovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kindhumancovid19masks.com"; sid:598234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovidmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovidmadrid.com"; sid:598235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitsforcovid19.com"; sid:598236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kizilaybagis-covid19-tr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kizilaybagis-covid19-tr.com"; sid:598237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowyourcoronastatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowyourcoronastatus.com"; sid:598238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowyourcovidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowyourcovidstatus.com"; sid:598239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycovidclean.com"; sid:598240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lagunacovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lagunacovid19relief.com"; sid:598241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for landlordcovidconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"landlordcovidconsultant.com"; sid:598242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for landlordissuescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"landlordissuescovid19.com"; sid:598243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laughterinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laughterinthetimeofcovid19.com"; sid:598244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lenderissuescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lenderissuescovid19.com"; sid:598245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcovid19.today"; sid:598246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid.club"; sid:598247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limpiadorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limpiadorcoronavirus.com"; sid:598248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcovid19cases.com"; sid:598249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparaestorcontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparaestorcontraelcoronavirus.com"; sid:598250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasanticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasanticovid.net"; sid:598251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparascomerciocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparascomerciocovid.com"; sid:598252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparashosteleriacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparashosteleriacovid.com"; sid:598253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for master-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"master-covid.com"; sid:598254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meineweltmitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meineweltmitcorona.com"; sid:598255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentallyfitandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentallyfitandcovid.com"; sid:598256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalwellnessandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalwellnessandcovid.com"; sid:598257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michcovid.com"; sid:598258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovidaloca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovidaloca.com"; sid:598259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micovid.net"; sid:598260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mothersandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mothersandcovid.com"; sid:598261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabusters.com"; sid:598262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronabusters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronabusters.net"; sid:598263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacertificate.com"; sid:598264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachallenge.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachallenge.club"; sid:598265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachallenge.com"; sid:598266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachallenge.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachallenge.info"; sid:598267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronachallenge.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronachallenge.net"; sid:598268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronapassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronapassport.com"; sid:598269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirus19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirus19test.com"; sid:598270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushomebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushomebusiness.com"; sid:598271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19apparel.com"; sid:598272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19pass.com"; sid:598273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19passport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19passport.com"; sid:598274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19testing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19testing.net"; sid:598275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19tests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19tests.net"; sid:598276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19treatment.com"; sid:598277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidapparel.com"; sid:598278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbenefits.com"; sid:598279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtreatment.com"; sid:598280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicfit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicfit.com"; sid:598281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytest4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytest4covid19.com"; sid:598282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacincovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacincovid.info"; sid:598283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nccovidtest.com"; sid:598284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19corona.com"; sid:598285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necovidtracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necovidtracing.com"; sid:598286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for network-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"network-pandemic.net"; sid:598287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for networkpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"networkpandemic.net"; sid:598288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newlifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newlifeaftercovid.com"; sid:598289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-touch-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-touch-corona.com"; sid:598290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccoronavirusresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccoronavirusresponse.net"; sid:598291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronavirusresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronavirusresponse.net"; sid:598292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oairocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oairocovid.com"; sid:598293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponatimeinwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponatimeinwuhan.com"; sid:598294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for one-valley-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"one-valley-covid-19.net"; sid:598295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovid19screening.com"; sid:598296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onsitecovid19screenings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onsitecovid19screenings.com"; sid:598297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-action.com"; sid:598298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicanswers.com"; sid:598299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdistillation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdistillation.com"; sid:598300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-freedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-freedom.com"; sid:598301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinparadise.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinparadise.info"; sid:598302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsights.com"; sid:598303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-insurance-cover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-insurance-cover.com"; sid:598304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinvestors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinvestors.com"; sid:598305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartner.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartner.club"; sid:598306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartner.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartner.date"; sid:598307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartners.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartners.club"; sid:598308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartners.date - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartners.date"; sid:598309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpartner.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpartner.singles"; sid:598310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpizza.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpizza.co.uk"; sid:598311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpoly.com"; sid:598312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppersonalprotectionwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppersonalprotectionwear.com"; sid:598313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicppw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicppw.com"; sid:598314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparedness2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparedness2020.com"; sid:598315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprofiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprofiles.com"; sid:598316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionwear.com"; sid:598317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-puzzles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-puzzles.com"; sid:598318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpw.com"; sid:598319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresults.com"; sid:598320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicriskconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicriskconsulting.com"; sid:598321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetysigns.com"; sid:598322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstatsbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstatsbar.com"; sid:598323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictattoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictattoo.com"; sid:598324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictraders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictraders.com"; sid:598325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictragedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictragedies.com"; sid:598326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panelcovid.com"; sid:598327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for para-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"para-covid.info"; sid:598328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pastpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pastpandemics.com"; sid:598329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pcscovidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pcscovidpros.com"; sid:598330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcovid-19.info"; sid:598331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phillyfightingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phillyfightingcorona.com"; sid:598332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planprotectioncovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planprotectioncovid-19.info"; sid:598333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plantsoverpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plantsoverpandemics.com"; sid:598334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcorona20.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcorona20.info"; sid:598335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrestaurant.com"; sid:598336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrestaurants.com"; sid:598337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicbusinessschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicbusinessschool.com"; sid:598338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicchicago.com"; sid:598339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicchicago.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicchicago.info"; sid:598340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicchicago.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicchicago.net"; sid:598341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemic.net"; sid:598342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicrecovery.com"; sid:598343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicstressrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicstressrelief.com"; sid:598344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemictraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemictraining.com"; sid:598345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premierpandemicpriority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premierpandemicpriority.com"; sid:598346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premierpandemicprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premierpandemicprogram.com"; sid:598347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for premierpandemicprograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"premierpandemicprograms.com"; sid:598348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaspread.com"; sid:598349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19solution.com"; sid:598350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionecovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionecovid.cloud"; sid:598351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezione-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezione-covid.com"; sid:598352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proveedorescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proveedorescovid19.com"; sid:598353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseanticovidstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseanticovidstation.com"; sid:598354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseanticovidstations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseanticovidstations.com"; sid:598355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantinecarwashcoronaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantinecarwashcoronaca.com"; sid:598356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ra-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ra-covid.com"; sid:598357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for racovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"racovid.com"; sid:598358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readcovid19mag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readcovid19mag.com"; sid:598359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for readcovid19stories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"readcovid19stories.com"; sid:598360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reclamarcoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reclamarcoronavirus.info"; sid:598361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renterissuescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renterissuescovid19.com"; sid:598362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantstopcovid.com"; sid:598363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantstopcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantstopcovid.net"; sid:598364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcovid.club"; sid:598365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcovid.com"; sid:598366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retracecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retracecovid19.com"; sid:598367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rnacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rnacovid-19.com"; sid:598368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rnacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rnacovid19.com"; sid:598369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidstore.com"; sid:598370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanmiguelfreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanmiguelfreecovid.com"; sid:598371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdcovid.today"; sid:598372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for securitycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"securitycovid19.com"; sid:598373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellcovidppe19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellcovidppe19.com"; sid:598374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for skipcoronajo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"skipcoronajo.com"; sid:598375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialcostofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialcostofcovid19.com"; sid:598376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedcovid5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedcovid5.com"; sid:598377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speedcovid5test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speedcovid5test.com"; sid:598378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-covid.com"; sid:598379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stickers-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stickers-covid.com"; sid:598380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19foreclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19foreclosure.com"; sid:598381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-pandemics.com"; sid:598382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovidvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovidvirus.net"; sid:598383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tabeaudebordcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tabeaudebordcovid.com"; sid:598384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tech4covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tech4covid.net"; sid:598385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenantissuescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenantissuescovid19.com"; sid:598386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenerifefreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenerifefreecovid.com"; sid:598387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testme4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testme4covid19.com"; sid:598388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronaviruslawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronaviruslawyer.net"; sid:598389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabot.com"; sid:598390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclown.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclown.net"; sid:598391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaclowns.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaclowns.net"; sid:598392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamagician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamagician.com"; sid:598393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamagician.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamagician.net"; sid:598394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamagicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamagicians.com"; sid:598395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronamagicians.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronamagicians.net"; sid:598396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusgear.com"; sid:598397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19answers.com"; sid:598398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19scarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19scarf.com"; sid:598399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidconnect.com"; sid:598400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidhouse.com"; sid:598401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkart.com"; sid:598402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmagician.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmagician.net"; sid:598403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmagicians.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmagicians.net"; sid:598404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmart.com"; sid:598405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsafesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsafesets.com"; sid:598406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsecurity.com"; sid:598407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicagenda2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicagenda2020.com"; sid:598408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrivedespitecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrivedespitecovid19.com"; sid:598409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tokaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tokaicorona.com"; sid:598410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tookapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tookapandemic.com"; sid:598411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for triadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"triadcovid.com"; sid:598412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tycovidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tycovidheroes.com"; sid:598413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for urgencecovid19sn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"urgencecovid19sn.com"; sid:598414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usabeatscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usabeatscoronavirus.net"; sid:598415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usapandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usapandemicsupply.com"; sid:598416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusvaccine.com"; sid:598417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uspandemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uspandemicsupply.com"; sid:598418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid-19.club"; sid:598419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid19.club"; sid:598420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid-19.com"; sid:598421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid.club"; sid:598422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoanticovid.com"; sid:598423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunascoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunascoronavirus.info"; sid:598424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viacovid.com"; sid:598425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for waroncorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"waroncorona.net"; sid:598426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for washingtongascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"washingtongascovid19.com"; sid:598427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wcovid19live.com"; sid:598428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for we-fight-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"we-fight-covid.info"; sid:598429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worcestercovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worcestercovid19survey.com"; sid:598430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfanrui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfanrui.com"; sid:598431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfengchengji1.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfengchengji1.info"; sid:598432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfengchengji.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfengchengji.info"; sid:598433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpools4d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpools4d.com"; sid:598434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpools4d.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpools4d.net"; sid:598435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusinvestigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusinvestigation.com"; sid:598436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19rflexions-iqb.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19rflexions-iqb.today"; sid:598437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--grnder-soforthilfe-corona-gwc.nrw - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--grnder-soforthilfe-corona-gwc.nrw"; sid:598438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--sealizacioncovid19-o0b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--sealizacioncovid19-o0b.com"; sid:598439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessstrategyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessstrategyaftercorona.com"; sid:598440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessstrategyaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessstrategyaftercorona.net"; sid:598441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessstrategyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessstrategyaftercovid19.com"; sid:598442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourbusinessstrategyaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourbusinessstrategyaftercovid19.net"; sid:598443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcleaningbusinessstrategyaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcleaningbusinessstrategyaftercorona.com"; sid:598444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcleaningbusinessstrategyaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcleaningbusinessstrategyaftercorona.net"; sid:598445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcleaningbusinessstrategyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcleaningbusinessstrategyaftercovid19.com"; sid:598446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcleaningbusinessstrategyaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcleaningbusinessstrategyaftercovid19.net"; sid:598447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidbot.com"; sid:598448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youronlinebusinessstrategyaftercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youronlinebusinessstrategyaftercorona.net"; sid:598449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youronlinebusinessstrategyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youronlinebusinessstrategyaftercovid19.com"; sid:598450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youronlinebusinessstrategyaftercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youronlinebusinessstrategyaftercovid19.net"; sid:598451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 828clearcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"828clearcovidrelief.com"; sid:598452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99onlycovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99onlycovidresponse.com"; sid:598453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actingforcovid.com"; sid:598454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaonline.com"; sid:598455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronasales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronasales.com"; sid:598456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidlifestyles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidlifestyles.com"; sid:598457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacovidfasttrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacovidfasttrack.com"; sid:598458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alawcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alawcovidcare.com"; sid:598459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albertacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albertacovidcleaning.com"; sid:598460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecovid19haiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecovid19haiti.com"; sid:598461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allapprovedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allapprovedcovidtest.com"; sid:598462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amillionmilesagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amillionmilesagainstcovid.com"; sid:598463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaimmunitytea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaimmunitytea.com"; sid:598464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidcleaners.com"; sid:598465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcocovid.com"; sid:598466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiacovid19.com"; sid:598467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcovidquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcovidquestions.com"; sid:598468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid-19test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid-19test.net"; sid:598469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for behindcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"behindcovid19.com"; sid:598470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-covid-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-covid-cure.com"; sid:598471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boriscoronagame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boriscoronagame.com"; sid:598472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandedcovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandedcovidprotection.com"; sid:598473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brandedcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brandedcovidsupplies.com"; sid:598474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovid-19.com"; sid:598475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovidnews.com"; sid:598476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careerbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careerbeyondcovid.com"; sid:598477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charipaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charipaycovid.com"; sid:598478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcoronavirustest.com"; sid:598479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocorona.com"; sid:598480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicago-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicago-covid.com"; sid:598481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidsigns.com"; sid:598482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidtest.com"; sid:598483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for churchbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"churchbeyondcovid.com"; sid:598484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for circuitcovid-tunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"circuitcovid-tunisie.com"; sid:598485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citaliscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citaliscovid19.com"; sid:598486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cms-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cms-covid19.com"; sid:598487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coberturacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coberturacovid.com"; sid:598488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cococovidresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cococovidresources.com"; sid:598489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comingoutofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comingoutofcovid.com"; sid:598490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concursoempresascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concursoempresascovid19.com"; sid:598491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscovid-19.com"; sid:598492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona11.com"; sid:598493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona122.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona122.com"; sid:598494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19date.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19date.com"; sid:598495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19therapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19therapeutics.com"; sid:598496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona91babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona91babies.com"; sid:598497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona91baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona91baby.com"; sid:598498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababiesinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababiesinc.com"; sid:598499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyinc.com"; sid:598500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-banare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-banare.com"; sid:598501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankruptcyprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankruptcyprotection.com"; sid:598502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-besucherbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-besucherbox.com"; sid:598503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuch.com"; sid:598504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesslosslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesslosslawsuit.com"; sid:598505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachiever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachiever.com"; sid:598506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersnj.com"; sid:598507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacle.com"; sid:598508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedytour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedytour.com"; sid:598509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crash-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crash-2020.com"; sid:598510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeck.com"; sid:598511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosupholstery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosupholstery.com"; sid:598512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeagent.com"; sid:598513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetransaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetransaction.com"; sid:598514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-frei.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-frei.net"; sid:598515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gadgets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gadgets.com"; sid:598516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholidayadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholidayadvice.com"; sid:598517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoy.com"; sid:598518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiosk.com"; sid:598519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliza.com"; sid:598520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanuke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanuke.com"; sid:598521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaology.com"; sid:598522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicdaily.com"; sid:598523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicdailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicdailyreport.com"; sid:598524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicorigin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicorigin.com"; sid:598525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapedia.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapedia.info"; sid:598526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyglass.com"; sid:598527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyshop.com"; sid:598528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasandwich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasandwich.com"; sid:598529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasda.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasda.church"; sid:598530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldtechnologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldtechnologies.com"; sid:598531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasproductions.com"; sid:598532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasueca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasueca.com"; sid:598533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatik-eshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatik-eshop.com"; sid:598534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiser.com"; sid:598535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatools.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatools.company"; sid:598536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatownusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatownusa.com"; sid:598537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineupdate.com"; sid:598538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavac.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavac.info"; sid:598539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavi.net"; sid:598540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschampions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschampions.com"; sid:598541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoldwar.com"; sid:598542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelasnarices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelasnarices.com"; sid:598543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemporium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemporium.com"; sid:598544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstrespondersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstrespondersclassactionlawsuit.com"; sid:598545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenetictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenetictest.com"; sid:598546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcareworkersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcareworkersclassactionlawsuit.com"; sid:598547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheretostay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheretostay.com"; sid:598548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemiclatestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemiclatestnews.com"; sid:598549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyglass.com"; sid:598550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussimulation.com"; sid:598551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestchicago.com"; sid:598552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingaz.com"; sid:598553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmaps.net"; sid:598554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsites.net"; sid:598555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkiosk.com"; sid:598556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustuitionrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustuitionrefund.com"; sid:598557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinationcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinationcentre.com"; sid:598558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinecenters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinecenters.net"; sid:598559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinesites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinesites.net"; sid:598560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wine.com"; sid:598561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldpandemic.com"; sid:598562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithrhyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithrhyme.com"; sid:598563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abscreening.com"; sid:598564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abtesting.com"; sid:598565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airsensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airsensor.com"; sid:598566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiescomfirmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiescomfirmed.com"; sid:598567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodiesverified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodiesverified.com"; sid:598568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestonline.net"; sid:598569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestsites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestsites.net"; sid:598570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aroundtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aroundtheworld.com"; sid:598571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19artist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19artist.com"; sid:598572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19artist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19artist.net"; sid:598573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19automaticdooropeners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19automaticdooropeners.com"; sid:598574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19automaticdooropeners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19automaticdooropeners.com"; sid:598575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bankruptcyny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bankruptcyny.com"; sid:598576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biometric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biometric.com"; sid:598577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bioscience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bioscience.com"; sid:598578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blanket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blanket.com"; sid:598579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canceresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canceresources.com"; sid:598580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cancerresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cancerresource.com"; sid:598581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19changeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19changeworld.com"; sid:598582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaningdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaningdisinfecting.com"; sid:598583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cms.com"; sid:598584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coldwar.com"; sid:598585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coldwar.com"; sid:598586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comprarmascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comprarmascarillas.com"; sid:598587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conf.com"; sid:598588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronaviruspandemic.com"; sid:598589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseclaim.com"; sid:598590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cyprusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cyprusnews.com"; sid:598591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dailyreport.com"; sid:598592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19digital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19digital.com"; sid:598593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectioncompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectioncompanies.com"; sid:598594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecology.com"; sid:598595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19edge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19edge.com"; sid:598596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experiment.com"; sid:598597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firdge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firdge.com"; sid:598598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19firstrespondersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19firstrespondersclassactionlawsuit.com"; sid:598599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstrespondersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstrespondersclassactionlawsuit.com"; sid:598600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freetest.com"; sid:598601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gelhidroalcoholico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gelhidroalcoholico.com"; sid:598602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19genetictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19genetictest.com"; sid:598603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harvardlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harvardlaw.com"; sid:598604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcareworkersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcareworkersclassactionlawsuit.com"; sid:598605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareworkersclassactionlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareworkersclassactionlawsuit.com"; sid:598606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helping.com"; sid:598607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19heretostay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19heretostay.com"; sid:598608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heretostay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heretostay.com"; sid:598609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idme.com"; sid:598610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internationalnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internationalnews.com"; sid:598611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isacover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isacover.com"; sid:598612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killer.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killer.info"; sid:598613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kure.com"; sid:598614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legaladvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legaladvocates.com"; sid:598615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19locator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19locator.com"; sid:598616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19locator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19locator.net"; sid:598617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lovedoll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lovedoll.com"; sid:598618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maskproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maskproject.com"; sid:598619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noseandmouthcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noseandmouthcover.com"; sid:598620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noseandmouthprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noseandmouthprotection.com"; sid:598621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19noseandmouthshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19noseandmouthshield.com"; sid:598622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officedesign.com"; sid:598623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officedesign.com"; sid:598624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officedesign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officedesign.net"; sid:598625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officedesign.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officedesign.net"; sid:598626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officefurniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officefurniture.com"; sid:598627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officefurniture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officefurniture.com"; sid:598628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officefurniture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officefurniture.net"; sid:598629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officefurniture.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officefurniture.net"; sid:598630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officelayout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officelayout.com"; sid:598631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officelayout.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officelayout.net"; sid:598632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19office.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19office.net"; sid:598633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19office.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19office.net"; sid:598634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offices.com"; sid:598635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19offices.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19offices.net"; sid:598636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officespace.com"; sid:598637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officespace.com"; sid:598638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officespace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officespace.net"; sid:598639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officespace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officespace.net"; sid:598640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19origin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19origin.com"; sid:598641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pack.com"; sid:598642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-passed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-passed.com"; sid:598643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passed.com"; sid:598644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19privatetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19privatetesting.com"; sid:598645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidlabs.com"; sid:598646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestcorp.com"; sid:598647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-r.com"; sid:598648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reflection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reflection.com"; sid:598649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-remdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-remdesivir.com"; sid:598650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remdesivirrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remdesivirrx.com"; sid:598651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-remdesivirscript.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-remdesivirscript.com"; sid:598652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retreatsrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retreatsrelief.com"; sid:598653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ring.com"; sid:598654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roadmaptorecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roadmaptorecovery.com"; sid:598655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19roadtorecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19roadtorecovery.com"; sid:598656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safereception.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safereception.com"; sid:598657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19samedaydebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19samedaydebtrelief.com"; sid:598658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19simulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19simulator.com"; sid:598659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stores.com"; sid:598660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testchicago.com"; sid:598661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.expert"; sid:598662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingmaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingmaps.net"; sid:598663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingonline.net"; sid:598664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingsites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingsites.net"; sid:598665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkiosk.com"; sid:598666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testonline.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testonline.net"; sid:598667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testsnow.com"; sid:598668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teszt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teszt.com"; sid:598669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teszt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teszt.net"; sid:598670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tracker-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tracker-nj.com"; sid:598671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker-nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker-nj.com"; sid:598672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackernj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackernj.com"; sid:598673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tracker-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tracker-ny.com"; sid:598674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker-ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker-ny.com"; sid:598675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19utilitybelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19utilitybelt.com"; sid:598676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinationcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinationcentre.com"; sid:598677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinecenters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinecenters.net"; sid:598678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinelocations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinelocations.net"; sid:598679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinelocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinelocator.com"; sid:598680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinelocator.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinelocator.net"; sid:598681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinemaps.com"; sid:598682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinesites.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinesites.net"; sid:598683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualhomes.com"; sid:598684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualrealestate.com"; sid:598685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weather.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weather.com"; sid:598686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19we.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19we.com"; sid:598687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whatisbehind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whatisbehind.com"; sid:598688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid973.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid973.com"; sid:598689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactual.com"; sid:598690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaircurtains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaircurtains.com"; sid:598691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaiser.com"; sid:598692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalia.com"; sid:598693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalization.com"; sid:598694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalize.com"; sid:598695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodychicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodychicago.com"; sid:598696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidas.net"; sid:598697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-assistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-assistance.net"; sid:598698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviday19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviday19.com"; sid:598699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bet.com"; sid:598700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiometric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiometric.com"; sid:598701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbizhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbizhelp.net"; sid:598702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblanket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblanket.com"; sid:598703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptionlawfirm.com"; sid:598704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterscertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterscertified.com"; sid:598705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterscertified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterscertified.net"; sid:598706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.cloud"; sid:598707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcafe.net"; sid:598708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-campfire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-campfire.com"; sid:598709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresupply.com"; sid:598710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedcleaners.com"; sid:598711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchartify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchartify.com"; sid:598712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanconsulting.com"; sid:598713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleansed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleansed.com"; sid:598714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanvacay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanvacay.com"; sid:598715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearreadytowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearreadytowork.com"; sid:598716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcle.com"; sid:598717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleveland.com"; sid:598718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcompany.com"; sid:598719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-culture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-culture.com"; sid:598720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidculturedataportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidculturedataportal.com"; sid:598721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcwaft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcwaft.com"; sid:598722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseteam.com"; sid:598723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscussionlac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscussionlac.com"; sid:598724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefeat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefeat.com"; sid:598725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelopements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelopements.com"; sid:598726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentalfiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentalfiles.com"; sid:598727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesinfection.com"; sid:598728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialgear.com"; sid:598729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevice.com"; sid:598730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarmers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarmers.com"; sid:598731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstlineworkers.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstlineworkers.info"; sid:598732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstreponders.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstreponders.info"; sid:598733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fitness.com"; sid:598734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree.company"; sid:598735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeguatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeguatemala.com"; sid:598736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreereadytowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreereadytowork.com"; sid:598737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendly.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendly.info"; sid:598738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgearup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgearup.com"; sid:598739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhappy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhappy.com"; sid:598740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthsafety.com"; sid:598741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hep.com"; sid:598742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhep.com"; sid:598743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhep.net"; sid:598744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhighered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhighered.com"; sid:598745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhighered.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhighered.net"; sid:598746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididme.com"; sid:598747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidind.com"; sid:598748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insurance-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insurance-lawyer.com"; sid:598749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisacover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisacover.com"; sid:598750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobscorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobscorps.com"; sid:598751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobvictims.com"; sid:598752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeepsakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeepsakes.com"; sid:598753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitph.com"; sid:598754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlandlord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlandlord.com"; sid:598755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlearningloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlearningloss.com"; sid:598756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalchallenges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalchallenges.com"; sid:598757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivingessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivingessentials.com"; sid:598758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnanokits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnanokits.com"; sid:598759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewstop.com"; sid:598760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoseandmouthcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoseandmouthcover.com"; sid:598761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoseandmouthguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoseandmouthguard.com"; sid:598762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoseandmouthprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoseandmouthprotection.com"; sid:598763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoseandmouthshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoseandmouthshield.com"; sid:598764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnutriceuticals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnutriceuticals.com"; sid:598765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoxyde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoxyde.com"; sid:598766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpension.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpension.com"; sid:598767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pin.com"; sid:598768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppebeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppebeverlyhills.com"; sid:598769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppeconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppeconcierge.com"; sid:598770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppestore.com"; sid:598771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatetesting.com"; sid:598772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionpro.com"; sid:598773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqp.com"; sid:598774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidassay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidassay.com"; sid:598775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestateloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestateloans.com"; sid:598776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverypanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverypanel.com"; sid:598777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverytips.com"; sid:598778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefinance.com"; sid:598779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefclaim.com"; sid:598780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrescue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrescue.net"; sid:598781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawyers.com"; sid:598782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrns.com"; sid:598783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrr.com"; sid:598784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesalons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesalons.com"; sid:598785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyatwork.com"; sid:598786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyequipment.com"; sid:598787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysuppliesgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysuppliesgroup.com"; sid:598788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalonsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalonsafe.com"; sid:598789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsandwich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsandwich.com"; sid:598790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanibot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanibot.com"; sid:598791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanikit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanikit.com"; sid:598792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolfree.com"; sid:598793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolfriendly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolfriendly.com"; sid:598794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-score.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-score.net"; sid:598795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscore.net"; sid:598796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsinglesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsinglesonline.com"; sid:598797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmile.com"; sid:598798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialdistancingbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialdistancingbracelet.com"; sid:598799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatusnow.com"; sid:598800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrange.com"; sid:598801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplychainil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplychainil.com"; sid:598802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplychain.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplychain.net"; sid:598803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testing-results-10min.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testing-results-10min.com"; sid:598804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkiosk.com"; sid:598805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestschicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestschicago.com"; sid:598806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheafterparty.com"; sid:598807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidualization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidualization.com"; sid:598808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidualize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidualize.com"; sid:598809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidualize.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidualize.net"; sid:598810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarz.com"; sid:598811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarzombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarzombie.com"; sid:598812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarzombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarzombies.com"; sid:598813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwe.com"; sid:598814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-x-change.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-x-change.com"; sid:598815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-xchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-xchange.com"; sid:598816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cushnercovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cushnercovidlaw.com"; sid:598817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutarcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutarcorona.com"; sid:598818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciocovid.com"; sid:598819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectcovid.com"; sid:598820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecovid.info"; sid:598821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecovid.net"; sid:598822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didihavecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didihavecovids.com"; sid:598823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disciplinekillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disciplinekillcorona.com"; sid:598824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectnyccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectnyccovid19.com"; sid:598825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovid.net"; sid:598826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecovidnow.com"; sid:598827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donacioncovid.com"; sid:598828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid19buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid19buy.com"; sid:598829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadedesinfeccioncoronavirusbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadedesinfeccioncoronavirusbarcelona.com"; sid:598830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadedesinfeccioncoronavirusmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadedesinfeccioncoronavirusmadrid.com"; sid:598831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadesinfeccioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadesinfeccioncoronavirus.net"; sid:598832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadesinfeccioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadesinfeccioncovid-19.com"; sid:598833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresadesinfeccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresadesinfeccioncovid19.com"; sid:598834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmodel.com"; sid:598835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicoffer.com"; sid:598836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsimulation.com"; sid:598837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eric4covidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eric4covidgear.com"; sid:598838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ericforcovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ericforcovidgear.com"; sid:598839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecovid-19.com"; sid:598840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskforcovid.com"; sid:598841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for faceshieldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"faceshieldcovid.com"; sid:598842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fda-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fda-coronavirus.com"; sid:598843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firenzecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firenzecoronavirus.com"; sid:598844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forkliftrentalscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forkliftrentalscorona.com"; sid:598845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19masks.com"; sid:598846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidguatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidguatemala.com"; sid:598847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckyoucoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckyoucoronamask.com"; sid:598848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gelcovid19-hidroalcoholico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gelcovid19-hidroalcoholico.com"; sid:598849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gel-hidroalcoholicocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gel-hidroalcoholicocovid19.com"; sid:598850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronamasks.com"; sid:598851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacovidshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacovidshot.com"; sid:598852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getapprovedcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getapprovedcovidtest.com"; sid:598853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronabuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronabuster.com"; sid:598854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grillvolcandelacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grillvolcandelacorona.com"; sid:598855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveihadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveihadcovid19.com"; sid:598856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmewithcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmewithcovid19.info"; sid:598857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higheredcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higheredcovid.com"; sid:598858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for higheredcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"higheredcovid.net"; sid:598859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hostingcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hostingcovidfree.com"; sid:598860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamimmunecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamimmunecovid19.com"; sid:598861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illuminacovidseq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illuminacovidseq.com"; sid:598862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immuncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immuncovid19.com"; sid:598863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indicatoricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indicatoricovid.com"; sid:598864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-viruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-viruscovid19.com"; sid:598865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspiredbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspiredbycovid.com"; sid:598866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusban.com"; sid:598867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusban.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusban.net"; sid:598868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronaviruscoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronaviruscoalition.com"; sid:598869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronaviruscoalition.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronaviruscoalition.net"; sid:598870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronaviruspetition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronaviruspetition.com"; sid:598871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronaviruspetition.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronaviruspetition.net"; sid:598872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusprotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusprotest.com"; sid:598873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusprotest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusprotest.net"; sid:598874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusstrike.com"; sid:598875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcoronavirusstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcoronavirusstrike.net"; sid:598876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid19strike.com"; sid:598877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid19strike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid19strike.net"; sid:598878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid.com"; sid:598879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid.com"; sid:598880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covid.net"; sid:598881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovid.net"; sid:598882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covidstrike.com"; sid:598883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovidstrike.com"; sid:598884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacart-covidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacart-covidstrike.net"; sid:598885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartcovidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartcovidstrike.net"; sid:598886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercoronavirus.com"; sid:598887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercoronavirus.net"; sid:598888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercoronavirusstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercoronavirusstrike.com"; sid:598889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercoronavirusstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercoronavirusstrike.net"; sid:598890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid-19.com"; sid:598891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid19.com"; sid:598892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid-19.net"; sid:598893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid19.net"; sid:598894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid19strike.com"; sid:598895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid19strike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid19strike.net"; sid:598896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid.com"; sid:598897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovid.net"; sid:598898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovidstrike.com"; sid:598899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshoppercovidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshoppercovidstrike.net"; sid:598900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscoronavirus.com"; sid:598901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscoronavirus.net"; sid:598902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscoronavirusstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscoronavirusstrike.com"; sid:598903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscoronavirusstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscoronavirusstrike.net"; sid:598904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid-19.com"; sid:598905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid19.com"; sid:598906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid-19.net"; sid:598907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid19.net"; sid:598908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid19strike.com"; sid:598909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid19strike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid19strike.net"; sid:598910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid.com"; sid:598911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovid.net"; sid:598912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovidstrike.com"; sid:598913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartshopperscovidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartshopperscovidstrike.net"; sid:598914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercoronavirusstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercoronavirusstrike.com"; sid:598915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercoronavirusstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercoronavirusstrike.net"; sid:598916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovid19.com"; sid:598917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovid19.net"; sid:598918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovid19strike.com"; sid:598919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovid19strike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovid19strike.net"; sid:598920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovidstrike.com"; sid:598921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkercovidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkercovidstrike.net"; sid:598922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscoronavirusstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscoronavirusstrike.com"; sid:598923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscoronavirusstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscoronavirusstrike.net"; sid:598924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovid19.com"; sid:598925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovid19.net"; sid:598926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovid19strike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovid19strike.com"; sid:598927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovid19strike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovid19strike.net"; sid:598928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovidstrike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovidstrike.com"; sid:598929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacartworkerscovidstrike.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacartworkerscovidstrike.net"; sid:598930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesusovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesusovercovid.com"; sid:598931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaleidoscopetrust-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaleidoscopetrust-covid19.com"; sid:598932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kerrycovid19tablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kerrycovid19tablets.com"; sid:598933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kissmyasscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kissmyasscovid19.com"; sid:598934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit4covid.com"; sid:598935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowaboutcovid.com"; sid:598936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lanzarotecovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lanzarotecovid19free.com"; sid:598937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimeofcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimeofcorona2020.com"; sid:598938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livewithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livewithcovid-19.com"; sid:598939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lochcarroncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lochcarroncovid19.com"; sid:598940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loscoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loscoronabusters.com"; sid:598941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luxotticacovid19toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luxotticacovid19toolkit.com"; sid:598942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparasproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparasproteccioncovid19.com"; sid:598943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manufacturedpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manufacturedpandemic.com"; sid:598944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marketingpostcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marketingpostcoronavirus.com"; sid:598945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascoronavirusperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascoronavirusperu.com"; sid:598946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascoronavirusperu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascoronavirusperu.net"; sid:598947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid19usa.com"; sid:598948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-anticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-anticovid19.com"; sid:598949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-alternatif-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-alternatif-coronavirus.com"; sid:598950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-alternatif-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-alternatif-covid-19.com"; sid:598951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-alternatif-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-alternatif-covid19.com"; sid:598952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-alternatif-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-alternatif-covid.com"; sid:598953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquechirurgicalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquechirurgicalcovid-19.com"; sid:598954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueprotectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueprotectioncoronavirus.com"; sid:598955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-protection-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-protection-covid-19.com"; sid:598956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masqueprotectioncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masqueprotectioncovid-19.com"; sid:598957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-alternatif-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-alternatif-coronavirus.com"; sid:598958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquesprotectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquesprotectioncoronavirus.com"; sid:598959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-protection-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-protection-covid-19.com"; sid:598960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masques-protection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masques-protection-covid19.com"; sid:598961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materialdeproteccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materialdeproteccioncoronavirus.com"; sid:598962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for materialdeproteccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"materialdeproteccioncovid19.com"; sid:598963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mi-covid-archive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mi-covid-archive.com"; sid:598964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mister-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mister-covid.com"; sid:598965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for municovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"municovid19.com"; sid:598966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19bracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19bracelet.com"; sid:598967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbracelet.com"; sid:598968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidconnection.com"; sid:598969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemiccookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemiccookbook.com"; sid:598970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netejacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netejacoronavirus.com"; sid:598971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for niccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"niccovid.com"; sid:598972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19masks.com"; sid:598973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecovid19mask.com"; sid:598974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomorecovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomorecovid19masks.com"; sid:598975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycmuslimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycmuslimcovid.com"; sid:598976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidresponse.com"; sid:598977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlivesaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlivesaftercovid19.com"; sid:598978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourlivesaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourlivesaftercovid.com"; sid:598979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourpandemiclives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourpandemiclives.com"; sid:598980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdailyreport.com"; sid:598981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentialsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentialsusa.com"; sid:598982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfilter.com"; sid:598983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichelphq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichelphq.com"; sid:598984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclatestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclatestnews.com"; sid:598985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutreach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutreach.com"; sid:598986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplantshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplantshop.com"; sid:598987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesspoopkit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesspoopkit.info"; sid:598988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofforbusiness.com"; sid:598989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofthebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofthebook.com"; sid:598990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicregistration.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicregistration.info"; sid:598991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetyofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetyofficer.com"; sid:598992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsafetyofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsafetyofficers.com"; sid:598993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutionsng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutionsng.com"; sid:598994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusorigin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusorigin.com"; sid:598995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patinescovid19sv.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patinescovid19sv.info"; sid:598996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pflege-nach-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pflege-nach-corona.com"; sid:598997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pflegenachcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pflegenachcorona.com"; sid:598998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pflege-nach-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pflege-nach-corona.info"; sid:598999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pflege-nach-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pflege-nach-corona.net"; sid:599000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pflegenachcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pflegenachcorona.net"; sid:599001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phuckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phuckcovid.com"; sid:599002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinterestpandemicprovocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinterestpandemicprovocation.com"; sid:599003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmacovid19.com"; sid:599004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronadiseasegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronadiseasegroup.com"; sid:599005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-19restaurantdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-19restaurantdesign.com"; sid:599006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidearth.com"; sid:599007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemiccompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemiccompany.com"; sid:599008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicentertainment.com"; sid:599009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicfest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicfest.com"; sid:599010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicfestival.com"; sid:599011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicliving.com"; sid:599012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpractice.com"; sid:599013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbeaconcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbeaconcorona.com"; sid:599014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbeaconcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbeaconcoronavirus.com"; sid:599015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbeaconcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbeaconcovid-19.com"; sid:599016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbeaconcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbeaconcovid19.com"; sid:599017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectbeaconcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectbeaconcovid.com"; sid:599018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcoronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcoronascreening.com"; sid:599019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovid19teststore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovid19teststore.com"; sid:599020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rdvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rdvcovid.com"; sid:599021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rectalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rectalcovid.com"; sid:599022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rectalcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rectalcovid.net"; sid:599023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for referent-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"referent-coronavirus.com"; sid:599024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rememberthemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rememberthemcovid.com"; sid:599025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reparacionpccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reparacionpccovid19.com"; sid:599026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for responsable-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"responsable-coronavirus.com"; sid:599027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for responsable-securite-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"responsable-securite-coronavirus.com"; sid:599028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rx4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rx4covid.com"; sid:599029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for salesaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"salesaftercorona.com"; sid:599030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizenyccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizenyccovid19.com"; sid:599031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saveplacescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saveplacescorona.com"; sid:599032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for savespacescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"savespacescorona.com"; sid:599033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secondwavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secondwavecovid19.com"; sid:599034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serviciodesinfeccioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serviciodesinfeccioncoronavirus.com"; sid:599035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serviciodesinfeccioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serviciodesinfeccioncovid19.com"; sid:599036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solucion-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solucion-covid.com"; sid:599037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spirulina-covid19project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spirulina-covid19project.com"; sid:599038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcovid.com"; sid:599039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaproducten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaproducten.com"; sid:599040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaproducts.com"; sid:599041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusfacemaskpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusfacemaskpins.com"; sid:599042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirusmaskpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirusmaskpins.com"; sid:599043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaviruspins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaviruspins.com"; sid:599044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19facemaskpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19facemaskpins.com"; sid:599045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19maskpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19maskpins.com"; sid:599046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19maskpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19maskpins.com"; sid:599047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-19pins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-19pins.com"; sid:599048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19pins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19pins.com"; sid:599049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid972.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid972.com"; sid:599050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopstopcovid.com"; sid:599051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for store-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"store-covid.com"; sid:599052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studiolegalecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studiolegalecovid19.com"; sid:599053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tccovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tccovid19response.com"; sid:599054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for technocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"technocovid.com"; sid:599055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testme4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testme4covid.com"; sid:599056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-corona-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-corona-book.com"; sid:599057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusafterparty.com"; sid:599058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbattle.com"; sid:599059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19artist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19artist.com"; sid:599060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19artist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19artist.com"; sid:599061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19artistcookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19artistcookbook.com"; sid:599062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19artist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19artist.net"; sid:599063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19battle.com"; sid:599064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19battle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19battle.com"; sid:599065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19blanket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19blanket.com"; sid:599066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19cookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19cookbook.com"; sid:599067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19cookbook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19cookbook.net"; sid:599068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19files.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19files.com"; sid:599069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19lbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19lbs.com"; sid:599070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidafterparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidafterparty.com"; sid:599071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidartist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidartist.com"; sid:599072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidartistcookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidartistcookbook.com"; sid:599073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidartist.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidartist.net"; sid:599074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidblanket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidblanket.com"; sid:599075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcoach.com"; sid:599076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcompliantsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcompliantsociety.com"; sid:599077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-protection.com"; sid:599078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidsafesalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidsafesalon.com"; sid:599079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thelastpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thelastpandemic.com"; sid:599080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theoriginofthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theoriginofthecoronavirus.com"; sid:599081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcovid.com"; sid:599082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisismecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisismecovid19.com"; sid:599083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisismecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisismecovid19.info"; sid:599084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisismecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisismecovid19.net"; sid:599085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for timetolosethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"timetolosethecovid19.com"; sid:599086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totemcovid.com"; sid:599087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tracing-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tracing-covid.com"; sid:599088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tururutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tururutcovid.com"; sid:599089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tuttoperilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tuttoperilcovid.com"; sid:599090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for twohourcovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"twohourcovidkits.com"; sid:599091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ubersupport-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ubersupport-covid19.com"; sid:599092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uptodatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uptodatecovid19.com"; sid:599093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usvscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usvscovid.info"; sid:599094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccincoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccincoronavirus.net"; sid:599095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-coronavirus.com"; sid:599096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicoronavirus.com"; sid:599097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-coronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-coronavirus.info"; sid:599098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicoronavirus.info"; sid:599099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-coronavirus.net"; sid:599100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicoronavirus.net"; sid:599101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-covid.com"; sid:599102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicovid.com"; sid:599103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-covid.info"; sid:599104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicovid.info"; sid:599105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-covid.net"; sid:599106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicovid.net"; sid:599107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecoronafree.com"; sid:599108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whitepowercovidfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whitepowercovidfacts.com"; sid:599109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wicovidchart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wicovidchart.com"; sid:599110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidproject.com"; sid:599111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidproject.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidproject.info"; sid:599112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidproject.net"; sid:599113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrongfuldeathcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrongfuldeathcorona.com"; sid:599114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wrongfuldeathcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wrongfuldeathcovid.com"; sid:599115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanai.com"; sid:599116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbatco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbatco.com"; sid:599117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhankk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhankk.com"; sid:599118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmart.com"; sid:599119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmcl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmcl.com"; sid:599120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusbattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusbattle.com"; sid:599121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdaily.com"; sid:599122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdailyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdailyreport.com"; sid:599123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruslatestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruslatestnews.com"; sid:599124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusorigin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusorigin.com"; sid:599125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusresearch.com"; sid:599126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanyu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanyu.net"; sid:599127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xexcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xexcorona.com"; sid:599128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yycovidelectronicsdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yycovidelectronicsdrive.com"; sid:599129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidtesting.com"; sid:599130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualites-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualites-coronavirus.com"; sid:599131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovidcare.com"; sid:599132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adbcovid19policy.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adbcovid19policy.info"; sid:599133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghancovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghancovid19relief.com"; sid:599134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghancovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghancovidrelief.com"; sid:599135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovid-19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovid-19free.com"; sid:599136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicproject.com"; sid:599137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtestkit.com"; sid:599138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aucovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aucovidhelp.com"; sid:599139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awuhanlabvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awuhanlabvirus.com"; sid:599140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beheard4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beheard4covid.com"; sid:599141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizimpactcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizimpactcoronavirus.com"; sid:599142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blamecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blamecovid19.com"; sid:599143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blamecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blamecovid.com"; sid:599144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canarycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canarycovidfree.com"; sid:599145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturingcovidslc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturingcovidslc.com"; sid:599146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carewithcovid.com"; sid:599147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscovidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscovidmx.com"; sid:599148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcleaningcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcleaningcovid19.com"; sid:599149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.today"; sid:599150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copyprint-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copyprint-covid19.com"; sid:599151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19babies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19babies.com"; sid:599152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19babyinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19babyinc.com"; sid:599153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19defender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19defender.com"; sid:599154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19help.com"; sid:599155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaappliances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaappliances.com"; sid:599156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bride.com"; sid:599157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bypass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bypass.com"; sid:599158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bypass.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bypass.info"; sid:599159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bypass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bypass.net"; sid:599160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleancar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleancar.com"; sid:599161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoparenting.com"; sid:599162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrise.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrise.net"; sid:599163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacupchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacupchallenge.com"; sid:599164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadatingexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadatingexpert.com"; sid:599165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadays20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadays20.com"; sid:599166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecaridad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecaridad.com"; sid:599167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiag.com"; sid:599168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiktatur.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiktatur.info"; sid:599169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoupdate.com"; sid:599170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreefoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreefoods.com"; sid:599171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahertz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahertz.com"; sid:599172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahottie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahottie.com"; sid:599173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaissancewriters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaissancewriters.com"; sid:599174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaloveexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaloveexpert.com"; sid:599175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek100.com"; sid:599176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek10.com"; sid:599177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek1.com"; sid:599178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek2.com"; sid:599179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek3.com"; sid:599180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek4.com"; sid:599181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek66.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek66.com"; sid:599182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek6.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek6.com"; sid:599183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek77.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek77.com"; sid:599184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek7.com"; sid:599185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek88.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek88.com"; sid:599186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek8.com"; sid:599187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek99.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek99.com"; sid:599188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemek9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemek9.com"; sid:599189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilfs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilfs.com"; sid:599190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanamillion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanamillion.com"; sid:599191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatience.com"; sid:599192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatience.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatience.net"; sid:599193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarealstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarealstory.com"; sid:599194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarme.com"; sid:599195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarto.com"; sid:599196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitiserunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitiserunit.com"; sid:599197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasda.com"; sid:599198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdecaridad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdecaridad.com"; sid:599199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasignages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasignages.com"; sid:599200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoppers.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoppers.today"; sid:599201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastory.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastory.net"; sid:599202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportapp.com"; sid:599203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupportusa.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupportusa.info"; sid:599204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswede.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswede.com"; sid:599205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestdrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestdrivethru.com"; sid:599206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathera.com"; sid:599207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizingbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizingbusiness.com"; sid:599208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracing.net"; sid:599209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattp.com"; sid:599210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-advocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-advocate.com"; sid:599211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanitising.com"; sid:599212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-antibody.com"; sid:599213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedspecialists.com"; sid:599214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeaths.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeaths.life"; sid:599215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-disinfecting-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-disinfecting-services.com"; sid:599216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-disinfection-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-disinfection-services.com"; sid:599217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstresponderheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstresponderheroes.com"; sid:599218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcareheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcareheroes.com"; sid:599219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindia19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindia19.info"; sid:599220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopenrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopenrestaurants.com"; sid:599221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ozone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ozone.com"; sid:599222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-plasma-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-plasma-therapy.com"; sid:599223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyapp.com"; sid:599224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitiserunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitiserunit.com"; sid:599225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitising.com"; sid:599226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussprayingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussprayingservices.com"; sid:599227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tracing.com"; sid:599228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelpolicy.com"; sid:599229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravel.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravel.solutions"; sid:599230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateuk.com"; sid:599231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cov19pandemicprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cov19pandemicprotection.com"; sid:599232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acutemx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acutemx.com"; sid:599233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acutemx.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acutemx.info"; sid:599234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-advocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-advocate.com"; sid:599235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19amnesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19amnesia.com"; sid:599236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometest.net"; sid:599237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19awarenesstraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19awarenesstraining.com"; sid:599238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bod.com"; sid:599239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesscleaning.com"; sid:599240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerplan4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerplan4u.com"; sid:599241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buyerprotection.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buyerprotection.info"; sid:599242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedspecialists.com"; sid:599243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clean.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clean.biz"; sid:599244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningaz.com"; sid:599245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliancy.com"; sid:599246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connected.com"; sid:599247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cool.com"; sid:599248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cure.biz"; sid:599249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfecting.com"; sid:599250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfecting-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfecting-services.com"; sid:599251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disinfection-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disinfection-services.com"; sid:599252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.net"; sid:599253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19extempochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19extempochallenge.com"; sid:599254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19extempochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19extempochallenge.com"; sid:599255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fiasco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fiasco.com"; sid:599256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19firstresponderheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19firstresponderheroes.com"; sid:599257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floorsign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floorsign.com"; sid:599258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeandclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeandclear.com"; sid:599259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freetourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freetourism.com"; sid:599260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freetourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freetourism.com"; sid:599261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freeworldtourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freeworldtourism.com"; sid:599262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeworldtourism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeworldtourism.com"; sid:599263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitiser.com"; sid:599264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hazardcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hazardcleaning.com"; sid:599265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hazardcleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hazardcleaning.net"; sid:599266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareheroes.com"; sid:599267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homecleaning.com"; sid:599268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-home.com"; sid:599269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homepage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homepage.com"; sid:599270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19housecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19housecleaning.com"; sid:599271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icuconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icuconsult.com"; sid:599272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19icuconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19icuconsulting.com"; sid:599273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internet-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internet-support.com"; sid:599274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iot.com"; sid:599275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jab.com"; sid:599276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killer.net"; sid:599277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kit.biz"; sid:599278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyers.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyers.info"; sid:599279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19material.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19material.com"; sid:599280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialpark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialpark.com"; sid:599281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19modeling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19modeling.com"; sid:599282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mtc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mtc.com"; sid:599283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutationdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutationdatabase.com"; sid:599284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutationdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutationdatabase.com"; sid:599285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutationdatabase.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutationdatabase.net"; sid:599286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutationdatabase.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutationdatabase.net"; sid:599287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ohsguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ohsguidance.com"; sid:599288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plaintiffs.com"; sid:599289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plaintiffslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plaintiffslawyer.com"; sid:599290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plaintiffslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plaintiffslawyer.com"; sid:599291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plaintiffslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plaintiffslawyers.com"; sid:599292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plaintiffslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plaintiffslawyers.com"; sid:599293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poetry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poetry.com"; sid:599294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pro.com"; sid:599295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regs.com"; sid:599296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19result.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19result.com"; sid:599297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferealestate.com"; sid:599298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeworkplaceprinciples.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeworkplaceprinciples.com"; sid:599299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeworkplaceprinciples.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeworkplaceprinciples.net"; sid:599300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitiser.com"; sid:599301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sellerplan4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sellerplan4u.com"; sid:599302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shots.com"; sid:599303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19signages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19signages.com"; sid:599304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signages.com"; sid:599305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signagesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signagesolutions.com"; sid:599306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signfactory.com"; sid:599307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19slut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19slut.com"; sid:599308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sterilize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sterilize.com"; sid:599309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stockalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stockalerts.com"; sid:599310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-tcm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-tcm.com"; sid:599311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.tips"; sid:599312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnearme.net"; sid:599313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theconspiracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theconspiracy.com"; sid:599314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thefa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thefa.com"; sid:599315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-thefa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-thefa.com"; sid:599316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracker.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracker.mobi"; sid:599317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tradiesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tradiesafe.com"; sid:599318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tradiesafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tradiesafe.net"; sid:599319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upstateny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upstateny.com"; sid:599320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxcenter.com"; sid:599321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019earth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019earth.com"; sid:599322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20-19.info"; sid:599323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020new.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020new.com"; sid:599324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20clean.com"; sid:599325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-360.com"; sid:599326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid517.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid517.com"; sid:599327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9tees.com"; sid:599328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-advocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-advocate.com"; sid:599329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannihalator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannihalator.com"; sid:599330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattire.com"; sid:599331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbd.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbd.life"; sid:599332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bnb.com"; sid:599333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbod.com"; sid:599334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbullshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbullshit.com"; sid:599335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssafety.com"; sid:599336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuyandsell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuyandsell.com"; sid:599337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-buy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-buy.com"; sid:599338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuysell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuysell.com"; sid:599339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcartshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcartshield.com"; sid:599340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles2020.com"; sid:599341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles2020.net"; sid:599342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearpass.com"; sid:599343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearzone.com"; sid:599344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclub.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclub.net"; sid:599345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-commercialtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-commercialtesting.com"; sid:599346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialtesting.com"; sid:599347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compensation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compensation.info"; sid:599348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancy.com"; sid:599349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultinggroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultinggroup.com"; sid:599350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracers.com"; sid:599351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostbenefit.com"; sid:599352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-craft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-craft.com"; sid:599353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupboard.com"; sid:599354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcv.com"; sid:599355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecal.com"; sid:599356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefencesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefencesolutions.com"; sid:599357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevoted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevoted.com"; sid:599358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemotions.study - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemotions.study"; sid:599359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocam.com"; sid:599360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevaluation.com"; sid:599361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidex19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidex19.com"; sid:599362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfearsheep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfearsheep.com"; sid:599363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstlineworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstlineworkers.com"; sid:599364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstlineworkers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstlineworkers.net"; sid:599365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstreponders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstreponders.com"; sid:599366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstreponders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstreponders.net"; sid:599367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflag.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflag.net"; sid:599368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeandclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeandclear.com"; sid:599369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeweddings.com"; sid:599370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfullyclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfullyclean.com"; sid:599371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gaming.com"; sid:599372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgpo.com"; sid:599373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsanitiser.com"; sid:599374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsanitiserunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsanitiserunit.com"; sid:599375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelporangecounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelporangecounty.com"; sid:599376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hygeine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hygeine.com"; sid:599377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhygeine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhygeine.com"; sid:599378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfodemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfodemic.com"; sid:599379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidio.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidio.net"; sid:599380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobsupport.com"; sid:599381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleenusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleenusa.com"; sid:599382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkleenus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkleenus.com"; sid:599383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidknockout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidknockout.com"; sid:599384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalstore.com"; sid:599385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmental.com"; sid:599386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmilf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmilf.com"; sid:599387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmilfs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmilfs.com"; sid:599388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidne.com"; sid:599389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativelivesmatter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativelivesmatter.com"; sid:599390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.digital"; sid:599391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnient.com"; sid:599392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.guru"; sid:599393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenmemorial.com"; sid:599394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnuker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnuker.com"; sid:599395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonomics.com"; sid:599396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonomist.com"; sid:599397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonvacay2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonvacay2020.com"; sid:599398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organicsgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organicsgh.com"; sid:599399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidouting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidouting.com"; sid:599400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-passport.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-passport.info"; sid:599401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanetjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanetjournal.com"; sid:599402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plasma-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plasma-therapy.com"; sid:599403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplusmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplusmonitor.com"; sid:599404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppekits.com"; sid:599405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionsolution.com"; sid:599406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinechronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinechronicles.com"; sid:599407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyhome.com"; sid:599408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefund1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefund1.com"; sid:599409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchinfo.com"; sid:599410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchnews.com"; sid:599411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcedirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcedirectory.com"; sid:599412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids20.com"; sid:599413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe-realestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe-realestate.com"; sid:599414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyreport.com"; sid:599415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitiser.com"; sid:599416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitiserunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitiserunit.com"; sid:599417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureweddings.com"; sid:599418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftestkits.com"; sid:599419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignfactory.com"; sid:599420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslut.com"; sid:599421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstickerfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstickerfactory.com"; sid:599422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstocklive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstocklive.com"; sid:599423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnearme.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnearme.net"; sid:599424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttips.com"; sid:599425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthera.com"; sid:599426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapytracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapytracker.com"; sid:599427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermometercheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermometercheck.com"; sid:599428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracking.com"; sid:599429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelkits.com"; sid:599430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentmeds.com"; sid:599431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruthers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruthers.com"; sid:599432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidulating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidulating.com"; sid:599433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurham.com"; sid:599434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxcenter.com"; sid:599435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwipeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwipeout.com"; sid:599436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx11.com"; sid:599437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyouthproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyouthproject.com"; sid:599438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzapper.com"; sid:599439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzyme.com"; sid:599440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for craze-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"craze-corona.com"; sid:599441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazecorona.com"; sid:599442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendercovid19.com"; sid:599443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dicksoutforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dicksoutforcovid.com"; sid:599444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dpi-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dpi-covid19.com"; sid:599445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronatests.com"; sid:599446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucovidtest.com"; sid:599447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enviropandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enviropandemic.com"; sid:599448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enviropandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enviropandemics.com"; sid:599449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epicovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epicovid19shop.com"; sid:599450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espanacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espanacovidfree.com"; sid:599451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estacioncovid.com"; sid:599452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakepandemicvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakepandemicvirus.com"; sid:599453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcovid19.club"; sid:599454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitforcovid.com"; sid:599455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcovidshop.com"; sid:599456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for focuscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"focuscovid.info"; sid:599457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidarea.com"; sid:599458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckdacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckdacorona.com"; sid:599459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronalive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronalive.com"; sid:599460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glantzcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glantzcovidsupplies.com"; sid:599461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronaessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronaessentials.com"; sid:599462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glycovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glycovid-19.info"; sid:599463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grantcountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grantcountycovid.com"; sid:599464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hashcorona.com"; sid:599465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healedcovid.com"; sid:599466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healing-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healing-coronavirus.com"; sid:599467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpbecovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpbecovid19safe.com"; sid:599468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingfamiliesduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingfamiliesduringcovid19.com"; sid:599469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmebecovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmebecovid19safe.com"; sid:599470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmewithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmewithcovid19.com"; sid:599471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpmewithcovid19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpmewithcovid19safety.com"; sid:599472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpusbecovid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpusbecovid19safe.com"; sid:599473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpuswithcovid19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpuswithcovid19safety.com"; sid:599474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid19safetyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid19safetyapp.com"; sid:599475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid19safety.com"; sid:599476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid19safety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid19safety.net"; sid:599477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historicalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historicalcovid19.com"; sid:599478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hometest4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hometest4corona.com"; sid:599479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howwasyourpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howwasyourpandemic.com"; sid:599480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacorona19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacorona19baby.com"; sid:599481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronababy.com"; sid:599482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightcovid.com"; sid:599483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid19.education - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid19.education"; sid:599484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for injectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"injectcovid19.com"; sid:599485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iraqcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iraqcovid19.com"; sid:599486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwascovid-19.com"; sid:599487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwascovid19.com"; sid:599488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuscurescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuscurescovid19.com"; sid:599489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesushealscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesushealscovid19.com"; sid:599490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobsinwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobsinwuhan.com"; sid:599491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jordanskipcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jordanskipcorona.com"; sid:599492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9s4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9s4covid.com"; sid:599493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k9sforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k9sforcovid.com"; sid:599494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keepsafefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keepsafefromcovid.com"; sid:599495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitforcovid.com"; sid:599496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kn95coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kn95coronamask.com"; sid:599497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid-19.com"; sid:599498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libresdecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libresdecovid-19.com"; sid:599499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longtermcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longtermcovidcare.com"; sid:599500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lucacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lucacorona.com"; sid:599501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeitthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeitthroughcovid.com"; sid:599502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maelsadesinfeccioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maelsadesinfeccioncovid.com"; sid:599503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marrakechcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marrakechcovidfree.com"; sid:599504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacovidvirus.com"; sid:599505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matrixgocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matrixgocorona.com"; sid:599506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mmyquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mmyquestcovidtest.com"; sid:599507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneycovid-19.com"; sid:599508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mucorona.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mucorona.mobi"; sid:599509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mu-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mu-covid-19.com"; sid:599510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mundocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mundocovid-19.com"; sid:599511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaletters.com"; sid:599512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaregs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaregs.com"; sid:599513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-coronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-coronastory.com"; sid:599514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustory.com"; sid:599515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19attorneys.com"; sid:599516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19regs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19regs.com"; sid:599517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19rules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19rules.com"; sid:599518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidandmusicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidandmusicblog.com"; sid:599519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfashion.com"; sid:599520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidshirt.com"; sid:599521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidshirts.com"; sid:599522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-covidstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-covidstatus.com"; sid:599523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstyle.com"; sid:599524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mylifeaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mylifeaftercoronavirus.com"; sid:599525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqquestcovidtest.com"; sid:599526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myqueestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myqueestcovidtest.com"; sid:599527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquesstcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquesstcovidtest.com"; sid:599528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestccovidtest.com"; sid:599529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcoviddtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcoviddtest.com"; sid:599530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidteest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidteest.com"; sid:599531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtesst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtesst.com"; sid:599532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtestt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtestt.com"; sid:599533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtset.com"; sid:599534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidttest.com"; sid:599535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestscovidtest.com"; sid:599536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquesttcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquesttcovidtest.com"; sid:599537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquuestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquuestcovidtest.com"; sid:599538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myyquestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myyquestcovidtest.com"; sid:599539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirus.com"; sid:599540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirustestcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirustestcenters.com"; sid:599541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirustestcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirustestcentres.com"; sid:599542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcoronavirustest.com"; sid:599543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19testcenters.com"; sid:599544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacovid.com"; sid:599545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neucovid19.com"; sid:599546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nkacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nkacovid19.com"; sid:599547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19vaccine.com"; sid:599548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid19vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid19vax.com"; sid:599549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidvax.com"; sid:599550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norcalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norcalcovid.com"; sid:599551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for norcalcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"norcalcovidtest.com"; sid:599552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirusvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirusvax.com"; sid:599553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nutrition2fightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nutrition2fightcoronavirus.com"; sid:599554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19.info"; sid:599555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovidfree.com"; sid:599556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operacioncoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operacioncoronavirus.info"; sid:599557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbrewwerks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbrewwerks.com"; sid:599558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareunit.com"; sid:599559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccareunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccareunits.com"; sid:599560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchristmas.com"; sid:599561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdetox.com"; sid:599562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicflu.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicflu.info"; sid:599563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicindia.com"; sid:599564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemickush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemickush.com"; sid:599565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmethod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmethod.com"; sid:599566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmobilecareunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmobilecareunits.com"; sid:599567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicnewschannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicnewschannel.com"; sid:599568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesspoopkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesspoopkit.com"; sid:599569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesspoopkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesspoopkit.net"; sid:599570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictease.com"; sid:599571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictoothpaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictoothpaste.com"; sid:599572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petpandemic.com"; sid:599573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postalscovidianes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postalscovidianes.com"; sid:599574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidclub.com"; sid:599575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhome.com"; sid:599576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidimmunityclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidimmunityclub.com"; sid:599577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidjobs.com"; sid:599578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covidtraumaticstresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covidtraumaticstresssyndrome.com"; sid:599579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtraumaticstresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtraumaticstresssyndrome.com"; sid:599580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemicinnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemicinnovation.com"; sid:599581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicinnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicinnovation.com"; sid:599582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for project-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"project-covid19.com"; sid:599583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promocovid.com"; sid:599584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecao-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecao-covid.com"; sid:599585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccionparaelcovid19en3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccionparaelcovid19en3d.com"; sid:599586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectbusinessfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectbusinessfromcovid.com"; sid:599587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid19.com"; sid:599588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid19.info"; sid:599589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid19.net"; sid:599590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid.info"; sid:599591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid.net"; sid:599592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for publiccoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"publiccoronas.com"; sid:599593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for punishchina4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"punishchina4covid19.com"; sid:599594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidlabs.com"; sid:599595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinacorona.com"; sid:599596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retailcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retailcovid-19.com"; sid:599597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimentodannocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimentodannocovid.com"; sid:599598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rsppcovidmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rsppcovidmanager.com"; sid:599599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rsscoronawarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rsscoronawarriors.com"; sid:599600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for runfromcorona.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"runfromcorona.run"; sid:599601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizecovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizecovidnow.com"; sid:599602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecovid19.com"; sid:599603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sgcovid.com"; sid:599604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronafree.com"; sid:599605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for showvidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"showvidcovid.com"; sid:599606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sin-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sin-covid.com"; sid:599607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socalcovid.com"; sid:599608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solution-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solution-covid-19.com"; sid:599609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solution-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solution-covid19.com"; sid:599610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutioncovid19.com"; sid:599611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solutions-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solutions-covid-19.com"; sid:599612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscovid19.info"; sid:599613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizzazionecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizzazionecoronavirus.com"; sid:599614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizzazionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizzazionecovid.com"; sid:599615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopaucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopaucovid19.com"; sid:599616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.science - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.science"; sid:599617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivethecovid19depression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivethecovid19depression.com"; sid:599618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tecovid.com"; sid:599619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teslacovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teslacovidmask.com"; sid:599620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidantibody.com"; sid:599621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thaicovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thaicovid19.net"; sid:599622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaboard.com"; sid:599623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronabride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronabride.com"; sid:599624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19donation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19donation.com"; sid:599625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoviddepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoviddepot.com"; sid:599626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thefakepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thefakepandemic.com"; sid:599627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccook.com"; sid:599628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for therealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"therealcovid.com"; sid:599629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanlabvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanlabvirus.com"; sid:599630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomorrow-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomorrow-covid.info"; sid:599631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19payback.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19payback.biz"; sid:599632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19map.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19map.info"; sid:599633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valoracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valoracovid.com"; sid:599634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wesurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wesurvivecovid19.com"; sid:599635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid-19retailsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid-19retailsummit.com"; sid:599636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidproject.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidproject.world"; sid:599637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wscrushcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wscrushcovid19.com"; sid:599638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wthcovidclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wthcovidclothing.com"; sid:599639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanbuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanbuilding.com"; sid:599640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlabcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlabcoronavirus.com"; sid:599641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlabcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlabcovid19.com"; sid:599642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlabvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlabvirus.com"; sid:599643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanprotocol.com"; sid:599644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanprotocol.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanprotocol.net"; sid:599645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshipping.com"; sid:599646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantianqi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantianqi.net"; sid:599647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-tyy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-tyy.club"; sid:599648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-antikrpertest-fbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-antikrpertest-fbc.com"; sid:599649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-antikrper-test-sec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-antikrper-test-sec.com"; sid:599650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--espaacoronavirus-9tb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--espaacoronavirus-9tb.com"; sid:599651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--salk-bakanl-covid19-6ucj10biab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--salk-bakanl-covid19-6ucj10biab.net"; sid:599652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19attorneys.com"; sid:599653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19lawyers.com"; sid:599654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidlawyers.com"; sid:599655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2daycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2daycovid19test.com"; sid:599656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99covid.com"; sid:599657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronavirusvaccine.com"; sid:599658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid-19vaccine.com"; sid:599659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activecovid19.com"; sid:599660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecoronasyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecoronasyndrome.com"; sid:599661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecoronasyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecoronasyndrome.net"; sid:599662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovidsyndrome.com"; sid:599663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovidsyndrome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovidsyndrome.net"; sid:599664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona-sales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona-sales.com"; sid:599665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19sale.com"; sid:599666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid19sale.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid19sale.net"; sid:599667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidworld.com"; sid:599668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajscovidblog.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajscovidblog.life"; sid:599669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allborocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allborocovid19.com"; sid:599670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiesforcovid.com"; sid:599671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidclub.com"; sid:599672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidgear.com"; sid:599673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-market.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-market.com"; sid:599674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspectosfisiopatologicoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspectosfisiopatologicoscovid19.com"; sid:599675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asroadwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asroadwuhan.com"; sid:599676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australianchambercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australianchambercovid.com"; sid:599677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for be-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"be-corona.com"; sid:599678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioprotegidocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioprotegidocovid19.com"; sid:599679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioprotegidocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioprotegidocovid19.net"; sid:599680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bornemultimedia-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bornemultimedia-covid19.com"; sid:599681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingnewscorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingnewscorona.info"; sid:599682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bumpinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bumpinpandemic.com"; sid:599683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catcoronavirusmask.com"; sid:599684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catcovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catcovid-19mask.com"; sid:599685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catcovid19mask.com"; sid:599686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catpandemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catpandemicmask.com"; sid:599687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdforcovid.com"; sid:599688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovidrapidtest.com"; sid:599689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapestcoronainsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapestcoronainsurance.com"; sid:599690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinaunleashedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinaunleashedcovid.com"; sid:599691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovidcare.com"; sid:599692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chugsagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chugsagainstcorona.com"; sid:599693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claims4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claims4covid.com"; sid:599694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coalitionforepidemicpreparednessinnovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coalitionforepidemicpreparednessinnovations.com"; sid:599695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorfulpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorfulpandemic.com"; sid:599696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colourfulpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colourfulpandemic.com"; sid:599697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comerciocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comerciocovidfree.com"; sid:599698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copass-outil-covide-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copass-outil-covide-19.com"; sid:599699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanalysts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanalysts.com"; sid:599700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodytesting.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodytesting.info"; sid:599701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabiden.com"; sid:599702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacandids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacandids.com"; sid:599703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-city.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-city.com"; sid:599704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrossdressing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrossdressing.com"; sid:599705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacv.com"; sid:599706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dag.com"; sid:599707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadag.com"; sid:599708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectionservices.com"; sid:599709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadry.com"; sid:599710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpo.com"; sid:599711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-croatia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-croatia.com"; sid:599712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecroatia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecroatia.com"; sid:599713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeday.com"; sid:599714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-travel.com"; sid:599715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-free-trips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-free-trips.com"; sid:599716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetrips.com"; sid:599717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevacationrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevacationrentals.com"; sid:599718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardmasks.com"; sid:599719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairs.com"; sid:599720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalevenstestament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalevenstestament.com"; sid:599721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalitigators.com"; sid:599722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medic.com"; sid:599723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapostres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapostres.com"; sid:599724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronappekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronappekit.com"; sid:599725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqatarsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqatarsupplies.com"; sid:599726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarena.com"; sid:599727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresources.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresources.info"; sid:599728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaferentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaferentals.com"; sid:599729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermhoreca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermhoreca.com"; sid:599730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermkantoor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermkantoor.com"; sid:599731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermwerkplek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermwerkplek.com"; sid:599732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzset.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzset.info"; sid:599733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzset.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzset.net"; sid:599734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascotch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascotch.com"; sid:599735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatus.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatus.life"; sid:599736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastick.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastick.net"; sid:599737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplies.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplies.info"; sid:599738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupply.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupply.info"; sid:599739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestament.com"; sid:599740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcenters.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcenters.info"; sid:599741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingmoose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingmoose.com"; sid:599742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingnearme.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingnearme.info"; sid:599743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsites.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsites.info"; sid:599744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsitesnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsitesnearme.com"; sid:599745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsitesnearme.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsitesnearme.info"; sid:599746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trade.com"; sid:599747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunterstuetzung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunterstuetzung.com"; sid:599748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdate.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdate.life"; sid:599749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.group"; sid:599750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.guru"; sid:599751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.solutions"; sid:599752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaregiver.com"; sid:599753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesktop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesktop.com"; sid:599754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesktops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesktops.com"; sid:599755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusepidemiolgy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusepidemiolgy.com"; sid:599756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgilead.com"; sid:599757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunisation.com"; sid:599758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficesafety.com"; sid:599759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficespace.com"; sid:599760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusofficespaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusofficespaces.com"; sid:599761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreenprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreenprotection.com"; sid:599762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingmoose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingmoose.com"; sid:599763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestreport.com"; sid:599764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-therapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-therapies.com"; sid:599765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.network"; sid:599766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkspace.com"; sid:599767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020mx.com"; sid:599768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acutemx.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acutemx.guide"; sid:599769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acutemx.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acutemx.support"; sid:599770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allaince.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allaince.com"; sid:599771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analysts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analysts.com"; sid:599772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestingsite.com"; sid:599773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awarness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awarness.com"; sid:599774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beverlyhills.com"; sid:599775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-card.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-card.com"; sid:599776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdmx.com"; sid:599777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certified.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certified.net"; sid:599778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningbrooklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningbrooklyn.com"; sid:599779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningdelaware.com"; sid:599780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmaryland.com"; sid:599781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnewjersey.com"; sid:599782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningpa.com"; sid:599783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaning-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaning-services.com"; sid:599784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningstatenisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningstatenisland.com"; sid:599785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanservices.com"; sid:599786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruises.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruises.info"; sid:599787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-desinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-desinfections.com"; sid:599788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingcompany.com"; sid:599789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingdelaware.com"; sid:599790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingmaryland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingmaryland.com"; sid:599791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingphiladelphia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingphiladelphia.com"; sid:599792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dogmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dogmask.com"; sid:599793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dogmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dogmask.com"; sid:599794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eauclaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eauclaire.com"; sid:599795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-face-masks-personal-protection-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-face-masks-personal-protection-products.com"; sid:599796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-graphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-graphs.com"; sid:599797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haitik2d.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haitik2d.info"; sid:599798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesellingprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesellingprotection.com"; sid:599799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitality.com"; sid:599800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hygienebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hygienebox.com"; sid:599801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inkorea.com"; sid:599802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19julyand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19julyand.com"; sid:599803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19key.com"; sid:599804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19khulna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19khulna.com"; sid:599805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-mask-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-mask-sale.com"; sid:599806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mask-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mask-sale.com"; sid:599807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mathblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mathblog.com"; sid:599808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memoirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memoirs.com"; sid:599809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mukti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mukti.com"; sid:599810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nyccleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nyccleaning.com"; sid:599811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlineresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlineresource.com"; sid:599812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-online-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-online-test.com"; sid:599813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19organic-drug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19organic-drug.com"; sid:599814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19organicdrug-madagascar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19organicdrug-madagascar.com"; sid:599815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19organics-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19organics-cure.com"; sid:599816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionequipment.com"; sid:599817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protection.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protection.net"; sid:599818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quilt.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quilt.info"; sid:599819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19racetrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19racetrack.com"; sid:599820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19racetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19racetracker.com"; sid:599821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoveryindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoveryindex.com"; sid:599822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyclass.com"; sid:599823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-schutz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-schutz.info"; sid:599824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scientific.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scientific.world"; sid:599825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screenprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screenprotection.com"; sid:599826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlementhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlementhelp.com"; sid:599827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19somaliland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19somaliland.com"; sid:599828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingfromhome.com"; sid:599829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingmoose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingmoose.com"; sid:599830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingsiteoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingsiteoakland.com"; sid:599831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testreport.com"; sid:599832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toy.com"; sid:599833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toy.com"; sid:599834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19toys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19toys.com"; sid:599835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracktrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracktrace.com"; sid:599836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19treatmentcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19treatmentcenter.com"; sid:599837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidae.com"; sid:599838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alert.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alert.info"; sid:599839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalysts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalysts.com"; sid:599840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandafter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandafter.com"; sid:599841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangels.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangels.net"; sid:599842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattheborder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattheborder.com"; sid:599843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatty.com"; sid:599844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiotics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiotics.com"; sid:599845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbroker.com"; sid:599846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-businessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-businessfunding.com"; sid:599847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesspolicyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesspolicyclaims.com"; sid:599848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessservices.com"; sid:599849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ca.com"; sid:599850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcansuckit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcansuckit.com"; sid:599851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecollective.com"; sid:599852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatalyst.com"; sid:599853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsfunding.com"; sid:599854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanaz.com"; sid:599855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancenter.com"; sid:599856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningdelaware.com"; sid:599857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningfl.com"; sid:599858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnewjersey.com"; sid:599859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.nyc"; sid:599860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommodities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommodities.com"; sid:599861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommodity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommodity.com"; sid:599862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorrector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorrector.com"; sid:599863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurenews.com"; sid:599864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurenews.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurenews.info"; sid:599865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cuts.com"; sid:599866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatadash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatadash.com"; sid:599867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatarights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatarights.com"; sid:599868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeclaration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeclaration.com"; sid:599869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefense.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefense.net"; sid:599870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivider.com"; sid:599871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencysupplies.com"; sid:599872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideolink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideolink.com"; sid:599873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeestepona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeestepona.com"; sid:599874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlinetribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlinetribute.com"; sid:599875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundings.com"; sid:599876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguide.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguide.guru"; sid:599877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcheck.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcheck.net"; sid:599878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelponline.com"; sid:599879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhighschoolgraduates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhighschoolgraduates.com"; sid:599880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometrial.com"; sid:599881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididcard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididcard.net"; sid:599882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinside.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinside.net"; sid:599883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsuranceactnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsuranceactnow.com"; sid:599884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsbook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsbook.net"; sid:599885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkimlik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkimlik.com"; sid:599886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaverune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaverune.com"; sid:599887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawresponse.com"; sid:599888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawresponseteam.com"; sid:599889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlms.com"; sid:599890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskscalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskscalifornia.com"; sid:599891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialtribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialtribute.com"; sid:599892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmotivationnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmotivationnow.com"; sid:599893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnyfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnyfw.com"; sid:599894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopening.com"; sid:599895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpethealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpethealth.com"; sid:599896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpethealth.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpethealth.info"; sid:599897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpethealthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpethealthsupplies.com"; sid:599898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplacards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplacards.com"; sid:599899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protect.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protect.info"; sid:599900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectus.com"; sid:599901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsychotherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsychotherapist.com"; sid:599902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpulseox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpulseox.com"; sid:599903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-q.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-q.com"; sid:599904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrange.com"; sid:599905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidranks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidranks.com"; sid:599906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryinsurance.com"; sid:599907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverylab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverylab.com"; sid:599908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resource-allocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resource-allocation.com"; sid:599909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawfirm.com"; sid:599910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawfirm.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawfirm.info"; sid:599911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawfirm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawfirm.net"; sid:599912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawyer.com"; sid:599913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawyer.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawyer.info"; sid:599914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponselawyer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponselawyer.net"; sid:599915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrpbp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrpbp.com"; sid:599916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrunner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrunner.com"; sid:599917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestaging.com"; sid:599918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetymaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetymaskshop.com"; sid:599919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementfund.com"; sid:599920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementhelp.com"; sid:599921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementhelp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementhelp.info"; sid:599922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementhelp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementhelp.net"; sid:599923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslide.com"; sid:599924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsl.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsl.info"; sid:599925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmashed.com"; sid:599926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoloutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoloutions.com"; sid:599927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsquares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsquares.com"; sid:599928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstressmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstressmanagement.com"; sid:599929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-super-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-super-busters.com"; sid:599930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuperbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuperbusters.com"; sid:599931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuraksha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuraksha.com"; sid:599932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbooth.com"; sid:599933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingbooths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingbooths.com"; sid:599934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmoose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmoose.com"; sid:599935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtextiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtextiles.com"; sid:599936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.theater - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.theater"; sid:599937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtms.com"; sid:599938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoes.net"; sid:599939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.tours - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.tours"; sid:599940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtower.com"; sid:599941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrader.com"; sid:599942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveladvice.com"; sid:599943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-treatments.com"; sid:599944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialathome.com"; sid:599945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtribune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtribune.com"; sid:599946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidukcommunitygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidukcommunitygroup.com"; sid:599947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviewinteractive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviewinteractive.com"; sid:599948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusmedicine.com"; sid:599949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoices.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoices.info"; sid:599950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkspace.com"; sid:599951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldinfo.com"; sid:599952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crochet-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crochet-covid.com"; sid:599953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronesofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronesofcorona.com"; sid:599954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curvacovid19argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curvacovid19argentina.com"; sid:599955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dagboekcollectiefcoronacrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dagboekcollectiefcoronacrisis.com"; sid:599956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dag-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dag-corona.com"; sid:599957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dagcorona.com"; sid:599958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailystatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailystatscovid19.com"; sid:599959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deceduticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deceduticoronavirus.com"; sid:599960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19now.com"; sid:599961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendingfloridacovidclaims.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendingfloridacovidclaims.info"; sid:599962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecovid19cleaning.com"; sid:599963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destorycovid19.com"; sid:599964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diacovid-19.com"; sid:599965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diacovid19.com"; sid:599966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diacovid.com"; sid:599967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diag-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diag-covid-19.com"; sid:599968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disappearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disappearcorona.com"; sid:599969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcoronavirusmask.com"; sid:599970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcovid-19mask.com"; sid:599971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcovid19mask.com"; sid:599972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogpandemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogpandemicmask.com"; sid:599973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donwuhan.com"; sid:599974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drbartcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drbartcovidtest.com"; sid:599975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dxcoronavirus.com"; sid:599976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dycovid.com"; sid:599977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for edgsj-covidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"edgsj-covidcases.com"; sid:599978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effective5ideastokillcovid19germsathome.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effective5ideastokillcovid19germsathome.recipes"; sid:599979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicglobal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicglobal.net"; sid:599980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprojections.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprojections.group"; sid:599981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facilitycovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facilitycovidcleaners.com"; sid:599982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fda-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fda-covid19.com"; sid:599983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.biz"; sid:599984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidathome.com"; sid:599985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacovid19testingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacovid19testingsite.com"; sid:599986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findinganewnormalaftercovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findinganewnormalaftercovid-19.com"; sid:599987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidcleaning.com"; sid:599988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidcleaning.com"; sid:599989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fsmcoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fsmcoronablog.com"; sid:599990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid19.today"; sid:599991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ganchoanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ganchoanticovid.com"; sid:599992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gbicovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gbicovidsupplies.com"; sid:599993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19masks.net"; sid:599994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidrapidtest.com"; sid:599995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getovercovid19.com"; sid:599996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicshield.com"; sid:599997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronapro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronapro.com"; sid:599998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocovid19go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocovid19go.com"; sid:599999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for graficacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"graficacovid19.com"; sid:600000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpgetcoronamoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpgetcoronamoney.com"; sid:600001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horecacoronaproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horecacoronaproof.com"; sid:600002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for horecacoronaschermen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"horecacoronaschermen.com"; sid:600003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hosteleriacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hosteleriacovidfree.com"; sid:600004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovidtrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovidtrackers.com"; sid:600005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igienizzantecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igienizzantecoronavirus.com"; sid:600006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igienizzantecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igienizzantecovid19.com"; sid:600007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunityfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunityfromcovid19.com"; sid:600008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspectcovid19.com"; sid:600009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inspectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inspectcovid.com"; sid:600010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurcovid.cat"; sid:600011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iscoronavirusreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iscoronavirusreal.com"; sid:600012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isocovid-19.com"; sid:600013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itracecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itracecovid.com"; sid:600014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itrackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itrackcovid.com"; sid:600015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jedcovid19.com"; sid:600016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kantoorcoronaproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kantoorcoronaproof.com"; sid:600017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kibriscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kibriscorona.com"; sid:600018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickscorona.com"; sid:600019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kungflucovidtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kungflucovidtees.com"; sid:600020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for la-covidie-humaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"la-covidie-humaine.com"; sid:600021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawlibrariansmonitoringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawlibrariansmonitoringcovid19.com"; sid:600022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lead-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lead-covid19.com"; sid:600023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leadcovid.com"; sid:600024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifecovidtest.com"; sid:600025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeinthetimecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeinthetimecorona.com"; sid:600026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for l-outil-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"l-outil-covid.com"; sid:600027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macovidbox.com"; sid:600028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovid19cleaning.com"; sid:600029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covid.biz"; sid:600030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquecoronaviruso2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquecoronaviruso2.com"; sid:600031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memorialcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memorialcovid.info"; sid:600032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19card.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19card.com"; sid:600033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidachievements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidachievements.com"; sid:600034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidimmune.com"; sid:600035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidtest.com"; sid:600036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19treatment.com"; sid:600037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19treatments.com"; sid:600038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovidtreatment.com"; sid:600039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtest-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtest-covid-19.com"; sid:600040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtestcovid19.com"; sid:600041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtest-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtest-covid-19.net"; sid:600042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtestcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtestcovid19.net"; sid:600043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtest-covid.com"; sid:600044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtestcovid.com"; sid:600045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtest-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtest-covid.net"; sid:600046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ngtestcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ngtestcovid.net"; sid:600047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyfwcovidcollections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyfwcovidcollections.com"; sid:600048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occovid-19.com"; sid:600049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovid19days.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovid19days.com"; sid:600050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oxcovid.com"; sid:600051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplanner.com"; sid:600052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpilgrimage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpilgrimage.com"; sid:600053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpilgrimage.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpilgrimage.world"; sid:600054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivot.net"; sid:600055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprogram.com"; sid:600056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-surfing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-surfing.com"; sid:600057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusimpact.com"; sid:600058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovidlawyer.com"; sid:600059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovidlawyers.com"; sid:600060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pennsylvaniacovidresponselawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pennsylvaniacovidresponselawfirm.com"; sid:600061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharma-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharma-covid-19.com"; sid:600062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcoronaviruslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcoronaviruslawyers.com"; sid:600063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidinsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidinsurancelawyer.com"; sid:600064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidinsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidinsurancelawyers.com"; sid:600065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlawresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlawresponse.com"; sid:600066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlawyer.com"; sid:600067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlawyers.com"; sid:600068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlawyers.net"; sid:600069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlitigationlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlitigationlawyer.com"; sid:600070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidlitigationlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidlitigationlawyers.com"; sid:600071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidresponselawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidresponselawfirm.com"; sid:600072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidresponselawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidresponselawyer.com"; sid:600073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pittsburghcovidresponselawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pittsburghcovidresponselawyers.com"; sid:600074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playascovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playascovidfree.com"; sid:600075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexirom-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexirom-covid19.com"; sid:600076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiromcovid19.com"; sid:600077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plexiromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plexiromcovid.com"; sid:600078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19guidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19guidance.com"; sid:600079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidadvisors.com"; sid:600080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidconsultants.com"; sid:600081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidguidance.com"; sid:600082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidpain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidpain.com"; sid:600083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidplan.com"; sid:600084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidrock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidrock.com"; sid:600085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtreatment.com"; sid:600086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicguidance.com"; sid:600087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pouryourcoronaout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pouryourcoronaout.com"; sid:600088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prestigecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prestigecovidfree.com"; sid:600089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for profoundcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"profoundcovid.com"; sid:600090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncovidperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncovidperu.com"; sid:600091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid19.biz"; sid:600092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prudencecovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prudencecovid.biz"; sid:600093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rahatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rahatcorona.com"; sid:600094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoviddeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoviddeals.com"; sid:600095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinventingaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinventingaftercovid.com"; sid:600096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relieffundcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relieffundcovid19.com"; sid:600097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rickrollcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rickrollcovid19.com"; sid:600098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for risarcimenticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"risarcimenticovid19.com"; sid:600099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saintcorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saintcorona.info"; sid:600100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sdscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sdscovid.com"; sid:600101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shotforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shotforcovid19.com"; sid:600102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spartacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spartacovid.com"; sid:600103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadkindnessnotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadkindnessnotcorona.com"; sid:600104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadkindnessnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadkindnessnotcovid.com"; sid:600105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffcovid19.com"; sid:600106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-latam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-latam.com"; sid:600107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-mundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-mundo.com"; sid:600108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suewuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suewuhan.com"; sid:600109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survingcovid19.com"; sid:600110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tejedafreecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tejedafreecovid-19.com"; sid:600111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoloursofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoloursofcovid.com"; sid:600112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusparadox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusparadox.com"; sid:600113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusvaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusvaccination.com"; sid:600114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19effect.com"; sid:600115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19ppe.com"; sid:600116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidawards.com"; sid:600117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclaimslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclaimslawyer.com"; sid:600118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidclinic.com"; sid:600119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcovers.com"; sid:600120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidfile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidfile.com"; sid:600121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkillers.com"; sid:600122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidtruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidtruth.com"; sid:600123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecurecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecurecovid19.com"; sid:600124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theharleystreetcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theharleystreetcovidclinic.com"; sid:600125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepongpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepongpandemic.com"; sid:600126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepostcoronalife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepostcoronalife.com"; sid:600127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theprocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theprocovid19.com"; sid:600128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thisweekincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thisweekincorona.com"; sid:600129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatscoronavirus.com"; sid:600130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatscovid19.com"; sid:600131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trienlamanhcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trienlamanhcovid-19.com"; sid:600132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvccovid19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvccovid19killer.com"; sid:600133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidkiller.com"; sid:600134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecorona.info"; sid:600135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecoronavirus.com"; sid:600136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecovid-19.com"; sid:600137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecovid19.info"; sid:600138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecovid.info"; sid:600139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidacovidiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidacovidiana.com"; sid:600140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-coronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-coronavirus.biz"; sid:600141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigicoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigicoronavirus.biz"; sid:600142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vigi-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vigi-covid.biz"; sid:600143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitaminadycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitaminadycovid.com"; sid:600144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamind-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamind-covid.com"; sid:600145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearonecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearonecovid19.com"; sid:600146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for werkplekcoronaproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"werkplekcoronaproof.com"; sid:600147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovidinsurancelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovidinsurancelawyer.com"; sid:600148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovidinsurancelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovidinsurancelawyers.com"; sid:600149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovidlawyer.com"; sid:600150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westvirginiacovidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westvirginiacovidlawyers.com"; sid:600151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatsaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatsaftercovid.com"; sid:600152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whocovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whocovid.info"; sid:600153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whosurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whosurvivedcovid19.com"; sid:600154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for working-after-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"working-after-covid.com"; sid:600155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovid19tracker.com"; sid:600156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldunitedagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldunitedagainstcoronavirus.com"; sid:600157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid-19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid-19pandemic.com"; sid:600158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjiameiqiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjiameiqiye.com"; sid:600159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhano2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhano2.com"; sid:600160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviruscatmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviruscatmask.com"; sid:600161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusdogmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusdogmask.com"; sid:600162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanwans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanwans.com"; sid:600163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwcorona.com"; sid:600164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yearofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yearofthecovid.com"; sid:600165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19solution.com"; sid:600166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for your-covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"your-covidtest.com"; sid:600167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021antiviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021antiviruscovid19.com"; sid:600168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covid19antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covid19antivirus.com"; sid:600169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800covidlaw.com"; sid:600170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 888covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"888covidlaw.com"; sid:600171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 91-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"91-covid.com"; sid:600172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid2020.com"; sid:600173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinescovid19.com"; sid:600174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinesguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinesguidelinescovid19.com"; sid:600175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airmaskprocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airmaskprocovid-19.com"; sid:600176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudacoronavirus.com"; sid:600177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19guide.com"; sid:600178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antifragilecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antifragilecovid.com"; sid:600179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antoniocoronato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antoniocoronato.com"; sid:600180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apa-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apa-covid-19.com"; sid:600181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbeitsrecht-corona-hagen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbeitsrecht-corona-hagen.com"; sid:600182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ascovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ascovidcleaner.com"; sid:600183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atendimentocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atendimentocovid.com"; sid:600184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-perte-exploitation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-perte-exploitation-covid-19.com"; sid:600185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for balisafecovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"balisafecovidsafe.com"; sid:600186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcovid-19.com"; sid:600187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcypandemic.com"; sid:600188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19.com"; sid:600189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthepandemic.com"; sid:600190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bilbaocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bilbaocovidfree.com"; sid:600191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bioseguridadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bioseguridadcoronavirus.com"; sid:600192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid19defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid19defense.com"; sid:600193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogscorona.com"; sid:600194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breatheazycovid19trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breatheazycovid19trial.com"; sid:600195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidcleaner.com"; sid:600196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartelcoronavirus.com"; sid:600197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartelescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartelescoronavirus.com"; sid:600198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for castelloncovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"castelloncovidfree.com"; sid:600199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbd4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbd4covid.com"; sid:600200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid.com"; sid:600201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cecovidenov.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cecovidenov.blue"; sid:600202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centercovid19.com"; sid:600203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cidraayudacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cidraayudacovid-19.com"; sid:600204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citizenpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citizenpandemic.com"; sid:600205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactionmaskcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactionmaskcovid.com"; sid:600206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cndhcovid19guidebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cndhcovid19guidebook.com"; sid:600207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid2019.com"; sid:600208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concept-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concept-corona.com"; sid:600209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingcovid19.com"; sid:600210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectingcovid.com"; sid:600211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contest-covid.com"; sid:600212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19vaccines.com"; sid:600213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bank.com"; sid:600214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabestdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabestdefense.com"; sid:600215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabooth.com"; sid:600216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-buch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-buch.com"; sid:600217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersllc.com"; sid:600218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersoftexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersoftexas.com"; sid:600219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterstexas.com"; sid:600220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterstl.com"; sid:600221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterusa.com"; sid:600222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertificates.com"; sid:600223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharms.com"; sid:600224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checkin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checkin.com"; sid:600225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleancertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleancertified.com"; sid:600226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cle.com"; sid:600227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoach.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoach.biz"; sid:600228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommitte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommitte.com"; sid:600229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfess.com"; sid:600230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorvette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorvette.com"; sid:600231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrimewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrimewatch.com"; sid:600232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisruptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisruptions.com"; sid:600233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoggingpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoggingpros.com"; sid:600234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreepeople.com"; sid:600235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunitea.com"; sid:600236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaings.com"; sid:600237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainrussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainrussia.com"; sid:600238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitsu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitsu.com"; sid:600239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajerk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajerk.com"; sid:600240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakakumei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakakumei.com"; sid:600241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakanzlei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakanzlei.com"; sid:600242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalampe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalampe.com"; sid:600243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalind.com"; sid:600244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameditation.com"; sid:600245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamultivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamultivitamin.com"; sid:600246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamultivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamultivitamins.com"; sid:600247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaof2020.com"; sid:600248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganicstea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganicstea.com"; sid:600249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganicsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganicsus.com"; sid:600250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorganictea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorganictea.com"; sid:600251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicinsurance.com"; sid:600252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaparkporkstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaparkporkstore.com"; sid:600253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroofrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroofrelief.com"; sid:600254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safety-bulkbuy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safety-bulkbuy.com"; sid:600255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasalez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasalez.com"; sid:600256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslot19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslot19.com"; sid:600257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasstop.com"; sid:600258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucked.com"; sid:600259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatap.com"; sid:600260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatong.com"; sid:600261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-transgender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-transgender.com"; sid:600262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavette.com"; sid:600263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavibing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavibing.com"; sid:600264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandkids.com"; sid:600265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeaten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeaten.com"; sid:600266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanersnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanersnyc.com"; sid:600267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollegerefundlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollegerefundlawyers.com"; sid:600268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrime.com"; sid:600269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrimewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrimewatch.com"; sid:600270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffectonchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffectonchildren.com"; sid:600271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffectonteens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffectonteens.com"; sid:600272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffectsonchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffectsonchildren.com"; sid:600273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffectsonteens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffectsonteens.com"; sid:600274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevidence.com"; sid:600275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasksonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasksonline.com"; sid:600276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreeproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreeproperty.com"; sid:600277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgearstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgearstore.com"; sid:600278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunitea.com"; sid:600279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusl-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusl-supplies.com"; sid:600280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonoclonal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonoclonal.com"; sid:600281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmrna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmrna.com"; sid:600282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmultivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmultivitamin.com"; sid:600283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmultivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmultivitamins.com"; sid:600284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmuseums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmuseums.com"; sid:600285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmutating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmutating.com"; sid:600286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspantemicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspantemicblog.com"; sid:600287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientcare.com"; sid:600288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientresource.com"; sid:600289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatienttreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatienttreatment.com"; sid:600290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaintiffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaintiffs.com"; sid:600291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaintiffslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaintiffslawyers.com"; sid:600292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquilt2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquilt2020.com"; sid:600293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussecretsrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussecretsrevealed.com"; sid:600294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorapparel.com"; sid:600295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitstexas.com"; sid:600296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustruthandlies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustruthandlies.com"; sid:600297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalkintesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalkintesting.com"; sid:600298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalkuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalkuptesting.com"; sid:600299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweizen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweizen.com"; sid:600300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawreslter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawreslter.com"; sid:600301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020quilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020quilt.com"; sid:600302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020quilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020quilt.com"; sid:600303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aides.com"; sid:600304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airmaskpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airmaskpro.com"; sid:600305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andkids.com"; sid:600306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andkids.com"; sid:600307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestlocations.com"; sid:600308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assessment.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assessment.care"; sid:600309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breakoutupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breakoutupdates.com"; sid:600310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cerb-application.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cerb-application.com"; sid:600311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certifiedfacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certifiedfacility.com"; sid:600312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanersmaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanersmaui.com"; sid:600313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningmaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningmaui.com"; sid:600314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanmaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanmaui.com"; sid:600315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultation.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultation.biz"; sid:600316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cruises.com"; sid:600317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-customizedppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-customizedppe.com"; sid:600318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ecole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ecole.com"; sid:600319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-edf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-edf.com"; sid:600320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19evidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19evidence.com"; sid:600321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19externinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19externinator.com"; sid:600322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsvsfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsvsfiction.com"; sid:600323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19favipiravir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19favipiravir.com"; sid:600324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free-zone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free-zone.com"; sid:600325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalinsurance.com"; sid:600326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalinsurance.com"; sid:600327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herostories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herostories.com"; sid:600328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-huntingtoningalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-huntingtoningalls.com"; sid:600329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygieneplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygieneplan.com"; sid:600330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygienesafetyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygienesafetyplan.com"; sid:600331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygienesafetyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygienesafetyplan.com"; sid:600332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jogging.com"; sid:600333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killerteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killerteam.com"; sid:600334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanau.com"; sid:600335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ltd.com"; sid:600336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malpracticeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malpracticeclaims.com"; sid:600337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malpracticesuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malpracticesuit.com"; sid:600338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-masken.com"; sid:600339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19monoclonal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19monoclonal.com"; sid:600340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monoclonal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monoclonal.com"; sid:600341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19multivitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19multivitamin.com"; sid:600342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19multivitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19multivitamins.com"; sid:600343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutating.com"; sid:600344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutating.com"; sid:600345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutation.com"; sid:600346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutations.com"; sid:600347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ninjaairmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ninjaairmask.com"; sid:600348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partitions.com"; sid:600349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19patientcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19patientcare.com"; sid:600350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pepcidac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pepcidac.com"; sid:600351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-personalizedppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-personalizedppe.com"; sid:600352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plexiguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plexiguards.com"; sid:600353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19polycarbonate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19polycarbonate.com"; sid:600354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19polycarbonateguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19polycarbonateguards.com"; sid:600355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ppeneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ppeneeds.com"; sid:600356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quilt.com"; sid:600357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestcassette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestcassette.com"; sid:600358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtestcassette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtestcassette.com"; sid:600359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realconciergemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realconciergemedicine.com"; sid:600360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19redblackgreenandbrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19redblackgreenandbrown.com"; sid:600361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskanalysis.com"; sid:600362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskassessments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskassessments.com"; sid:600363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rtw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rtw.com"; sid:600364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyplan.com"; sid:600365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizingnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizingnj.com"; sid:600366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solution.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solution.biz"; sid:600367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutions.biz"; sid:600368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techresponse.com"; sid:600369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingcenternearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingcenternearme.com"; sid:600370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testkitstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testkitstexas.com"; sid:600371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsource.com"; sid:600372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19things.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19things.com"; sid:600373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracing.com"; sid:600374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveladvice.com"; sid:600375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralclosings.com"; sid:600376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralguidlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralguidlines.com"; sid:600377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralmasks.com"; sid:600378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralprecations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralprecations.com"; sid:600379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralprecaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralprecaution.com"; sid:600380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralprevention.com"; sid:600381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralprophylaxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralprophylaxis.com"; sid:600382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralprotection.com"; sid:600383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralresources.com"; sid:600384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralrestrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralrestrictions.com"; sid:600385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralsupplies.com"; sid:600386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viralsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viralsupport.com"; sid:600387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viraltherapies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viraltherapies.com"; sid:600388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viraltreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viraltreatment.com"; sid:600389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viraltreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viraltreatments.com"; sid:600390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusregulations.com"; sid:600391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussstore.com"; sid:600392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplaceplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplaceplan.com"; sid:600393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplaceplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplaceplan.com"; sid:600394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yxe.com"; sid:600395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid25mudra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid25mudra.com"; sid:600396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacrylic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacrylic.com"; sid:600397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairport.com"; sid:600398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalcol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalcol.com"; sid:600399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamazonprime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamazonprime.com"; sid:600400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamazonstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamazonstore.com"; sid:600401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodygear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodygear.com"; sid:600402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappointments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappointments.com"; sid:600403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbacktoworkplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbacktoworkplan.com"; sid:600404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbatcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbatcrazy.com"; sid:600405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bear.com"; sid:600406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbombs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbombs.com"; sid:600407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbutfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbutfashion.com"; sid:600408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarrier.com"; sid:600409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasuality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasuality.com"; sid:600410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcelloproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcelloproject.com"; sid:600411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchance.com"; sid:600412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaner.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaner.biz"; sid:600413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearfilmsets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearfilmsets.com"; sid:600414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomida.com"; sid:600415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnection.biz"; sid:600416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolcr.com"; sid:600417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronamaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronamaske.com"; sid:600418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrimewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrimewatch.com"; sid:600419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cruises.com"; sid:600420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensetea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensetea.com"; sid:600421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectantservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectantservice.com"; sid:600422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddomicilio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddomicilio.com"; sid:600423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrones.com"; sid:600424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidebay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidebay.com"; sid:600425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidebaystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidebaystore.com"; sid:600426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecleaning.com"; sid:600427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviden10min.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviden10min.com"; sid:600428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidengineering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidengineering.com"; sid:600429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepromo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepromo.com"; sid:600430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventsafety.com"; sid:600431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexhibition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexhibition.com"; sid:600432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-face-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-face-mask.com"; sid:600433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-face-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-face-masks.com"; sid:600434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightingtea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightingtea.com"; sid:600435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilters.com"; sid:600436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirmportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirmportal.com"; sid:600437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflowers.com"; sid:600438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluencer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluencer.com"; sid:600439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluencers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluencers.com"; sid:600440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluenzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluenzer.com"; sid:600441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluenzers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluenzers.com"; sid:600442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflushot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflushot.com"; sid:600443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflushots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflushots.com"; sid:600444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootball.com"; sid:600445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeplanet.com"; sid:600446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeproperty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeproperty.com"; sid:600447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerides.com"; sid:600448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetransportation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetransportation.com"; sid:600449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetransport.com"; sid:600450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-frontline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-frontline.com"; sid:600451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringsafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringsafely.com"; sid:600452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringssafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringssafety.com"; sid:600453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgradshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgradshirts.com"; sid:600454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraduate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraduate.com"; sid:600455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthline.com"; sid:600456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomefitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomefitness.com"; sid:600457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeresponse.com"; sid:600458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhornets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhornets.com"; sid:600459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididibaubau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididibaubau.com"; sid:600460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunebooster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunebooster.com"; sid:600461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitea.com"; sid:600462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia19.com"; sid:600463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfections.com"; sid:600464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiptv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiptv.com"; sid:600465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisascam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisascam.com"; sid:600466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivoc.com"; sid:600467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobbank.com"; sid:600468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkawaii.com"; sid:600469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeepsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeepsafe.com"; sid:600470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidks.com"; sid:600471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-l9news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-l9news.com"; sid:600472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalfund.com"; sid:600473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpracticeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpracticeclaims.com"; sid:600474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafely.com"; sid:600475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafety.com"; sid:600476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmostwanted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmostwanted.com"; sid:600477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmulti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmulti.com"; sid:600478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurderhornets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurderhornets.com"; sid:600479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnaturals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnaturals.com"; sid:600480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficecleaning.com"; sid:600481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicstea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicstea.com"; sid:600482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicsusa.com"; sid:600483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicsus.com"; sid:600484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganictea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganictea.com"; sid:600485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnancyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnancyguide.com"; sid:600486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionsigns.com"; sid:600487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofcommunion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofcommunion.com"; sid:600488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionplans.com"; sid:600489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectivestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectivestore.com"; sid:600490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectorusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectorusa.com"; sid:600491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotects.com"; sid:600492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuzzels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuzzels.com"; sid:600493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqatar.com"; sid:600494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidray.com"; sid:600495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregs.com"; sid:600496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepel.com"; sid:600497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreservations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreservations.com"; sid:600498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestructuring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestructuring.com"; sid:600499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretrofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretrofits.com"; sid:600500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-return.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-return.com"; sid:600501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroofrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroofrelief.com"; sid:600502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebusinessmodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebusinessmodels.com"; sid:600503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehome.com"; sid:600504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyglass.com"; sid:600505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalvation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalvation.com"; sid:600506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscorecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscorecard.com"; sid:600507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecrets.com"; sid:600508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselfcheckri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselfcheckri.com"; sid:600509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservicecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservicecenters.com"; sid:600510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshipping.com"; sid:600511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshowvid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshowvid.com"; sid:600512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmostwanted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmostwanted.com"; sid:600513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatesofamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatesofamerica.com"; sid:600514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore19.com"; sid:600515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorstory.com"; sid:600516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingclinic.com"; sid:600517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermalglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermalglasses.com"; sid:600518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthinkingofyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthinkingofyou.com"; sid:600519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidujjain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidujjain.com"; sid:600520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineprep.com"; sid:600521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacsinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacsinations.com"; sid:600522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacsines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacsines.com"; sid:600523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverses.com"; sid:600524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvillage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvillage.com"; sid:600525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusgear.com"; sid:600526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-voices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-voices.com"; sid:600527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-volunteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-volunteer.com"; sid:600528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalkintesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalkintesting.com"; sid:600529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalkuptesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalkuptesting.com"; sid:600530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweightloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweightloss.com"; sid:600531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrestler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrestler.com"; sid:600532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxit.com"; sid:600533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiselinesguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiselinesguidelinescovid19.com"; sid:600534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovidresponse.com"; sid:600535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureagainstcovid19.com"; sid:600536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidnyc.com"; sid:600537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvcovidrelief.com"; sid:600538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcoronaletters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcoronaletters.com"; sid:600539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendingcovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendingcovidclaims.com"; sid:600540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendingfloridacovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendingfloridacovidclaims.com"; sid:600541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendingfloridacovidinsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendingfloridacovidinsuranceclaims.com"; sid:600542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescovid.cat"; sid:600543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectadocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectadocovid.com"; sid:600544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for difesacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"difesacovid.com"; sid:600545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earthafterpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earthafterpandemic.com"; sid:600546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for el-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"el-covid.com"; sid:600547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresafumigacioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresafumigacioncoronavirus.com"; sid:600548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresalimpiezacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresalimpiezacoronavirus.com"; sid:600549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for empresalimpiezacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"empresalimpiezacovid-19.com"; sid:600550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-passportcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-passportcovid19.com"; sid:600551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicengineers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicengineers.com"; sid:600552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventcovidtesting.com"; sid:600553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for experiences-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"experiences-covid-19.com"; sid:600554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesinaustraliacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesinaustraliacoronavirus.com"; sid:600555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesinaustraliacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesinaustraliacovid19.com"; sid:600556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesinaustraliasurveycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesinaustraliasurveycoronavirus.com"; sid:600557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familiesinaustraliasurveycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familiesinaustraliasurveycovid19.com"; sid:600558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famotidineforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famotidineforcovid19.com"; sid:600559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for famotidineforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"famotidineforcovid.com"; sid:600560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fia-survey-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fia-survey-coronavirus.com"; sid:600561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiasurvey-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiasurvey-coronavirus.com"; sid:600562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiasurveycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiasurveycoronavirus.com"; sid:600563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fia-survey-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fia-survey-covid-19.com"; sid:600564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiasurvey-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiasurvey-covid-19.com"; sid:600565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiasurveycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiasurveycovid19.com"; sid:600566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ficovidalesafaris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ficovidalesafaris.com"; sid:600567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid-iot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid-iot.com"; sid:600568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthepandemic.com"; sid:600569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filedropboxbusinesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filedropboxbusinesscovid.com"; sid:600570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flywuhan.com"; sid:600571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forclosurepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forclosurepandemic.com"; sid:600572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forclosurespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forclosurespandemic.com"; sid:600573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foreclosurecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foreclosurecovid-19.com"; sid:600574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foreclosurescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foreclosurescovid-19.com"; sid:600575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freedompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freedompandemic.com"; sid:600576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecorona19.com"; sid:600577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronacare.com"; sid:600578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronainfo.com"; sid:600579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronabuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronabuster.com"; sid:600580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronabusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronabusters.com"; sid:600581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for godandthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"godandthepandemic.com"; sid:600582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gplcovidform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gplcovidform.com"; sid:600583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hacking4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hacking4pandemic.com"; sid:600584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingcovid19afrique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingcovid19afrique.com"; sid:600585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingthepandemic.com"; sid:600586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hackingthepandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hackingthepandemic.net"; sid:600587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healgencovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healgencovidtest.com"; sid:600588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healgenrapidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healgenrapidcovid.com"; sid:600589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpercovid.com"; sid:600590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteltravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteltravelguidelinescovid19.com"; sid:600591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteltravelguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteltravelguidelinescovid19.net"; sid:600592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howlongwillcovid19last.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howlongwillcovid19last.com"; sid:600593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howlongwillcovidlast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howlongwillcovidlast.com"; sid:600594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hungerpandemicresponseteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hungerpandemicresponseteam.com"; sid:600595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icarecovid.com"; sid:600596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icarecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icarecovid.net"; sid:600597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-eat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-eat-corona.com"; sid:600598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiatravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiatravelguidelinescovid19.com"; sid:600599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infografiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infografiacoronavirus.com"; sid:600600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inovacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inovacovid19.com"; sid:600601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcoronavirusvaccine.com"; sid:600602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcoronashirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcoronashirt.com"; sid:600603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for japantravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"japantravelguidelinescovid19.com"; sid:600604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for japantravelguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"japantravelguidelinescovid19.net"; sid:600605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jayscovidgraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jayscovidgraphs.com"; sid:600606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jorgecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jorgecorona.com"; sid:600607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidvax.com"; sid:600608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowaboutcovid-19.com"; sid:600609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidcleaner.com"; sid:600610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidsafe.com"; sid:600611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidservice.com"; sid:600612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latiendadelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latiendadelcovid.com"; sid:600613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for life-after-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"life-after-covid.com"; sid:600614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovidfreestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovidfreestore.com"; sid:600615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostwagescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostwagescovid-19.com"; sid:600616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lostwagescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lostwagescovid.com"; sid:600617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makechinapaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makechinapaycovid19.com"; sid:600618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marshdidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marshdidcovid.com"; sid:600619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovid.net"; sid:600620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskexpresscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskexpresscovid.com"; sid:600621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskupagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskupagainstcovid19.com"; sid:600622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masquejetablecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masquejetablecovid.com"; sid:600623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masstransitguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masstransitguidelinescovid19.com"; sid:600624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masstransitguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masstransitguidelinescovid19.net"; sid:600625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masstrasnitguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masstrasnitguidelinescovid19.com"; sid:600626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masstrasnitguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masstrasnitguidelinescovid19.net"; sid:600627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meetingcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meetingcovidtesting.com"; sid:600628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montestcovid.com"; sid:600629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montestcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montestcovid.net"; sid:600630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-19portal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-19portal.com"; sid:600631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidquestions.com"; sid:600632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid-risk.com"; sid:600633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstock.com"; sid:600634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtraining.com"; sid:600635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needcovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needcovidppe.com"; sid:600636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for neucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"neucoronavirus.com"; sid:600637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhope4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhope4covid19.com"; sid:600638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhscovid-19.com"; sid:600639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nickiescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nickiescovid.com"; sid:600640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nymuslimcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nymuslimcovid.com"; sid:600641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregonstatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregonstatecoronavirus.com"; sid:600642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalliance.com"; sid:600643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalliances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalliances.com"; sid:600644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglobalinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglobalinsurance.com"; sid:600645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicinsomnia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicinsomnia.com"; sid:600646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmalpracticeclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmalpracticeclaims.com"; sid:600647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmalpractice.com"; sid:600648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutlet.com"; sid:600649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpail.com"; sid:600650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproducts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproducts.biz"; sid:600651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-relationships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-relationships.com"; sid:600652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-releaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-releaf.com"; sid:600653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreliefinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreliefinitiative.com"; sid:600654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsstore.com"; sid:600655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictracers.com"; sid:600656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusevidence.com"; sid:600657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-zen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-zen.com"; sid:600658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patientcovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patientcovidsurvey.com"; sid:600659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pepcidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pepcidcoronavirus.com"; sid:600660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pepcidcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pepcidcovid19.com"; sid:600661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perte-exploitation-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perte-exploitation-coronavirus.com"; sid:600662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perte-exploitation-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perte-exploitation-covid-19.com"; sid:600663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinturaanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinturaanticovid19.com"; sid:600664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinturaanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinturaanticovid.com"; sid:600665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinturasanticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinturasanticovid19.com"; sid:600666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinturasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinturasanticovid.com"; sid:600667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pivotwithcovidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pivotwithcovidbook.com"; sid:600668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidcompany.com"; sid:600669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfatigue.com"; sid:600670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid-nomad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid-nomad.com"; sid:600671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidoption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidoption.com"; sid:600672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-coronavirus.com"; sid:600673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppe-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppe-covid.com"; sid:600674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycovidaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycovidaway.com"; sid:600675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pregnancyduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pregnancyduringcovid.com"; sid:600676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusinfection.com"; sid:600677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventthepandemic.com"; sid:600678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promcovid.com"; sid:600679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccion-covid19.com"; sid:600680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protecovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protecovidstore.com"; sid:600681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protege-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protege-covid19.com"; sid:600682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questingcovid.com"; sid:600683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rengencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rengencovid19.com"; sid:600684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantguidelinescovid19.com"; sid:600685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridescovidfree.com"; sid:600686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridingoutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridingoutcorona.com"; sid:600687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for run4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"run4covid.com"; sid:600688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexincovid.com"; sid:600689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfaftercorona.com"; sid:600690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfpostcorona.com"; sid:600691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sfpostpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sfpostpandemic.com"; sid:600692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shouldiprotestduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shouldiprotestduringcovid.com"; sid:600693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signscovid19.com"; sid:600694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signscovid.com"; sid:600695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for slcovidmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"slcovidmodel.com"; sid:600696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smallbizvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smallbizvscovid.com"; sid:600697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smithcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smithcovidtesting.com"; sid:600698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soskitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soskitcovid.com"; sid:600699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparklecovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparklecovid19supplies.com"; sid:600700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampcovid.com"; sid:600701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcoronavirus.com"; sid:600702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stampoutcovidstamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stampoutcovidstamps.com"; sid:600703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standupforcoronascheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standupforcoronascheckup.com"; sid:600704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus19.com"; sid:600705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.care"; sid:600706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencoronaviruseffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencoronaviruseffects.com"; sid:600707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencovid-19effects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencovid-19effects.com"; sid:600708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teencovid19effects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teencovid19effects.com"; sid:600709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tests4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tests4covid19.com"; sid:600710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascoronacleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascoronacleaners.com"; sid:600711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainformation.com"; sid:600712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirushandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirushandbook.com"; sid:600713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19handbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19handbook.com"; sid:600714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19survivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19survivalguide.com"; sid:600715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidboard.com"; sid:600716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidgames.com"; sid:600717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidppe.com"; sid:600718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidprotects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidprotects.com"; sid:600719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidweb.com"; sid:600720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicdepot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicdepot.com"; sid:600721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldtravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldtravelguidelinescovid19.com"; sid:600722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trampcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trampcovid.com"; sid:600723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transportationcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transportationcovidfree.com"; sid:600724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for transportcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"transportcovidfree.com"; sid:600725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedkingdomtravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedkingdomtravelguidelinescovid19.com"; sid:600726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unpaidbillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unpaidbillscovid.com"; sid:600727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidnumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidnumbers.com"; sid:600728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uvcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uvcovidfree.com"; sid:600729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uv-light-kills-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uv-light-kills-covid19.com"; sid:600730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacacionessincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacacionessincovid19.com"; sid:600731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecorona.com"; sid:600732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatecovid.com"; sid:600733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viajarsincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viajarsincovid.com"; sid:600734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visiere-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visiere-covid19.com"; sid:600735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vzwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vzwcovid.com"; sid:600736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warehousecovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warehousecovid19supplies.com"; sid:600737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weareallinthistogetherpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weareallinthistogetherpandemic.com"; sid:600738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wedisinfectcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wedisinfectcorona.com"; sid:600739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotcovid19.com"; sid:600740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotoyoucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotoyoucovid.com"; sid:600741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotucovid.com"; sid:600742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotyoucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotyoucovid19.com"; sid:600743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westaycovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westaycovidclean.com"; sid:600744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatpandemic.com"; sid:600745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutyourbillscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutyourbillscovid-19.com"; sid:600746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutyourbillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutyourbillscovid19.com"; sid:600747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wipeoutyourbillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wipeoutyourbillscovid.com"; sid:600748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wondfo-covid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wondfo-covid19test.com"; sid:600749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worcestermscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worcestermscovid19.com"; sid:600750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workplacecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workplacecorona.com"; sid:600751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workplacecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workplacecovid.com"; sid:600752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan7.com"; sid:600753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancjz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancjz.com"; sid:600754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfengshan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfengshan.com"; sid:600755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhangreenland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhangreenland.com"; sid:600756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhoaxorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhoaxorganization.com"; sid:600757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanluke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanluke.com"; sid:600758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmurderhornets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmurderhornets.com"; sid:600759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhansaima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhansaima.com"; sid:600760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusevidence.com"; sid:600761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusmutating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusmutating.com"; sid:600762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusmutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusmutation.com"; sid:600763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzi.com"; sid:600764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronacl-i1a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronacl-i1a.com"; sid:600765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--soscoronavrus-5ib.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--soscoronavrus-5ib.com"; sid:600766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcoronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcoronastory.com"; sid:600767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zaragozacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zaragozacovidfree.com"; sid:600768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaacovidcleanup.com"; sid:600769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecoronasyndrome.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecoronasyndrome.world"; sid:600770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecovidsyndrome.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecovidsyndrome.world"; sid:600771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-coronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-coronavirus2020.com"; sid:600772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid2020.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid2020.info"; sid:600773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinescovid19.info"; sid:600774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinescovid19.net"; sid:600775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinesguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinesguidelinescovid19.info"; sid:600776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinesguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinesguidelinescovid19.net"; sid:600777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaagainstcovid.com"; sid:600778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anormalpandemicday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anormalpandemicday.com"; sid:600779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtested.com"; sid:600780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbeitsrecht-corona-hagen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbeitsrecht-corona-hagen.net"; sid:600781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for archmillcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"archmillcovid19.com"; sid:600782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artforcovidlv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artforcovidlv.com"; sid:600783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artisanscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artisanscovid19.com"; sid:600784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atscovid.com"; sid:600785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecovidph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecovidph.com"; sid:600786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for braziltravelguidelinescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"braziltravelguidelinescovid19.com"; sid:600787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for braziltravelguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"braziltravelguidelinescovid19.net"; sid:600788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buildingaroundcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buildingaroundcoronavirus.com"; sid:600789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronarapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronarapidtest.com"; sid:600790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinacontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinacontracovid.com"; sid:600791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronainsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronainsurance.com"; sid:600792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronavirusinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronavirusinsurance.com"; sid:600793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid.com"; sid:600794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidinsurance.com"; sid:600795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canarycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canarycovid.com"; sid:600796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercoronavirusandconfetti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercoronavirusandconfetti.com"; sid:600797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercovidandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercovidandme.com"; sid:600798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canningthroughcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canningthroughcovid.com"; sid:600799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caregivingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caregivingwithcovid.com"; sid:600800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carehomecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carehomecoronavirus.com"; sid:600801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carehomecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carehomecovid19.com"; sid:600802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cassetoicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cassetoicovid.com"; sid:600803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centercovidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centercovidsecure.com"; sid:600804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centercovidsecure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centercovidsecure.net"; sid:600805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrocovidseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrocovidseguro.com"; sid:600806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrocovidseguro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrocovidseguro.net"; sid:600807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidfree.com"; sid:600808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidcleanup.com"; sid:600809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chs-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chs-covid.com"; sid:600810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cinemacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cinemacovid.com"; sid:600811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleankillcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleankillcovid.com"; sid:600812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanyourcovidhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanyourcovidhouse.com"; sid:600813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanyourcovidhouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanyourcovidhouses.com"; sid:600814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothesforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothesforcovid.com"; sid:600815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clothingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clothingforcovid.com"; sid:600816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovidaboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovidaboutique.com"; sid:600817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeeforcovid.com"; sid:600818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorsofcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorsofcovid.info"; sid:600819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for complycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"complycovid.com"; sid:600820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprarcoronavirus.com"; sid:600821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovid19together.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovid19together.com"; sid:600822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovidtogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovidtogether.com"; sid:600823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consciousconnectingincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consciousconnectingincovid.com"; sid:600824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcoronausa.com"; sid:600825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19healthcare.com"; sid:600826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19healthcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19healthcare.net"; sid:600827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaircurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaircurtain.com"; sid:600828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaartproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaartproject.com"; sid:600829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboxshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboxshop.com"; sid:600830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboxshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboxshop.net"; sid:600831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersllc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersllc.info"; sid:600832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersllc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersllc.net"; sid:600833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalbank.com"; sid:600834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitaltrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitaltrade.com"; sid:600835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapsule.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapsule.net"; sid:600836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaretv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaretv.com"; sid:600837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarton.com"; sid:600838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacartons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacartons.com"; sid:600839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaytion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaytion.com"; sid:600840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningkit.com"; sid:600841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanup561.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanup561.com"; sid:600842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanuppbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanuppbc.com"; sid:600843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclub.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclub.info"; sid:600844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-concept.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-concept.net"; sid:600845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconquerors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconquerors.com"; sid:600846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacookingsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacookingsurvey.com"; sid:600847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectiontech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectiontech.com"; sid:600848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagate.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagate.today"; sid:600849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainvoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainvoices.com"; sid:600850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ist-doof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ist-doof.com"; sid:600851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaistdoof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaistdoof.com"; sid:600852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajahr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajahr.com"; sid:600853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajerks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajerks.com"; sid:600854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakombat.com"; sid:600855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawdefense.com"; sid:600856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaradona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaradona.com"; sid:600857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamatten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamatten.com"; sid:600858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewstrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewstrain.com"; sid:600859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewstring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewstring.com"; sid:600860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprat.com"; sid:600861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofferias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofferias.com"; sid:600862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofholidays.com"; sid:600863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofvacations.com"; sid:600864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotocols.com"; sid:600865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebellen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebellen.net"; sid:600866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarechtsanwalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarechtsanwalt.com"; sid:600867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresource.net"; sid:600868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe-conti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe-conti.com"; sid:600869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeholidays.com"; sid:600870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaver.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaver.net"; sid:600871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz.gmbh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz.gmbh"; sid:600872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaside-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaside-20.com"; sid:600873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stats.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stats.mobi"; sid:600874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastays.com"; sid:600875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastring.com"; sid:600876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmobil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmobil.com"; sid:600877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathebat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathebat.com"; sid:600878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronati.one - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronati.one"; sid:600879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelinsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelinsure.com"; sid:600880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravel.net"; sid:600881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatripinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatripinsurance.com"; sid:600882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideogag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideogag.com"; sid:600883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirua.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirua.today"; sid:600884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19counseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19counseling.com"; sid:600885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19solutions.com"; sid:600886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19stats.com"; sid:600887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarchitect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarchitect.com"; sid:600888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbondfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbondfund.com"; sid:600889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptionlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptionlawfirm.com"; sid:600890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimuk.com"; sid:600891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningalabama.com"; sid:600892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningbuffalo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningbuffalo.com"; sid:600893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdesmoines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdesmoines.com"; sid:600894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdurham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdurham.com"; sid:600895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninggreensboro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninggreensboro.com"; sid:600896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningirvine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningirvine.com"; sid:600897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningrichmond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningrichmond.com"; sid:600898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningspokane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningspokane.com"; sid:600899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningstpetersburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningstpetersburg.com"; sid:600900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtoledo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtoledo.com"; sid:600901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusd614g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusd614g.com"; sid:600902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesigner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesigner.com"; sid:600903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesigners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesigners.com"; sid:600904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesigns.com"; sid:600905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflight.com"; sid:600906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicfacts.com"; sid:600907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspinatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspinatas.com"; sid:600908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqueretaro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqueretaro.com"; sid:600909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeflights.com"; sid:600910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafeflying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafeflying.com"; sid:600911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafr.com"; sid:600912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafrfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafrfund.com"; sid:600913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafrfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafrfundinfo.com"; sid:600914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaocristovao.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaocristovao.net"; sid:600915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-screen.com"; sid:600916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screen.net"; sid:600917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-screens.com"; sid:600918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screens.com"; sid:600919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-screens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-screens.net"; sid:600920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscreens.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscreens.net"; sid:600921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussolutions19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussolutions19.com"; sid:600922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorsassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorsassociation.com"; sid:600923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingpdl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingpdl.com"; sid:600924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingsupportpdl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingsupportpdl.com"; sid:600925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest-uae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest-uae.com"; sid:600926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelgroup.com"; sid:600927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelinsure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelinsure.com"; sid:600928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinequiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinequiz.com"; sid:600929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.works - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.works"; sid:600930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusversusflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusversusflu.com"; sid:600931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavmofflinr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavmofflinr.com"; sid:600932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawares.com"; sid:600933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warn-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warn-app.com"; sid:600934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warnapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warnapp.com"; sid:600935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarnapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarnapp.com"; sid:600936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warn-app.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warn-app.info"; sid:600937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warnapp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warnapp.info"; sid:600938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarnapp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarnapp.info"; sid:600939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warn-app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warn-app.net"; sid:600940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warnapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warnapp.net"; sid:600941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarnapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarnapp.net"; sid:600942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayogahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayogahealth.com"; sid:600943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazeiten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazeiten.net"; sid:600944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1913lue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1913lue.com"; sid:600945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestlocations.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestlocations.net"; sid:600946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backtoworksafely.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backtoworksafely.com"; sid:600947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19backtoworksafely.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19backtoworksafely.info"; sid:600948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19batshitcrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19batshitcrazy.com"; sid:600949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19battles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19battles.com"; sid:600950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bondfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bondfund.com"; sid:600951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingtest.com"; sid:600952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cabs.com"; sid:600953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19center.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19center.info"; sid:600954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinicaltrialconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinicaltrialconnect.com"; sid:600955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conspiracy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conspiracy.net"; sid:600956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultation.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultation.info"; sid:600957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultation.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultation.mobi"; sid:600958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultation.net"; sid:600959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consulting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consulting.net"; sid:600960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracinginfo.com"; sid:600961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contacttracingtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contacttracingtraining.com"; sid:600962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19d614g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19d614g.com"; sid:600963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deceitcoverup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deceitcoverup.com"; sid:600964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnostics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnostics.net"; sid:600965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-employer-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-employer-lawsuit.com"; sid:600966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exhibit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exhibit.com"; sid:600967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fauci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fauci.com"; sid:600968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free-zone.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free-zone.info"; sid:600969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free-zone.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free-zone.net"; sid:600970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gin.com"; sid:600971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hojo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hojo.com"; sid:600972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygieneplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygieneplan.info"; sid:600973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hygienesafetyplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hygienesafetyplan.info"; sid:600974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygienesafetyplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygienesafetyplan.info"; sid:600975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iatf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iatf.com"; sid:600976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isascam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isascam.com"; sid:600977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jam.com"; sid:600978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-jfk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-jfk.com"; sid:600979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19keys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19keys.com"; sid:600980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kid.net"; sid:600981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kids.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kids.net"; sid:600982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawadvice.com"; sid:600983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyercenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyercenter.com"; sid:600984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerinfo.com"; sid:600985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lender.com"; sid:600986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lenders.com"; sid:600987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loanoption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loanoption.com"; sid:600988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanoption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanoption.com"; sid:600989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19loanoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19loanoptions.com"; sid:600990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19loanoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19loanoptions.com"; sid:600991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masks.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masks.info"; sid:600992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medloan.com"; sid:600993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medloan.com"; sid:600994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-memories.com"; sid:600995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-memory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-memory.com"; sid:600996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mrna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mrna.com"; sid:600997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19news.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19news.world"; sid:600998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-nursing-home-lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-nursing-home-lawsuit.com"; sid:600999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nye.com"; sid:601000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oil.com"; sid:601001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pathmakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pathmakers.com"; sid:601002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pricing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pricing.com"; sid:601003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertyadvice.com"; sid:601004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertyinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertyinformation.com"; sid:601005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertynews.com"; sid:601006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertyvictoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertyvictoria.com"; sid:601007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivegown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivegown.com"; sid:601008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quilt.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quilt.net"; sid:601009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidtestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidtestkit.net"; sid:601010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestateinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestateinformation.com"; sid:601011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-registration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-registration.com"; sid:601012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rentrelieffundingprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rentrelieffundingprogram.com"; sid:601013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseprogram.com"; sid:601014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseprogram.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseprogram.net"; sid:601015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-resq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-resq.com"; sid:601016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19robot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19robot.com"; sid:601017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rollerscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rollerscreens.com"; sid:601018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safe.net"; sid:601019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetyplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetyplan.info"; sid:601020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyplan.info"; sid:601021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safr.com"; sid:601022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safrfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safrfund.com"; sid:601023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safrfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safrfundinfo.com"; sid:601024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safrinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safrinfo.com"; sid:601025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sepeti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sepeti.com"; sid:601026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shameless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shameless.com"; sid:601027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solidarityfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solidarityfund.com"; sid:601028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesshop.com"; sid:601029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportpdl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportpdl.com"; sid:601030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorgear.com"; sid:601031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swabtesting.com"; sid:601032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19systems.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19systems.info"; sid:601033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxis.com"; sid:601034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingpdl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingpdl.com"; sid:601035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.services"; sid:601036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-time.com"; sid:601037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tn.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tn.info"; sid:601038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-topas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-topas.com"; sid:601039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-topos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-topos.com"; sid:601040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toposmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toposmap.com"; sid:601041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracking.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracking.nyc"; sid:601042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tyranny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tyranny.com"; sid:601043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19up.com"; sid:601044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvdisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvdisinfect.com"; sid:601045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19versusflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19versusflu.com"; sid:601046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusbankruptcy.com"; sid:601047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19walmartassociates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19walmartassociates.com"; sid:601048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplaceplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplaceplan.info"; sid:601049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplaceplan.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplaceplan.info"; sid:601050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldnews.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldnews.info"; sid:601051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yemen.com"; sid:601052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020solution.com"; sid:601053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021.life"; sid:601054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21sucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21sucks.com"; sid:601055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid614.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid614.com"; sid:601056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacfilters.com"; sid:601057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairfilters.com"; sid:601058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanesthesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanesthesia.com"; sid:601059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodygear.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodygear.info"; sid:601060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibody.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibody.info"; sid:601061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytest.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytest.info"; sid:601062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.info"; sid:601063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidashboard.com"; sid:601064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathometesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathometesting.com"; sid:601065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidavengers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidavengers.com"; sid:601066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawarestickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawarestickers.com"; sid:601067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabysafe.com"; sid:601068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabysafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabysafety.com"; sid:601069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcylawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcylawny.com"; sid:601070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcylaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcylaws.com"; sid:601071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbargains.com"; sid:601072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbid.com"; sid:601073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbidding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbidding.com"; sid:601074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.black"; sid:601075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackjack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackjack.com"; sid:601076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblackmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblackmasks.com"; sid:601077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboutique.com"; sid:601078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbungler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbungler.com"; sid:601079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcancer.com"; sid:601080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-care.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-care.info"; sid:601081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcat.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcat.cat"; sid:601082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentra.com"; sid:601083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentra.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentra.info"; sid:601084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchance.net"; sid:601085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheapflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheapflights.com"; sid:601086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-check-chantier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-check-chantier.com"; sid:601087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildsafe.com"; sid:601088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchildsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchildsafety.com"; sid:601089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean561.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean561.com"; sid:601090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersgta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersgta.com"; sid:601091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningkit.com"; sid:601092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsny.com"; sid:601093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningteams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningteams.com"; sid:601094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupfl.com"; sid:601095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupnyc.com"; sid:601096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clear.net"; sid:601097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coffee.com"; sid:601098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coffee.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coffee.info"; sid:601099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoiffure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoiffure.com"; sid:601100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommuter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommuter.com"; sid:601101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compass.com"; sid:601102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantoffices.com"; sid:601103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracinginfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracinginfo.com"; sid:601104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractlawny.com"; sid:601105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontractlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontractlaws.com"; sid:601106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatelaw.com"; sid:601107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatelawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatelawny.com"; sid:601108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriminallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriminallaw.com"; sid:601109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcriminallawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcriminallawny.com"; sid:601110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomersurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomersurvey.com"; sid:601111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcybermonday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcybermonday.com"; sid:601112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesinfectioncompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesinfectioncompany.com"; sid:601113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddirectdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddirectdelivery.com"; sid:601114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfections.com"; sid:601115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcelaw.com"; sid:601116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddivorcelawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddivorcelawny.com"; sid:601117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrama.com"; sid:601118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddream.com"; sid:601119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideep.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideep.net"; sid:601120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemotionalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemotionalsupport.com"; sid:601121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlawny.com"; sid:601122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymentlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymentlaws.com"; sid:601123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentertainmentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentertainmentlaw.com"; sid:601124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentertainmentlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentertainmentlawny.com"; sid:601125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideofun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideofun.com"; sid:601126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidersary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidersary.com"; sid:601127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidespana.com"; sid:601128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevals.com"; sid:601129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventsafety.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventsafety.info"; sid:601130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventsafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventsafety.net"; sid:601131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpressdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpressdelivery.com"; sid:601132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilylaw.com"; sid:601133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilylawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilylawny.com"; sid:601134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarmacos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarmacos.com"; sid:601135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfastfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfastfood.com"; sid:601136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinale.com"; sid:601137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiring.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiring.info"; sid:601138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforlife.com"; sid:601139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoundationltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoundationltd.com"; sid:601140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedentalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedentalcleaning.com"; sid:601141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevillas.com"; sid:601142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgapyears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgapyears.com"; sid:601143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringsafely.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringsafely.info"; sid:601144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringsafely.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringsafely.net"; sid:601145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringssafety.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringssafety.info"; sid:601146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatheringssafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatheringssafety.net"; sid:601147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgon.com"; sid:601148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgranthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgranthelp.com"; sid:601149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguns.com"; sid:601150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhauntedhouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhauntedhouses.com"; sid:601151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthid.com"; sid:601152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthmeter.com"; sid:601153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthpassport.com"; sid:601154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecare.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecare.info"; sid:601155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecare.net"; sid:601156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeproviders.com"; sid:601157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeproviders.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeproviders.info"; sid:601158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeproviders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeproviders.net"; sid:601159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhope.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhope.info"; sid:601160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhorizonte.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhorizonte.net"; sid:601161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoteldiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoteldiscounts.com"; sid:601162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianagile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianagile.com"; sid:601163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiandiversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiandiversity.com"; sid:601164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianinclusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianinclusion.com"; sid:601165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiankids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiankids.com"; sid:601166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiansafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiansafety.com"; sid:601167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianscrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianscrum.com"; sid:601168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianworld.com"; sid:601169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididz.com"; sid:601170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincare.com"; sid:601171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincare.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincare.info"; sid:601172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincare.net"; sid:601173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhomenursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhomenursing.com"; sid:601174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhomenursing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhomenursing.info"; sid:601175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhomenursing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhomenursing.net"; sid:601176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstyle.com"; sid:601177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancepolicy.com"; sid:601178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocies.com"; sid:601179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot19virus.com"; sid:601180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotsbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotsbook.com"; sid:601181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.today"; sid:601182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaborlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaborlaw.com"; sid:601183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaborlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaborlawny.com"; sid:601184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawdefense.com"; sid:601185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawentertainment.com"; sid:601186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawentertainmentny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawentertainmentny.com"; sid:601187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawhospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawhospitality.com"; sid:601188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawhospitalityny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawhospitalityny.com"; sid:601189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawleases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawleases.com"; sid:601190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawleasesny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawleasesny.com"; sid:601191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawrealestate.com"; sid:601192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawrealestateny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawrealestateny.com"; sid:601193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawrentals.com"; sid:601194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawrentalsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawrentalsny.com"; sid:601195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliar.com"; sid:601196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlottery.com"; sid:601197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlotto.com"; sid:601198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovechild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovechild.com"; sid:601199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlowprices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlowprices.com"; sid:601200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlyobese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlyobese.com"; sid:601201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanufacturing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanufacturing.com"; sid:601202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketingsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketingsurvey.com"; sid:601203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdeal.com"; sid:601204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmealdelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmealdelivery.com"; sid:601205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalmalpracticelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalmalpracticelaw.com"; sid:601206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalmalpracticelawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalmalpracticelawny.com"; sid:601207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsuppliesshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsuppliesshop.com"; sid:601208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafely.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafely.info"; sid:601209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafely.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafely.net"; sid:601210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafety.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafety.info"; sid:601211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeetingsafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeetingsafety.net"; sid:601212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmfg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmfg.com"; sid:601213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmg.com"; sid:601214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnative.com"; sid:601215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnatural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnatural.com"; sid:601216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingcare.com"; sid:601217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingcare.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingcare.info"; sid:601218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingcare.net"; sid:601219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursing.info"; sid:601220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursing.net"; sid:601221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingproviders.com"; sid:601222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingproviders.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingproviders.info"; sid:601223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingproviders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingproviders.net"; sid:601224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnye.com"; sid:601225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinebets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinebets.com"; sid:601226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinecasino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinecasino.com"; sid:601227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinegroceries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinegroceries.com"; sid:601228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinepoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinepoker.com"; sid:601229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-opportunities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-opportunities.com"; sid:601230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-opportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-opportunity.com"; sid:601231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorlando.com"; sid:601232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pandemic-mask-depot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pandemic-mask-depot.com"; sid:601233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassword.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassword.info"; sid:601234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassword.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassword.pro"; sid:601235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassworld.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassworld.info"; sid:601236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassworld.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassworld.pro"; sid:601237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpathforward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpathforward.com"; sid:601238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjurylaw.com"; sid:601239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonalinjurylawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonalinjurylawny.com"; sid:601240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpetkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpetkit.com"; sid:601241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpickup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpickup.com"; sid:601242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplayoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplayoffs.com"; sid:601243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoerypill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoerypill.com"; sid:601244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoerypills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoerypills.com"; sid:601245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppesuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppesuppliers.com"; sid:601246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenurse.com"; sid:601247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenurse.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenurse.info"; sid:601248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenurse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenurse.net"; sid:601249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenursing.com"; sid:601250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenursing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenursing.info"; sid:601251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatenursing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatenursing.net"; sid:601252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionscreen.com"; sid:601253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectorscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectorscreen.com"; sid:601254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectorscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectorscreens.com"; sid:601255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotek.com"; sid:601256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqatar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqatar.net"; sid:601257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqueen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqueen.com"; sid:601258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquilt2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquilt2020.com"; sid:601259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidracing.com"; sid:601260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestatelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestatelaw.com"; sid:601261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestatelawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestatelawny.com"; sid:601262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-relief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-relief.net"; sid:601263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreloaded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreloaded.com"; sid:601264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponer.net"; sid:601265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskapp.com"; sid:601266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrobot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrobot.com"; sid:601267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferides.com"; sid:601268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationsolutions.com"; sid:601269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-screens.com"; sid:601270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsegur.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsegur.net"; sid:601271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorcare.com"; sid:601272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsenior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsenior.com"; sid:601273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseniorsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseniorsafety.com"; sid:601274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensus.com"; sid:601275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield.nyc"; sid:601276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldnyc.com"; sid:601277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshitbags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshitbags.com"; sid:601278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop20.com"; sid:601279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop21.com"; sid:601280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop22.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop22.com"; sid:601281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsisters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsisters.com"; sid:601282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsportsbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsportsbot.com"; sid:601283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsportzbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsportzbot.com"; sid:601284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-story.com"; sid:601285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stuff.com"; sid:601286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuperbowl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuperbowl.com"; sid:601287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsassociation.com"; sid:601288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsyndrome.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsyndrome.world"; sid:601289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtable.com"; sid:601290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxlaw.com"; sid:601291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxlawny.com"; sid:601292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteas.com"; sid:601293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterror.com"; sid:601294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestappointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestappointment.com"; sid:601295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcampania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcampania.com"; sid:601296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tester.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tester.world"; sid:601297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestoc.com"; sid:601298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthanksgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthanksgiving.com"; sid:601299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimes.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimes.net"; sid:601300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrainer.com"; sid:601301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelplans.com"; sid:601302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruthtopower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruthtopower.com"; sid:601303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidturf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidturf.com"; sid:601304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidumbrella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidumbrella.com"; sid:601305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemploymentlaw.com"; sid:601306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunemploymentlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunemploymentlawny.com"; sid:601307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunturned.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunturned.net"; sid:601308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacations.com"; sid:601309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-claim.com"; sid:601310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkerscompensationlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkerscompensationlaw.com"; sid:601311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkerscompensationlawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkerscompensationlawny.com"; sid:601312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxmas.com"; sid:601313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyourmouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyourmouth.com"; sid:601314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiselinesguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiselinesguidelinescovid19.info"; sid:601315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiselinesguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiselinesguidelinescovid19.net"; sid:601316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid19now.com"; sid:601317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cutoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cutoutcovid.com"; sid:601318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendingfloridacovidclaims.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendingfloridacovidclaims.net"; sid:601319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designforcoronavirus.com"; sid:601320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfecciondecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfecciondecovid19.com"; sid:601321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfect-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfect-covid19.com"; sid:601322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectcovid19.com"; sid:601323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-coronavirus-entreprise.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-coronavirus-entreprise.info"; sid:601324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositiviprotezionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositiviprotezionecovid.com"; sid:601325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dreamincoronatime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dreamincoronatime.com"; sid:601326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eaudecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eaudecorona.com"; sid:601327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidcure.com"; sid:601328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecoviddaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecoviddaily.com"; sid:601329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidian.com"; sid:601330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidnews.com"; sid:601331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidupdate.com"; sid:601332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidcare.com"; sid:601333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidcare.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidcare.info"; sid:601334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidcare.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidcare.net"; sid:601335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidnursing.com"; sid:601336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidnursing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidnursing.info"; sid:601337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidnursing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidnursing.net"; sid:601338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecovidtests.com"; sid:601339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-passportcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-passportcovid19.net"; sid:601340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-global.com"; sid:601341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-histories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-histories.com"; sid:601342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicluts.com"; sid:601343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciocovidseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciocovidseguro.com"; sid:601344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciocovidseguro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciocovidseguro.net"; sid:601345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essentialpandemicproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essentialpandemicproducts.com"; sid:601346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-anticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-anticorona.com"; sid:601347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-anticorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-anticorona.net"; sid:601348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-anticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-anticovid.net"; sid:601349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-corona.com"; sid:601350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-corona.net"; sid:601351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-covid.com"; sid:601352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-covid.net"; sid:601353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everydaypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everydaypandemic.com"; sid:601354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everytingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everytingcorona.com"; sid:601355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcovid-19.com"; sid:601356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutwuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutwuhanvirus.com"; sid:601357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid.info"; sid:601358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findajobinapostpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findajobinapostpandemicworld.com"; sid:601359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findyourdreamjobinapostpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findyourdreamjobinapostpandemicworld.com"; sid:601360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flashbackcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flashbackcorona.com"; sid:601361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidcleanup.com"; sid:601362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidsupplies.com"; sid:601363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fluversuscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fluversuscoronavirus.com"; sid:601364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fluversuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fluversuscovid19.com"; sid:601365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fmcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fmcorona.com"; sid:601366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fr-connectezvous-comptelclcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fr-connectezvous-comptelclcovid19.com"; sid:601367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fr-covid19nlcl-safemodeforuser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fr-covid19nlcl-safemodeforuser.com"; sid:601368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frs-userllcl-luttercontrelecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frs-userllcl-luttercontrelecovid19.com"; sid:601369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fumigacioncoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fumigacioncoronavirus.net"; sid:601370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funnycovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funnycovid19masks.com"; sid:601371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gethiredinapostpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gethiredinapostpandemicworld.com"; sid:601372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for go-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"go-corona.info"; sid:601373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronashop.com"; sid:601374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grabacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grabacorona.com"; sid:601375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gtacovid19sellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gtacovid19sellerplan.com"; sid:601376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gymcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gymcovidcheck.com"; sid:601377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hadthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hadthecovid.com"; sid:601378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecarecoronavirus.com"; sid:601379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hoteltravelguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hoteltravelguidelinescovid19.info"; sid:601380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houston-covid-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houston-covid-testing.com"; sid:601381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirusvaccine.com"; sid:601382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hungerpandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hungerpandemicrelief.com"; sid:601383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatcovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatcovid19shop.com"; sid:601384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatthepandemic.com"; sid:601385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihescovid19webinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihescovid19webinar.com"; sid:601386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imdyingofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imdyingofcovid.com"; sid:601387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactocovid.com"; sid:601388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impfstoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impfstoffcovid19.com"; sid:601389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiatravelguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiatravelguidelinescovid19.info"; sid:601390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insumosmedicoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insumosmedicoscovid.com"; sid:601391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insurcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insurcovid.com"; sid:601392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalfightscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalfightscoronavirus.com"; sid:601393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsthepandemicstupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsthepandemicstupid.com"; sid:601394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for japantravelguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"japantravelguidelinescovid19.info"; sid:601395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jobseekersguidetoapostpandemicworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jobseekersguidetoapostpandemicworld.com"; sid:601396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kanoagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kanoagainstcovid19.com"; sid:601397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsandcoronavirus.com"; sid:601398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsandcovid-19.com"; sid:601399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsandcovid19.com"; sid:601400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killing-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killing-corona.com"; sid:601401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kill-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kill-pandemic.com"; sid:601402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killpandemic.com"; sid:601403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit3dcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit3dcovid.com"; sid:601404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit3dcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit3dcovid.info"; sid:601405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit3dcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit3dcovid.net"; sid:601406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidcleaner.com"; sid:601407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidcleaners.com"; sid:601408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyers-for-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyers-for-covid-19.com"; sid:601409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyersforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyersforcovid-19.com"; sid:601410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legal-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legal-covid19.com"; sid:601411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legal-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legal-covid19.info"; sid:601412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lgcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lgcovidsolutions.com"; sid:601413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovidonline.com"; sid:601414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for liveincarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"liveincarecovid19.com"; sid:601415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimecovid.com"; sid:601416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovetheoriginalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovetheoriginalpandemic.com"; sid:601417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovidcleaner.com"; sid:601418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovidcleaners.com"; sid:601419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makechinapaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makechinapaycoronavirus.com"; sid:601420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malawiagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malawiagainstcovid19.com"; sid:601421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mamparas-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mamparas-covid19.com"; sid:601422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaracovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaracovid.info"; sid:601423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskprotectionagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskprotectionagainstcovid19.com"; sid:601424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masstransitguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masstransitguidelinescovid19.info"; sid:601425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meandcovid19.com"; sid:601426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mhc-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mhc-covid19.com"; sid:601427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamicovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamicovidsupplies.com"; sid:601428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mondkapjescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mondkapjescorona.com"; sid:601429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moveforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moveforcovid.com"; sid:601430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronadelmarlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronadelmarlife.com"; sid:601431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronappe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronappe.com"; sid:601432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbody.com"; sid:601433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbody.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbody.info"; sid:601434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidbody.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidbody.net"; sid:601435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidworld.com"; sid:601436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestcovidtest.com"; sid:601437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for namocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"namocorona.com"; sid:601438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearestcoronavirusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearestcoronavirusclinic.com"; sid:601439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearestcovid-19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearestcovid-19clinic.com"; sid:601440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearestcovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearestcovid19clinic.com"; sid:601441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for negociosposcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"negociosposcovid.com"; sid:601442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronastrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronastrain.com"; sid:601443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsnowcovid19.com"; sid:601444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nilcorona.com"; sid:601445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidhere.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidhere.world"; sid:601446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.life"; sid:601447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nonprofitpandemicpivot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nonprofitpandemicpivot.com"; sid:601448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for normascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"normascovid19.com"; sid:601449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novicovid.com"; sid:601450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocovid19sn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocovid19sn.com"; sid:601451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19events.com"; sid:601452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcovid19worldmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcovid19worldmemorial.com"; sid:601453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialtruthcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialtruthcovid19.com"; sid:601454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omscovidcollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omscovidcollaborative.com"; sid:601455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onecovidnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onecovidnation.com"; sid:601456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ordercovid19signs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ordercovid19signs.com"; sid:601457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orlandocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orlandocovid.com"; sid:601458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcovidlife.com"; sid:601459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocoronavirus.net"; sid:601460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessential.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessential.info"; sid:601461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessential.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessential.net"; sid:601462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentialproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentialproducts.com"; sid:601463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentialservices.com"; sid:601464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentials.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentials.net"; sid:601465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicexposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicexposure.com"; sid:601466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforecasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforecasting.com"; sid:601467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmultitool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmultitool.com"; sid:601468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmultitools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmultitools.com"; sid:601469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutlet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutlet.net"; sid:601470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpathway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpathway.com"; sid:601471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpathways.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpathways.com"; sid:601472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpathways.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpathways.net"; sid:601473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpooch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpooch.com"; sid:601474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofincome.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofincome.club"; sid:601475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsbite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsbite.com"; sid:601476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicselfportraits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicselfportraits.com"; sid:601477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsonline.com"; sid:601478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictestprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictestprep.com"; sid:601479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictravelgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictravelgroup.com"; sid:601480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvines.com"; sid:601481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusandkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusandkids.com"; sid:601482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passwordcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passwordcovid.info"; sid:601483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pbccovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pbccovidcleanup.com"; sid:601484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for personalcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"personalcovidtests.com"; sid:601485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for perte-exploitation-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"perte-exploitation-coronavirus.net"; sid:601486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plancovidperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plancovidperu.com"; sid:601487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for planned-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"planned-pandemic.com"; sid:601488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidfatigue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidfatigue.net"; sid:601489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-gear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-gear.com"; sid:601490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-gear.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-gear.net"; sid:601491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidideas.com"; sid:601492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidoption.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidoption.net"; sid:601493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicagency.com"; sid:601494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycovidaway.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycovidaway.info"; sid:601495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycovidaway.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycovidaway.net"; sid:601496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prayeroverpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prayeroverpandemic.com"; sid:601497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predicovid.com"; sid:601498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventie-coronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventie-coronavirus.info"; sid:601499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventthecovidslide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventthecovidslide.com"; sid:601500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prismacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prismacovid19.com"; sid:601501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productocovidseguro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productocovidseguro.com"; sid:601502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productocovidseguro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productocovidseguro.net"; sid:601503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovid.vision - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovid.vision"; sid:601504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promo-das-maes-previnase-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promo-das-maes-previnase-covid19.com"; sid:601505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncontracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncontracovid19.com"; sid:601506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccioncristalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccioncristalcovid.com"; sid:601507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proteccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proteccovid19.com"; sid:601508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionsanitaireanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionsanitaireanticovid.com"; sid:601509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for providingcarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"providingcarecoronavirus.com"; sid:601510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for providingcarecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"providingcarecovid19.com"; sid:601511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psycovid.net"; sid:601512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulmatrixcovid19trial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulmatrixcovid19trial.com"; sid:601513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purificadorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purificadorcoronavirus.com"; sid:601514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purificadorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purificadorcovid.com"; sid:601515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quarantunescovid19fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quarantunescovid19fund.com"; sid:601516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questiningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questiningcovid.com"; sid:601517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rcfcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rcfcovid.com"; sid:601518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for renaulttrucks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"renaulttrucks-covid19.com"; sid:601519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resistcovid19tyranny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resistcovid19tyranny.com"; sid:601520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantguidelinescovid19.info"; sid:601521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for restaurantguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"restaurantguidelinescovid19.net"; sid:601522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roccovid19.com"; sid:601523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rsacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rsacovid19.com"; sid:601524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid19.info"; sid:601525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid20.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid20.info"; sid:601526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovidresponse.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovidresponse.info"; sid:601527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safedistancingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safedistancingcoronavirus.com"; sid:601528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safrcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safrcoronavirus.com"; sid:601529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safrcoronavirusfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safrcoronavirusfund.com"; sid:601530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safrcoronavirusfundinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safrcoronavirusfundinfo.com"; sid:601531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanifica-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanifica-covid.com"; sid:601532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanitizercoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanitizercoronavirus.info"; sid:601533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarawakcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarawakcovid19.com"; sid:601534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for secondwavecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"secondwavecovid.com"; sid:601535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serviciosintegralescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serviciosintegralescovid19.com"; sid:601536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signscovid19.net"; sid:601537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for signscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"signscovid.net"; sid:601538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sinvirusysincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sinvirusysincorona.com"; sid:601539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for smscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"smscovidtesting.com"; sid:601540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spacecovidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spacecovidsecure.com"; sid:601541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spacecovidsecure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spacecovidsecure.net"; sid:601542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sportpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sportpandemic.com"; sid:601543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staffcyngorgwyneddcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staffcyngorgwyneddcovid19.com"; sid:601544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for standcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"standcovid.com"; sid:601545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stanfordcovidprobono.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stanfordcovidprobono.com"; sid:601546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staysafefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staysafefromcovid.com"; sid:601547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-anticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-anticorona.com"; sid:601548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-anticorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-anticorona.net"; sid:601549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-anticovid.com"; sid:601550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-corona.com"; sid:601551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-corona.net"; sid:601552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-covid.net"; sid:601553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stratfordrotarycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stratfordrotarycovid19.com"; sid:601554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for streetsforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"streetsforcovid.com"; sid:601555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviveandthriveinapostpandemiccareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviveandthriveinapostpandemiccareer.com"; sid:601556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovidonline.com"; sid:601557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.world"; sid:601558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovidworld.com"; sid:601559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tech-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tech-covid.com"; sid:601560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tellcovidtruthtopower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tellcovidtruthtopower.com"; sid:601561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tescovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tescovid-19.info"; sid:601562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.madrid"; sid:601563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testselfcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testselfcorona.com"; sid:601564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestpandemicever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestpandemicever.com"; sid:601565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaverses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaverses.com"; sid:601566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscenter.com"; sid:601567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscenter.net"; sid:601568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscenters.com"; sid:601569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscenters.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscenters.net"; sid:601570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19center.com"; sid:601571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19center.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19center.net"; sid:601572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-19effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-19effect.com"; sid:601573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchange.com"; sid:601574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidchanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidchanges.com"; sid:601575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidplan.com"; sid:601576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidproducts.com"; sid:601577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidstrong.com"; sid:601578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theofficialcovid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theofficialcovid19memorial.com"; sid:601579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicneeds.com"; sid:601580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcovid19virus.com"; sid:601581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thevaccineforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thevaccineforcoronavirus.com"; sid:601582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldtravelguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldtravelguidelinescovid19.info"; sid:601583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldtravelguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldtravelguidelinescovid19.net"; sid:601584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thingsbrokenincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thingsbrokenincovid.com"; sid:601585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thinkcovid-19care.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thinkcovid-19care.com"; sid:601586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ticketpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ticketpandemic.com"; sid:601587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ticovid19.com"; sid:601588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tococovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tococovid.com"; sid:601589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todocontraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todocontraelcoronavirus.com"; sid:601590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovid19test.com"; sid:601591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcovid19virus.com"; sid:601592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcovid.com"; sid:601593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthcovid.com"; sid:601594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthtopowercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthtopowercovid.com"; sid:601595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedkingdomtravelguidelinescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedkingdomtravelguidelinescovid19.info"; sid:601596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedkingdomtravelguidelinescovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedkingdomtravelguidelinescovid19.net"; sid:601597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatecovid19.info"; sid:601598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upyourscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upyourscovid19.com"; sid:601599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronafree.com"; sid:601600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusfree.com"; sid:601601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidesupplies.com"; sid:601602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidkits.com"; sid:601603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidsupplies.com"; sid:601604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtrends.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtrends.info"; sid:601605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uselesscovidmicrosite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uselesscovidmicrosite.com"; sid:601606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovidcleaner.com"; sid:601607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vegascovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vegascovidcleaners.com"; sid:601608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ventademascarillasparacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ventademascarillasparacovid19.com"; sid:601609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietcovid.info"; sid:601610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virginiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virginiacovid-19.com"; sid:601611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vivianecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vivianecoronado.com"; sid:601612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warehousecovid19supplies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warehousecovid19supplies.net"; sid:601613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warn-app-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warn-app-corona.com"; sid:601614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnapp-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnapp-corona.com"; sid:601615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnappcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnappcorona.com"; sid:601616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warn-app-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warn-app-corona.info"; sid:601617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnapp-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnapp-corona.info"; sid:601618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnappcorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnappcorona.info"; sid:601619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warn-app-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warn-app-corona.net"; sid:601620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnapp-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnapp-corona.net"; sid:601621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warnappcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warnappcorona.net"; sid:601622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warscovid.com"; sid:601623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for weaftercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"weaftercorona.com"; sid:601624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wegotyourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wegotyourcovid.com"; sid:601625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wekillcovidandmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wekillcovidandmore.com"; sid:601626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldconnectcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldconnectcovid-19.com"; sid:601627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjiajiaoganji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjiajiaoganji.com"; sid:601628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusandkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusandkids.com"; sid:601629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwhgecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwhgecovidcare.com"; sid:601630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wzcorona.com"; sid:601631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovidgem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovidgem.com"; sid:601632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovidx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovidx.com"; sid:601633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xxxcovidxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xxxcovidxxx.com"; sid:601634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19lawyers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19lawyers.net"; sid:601635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourlifeaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourlifeaftercovid.com"; sid:601636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidscreens.com"; sid:601637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1covidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1covidscreens.com"; sid:601638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aacovidtest.com"; sid:601639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscoronavirusonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscoronavirusonline.com"; sid:601640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadosparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadosparacoronavirus.com"; sid:601641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovid19.com"; sid:601642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovid19testkits.com"; sid:601643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovidtests.com"; sid:601644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adviseaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adviseaboutcoronavirus.com"; sid:601645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adviseaboutcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adviseaboutcovid-19.com"; sid:601646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adviseaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adviseaboutcovid19.com"; sid:601647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacoronavirus.com"; sid:601648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacoronaviruswarning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacoronaviruswarning.com"; sid:601649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacovid-19.com"; sid:601650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacovid19.com"; sid:601651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacovid-19warning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacovid-19warning.com"; sid:601652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahacovid19warning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahacovid19warning.com"; sid:601653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for all-aboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"all-aboutcoronavirus.com"; sid:601654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allo-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allo-covid.info"; sid:601655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allocovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allocovid.info"; sid:601656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angolacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angolacovid19.com"; sid:601657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronavirusdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronavirusdeaths.com"; sid:601658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asxcovid.com"; sid:601659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avertcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avertcovid.com"; sid:601660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avertcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avertcovid.net"; sid:601661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovidforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovidforeclosure.com"; sid:601662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudascovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudascovid19.info"; sid:601663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for balearescovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"balearescovidfree.com"; sid:601664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beeecoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beeecoronafree.com"; sid:601665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beeecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beeecovidfree.com"; sid:601666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19testkits.com"; sid:601667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackpandemic.com"; sid:601668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blacovid.com"; sid:601669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchainpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchainpandemic.com"; sid:601670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bobcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bobcorona.com"; sid:601671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bobcoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bobcoronas.com"; sid:601672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bobscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bobscorona.com"; sid:601673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bobscoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bobscoronas.com"; sid:601674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botcoronavirus.com"; sid:601675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botcoronavirus.net"; sid:601676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowelcovid.com"; sid:601677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bowelcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bowelcovid.net"; sid:601678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boxcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boxcorona.com"; sid:601679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotherspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotherspandemic.com"; sid:601680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessreadyaftercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessreadyaftercovid19.com"; sid:601681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesssolutionsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesssolutionsforcovid19.com"; sid:601682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovid.net"; sid:601683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitalonecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitalonecovid19.com"; sid:601684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecovid.info"; sid:601685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalunyacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalunyacovidfree.com"; sid:601686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caworkcompcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caworkcompcovid.com"; sid:601687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccmecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccmecovid.com"; sid:601688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdpcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdpcovid19.com"; sid:601689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centurycoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centurycoronado.com"; sid:601690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrencoronavirus.com"; sid:601691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapaysforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapaysforcovid.com"; sid:601692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapaysforcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapaysforcovid.world"; sid:601693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christepiscopalchurchcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christepiscopalchurchcoronado.com"; sid:601694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciscovideosolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciscovideosolutions.com"; sid:601695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanaircovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanaircovid19.com"; sid:601696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleangreencovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleangreencovidfree.com"; sid:601697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coastingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coastingforcovid.com"; sid:601698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colektiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colektiacorona.com"; sid:601699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concesionarioprotegidocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concesionarioprotegidocovid19.com"; sid:601700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confessionsofcorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confessionsofcorona19.com"; sid:601701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultcovid19.com"; sid:601702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contradictcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contradictcovid.com"; sid:601703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contradictingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contradictingcovid.com"; sid:601704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coordinationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coordinationcovid.com"; sid:601705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19antibodytest.com"; sid:601706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bescherming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bescherming.com"; sid:601707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabesity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabesity.com"; sid:601708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeveiliging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeveiliging.com"; sid:601709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabook.com"; sid:601710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathermask.com"; sid:601711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters.solutions"; sid:601712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaust.com"; sid:601713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.solutions"; sid:601714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensations.com"; sid:601715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconfinementcrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconfinementcrafts.com"; sid:601716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19.today"; sid:601717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-creations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-creations.com"; sid:601718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dag.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dag.amsterdam"; sid:601719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadag.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadag.amsterdam"; sid:601720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadays.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadays.net"; sid:601721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadigging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadigging.com"; sid:601722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogs.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogs.net"; sid:601723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotbirdband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotbirdband.com"; sid:601724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.services"; sid:601725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-freepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-freepass.com"; sid:601726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree-pass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree-pass.com"; sid:601727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafysiotherapie.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafysiotherapie.amsterdam"; sid:601728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakap.com"; sid:601729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillersllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillersllc.com"; sid:601730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakit.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakit.life"; sid:601731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknit.com"; sid:601732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakorumapaneli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakorumapaneli.com"; sid:601733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluege.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluege.info"; sid:601734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasquerade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasquerade.com"; sid:601735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaloozasignup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaloozasignup.com"; sid:601736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapassfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapassfree.com"; sid:601737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprinter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprinter.com"; sid:601738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protections.com"; sid:601739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurse.com"; sid:601740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe-demo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe-demo.com"; sid:601741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeindia.com"; sid:601742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaga.com"; sid:601743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascentials.com"; sid:601744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschadenersatz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschadenersatz.com"; sid:601745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascrewballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascrewballs.com"; sid:601746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shake-hands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shake-hands.com"; sid:601747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spenden.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spenden.info"; sid:601748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasplashguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasplashguard.com"; sid:601749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronassentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronassentials.com"; sid:601750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-subventionsbetrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-subventionsbetrug.com"; sid:601751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatok-eshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatok-eshop.com"; sid:601752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveladvice.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveladvice.info"; sid:601753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinatie.com"; sid:601754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanddisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanddisinfecting.com"; sid:601755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandpediatric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandpediatric.com"; sid:601756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbankruptcylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbankruptcylawfirm.com"; sid:601757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbannersforschools.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbannersforschools.net"; sid:601758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbanners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbanners.net"; sid:601759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestbooks.com"; sid:601760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbitch.com"; sid:601761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblacklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblacklist.com"; sid:601762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharts.net"; sid:601763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusclinic.com"; sid:601764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-compensation.com"; sid:601765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplaint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplaint.com"; sid:601766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectivebooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectivebooks.com"; sid:601767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdividers.com"; sid:601768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusease.com"; sid:601769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfdaapprovedpill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfdaapprovedpill.com"; sid:601770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfdaapprovedvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfdaapprovedvaccine.com"; sid:601771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalapp.com"; sid:601772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgums.com"; sid:601773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskindlebooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskindlebooks.com"; sid:601774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmab.com"; sid:601775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmabtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmabtherapy.com"; sid:601776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmamparas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmamparas.com"; sid:601777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmamparas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmamparas.net"; sid:601778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonoclonalantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonoclonalantibody.com"; sid:601779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmysterybooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmysterybooks.com"; sid:601780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlineupdate.com"; sid:601781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusornaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusornaments.com"; sid:601782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartitions.com"; sid:601783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchdatacenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchdatacenter.net"; sid:601784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteeth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteeth.com"; sid:601785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrius-sd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrius-sd.com"; sid:601786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corredorescontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corredorescontracovid.com"; sid:601787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costofcoronavirus.com"; sid:601788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costofcovid.com"; sid:601789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1939.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1939.com"; sid:601790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1939.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1939.com"; sid:601791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abogadony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abogadony.com"; sid:601792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19advise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19advise.com"; sid:601793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ale.com"; sid:601794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ambassadors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ambassadors.com"; sid:601795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19andpediatric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19andpediatric.com"; sid:601796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andpediatric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andpediatric.com"; sid:601797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodytestfairfaxva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodytestfairfaxva.com"; sid:601798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-artikel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-artikel.com"; sid:601799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorney.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorney.info"; sid:601800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bandits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bandits.com"; sid:601801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bandits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bandits.net"; sid:601802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banners4less.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banners4less.com"; sid:601803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banners4less.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banners4less.net"; sid:601804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bannersforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bannersforschools.com"; sid:601805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bannersforschools.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bannersforschools.net"; sid:601806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bireyselmujdeleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bireyselmujdeleriniz.com"; sid:601807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bireyselucretiade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bireyselucretiade.com"; sid:601808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blacklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blacklist.com"; sid:601809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brew.com"; sid:601810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessbanners.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessbanners.net"; sid:601811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessinfohub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessinfohub.com"; sid:601812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesswebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesswebinar.com"; sid:601813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cafe.com"; sid:601814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capecod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capecod.com"; sid:601815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certca.com"; sid:601816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsservices.com"; sid:601817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-class-action.com"; sid:601818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-class-action.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-class-action.info"; sid:601819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-class-action.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-class-action.net"; sid:601820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanerstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanerstl.com"; sid:601821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-colorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-colorado.com"; sid:601822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialcleanup.com"; sid:601823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19communications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19communications.com"; sid:601824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compensationclaims.com"; sid:601825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compliancetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compliancetesting.com"; sid:601826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19connects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19connects.com"; sid:601827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataview.com"; sid:601828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destegi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destegi.com"; sid:601829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-doctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-doctors.com"; sid:601830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-doctors.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-doctors.info"; sid:601831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-doctors.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-doctors.net"; sid:601832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donatefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donatefund.com"; sid:601833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employmentcounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employmentcounsel.com"; sid:601834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enza.com"; sid:601835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19everyone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19everyone.com"; sid:601836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-facemaskgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-facemaskgear.com"; sid:601837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factsorfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factsorfiction.com"; sid:601838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fdaapprovedpill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fdaapprovedpill.com"; sid:601839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fdaapprovedvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fdaapprovedvaccine.com"; sid:601840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fdaapprovedvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fdaapprovedvaccine.com"; sid:601841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19financialcrimeslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19financialcrimeslawyer.com"; sid:601842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19foreclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19foreclosure.com"; sid:601843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freedating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freedating.com"; sid:601844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalapp.com"; sid:601845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19globalupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19globalupdate.com"; sid:601846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grantss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grantss.com"; sid:601847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-guards.com"; sid:601848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19happens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19happens.com"; sid:601849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthandsafety.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthandsafety.solutions"; sid:601850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hope.com"; sid:601851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hopestudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hopestudy.com"; sid:601852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-job.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-job.com"; sid:601853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-job.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-job.info"; sid:601854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-job.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-job.net"; sid:601855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kidz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kidz.com"; sid:601856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19korumapaneli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19korumapaneli.com"; sid:601857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19layoffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19layoffs.com"; sid:601858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lifestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lifestories.com"; sid:601859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mab.com"; sid:601860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mabtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mabtherapy.com"; sid:601861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mabtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mabtreatment.com"; sid:601862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mademestartabusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mademestartabusiness.com"; sid:601863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19martyrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19martyrs.com"; sid:601864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monoclonalantibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monoclonalantibody.com"; sid:601865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monoclonalantibodytreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monoclonalantibodytreatment.com"; sid:601866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-network.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-network.info"; sid:601867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notices.com"; sid:601868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notification.com"; sid:601869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19notifications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19notifications.com"; sid:601870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nurse.com"; sid:601871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nurse.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nurse.info"; sid:601872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nurse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nurse.net"; sid:601873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursinghomecases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursinghomecases.com"; sid:601874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onlineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onlineupdate.com"; sid:601875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcpppcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcpppcom.com"; sid:601876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plaintiff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plaintiff.com"; sid:601877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plandemic.com"; sid:601878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppefinanceandsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppefinanceandsales.com"; sid:601879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesalesandfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesalesandfinance.com"; sid:601880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesales.com"; sid:601881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesf.com"; sid:601882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeusa.com"; sid:601883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19professional.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19professional.info"; sid:601884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19professionalnetwork.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19professionalnetwork.info"; sid:601885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19progressbar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19progressbar.com"; sid:601886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectioncabinet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectioncabinet.com"; sid:601887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivescreens.com"; sid:601888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19public.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19public.info"; sid:601889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quil.com"; sid:601890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19release.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19release.com"; sid:601891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19release.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19release.net"; sid:601892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rxbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rxbrasil.com"; sid:601893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rxbrasil.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rxbrasil.net"; sid:601894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rxnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rxnow.com"; sid:601895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.solutions"; sid:601896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safeworkplace.com"; sid:601897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19samplevalidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19samplevalidation.com"; sid:601898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sampling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sampling.com"; sid:601899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scandal.com"; sid:601900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securitycabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securitycabin.com"; sid:601901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sg.com"; sid:601902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smartbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smartbusiness.com"; sid:601903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialdistancingtshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialdistancingtshirts.com"; sid:601904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsforbusinesses.com"; sid:601905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statssite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statssite.com"; sid:601906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strongertogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strongertogether.com"; sid:601907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliernetwork.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliernetwork.info"; sid:601908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsworldwide.com"; sid:601909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorworldwide.com"; sid:601910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testandclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testandclear.com"; sid:601911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testfairfaxva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testfairfaxva.com"; sid:601912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testfallschurchva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testfallschurchva.com"; sid:601913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitsusa.com"; sid:601914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traumasurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traumasurvivors.com"; sid:601915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveladvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveladvise.com"; sid:601916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19updates.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19updates.today"; sid:601917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usahelp.com"; sid:601918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usahelp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usahelp.info"; sid:601919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uujo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uujo.com"; sid:601920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19validation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19validation.com"; sid:601921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vms.com"; sid:601922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vts.com"; sid:601923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20store.com"; sid:601924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20taskforce.com"; sid:601925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21store.com"; sid:601926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2x.com"; sid:601927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid69.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid69.net"; sid:601928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidafectados.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidafectados.info"; sid:601929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairway.com"; sid:601930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidambassadors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidambassadors.com"; sid:601931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangelofmercy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangelofmercy.com"; sid:601932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarelief.com"; sid:601933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatos.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatos.info"; sid:601934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcy.club"; sid:601935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcyguide.com"; sid:601936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampfire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampfire.com"; sid:601937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampfire.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampfire.info"; sid:601938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampfire.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampfire.net"; sid:601939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcensored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcensored.com"; sid:601940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenterargentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenterargentina.com"; sid:601941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchasers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchasers.com"; sid:601942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-checkin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-checkin.com"; sid:601943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmas2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmas2020.com"; sid:601944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-class-action.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-class-action.com"; sid:601945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-class-action.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-class-action.info"; sid:601946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-class-action.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-class-action.net"; sid:601947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactions.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactions.info"; sid:601948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactions.net"; sid:601949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclef.com"; sid:601950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcockups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcockups.com"; sid:601951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackinitiative.com"; sid:601952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialcleanup.com"; sid:601953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplegal.com"; sid:601954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcondo.com"; sid:601955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoupleseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoupleseries.com"; sid:601956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurb.com"; sid:601957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurb.net"; sid:601958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.life"; sid:601959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.dental"; sid:601960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-digest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-digest.com"; sid:601961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomicdata.com"; sid:601962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomicimpact.com"; sid:601963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelderlylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelderlylaw.com"; sid:601964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoparenting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoparenting.com"; sid:601965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesinfecciones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesinfecciones.com"; sid:601966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevaluations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevaluations.com"; sid:601967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpo.com"; sid:601968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.farm - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.farm"; sid:601969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfibs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfibs.com"; sid:601970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.fish - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.fish"; sid:601971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosureguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosureguide.com"; sid:601972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosures.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosures.life"; sid:601973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-ge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-ge.com"; sid:601974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehair.com"; sid:601975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemx.com"; sid:601976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-freepv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-freepv.com"; sid:601977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesalon.com"; sid:601978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeverificado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeverificado.com"; sid:601979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-frei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-frei.com"; sid:601980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlineusa.com"; sid:601981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobaldata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobaldata.com"; sid:601982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobaleconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobaleconomy.com"; sid:601983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrenier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrenier.com"; sid:601984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhespress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhespress.com"; sid:601985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhindsight2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhindsight2020.com"; sid:601986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hoax.com"; sid:601987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhopeworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhopeworldwide.com"; sid:601988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidia2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidia2020.com"; sid:601989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidia2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidia2021.com"; sid:601990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactdata.com"; sid:601991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-india.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-india.info"; sid:601992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.media - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.media"; sid:601993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinizing.com"; sid:601994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylawny.com"; sid:601995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinternationallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinternationallaw.com"; sid:601996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisgone.com"; sid:601997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkap.com"; sid:601998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeepaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeepaway.com"; sid:601999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeyusa.com"; sid:602000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillersllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillersllc.com"; sid:602001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawinternational.com"; sid:602002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanage.com"; sid:602003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanage.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanage.net"; sid:602004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilecare.com"; sid:602005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmondkapje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmondkapje.com"; sid:602006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnize.com"; sid:602007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnizing.com"; sid:602008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidokapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidokapp.com"; sid:602009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidom.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidom.net"; sid:602010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoversimplified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoversimplified.com"; sid:602011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartysupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartysupplies.com"; sid:602012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassword.com"; sid:602013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassworld.com"; sid:602014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassworld.net"; sid:602015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersonals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersonals.com"; sid:602016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprobability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprobability.com"; sid:602017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotec.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotec.net"; sid:602018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionguard.com"; sid:602019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublic.info"; sid:602020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquil.com"; sid:602021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecountal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecountal.com"; sid:602022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcanada.com"; sid:602023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefmontreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefmontreal.com"; sid:602024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeholidays.com"; sid:602025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestickers.com"; sid:602026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyscreens.com"; sid:602027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysticker.com"; sid:602028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevillas.com"; sid:602029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscandal.com"; sid:602030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreenedhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreenedhere.com"; sid:602031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreenhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreenhere.com"; sid:602032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageforschools.com"; sid:602033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignsforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignsforschools.com"; sid:602034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidssafebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidssafebiz.com"; sid:602035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaysafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaysafe.com"; sid:602036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaysafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaysafe.net"; sid:602037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories.info"; sid:602038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyplace.com"; sid:602039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivors.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivors.world"; sid:602040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsworld.com"; sid:602041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsworlwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsworlwide.com"; sid:602042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtail.com"; sid:602043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteer.com"; sid:602044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfree.com"; sid:602045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting247.com"; sid:602046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingfree.com"; sid:602047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnear.com"; sid:602048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnearyou.com"; sid:602049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingweb.com"; sid:602050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.life"; sid:602051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestwny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestwny.com"; sid:602052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccines.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccines.net"; sid:602053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineuk.com"; sid:602054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineuk.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineuk.net"; sid:602055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvconstitution.com"; sid:602056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvconstitution.movie - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvconstitution.movie"; sid:602057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvconstitutionmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvconstitutionmovie.com"; sid:602058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscreens.com"; sid:602059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-visiere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-visiere.com"; sid:602060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvsconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvsconstitution.com"; sid:602061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvstheconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvstheconstitution.com"; sid:602062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvtheconstitution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvtheconstitution.com"; sid:602063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwellbeingni.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwellbeingni.info"; sid:602064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldwidesurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldwidesurvivors.com"; sid:602065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-x.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-x.net"; sid:602066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curehonouredviralcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curehonouredviralcovid19.com"; sid:602067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovidshield.com"; sid:602068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for damcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"damcovid.com"; sid:602069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deerfieldagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deerfieldagainstcorona.com"; sid:602070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defenceagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defenceagainstcorona.com"; sid:602071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digestivecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digestivecovid.com"; sid:602072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digestivecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digestivecovid.net"; sid:602073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discovercovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discovercovidtesting.com"; sid:602074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discoverycovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discoverycovid19tests.com"; sid:602075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorsvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorsvscovid19.com"; sid:602076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doggonepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doggonepandemic.com"; sid:602077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidtest.com"; sid:602078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employmentlawyercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employmentlawyercovid19.com"; sid:602079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19now.com"; sid:602080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccheck.com"; sid:602081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmonitoring.com"; sid:602082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicproofprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicproofprofits.com"; sid:602083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicq.com"; sid:602084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espaciolibrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espaciolibrecovid.com"; sid:602085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-stop-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-stop-covid.com"; sid:602086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-stopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-stopcovid.com"; sid:602087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-stop-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-stop-covid.net"; sid:602088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etiquette-stopcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etiquette-stopcovid.net"; sid:602089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesofcovid19fallen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesofcovid19fallen.com"; sid:602090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidpartitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidpartitions.com"; sid:602091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidscreens.com"; sid:602092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcoronastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcoronastore.com"; sid:602093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona-now.com"; sid:602094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidsupplies.com"; sid:602095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followcovidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followcovidmoney.com"; sid:602096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodandcovid19.com"; sid:602097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foracovid19.com"; sid:602098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forgetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forgetcovid.com"; sid:602099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for formacioncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"formacioncovid19.com"; sid:602100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovidparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovidparty.com"; sid:602101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaycovid.com"; sid:602102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacovid-19.com"; sid:602103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacovidtest.com"; sid:602104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidtestkit.com"; sid:602105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gilbertocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gilbertocorona.com"; sid:602106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicmovie.com"; sid:602107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gmcoronavirus.com"; sid:602108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gmcovid19gm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gmcovid19gm.com"; sid:602109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gmh-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gmh-covid19.com"; sid:602110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.biz"; sid:602111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for googledoccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"googledoccovid19.com"; sid:602112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gutcovid.com"; sid:602113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hgecovidecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hgecovidecare.com"; sid:602114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honoringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honoringcovid.com"; sid:602115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotel-corona-anspruch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotel-corona-anspruch.com"; sid:602116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelerie-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelerie-corona.com"; sid:602117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovercovid.com"; sid:602118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impandemic.com"; sid:602119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insolvenz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insolvenz-corona.com"; sid:602120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19.com"; sid:602121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovidtests.com"; sid:602122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcovidlaw.com"; sid:602123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedthepandemicof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedthepandemicof2020.com"; sid:602124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iticovid.com"; sid:602125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iticovid.net"; sid:602126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itsacovidworldnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itsacovidworldnow.com"; sid:602127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justcleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justcleancorona.com"; sid:602128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karadcovid19.com"; sid:602129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kbkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kbkcovid.com"; sid:602130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ketaminecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ketaminecovid19.com"; sid:602131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcoronasbutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcoronasbutt.com"; sid:602132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for krankenhaus-anspruch-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"krankenhaus-anspruch-corona.com"; sid:602133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for krankenhaus-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"krankenhaus-corona.com"; sid:602134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lapandemic.com"; sid:602135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovid.com"; sid:602136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronaupdate.com"; sid:602137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lepandemic.com"; sid:602138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leritascovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leritascovid19testing.com"; sid:602139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leritascovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leritascovidtesting.com"; sid:602140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesdessousducovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesdessousducovid19.com"; sid:602141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lesdessousducovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lesdessousducovid19.net"; sid:602142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronaguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronaguide.com"; sid:602143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirusguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirusguide.com"; sid:602144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovidguide.com"; sid:602145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoviddata.com"; sid:602146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logisticpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logisticpandemic.com"; sid:602147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luttecontrelecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luttecontrelecovid.com"; sid:602148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maputi-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maputi-corona.com"; sid:602149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskandteecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskandteecovidfree.com"; sid:602150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigacovid.com"; sid:602151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multacovid.com"; sid:602152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for multas-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"multas-covid.com"; sid:602153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacrafts.com"; sid:602154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidband.com"; sid:602155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstats.com"; sid:602156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mysondiedofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mysondiedofcovid-19.com"; sid:602157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearestcorona-virusclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearestcorona-virusclinic.com"; sid:602158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobodyexpectsthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobodyexpectsthecoronavirus.com"; sid:602159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronacars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronacars.com"; sid:602160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nss-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nss-covid19.com"; sid:602161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycovidlaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycovidlaws.com"; sid:602162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycsoundscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycsoundscovid19.com"; sid:602163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for on-a-counta-the-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"on-a-counta-the-covid.com"; sid:602164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonoterapiaparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonoterapiaparacovid.com"; sid:602165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic1984.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic1984.com"; sid:602166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020festival.com"; sid:602167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalertness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalertness.com"; sid:602168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessresponse.com"; sid:602169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfaceprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfaceprotection.com"; sid:602170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichandprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichandprotection.com"; sid:602171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichealthandsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichealthandsafety.com"; sid:602172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmoive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmoive.com"; sid:602173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmove.com"; sid:602174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmovei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmovei.com"; sid:602175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmovi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmovi.com"; sid:602176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonalitieswithsprinkles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonalitieswithsprinkles.com"; sid:602177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpersonalitieswithsprinkles.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpersonalitieswithsprinkles.net"; sid:602178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-planet.com"; sid:602179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-planet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-planet.net"; sid:602180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreventionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreventionservices.com"; sid:602181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicremembranceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicremembranceday.com"; sid:602182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsandthelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsandthelaw.com"; sid:602183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscam.com"; sid:602184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscam.net"; sid:602185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicscandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicscandal.com"; sid:602186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsex.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsex.life"; sid:602187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsex.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsex.partners"; sid:602188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsterilization.com"; sid:602189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsterilizing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsterilizing.com"; sid:602190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuits.com"; sid:602191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworkplacesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworkplacesafety.com"; sid:602192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicworkplaceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicworkplaceservices.com"; sid:602193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passwordcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passwordcovid.com"; sid:602194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passwordcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passwordcovid.net"; sid:602195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passworldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passworldcovid.com"; sid:602196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatricandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatricandcoronavirus.com"; sid:602197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatricandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatricandcovid-19.com"; sid:602198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pediatricandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pediatricandcovid19.com"; sid:602199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pedirsincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pedirsincovid.com"; sid:602200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petsownersforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petsownersforcovid-19.com"; sid:602201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pghcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pghcovidnews.com"; sid:602202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for playcoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"playcoronaworld.com"; sid:602203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pornstarpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pornstarpandemic.com"; sid:602204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19hair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19hair.com"; sid:602205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhair.com"; sid:602206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemic-playbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemic-playbook.com"; sid:602207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-pandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-pandemicplaybook.com"; sid:602208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for potus45covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"potus45covid19.com"; sid:602209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pre-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pre-corona.net"; sid:602210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precorona.net"; sid:602211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for predicovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"predicovid.cloud"; sid:602212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevecovid.com"; sid:602213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevecovid.net"; sid:602214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prismacovidsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prismacovidsignage.com"; sid:602215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovid19tests.com"; sid:602216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for procovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"procovidtests.com"; sid:602217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productos-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productos-covid19.com"; sid:602218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protezionecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protezionecoronavirus.net"; sid:602219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pushcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pushcovid.com"; sid:602220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questioningcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questioningcorona.com"; sid:602221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for questoningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"questoningcovid.com"; sid:602222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rancovid.com"; sid:602223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestsforcoronavirus.com"; sid:602224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realgoodcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realgoodcovidtracker.com"; sid:602225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid19.com"; sid:602226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid19.net"; sid:602227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid20.com"; sid:602228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovid20.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovid20.net"; sid:602229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovidresponse.com"; sid:602230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rubiconcovidresponse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rubiconcovidresponse.net"; sid:602231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidppe.com"; sid:602232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidppesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidppesupply.com"; sid:602233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanifica-covid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanifica-covid.cloud"; sid:602234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scotuscovid19case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scotuscovid19case.com"; sid:602235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovidi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovidi.com"; sid:602236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screen-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screen-covid19.com"; sid:602237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screen-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screen-covid.com"; sid:602238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seattlecovidvirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seattlecovidvirustesting.com"; sid:602239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfisolationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfisolationcovid19.com"; sid:602240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sellingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sellingduringcovid.com"; sid:602241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincovid.net"; sid:602242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siscovid.com"; sid:602243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sitzpatentpendingsecretcovidbenefitformula.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sitzpatentpendingsecretcovidbenefitformula.com"; sid:602244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for socialanxietypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"socialanxietypandemic.com"; sid:602245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sos-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sos-covid.info"; sid:602246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spshcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spshcovidsupport.com"; sid:602247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sterilizingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sterilizingcovid.com"; sid:602248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-stop-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-stop-covid.com"; sid:602249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-stopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-stopcovid.com"; sid:602250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-stop-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-stop-covid.net"; sid:602251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sticker-stopcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sticker-stopcovid.net"; sid:602252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovidslide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovidslide.com"; sid:602253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swisstestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swisstestcovid.com"; sid:602254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronainvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronainvoice.com"; sid:602255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaqueens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaqueens.com"; sid:602256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronastore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronastore.net"; sid:602257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidkeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidkeys.com"; sid:602258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidmemoirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidmemoirs.com"; sid:602259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidreality.com"; sid:602260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiccollection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiccollection.com"; sid:602261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepeopleshistoryofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepeopleshistoryofcovid.com"; sid:602262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldoncovid.com"; sid:602263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tonami-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tonami-covid19.com"; sid:602264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovid19testkits.com"; sid:602265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidtestkits.com"; sid:602266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ucrtcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ucrtcovid.com"; sid:602267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovidpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovidpassport.com"; sid:602268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovidtest.com"; sid:602269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upcovid.com"; sid:602270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatedata-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatedata-corona.com"; sid:602271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid-19count.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid-19count.com"; sid:602272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19counts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19counts.com"; sid:602273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtrends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtrends.net"; sid:602274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralpandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralpandemic.info"; sid:602275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralpandemic.net"; sid:602276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visierecovid-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visierecovid-france.com"; sid:602277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vloerstickerscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vloerstickerscorona.com"; sid:602278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for voicemessageoffice365covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"voicemessageoffice365covid19.com"; sid:602279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warrioramidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warrioramidpandemic.com"; sid:602280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warriorsamidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warriorsamidpandemic.com"; sid:602281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencovidcame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencovidcame.com"; sid:602282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whencovidchangedtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whencovidchangedtheworld.com"; sid:602283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workerscomp-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workerscomp-covid.com"; sid:602284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidcare.com"; sid:602285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjohn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjohn.com"; sid:602286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjxwy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjxwy.com"; sid:602287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-ysoka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-ysoka.com"; sid:602288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwdoineedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwdoineedacovid19test.com"; sid:602289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--desinfeccincoronavirus-4fc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--desinfeccincoronavirus-4fc.com"; sid:602290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19traveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19traveladvice.com"; sid:602291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidcase.com"; sid:602292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ziraatbankcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ziraatbankcovid19.com"; sid:602293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidcrafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidcrafunds.com"; sid:602294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bw.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bw.center"; sid:602295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cracovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cracovidfunds.com"; sid:602296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhs-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhs-covid19.net"; sid:602297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozonocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozonocovid19.net"; sid:602298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viralpandemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viralpandemic.biz"; sid:602299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abscovid.com"; sid:602300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afccovidsafeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afccovidsafeworkplace.com"; sid:602301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airpurecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airpurecorona.com"; sid:602302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiescovid.com"; sid:602303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovidcool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovidcool.com"; sid:602304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidcool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidcool.com"; sid:602305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedpandemic.com"; sid:602306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beiiagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beiiagainstcovid.com"; sid:602307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beiicarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beiicarecovid.com"; sid:602308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beilcarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beilcarecovid.com"; sid:602309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beilfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beilfightcovid.com"; sid:602310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beliagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beliagainstcovid.com"; sid:602311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beliforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beliforcovid.com"; sid:602312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellagainstcovid.com"; sid:602313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellfightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellfightcovid.com"; sid:602314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19dashboard.com"; sid:602315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgatescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgatescovid.com"; sid:602316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19-ppe.com"; sid:602317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bye-byecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bye-byecovid.com"; sid:602318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificationcovid19.com"; sid:602319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrenofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrenofcovid.com"; sid:602320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloison-anticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloison-anticovid.com"; sid:602321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatealcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatealcovid.com"; sid:602322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-automaat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-automaat.com"; sid:602323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclasscord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclasscord.com"; sid:602324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleansepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleansepro.com"; sid:602325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomplishments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomplishments.com"; sid:602326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconmodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconmodels.com"; sid:602327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidmarket.com"; sid:602328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuentos.com"; sid:602329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dolls.com"; sid:602330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeisland.com"; sid:602331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagratitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagratitude.com"; sid:602332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahindsight2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahindsight2020.com"; sid:602333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainthekitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainthekitchen.com"; sid:602334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuithub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuithub.com"; sid:602335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquestionnaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquestionnaire.com"; sid:602336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasavetyglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasavetyglass.com"; sid:602337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutz-masken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutz-masken.com"; sid:602338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasizofis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasizofis.com"; sid:602339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausatest.com"; sid:602340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaustests.com"; sid:602341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadviceforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadviceforemployers.com"; sid:602342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusending.com"; sid:602343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusover.com"; sid:602344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrvsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrvsale.com"; sid:602345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stopcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stopcovid19.com"; sid:602346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tracers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tracers.com"; sid:602347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisa.com"; sid:602348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisas.com"; sid:602349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020strongertogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020strongertogether.com"; sid:602350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athena.com"; sid:602351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bestprices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bestprices.com"; sid:602352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bet.com"; sid:602353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessopportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessopportunity.com"; sid:602354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casket.com"; sid:602355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coffin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coffin.com"; sid:602356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cra.com"; sid:602357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deniers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deniers.com"; sid:602358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectioncleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectioncleaningservices.com"; sid:602359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19easyrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19easyrapidtest.com"; sid:602360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentopportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentopportunity.com"; sid:602361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fashionablemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fashionablemask.com"; sid:602362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthandwellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthandwellness.com"; sid:602363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcareworkerpsychiatrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcareworkerpsychiatrist.com"; sid:602364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcareworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcareworkers.com"; sid:602365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meatpacking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meatpacking.com"; sid:602366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneytrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneytrends.com"; sid:602367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mortgagereliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mortgagereliefprogram.com"; sid:602368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nfc.com"; sid:602369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicfacemask.com"; sid:602370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemicmask.com"; sid:602371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pims.com"; sid:602372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppemasks.com"; sid:602373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quil.com"; sid:602374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rvsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rvsale.com"; sid:602375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salesforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salesforce.com"; sid:602376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selfhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selfhelp.com"; sid:602377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signdesign.com"; sid:602378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sitetesting.com"; sid:602379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingasaservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingasaservice.com"; sid:602380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toxicshock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toxicshock.com"; sid:602381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toxicshocklawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toxicshocklawsuit.com"; sid:602382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaksin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaksin.com"; sid:602383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldtracking.com"; sid:602384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldwarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldwarrior.com"; sid:602385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabs.com"; sid:602386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaiir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaiir.com"; sid:602387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyscreen.com"; sid:602388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapps-19.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapps-19.bid"; sid:602389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbands2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbands2020.com"; sid:602390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscleaner.com"; sid:602391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessdefender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessdefender.com"; sid:602392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareservices.com"; sid:602393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashsolution.com"; sid:602394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcohorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcohorts.com"; sid:602395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoolio.com"; sid:602396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreep.com"; sid:602397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectingservice.com"; sid:602398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrink.com"; sid:602399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideer.com"; sid:602400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacialmask.com"; sid:602401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecyprus.com"; sid:602402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundworldwide.com"; sid:602403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhalloffame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhalloffame.com"; sid:602404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-healthbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-healthbot.com"; sid:602405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpms.com"; sid:602406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicrofiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicrofiction.com"; sid:602407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-one.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-one.com"; sid:602408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonors.com"; sid:602409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoven.com"; sid:602410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicmask.com"; sid:602411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpantry.com"; sid:602412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpattern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpattern.com"; sid:602413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmainitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmainitiative.com"; sid:602414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositivenews.com"; sid:602415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquality.com"; sid:602416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestkitusa.com"; sid:602417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresortdecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresortdecontamination.com"; sid:602418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyhub.com"; sid:602419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigndesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigndesign.com"; sid:602420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidssupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidssupplies.com"; sid:602421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrongertogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrongertogether.com"; sid:602422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplypack.com"; sid:602423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoxicshocklawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoxicshocklawsuit.com"; sid:602424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidundercover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidundercover.com"; sid:602425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedetox.com"; sid:602426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cracovidfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cracovidfunds.com"; sid:602427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnose-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnose-corona.com"; sid:602428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnose-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnose-covid-19.com"; sid:602429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidfree.com"; sid:602430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronaviruslocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronaviruslocation.com"; sid:602431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovidresult.com"; sid:602432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incoronation.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incoronation.club"; sid:602433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inoviocovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inoviocovid19vaccine.com"; sid:602434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jennyscoronablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jennyscoronablog.com"; sid:602435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jequiecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jequiecovid19.com"; sid:602436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidsofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidsofcovid19.com"; sid:602437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticovid-19.com"; sid:602438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a2zcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a2zcovid19.com"; sid:602439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affiliatemarketingcovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affiliatemarketingcovid-19.biz"; sid:602440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona.asia"; sid:602441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akclini-covid-19kensa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akclini-covid-19kensa.com"; sid:602442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovidreliefscrm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovidreliefscrm.com"; sid:602443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapostcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapostcovid19.com"; sid:602444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aurevoircovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aurevoircovid.com"; sid:602445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ballare-contro-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ballare-contro-corona.com"; sid:602446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidkind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidkind.com"; sid:602447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestofcovid.com"; sid:602448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificacion-libre-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificacion-libre-covid.com"; sid:602449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificacion-limpieza-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificacion-limpieza-covid.com"; sid:602450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidstress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidstress.com"; sid:602451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona956.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona956.com"; sid:602452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ampeln.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ampeln.com"; sid:602453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaampeln.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaampeln.com"; sid:602454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanse.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanse.biz"; sid:602455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebaby.com"; sid:602456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehousecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehousecleaning.com"; sid:602457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreepet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreepet.com"; sid:602458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetribe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetribe.com"; sid:602459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarulers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarulers.com"; sid:602460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasay.com"; sid:602461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.biz"; sid:602462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningmobile.com"; sid:602463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleansed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleansed.com"; sid:602464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggingengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggingengland.com"; sid:602465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggings.com"; sid:602466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoggingwales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoggingwales.com"; sid:602467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitallawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitallawsuit.com"; sid:602468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylawsuits.com"; sid:602469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslighttherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslighttherapy.com"; sid:602470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoriginated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoriginated.com"; sid:602471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitamind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitamind.com"; sid:602472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldtracker.com"; sid:602473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatecovid19test.com"; sid:602474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestlocations.com"; sid:602475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleanupkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleanupkit.com"; sid:602476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19collections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19collections.com"; sid:602477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19communicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19communicate.com"; sid:602478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communicate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communicate.com"; sid:602479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19droneservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19droneservice.com"; sid:602480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exitstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exitstrategies.com"; sid:602481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gearsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gearsupply.com"; sid:602482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hyperimmuneplasmabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hyperimmuneplasmabank.com"; sid:602483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealthsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealthsurvival.com"; sid:602484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobiletest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobiletest.app"; sid:602485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19originated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19originated.com"; sid:602486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plasmabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plasmabank.com"; sid:602487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pov.com"; sid:602488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolbuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolbuses.com"; sid:602489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securestandards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securestandards.com"; sid:602490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-signaletique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-signaletique.com"; sid:602491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storiesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storiesnyc.com"; sid:602492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surfaceremoval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surfaceremoval.com"; sid:602493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracer.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracer.app"; sid:602494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.app"; sid:602495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinemaps.com"; sid:602496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidannuitysales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidannuitysales.com"; sid:602497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrayan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrayan.com"; sid:602498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcay.com"; sid:602499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearai.com"; sid:602500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-comm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-comm.com"; sid:602501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunicationsclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunicationsclinic.com"; sid:602502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoral.com"; sid:602503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesafe.com"; sid:602504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaces.com"; sid:602505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapp.com"; sid:602506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglo.com"; sid:602507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthnews.com"; sid:602508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.club"; sid:602509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmac.com"; sid:602510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovie.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovie.club"; sid:602511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppeblockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppeblockchain.com"; sid:602512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-project.com"; sid:602513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-proof.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-proof.biz"; sid:602514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionkit.com"; sid:602515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidready.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidready.app"; sid:602516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecord.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecord.app"; sid:602517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.asia"; sid:602518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecommerce.com"; sid:602519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeplans.com"; sid:602520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeppe.com"; sid:602521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.app"; sid:602522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.biz"; sid:602523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurecertificate.com"; sid:602524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurecleaning.com"; sid:602525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.club"; sid:602526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield.app"; sid:602527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriesnyc.com"; sid:602528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsproject.com"; sid:602529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurex.com"; sid:602530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for custommadecovid19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"custommadecovid19facemasks.com"; sid:602531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danza-contro-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danza-contro-corona.com"; sid:602532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatcoronafree.com"; sid:602533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-labcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-labcovid-19.com"; sid:602534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elonisacovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elonisacovidiot.com"; sid:602535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmonitor.com"; sid:602536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicssolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicssolution.com"; sid:602537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familycovidsupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familycovidsupportgroup.com"; sid:602538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitpostcovid.com"; sid:602539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foggingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foggingcoronavirus.com"; sid:602540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidsafe.com"; sid:602541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glmcovid.com"; sid:602542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthandsafetycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthandsafetycovid19.com"; sid:602543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hev20pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hev20pandemic.com"; sid:602544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid19.blog"; sid:602545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalactioncovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalactioncovid-19.biz"; sid:602546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visadocovid-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visadocovid-19.cat"; sid:602547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100proofcovidprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100proofcovidprevention.com"; sid:602548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abrazodeosocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abrazodeosocovid19.com"; sid:602549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for achatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"achatcovid.com"; sid:602550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidchristmas.com"; sid:602551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidthanksgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidthanksgiving.com"; sid:602552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africanyouthagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africanyouthagainstcovid-19.com"; sid:602553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacoronavirus19.com"; sid:602554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafightscoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafightscoronavirus19.com"; sid:602555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.best"; sid:602556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona-shop.com"; sid:602557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-2019.com"; sid:602558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacoronabusinessinterruptioninsuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacoronabusinessinterruptioninsuranceclaims.com"; sid:602559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecovidfund.com"; sid:602560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bannerlegalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bannerlegalcovid19.com"; sid:602561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsecure.com"; sid:602562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bonuscovidristrutturazioni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bonuscovidristrutturazioni.com"; sid:602563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19items.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19items.com"; sid:602564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buytestcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buytestcovid19.com"; sid:602565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovidshield.com"; sid:602566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canariasfreecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canariasfreecovid-19.com"; sid:602567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colonnacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colonnacovid.com"; sid:602568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confessionsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confessionsofcovid.com"; sid:602569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattorneyforhire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattorneyforhire.com"; sid:602570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabonuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabonuses.com"; sid:602571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersca.com"; sid:602572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersct.com"; sid:602573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanersoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanersoh.com"; sid:602574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoapartmenthomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoapartmenthomes.com"; sid:602575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepis.com"; sid:602576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree-odmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree-odmor.com"; sid:602577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreergv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreergv.com"; sid:602578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardsusa.com"; sid:602579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuccessstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuccessstories.com"; sid:602580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinelab.com"; sid:602581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19symptoms.com"; sid:602582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabss.com"; sid:602583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelguide.com"; sid:602584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawealthplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawealthplanner.com"; sid:602585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkaround.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkaround.com"; sid:602586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxd.com"; sid:602587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatecovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatecovidclean.com"; sid:602588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autoclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autoclean.com"; sid:602589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-classifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-classifier.com"; sid:602590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearpass.com"; sid:602591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dtest.com"; sid:602592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goggles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goggles.com"; sid:602593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19informationworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19informationworld.com"; sid:602594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insurancelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insurancelife.com"; sid:602595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kush.com"; sid:602596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawerforhire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawerforhire.com"; sid:602597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mod.com"; sid:602598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nassaucountybusinesslawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nassaucountybusinesslawyers.com"; sid:602599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppechina.com"; sid:602600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizergate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizergate.com"; sid:602601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19secrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19secrets.com"; sid:602602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supervivientes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supervivientes.com"; sid:602603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinationshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinationshot.com"; sid:602604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-advisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-advisor.com"; sid:602605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalytics.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalytics.cloud"; sid:602606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidautofogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidautofogger.com"; sid:602607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanermt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanermt.com"; sid:602608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaneroh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaneroh.com"; sid:602609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersca.com"; sid:602610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersct.com"; sid:602611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersoh.com"; sid:602612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanlasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanlasvegas.com"; sid:602613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollege.com"; sid:602614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureforall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureforall.com"; sid:602615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dj.com"; sid:602616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddtreatment.com"; sid:602617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenv.com"; sid:602618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomehelp.com"; sid:602619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeoffice.com"; sid:602620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovationer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovationer.com"; sid:602621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkit-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkit-uk.com"; sid:602622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlesson.com"; sid:602623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.africa"; sid:602624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidome.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidome.biz"; sid:602625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safedentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safedentistry.com"; sid:602626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafefan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafefan.com"; sid:602627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycheck.com"; sid:602628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycheckin.com"; sid:602629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurecheck.com"; sid:602630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldnh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldnh.com"; sid:602631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-survival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-survival.com"; sid:602632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechglobal.com"; sid:602633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsdiy.com"; sid:602634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideotraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideotraining.com"; sid:602635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiseshipcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiseshipcorona.com"; sid:602636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruiseshipcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruiseshipcovid.com"; sid:602637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directoriofreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directoriofreecovid.com"; sid:602638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiativescompany-news-covid19-20200316token4787f6f3e205927896.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiativescompany-news-covid19-20200316token4787f6f3e205927896.buzz"; sid:602639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for initiativescompany-news-covid19-20200316token4787f6f3e205928465.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"initiativescompany-news-covid19-20200316token4787f6f3e205928465.buzz"; sid:602640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for my-corona-radar.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"my-corona-radar.app"; sid:602641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronaradar.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronaradar.app"; sid:602642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.app"; sid:602643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for with-corona.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"with-corona.blog"; sid:602644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1149coronadoterrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1149coronadoterrace.com"; sid:602645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidclean.com"; sid:602646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albertacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albertacovid19.com"; sid:602647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ambulanciascovid19encdmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ambulanciascovid19encdmx.com"; sid:602648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ambulanciascovid19enestadodemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ambulanciascovid19enestadodemexico.com"; sid:602649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-taskforce.com"; sid:602650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arruinadosporelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arruinadosporelcovid.com"; sid:602651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistsvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistsvscovid.com"; sid:602652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocollant-stop-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocollant-stop-covid.com"; sid:602653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidcleaners.com"; sid:602654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulkcovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulkcovidtestkits.com"; sid:602655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calgarycoviddrive-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calgarycoviddrive-in.com"; sid:602656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for candogsgetcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"candogsgetcovid.com"; sid:602657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedofcovid19.com"; sid:602658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coldorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coldorcovid.com"; sid:602659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-21.com"; sid:602660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antikoerper-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antikoerper-test.com"; sid:602661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabangsat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabangsat.com"; sid:602662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborrel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborrel.com"; sid:602663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronactions.com"; sid:602664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeid.com"; sid:602665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaharega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaharega.com"; sid:602666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalyzed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalyzed.com"; sid:602667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamamacomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamamacomics.com"; sid:602668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapositiveblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapositiveblog.com"; sid:602669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqualitymark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqualitymark.com"; sid:602670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschadeverhalen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschadeverhalen.com"; sid:602671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteamcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteamcleaning.com"; sid:602672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateste.com"; sid:602673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausbox.com"; sid:602674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020.cat"; sid:602675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningdisinfecting.com"; sid:602676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasksafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasksafety.com"; sid:602677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayoket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayoket.com"; sid:602678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveredincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveredincovid.com"; sid:602679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-24hrnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-24hrnews.com"; sid:602680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19banggai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19banggai.com"; sid:602681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bikini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bikini.com"; sid:602682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-checkin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-checkin.com"; sid:602683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clearprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clearprotection.com"; sid:602684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19died.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19died.com"; sid:602685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19factsupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19factsupdate.com"; sid:602686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gofit20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gofit20.com"; sid:602687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19impactonkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19impactonkids.com"; sid:602688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kilos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kilos.com"; sid:602689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskface.com"; sid:602690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalprotectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalprotectiveequipment.com"; sid:602691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prenotazionesicura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prenotazionesicura.com"; sid:602692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realstory.com"; sid:602693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.app"; sid:602694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safebooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safebooking.com"; sid:602695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetysign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetysign.com"; sid:602696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stressreliever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stressreliever.com"; sid:602697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusdisinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusdisinfectingservice.com"; sid:602698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wholesaleproductsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wholesaleproductsolutions.com"; sid:602699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.care"; sid:602700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbesthomebasebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbesthomebasebusiness.com"; sid:602701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbikini.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbikini.com"; sid:602702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecards.com"; sid:602703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning365.com"; sid:602704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-colonoscopy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-colonoscopy.com"; sid:602705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommissions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommissions.com"; sid:602706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancecompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancecompanies.com"; sid:602707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcertification.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcertification.biz"; sid:602708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantchefservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantchefservices.com"; sid:602709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantoffices.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantoffices.agency"; sid:602710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultingservice.com"; sid:602711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovrd.com"; sid:602712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredit.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredit.care"; sid:602713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.com"; sid:602714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-department.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-department.com"; sid:602715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddineout.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddineout.biz"; sid:602716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosafe.com"; sid:602717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepassport.com"; sid:602718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeresorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeresorts.com"; sid:602719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevacationhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevacationhomes.com"; sid:602720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fruit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fruit.com"; sid:602721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgameplan.com"; sid:602722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeneralstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeneralstore.com"; sid:602723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditing.com"; sid:602724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillbox.com"; sid:602725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmachines.com"; sid:602726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask95.com"; sid:602727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-necessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-necessities.com"; sid:602728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganization.com"; sid:602729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartyplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartyplanner.com"; sid:602730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpro.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpro.care"; sid:602731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquestionnaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquestionnaire.com"; sid:602732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealestatehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealestatehelp.com"; sid:602733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehab.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehab.care"; sid:602734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretirementsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretirementsolution.com"; sid:602735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycheck.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycheck.biz"; sid:602736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycheckin.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycheckin.biz"; sid:602737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtool.com"; sid:602738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingappsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingappsite.com"; sid:602739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatment.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatment.care"; sid:602740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusequipment.com"; sid:602741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvt.com"; sid:602742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwisk.com"; sid:602743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzon.com"; sid:602744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadosdacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadosdacovid19.com"; sid:602745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dctcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dctcovid19.com"; sid:602746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dieta-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dieta-covid19.com"; sid:602747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalwellnesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalwellnesscovid.com"; sid:602748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for equipement-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"equipement-covid.com"; sid:602749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemasksforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemasksforcovid-19.com"; sid:602750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facesoflovedoneskilledbythecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facesoflovedoneskilledbythecovid19virus.com"; sid:602751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fiegnocombateaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fiegnocombateaocovid.com"; sid:602752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightthecovid.com"; sid:602753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for firstaidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"firstaidcovid.com"; sid:602754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidmasks.com"; sid:602755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freshcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freshcorona.com"; sid:602756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gardacovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gardacovid19free.com"; sid:602757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcoronavirus.club"; sid:602758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidplus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidplus.net"; sid:602759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovidced.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovidced.info"; sid:602760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovidced.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovidced.org"; sid:602761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayurvediccovid-19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayurvediccovid-19.info"; sid:602762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belcovid19.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belcovid19.pro"; sid:602763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid.info"; sid:602764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid.org"; sid:602765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.site"; sid:602766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.xyz"; sid:602767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blesswuhan.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blesswuhan.org"; sid:602768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cestquoilecovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cestquoilecovid19.org"; sid:602769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicovid.org"; sid:602770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for children-vs-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"children-vs-covid.net"; sid:602771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncovid.net"; sid:602772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classactioncovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classactioncovid.org"; sid:602773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid.blog"; sid:602774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codetoendcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codetoendcovid.info"; sid:602775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codetoendcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codetoendcovid.net"; sid:602776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codetoendcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codetoendcovid.org"; sid:602777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coletivocovid19.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coletivocovid19.site"; sid:602778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confusionpandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confusionpandemic.org"; sid:602779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingincorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingincorona.info"; sid:602780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingincorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingincorona.org"; sid:602781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19md.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19md.net"; sid:602782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaball.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaball.org"; sid:602783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-beratung.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-beratung.biz"; sid:602784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabescherming.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabescherming.store"; sid:602785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash10.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash10.info"; sid:602786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash2.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash2.info"; sid:602787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash3.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash3.info"; sid:602788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash4.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash4.info"; sid:602789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash5.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash5.info"; sid:602790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash6.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash6.info"; sid:602791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash7.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash7.info"; sid:602792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash8.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash8.info"; sid:602793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash9.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash9.info"; sid:602794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cash.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cash.info"; sid:602795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontact.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontact.app"; sid:602796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacts.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacts.club"; sid:602797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacover.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacover.org"; sid:602798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurtain.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurtain.org"; sid:602799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeliminator.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeliminator.pro"; sid:602800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexterminator.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexterminator.pro"; sid:602801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermen.info"; sid:602802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-store.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-store.shop"; sid:602803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-store.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-store.site"; sid:602804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-store.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-store.store"; sid:602805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-timeline.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-timeline.info"; sid:602806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatogether.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatogether.net"; sid:602807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavest.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavest.page"; sid:602808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontact.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontact.org"; sid:602809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.lawyer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.lawyer"; sid:602810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeter.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeter.org"; sid:602811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews.space - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews.space"; sid:602812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warn.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warn.app"; sid:602813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentestsites.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentestsites.org"; sid:602814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businesscertification.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businesscertification.org"; sid:602815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ca.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ca.app"; sid:602816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capack.net"; sid:602817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capack.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capack.org"; sid:602818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.pro"; sid:602819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19club.top - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19club.top"; sid:602820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contact.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contact.org"; sid:602821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covid.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covid.shop"; sid:602822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covid.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covid.store"; sid:602823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19crossofhope.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19crossofhope.net"; sid:602824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19facemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19facemask.net"; sid:602825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freezone.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freezone.org"; sid:602826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freezone.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freezone.org"; sid:602827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeapp.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeapp.net"; sid:602828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.chat"; sid:602829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19juryconsultants.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19juryconsultants.org"; sid:602830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19koruma.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19koruma.info"; sid:602831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19koruma.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19koruma.net"; sid:602832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19koruma.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19koruma.org"; sid:602833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawexpert.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawexpert.org"; sid:602834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pass.net"; sid:602835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plasticbarriers.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plasticbarriers.info"; sid:602836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protection.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protection.store"; sid:602837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quilt.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quilt.org"; sid:602838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sa.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sa.org"; sid:602839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sa.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sa.site"; sid:602840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seperatoru.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seperatoru.info"; sid:602841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seperatoru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seperatoru.net"; sid:602842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seperatoru.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seperatoru.org"; sid:602843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serologytestsites.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serologytestsites.org"; sid:602844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thulusdhoo.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thulusdhoo.page"; sid:602845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracers.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracers.health"; sid:602846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracers.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracers.org"; sid:602847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvgi.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvgi.solutions"; sid:602848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.art"; sid:602849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodies.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodies.org"; sid:602850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxiety.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxiety.org"; sid:602851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmy.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmy.health"; sid:602852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrigade.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrigade.health"; sid:602853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcallcenters.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcallcenters.org"; sid:602854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cash16.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cash16.site"; sid:602855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatastrophe.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatastrophe.org"; sid:602856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuit.net"; sid:602857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactionlawsuit.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactionlawsuit.org"; sid:602858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance.healthcare"; sid:602859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcleaning.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcleaning.live"; sid:602860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcleaning.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcleaning.store"; sid:602861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcleaning.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcleaning.world"; sid:602862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantkitchens.space - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantkitchens.space"; sid:602863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantregulations.website - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantregulations.website"; sid:602864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantretail.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantretail.store"; sid:602865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.info"; sid:602866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrowdfunding.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrowdfunding.org"; sid:602867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurtain.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurtain.org"; sid:602868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcute.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcute.store"; sid:602869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddelivery.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddelivery.org"; sid:602870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix1.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix1.info"; sid:602871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix2.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix2.info"; sid:602872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix3.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix3.info"; sid:602873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix4.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix4.info"; sid:602874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflix5.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflix5.info"; sid:602875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgone.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgone.app"; sid:602876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkawasaki.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkawasaki.site"; sid:602877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoc.net"; sid:602878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayerstudy.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayerstudy.info"; sid:602879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepared.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepared.store"; sid:602880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts.info"; sid:602881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrater.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrater.info"; sid:602882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecovered.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecovered.life"; sid:602883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevolt.monster - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevolt.monster"; sid:602884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschool.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschool.org"; sid:602885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.click"; sid:602886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.solutions"; sid:602887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.africa"; sid:602888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.business"; sid:602889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.church"; sid:602890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.city"; sid:602891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.club"; sid:602892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.community"; sid:602893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.company - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.company"; sid:602894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.store"; sid:602895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.tech - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.tech"; sid:602896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstat.net"; sid:602897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.store"; sid:602898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracers.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracers.health"; sid:602899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruth.global - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruth.global"; sid:602900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvidap.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvidap.shop"; sid:602901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaste.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaste.org"; sid:602902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.shop"; sid:602903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.yoga - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.yoga"; sid:602904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushingcovid.net"; sid:602905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datadampakcovid19.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datadampakcovid19.page"; sid:602906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfection-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfection-covid.info"; sid:602907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for el-corona-streetwear.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"el-corona-streetwear.art"; sid:602908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidforgood.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidforgood.info"; sid:602909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidforgood.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidforgood.net"; sid:602910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidforgood.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidforgood.org"; sid:602911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmedia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmedia.net"; sid:602912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicproductions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicproductions.net"; sid:602913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estudiocovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estudiocovid.org"; sid:602914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-corona.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-corona.world"; sid:602915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.store"; sid:602916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidwith.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidwith.art"; sid:602917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.store"; sid:602918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcorona.org"; sid:602919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronago.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronago.store"; sid:602920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helptxcovidtest.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helptxcovidtest.org"; sid:602921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imfcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imfcovid.org"; sid:602922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactocovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactocovid19.org"; sid:602923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightcorona.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightcorona.store"; sid:602924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscorona.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscorona.xyz"; sid:602925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-covid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-covid.cloud"; sid:602926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-covid.net"; sid:602927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcovid.net"; sid:602928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcase.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcase.info"; sid:602929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcase.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcase.org"; sid:602930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidstatus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidstatus.info"; sid:602931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myhomevaluecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myhomevaluecovid19.info"; sid:602932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-covid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-covid19.org"; sid:602933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozono-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozono-covid19.info"; sid:602934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicartists.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicartists.org"; sid:602935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmedia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmedia.net"; sid:602936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproductions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproductions.net"; sid:602937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutions.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutions.biz"; sid:602938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutions.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutions.info"; sid:602939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paraelcoronavirus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paraelcoronavirus.org"; sid:602940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passingnotesfromthepandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passingnotesfromthepandemic.org"; sid:602941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid.net"; sid:602942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebascoronavirus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebascoronavirus.org"; sid:602943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicolabcovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicolabcovid19.org"; sid:602944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soycovidfree.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soycovidfree.org"; sid:602945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for speakuponcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"speakuponcovid.org"; sid:602946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suiteanticovid.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suiteanticovid.store"; sid:602947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for suiteanticovid.tech - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"suiteanticovid.tech"; sid:602948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for supervivientescoronavirus.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"supervivientescoronavirus.site"; sid:602949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testycovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testycovid19.org"; sid:602950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronakit.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronakit.org"; sid:602951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldcovid19.info"; sid:602952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truthaboutcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truthaboutcovid.org"; sid:602953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usresponsetothepandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usresponsetothepandemic.org"; sid:602954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-covid2019.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-covid2019.info"; sid:602955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wethaifightcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wethaifightcovid.org"; sid:602956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscovid19.org"; sid:602957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workplacereadycovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workplacereadycovid19.net"; sid:602958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for www-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"www-covid.info"; sid:602959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for www-covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"www-covid.net"; sid:602960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for www-covid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"www-covid.org"; sid:602961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19.org"; sid:602962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovidtests.com"; sid:602963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agevolazionicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agevolazionicoronavirus.com"; sid:602964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovid19treatment.com"; sid:602965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovid19vaccine.com"; sid:602966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycorona.com"; sid:602967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andthencamecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andthencamecovid.com"; sid:602968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafaceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafaceshield.com"; sid:602969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidalcolspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidalcolspray.com"; sid:602970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidanicespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidanicespray.com"; sid:602971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcoffespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcoffespray.com"; sid:602972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidhub.com"; sid:602973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidindia.com"; sid:602974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidlemonspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidlemonspray.com"; sid:602975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidorangespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidorangespray.com"; sid:602976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidoranspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidoranspray.com"; sid:602977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsambucaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsambucaspray.com"; sid:602978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicromance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicromance.com"; sid:602979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for applepandemico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"applepandemico.com"; sid:602980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoronavirustest.com"; sid:602981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoronavirustests.com"; sid:602982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistsforcovid19.com"; sid:602983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-covid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-covid.app"; sid:602984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovid.app"; sid:602985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billgatescovidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billgatescovidfund.com"; sid:602986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biodegradable-mask-corona-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biodegradable-mask-corona-covid.com"; sid:602987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19diagnosticmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19diagnosticmasks.com"; sid:602988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovid2020.com"; sid:602989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19mask.com"; sid:602990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovidinvestigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovidinvestigation.com"; sid:602991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for circuscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"circuscorona.com"; sid:602992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cliniccovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cliniccovidfree.com"; sid:602993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidtracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidtracing.com"; sid:602994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidrct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidrct.com"; sid:602995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabayyachtclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabayyachtclub.com"; sid:602996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckuk.com"; sid:602997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacraycraycrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacraycraycrazy.com"; sid:602998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacry2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacry2020.com"; sid:602999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-einweg-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-einweg-maske.com"; sid:603000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-evans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-evans.com"; sid:603001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecommunity.com"; sid:603002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonestore.com"; sid:603003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapasskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapasskey.com"; sid:603004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatriots.com"; sid:603005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphobes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphobes.com"; sid:603006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteam.com"; sid:603007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavias.com"; sid:603008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavir-ice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavir-ice.com"; sid:603009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus256.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus256.com"; sid:603010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactor.com"; sid:603011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetectiondog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetectiondog.com"; sid:603012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreakout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreakout.com"; sid:603013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskidsyndrome.com"; sid:603014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerca.com"; sid:603015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarker.com"; sid:603016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaya.com"; sid:603017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplayadelcarmen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplayadelcarmen.com"; sid:603018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tales.com"; sid:603019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestlondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestlondon.com"; sid:603020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestskensington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestskensington.com"; sid:603021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestslondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestslondon.com"; sid:603022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest-strips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest-strips.com"; sid:603023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldupdatesmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldupdatesmail.com"; sid:603024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warrior.com"; sid:603025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid194u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid194u.com"; sid:603026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airplanesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airplanesafety.com"; sid:603027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19an.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19an.com"; sid:603028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antikor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antikor.com"; sid:603029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assessmentcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assessmentcenter.com"; sid:603030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assessmentservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assessmentservices.com"; sid:603031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assessmenttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assessmenttest.com"; sid:603032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assists.com"; sid:603033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classroom.com"; sid:603034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningpro.com"; sid:603035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detectiondog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detectiondog.com"; sid:603036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectiondog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectiondog.com"; sid:603037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deu.com"; sid:603038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donedu.com"; sid:603039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19factcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19factcheck.com"; sid:603040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fondi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fondi.com"; sid:603041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graduates2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graduates2020.com"; sid:603042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19graduates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19graduates.com"; sid:603043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hub.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hub.club"; sid:603044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inontario.com"; sid:603045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plan.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plan.app"; sid:603046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppedirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppedirect.com"; sid:603047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppeplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppeplus.com"; sid:603048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseportal.com"; sid:603049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revelation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revelation.com"; sid:603050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedistancestickuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedistancestickuk.com"; sid:603051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycoordinator.com"; sid:603052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycoordinators.com"; sid:603053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyteam.com"; sid:603054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securityconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securityconsultant.com"; sid:603055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securityexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securityexperts.com"; sid:603056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneezescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneezescreen.com"; sid:603057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-status-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-status-tracker.com"; sid:603058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19store-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19store-france.com"; sid:603059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingservice.com"; sid:603060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testslondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testslondon.com"; sid:603061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uptade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uptade.com"; sid:603062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usashop.com"; sid:603063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vibe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vibe.com"; sid:603064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19waiver.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19waiver.app"; sid:603065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20challenge.com"; sid:603066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantikor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantikor.com"; sid:603067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-assessment.com"; sid:603068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aware.com"; sid:603069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbasket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbasket.com"; sid:603070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiosecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiosecurity.com"; sid:603071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessready.com"; sid:603072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersmd.com"; sid:603073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersny.com"; sid:603074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.app"; sid:603075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcbs.com"; sid:603076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-charities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-charities.com"; sid:603077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cide.com"; sid:603078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean20.com"; sid:603079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollector.com"; sid:603080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedychannel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedychannel.com"; sid:603081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-concerts.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-concerts.app"; sid:603082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoordinator.com"; sid:603083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrowdwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrowdwatch.com"; sid:603084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcub.com"; sid:603085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurriculum.com"; sid:603086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnosticmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnosticmask.com"; sid:603087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiagnosticsensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiagnosticsensor.com"; sid:603088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-distband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-distband.com"; sid:603089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedudon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedudon.com"; sid:603090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidehayir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidehayir.com"; sid:603091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideonight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideonight.com"; sid:603092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceguards.com"; sid:603093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetravels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetravels.com"; sid:603094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraduates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraduates.com"; sid:603095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhos.com"; sid:603096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjr.com"; sid:603097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkavach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkavach.com"; sid:603098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkn95mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkn95mx.com"; sid:603099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkov.com"; sid:603100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmagic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmagic.com"; sid:603101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnfl.com"; sid:603102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotify.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotify.app"; sid:603103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffservices.com"; sid:603104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplants.com"; sid:603105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasma.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasma.app"; sid:603106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplaya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplaya.com"; sid:603107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqavach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqavach.com"; sid:603108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrama.com"; sid:603109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevealed.com"; sid:603110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepromos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepromos.com"; sid:603111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycoordinator.com"; sid:603112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycoordinators.com"; sid:603113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetydirector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetydirector.com"; sid:603114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshell.com"; sid:603115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneezescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneezescreen.com"; sid:603116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneezescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneezescreens.com"; sid:603117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnorkelmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnorkelmask.com"; sid:603118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspice.com"; sid:603119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrong.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrong.club"; sid:603120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies.africa"; sid:603121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteamtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteamtracker.com"; sid:603122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingchicago.com"; sid:603123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingnewyork.com"; sid:603124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracingnyc.com"; sid:603125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunicorn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunicorn.com"; sid:603126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine4u.com"; sid:603127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestatus.com"; sid:603128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vision.com"; sid:603129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaiver.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaiver.app"; sid:603130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidword.com"; sid:603131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxxx.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxxx.club"; sid:603132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditrepairpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditrepairpandemic.com"; sid:603133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursoscovid19.com"; sid:603134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataofcovid.com"; sid:603135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcovid19ihateyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcovid19ihateyou.com"; sid:603136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delmarvacovidcrafters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delmarvacovidcrafters.com"; sid:603137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for documentingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"documentingcovid.com"; sid:603138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dumpcorona.com"; sid:603139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirus.cloud"; sid:603140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for esamecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"esamecovid19.com"; sid:603141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for estudiocoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"estudiocoronado.com"; sid:603142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-corona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-corona.biz"; sid:603143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddiaries.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddiaries.club"; sid:603144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscorona.app"; sid:603145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 567-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"567-corona.com"; sid:603146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.digital"; sid:603147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidfree.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidfree.org"; sid:603148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovidprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovidprevention.com"; sid:603149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovidpreventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovidpreventions.com"; sid:603150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alreadyhadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alreadyhadcovid.com"; sid:603151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alvidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alvidacorona.com"; sid:603152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.care"; sid:603153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidperu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidperu.net"; sid:603154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artforcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artforcovid.net"; sid:603155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auditoriacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auditoriacovidfree.com"; sid:603156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auditoriacovidfree.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auditoriacovidfree.org"; sid:603157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bafa-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bafa-corona.info"; sid:603158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoviddiet.com"; sid:603159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavaccine.com"; sid:603160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsites.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsites.today"; sid:603161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsites.website - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsites.website"; sid:603162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid-19vaccine.com"; sid:603163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19videodating.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19videodating.today"; sid:603164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcoviddiet.com"; sid:603165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackdoctorscovid19consortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackdoctorscovid19consortium.com"; sid:603166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackdoctorscovid19consortium.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackdoctorscovid19consortium.org"; sid:603167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brehm-covid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brehm-covid19.org"; sid:603168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buccovidscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buccovidscreener.com"; sid:603169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidoragnics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidoragnics.com"; sid:603170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyvaccinecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyvaccinecorona.com"; sid:603171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careinthetimeofcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careinthetimeofcovid.org"; sid:603172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casualtiesofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casualtiesofcovid.com"; sid:603173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkpointcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkpointcovid.com"; sid:603174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovid-19.com"; sid:603175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincovid19.com"; sid:603176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincovid19.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincovid19.xyz"; sid:603177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincycovid-19.com"; sid:603178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clean4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clean4covid19.com"; sid:603179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearof-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearof-covid.com"; sid:603180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidtracing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidtracing.net"; sid:603181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecovid.loans - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecovid.loans"; sid:603182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19controls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19controls.com"; sid:603183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19delete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19delete.com"; sid:603184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2019vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2019vaccine.com"; sid:603185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-5ch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-5ch.com"; sid:603186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabelt.com"; sid:603187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachase.com"; sid:603188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffeeclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffeeclub.com"; sid:603189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-coffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-coffee.com"; sid:603190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffee.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffee.live"; sid:603191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontactcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontactcare.com"; sid:603192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreekey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreekey.com"; sid:603193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriendlytravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriendlytravel.com"; sid:603194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriends.net"; sid:603195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-inshoku.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-inshoku.info"; sid:603196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajacket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajacket.com"; sid:603197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamandate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamandate.com"; sid:603198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamandate.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamandate.info"; sid:603199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamandates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamandates.com"; sid:603200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanicovid.com"; sid:603201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapursuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapursuit.com"; sid:603202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetraveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetraveling.com"; sid:603203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasatanatorios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasatanatorios.com"; sid:603204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastore.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastore.xyz"; sid:603205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastreetasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastreetasia.com"; sid:603206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfacilities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfacilities.com"; sid:603207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfacility.com"; sid:603208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestprep.com"; sid:603209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.attorney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.attorney"; sid:603210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakthroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakthroughs.com"; sid:603211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningrochesterny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningrochesterny.com"; sid:603212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeychain.com"; sid:603213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslatexgloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslatexgloves.com"; sid:603214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewshindi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewshindi.com"; sid:603215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsmotihari.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsmotihari.today"; sid:603216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearchdatacenter.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearchdatacenter.org"; sid:603217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususa.tech - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususa.tech"; sid:603218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriors20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriors20.com"; sid:603219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriorsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriorsindia.com"; sid:603220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawifi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawifi.com"; sid:603221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawifi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawifi.net"; sid:603222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020grads.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020grads.us"; sid:603223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19academy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19academy.net"; sid:603224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airmasks.com"; sid:603225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyhometest.com"; sid:603226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyhometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyhometests.com"; sid:603227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19app4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19app4u.com"; sid:603228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-asi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-asi.com"; sid:603229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-asi.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-asi.xyz"; sid:603230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breakthroughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breakthroughs.com"; sid:603231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19california.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19california.info"; sid:603232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cart.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cart.net"; sid:603233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19c.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19c.net"; sid:603234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contactcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contactcare.com"; sid:603235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaviruses.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaviruses.xyz"; sid:603236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19coronavirus.net"; sid:603237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataresearch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataresearch.net"; sid:603238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dating.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dating.today"; sid:603239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dgfip-finance-publique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dgfip-finance-publique.com"; sid:603240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19factsandfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19factsandfiction.com"; sid:603241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19florida.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19florida.net"; sid:603242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19florida.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19florida.org"; sid:603243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flu4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flu4u.com"; sid:603244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-funds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-funds.com"; sid:603245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19galleries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19galleries.com"; sid:603246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housecalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housecalls.com"; sid:603247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19housespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19housespray.com"; sid:603248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hvac.com"; sid:603249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hvacsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hvacsolutions.com"; sid:603250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hvacsolutons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hvacsolutons.com"; sid:603251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hygeinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hygeinic.com"; sid:603252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infectiouswaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infectiouswaste.com"; sid:603253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19italy.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19italy.info"; sid:603254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liberty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liberty.com"; sid:603255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19localhousecalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19localhousecalls.com"; sid:603256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19memorialforest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19memorialforest.com"; sid:603257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialforest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialforest.com"; sid:603258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mess.com"; sid:603259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mis.com"; sid:603260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mumbai.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mumbai.info"; sid:603261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19net.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19net.xyz"; sid:603262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officespray.com"; sid:603263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19popularity.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19popularity.today"; sid:603264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppeasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppeasap.com"; sid:603265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppemesf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppemesf.com"; sid:603266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppemess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppemess.com"; sid:603267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppewaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppewaste.com"; sid:603268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preneur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preneur.com"; sid:603269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19proofhealthproducts.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19proofhealthproducts.org"; sid:603270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quiz.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quiz.org"; sid:603271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realestatepractices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realestatepractices.com"; sid:603272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetykitbox.com"; sid:603273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19savealife.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19savealife.org"; sid:603274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-signage.com"; sid:603275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signal.com"; sid:603276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sources.com"; sid:603277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spraying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spraying.com"; sid:603278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survey.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survey.info"; sid:603279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tech.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tech.xyz"; sid:603280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing-singapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing-singapore.com"; sid:603281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsupplies.com"; sid:603282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19trackers.com"; sid:603283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19training.scot - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19training.scot"; sid:603284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelmask.com"; sid:603285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19triptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19triptest.com"; sid:603286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unicorn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unicorn.com"; sid:603287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19updates.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19updates.world"; sid:603288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa.international"; sid:603289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19views.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19views.com"; sid:603290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warstories.com"; sid:603291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-waste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-waste.com"; sid:603292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldalliance.com"; sid:603293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldalliance.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldalliance.org"; sid:603294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019data.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019data.live"; sid:603295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019stat.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019stat.live"; sid:603296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2-0.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2-0.cloud"; sid:603297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2-0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2-0.com"; sid:603298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-316.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-316.com"; sid:603299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4dentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4dentists.com"; sid:603300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaculture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaculture.com"; sid:603301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanimals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanimals.com"; sid:603302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.chat"; sid:603303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.net"; sid:603304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.online"; sid:603305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.singles - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.singles"; sid:603306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.today"; sid:603307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidateusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidateusa.com"; sid:603308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.world"; sid:603309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidb-gone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidb-gone.com"; sid:603310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiocleanse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiocleanse.com"; sid:603311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-blocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-blocker.com"; sid:603312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblocker.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblocker.org"; sid:603313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuscontrolsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuscontrolsystems.com"; sid:603314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbynumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbynumbers.com"; sid:603315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarefoundation.com"; sid:603316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarefoundation.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarefoundation.org"; sid:603317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarmasks.com"; sid:603318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cat.com"; sid:603319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanercrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanercrew.com"; sid:603320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodeofconduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodeofconduct.com"; sid:603321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialcleaning.com"; sid:603322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant.business"; sid:603323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontactcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontactcare.com"; sid:603324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoutoure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoutoure.com"; sid:603325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrown.com"; sid:603326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddating.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddating.today"; sid:603327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensegrabandgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensegrabandgo.com"; sid:603328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dog.com"; sid:603329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonors.com"; sid:603330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidef.com"; sid:603331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepassport.com"; sid:603332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideverify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideverify.com"; sid:603333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfairy.link - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfairy.link"; sid:603334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfighterforce.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfighterforce.org"; sid:603335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfordentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfordentists.com"; sid:603336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-freekey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-freekey.com"; sid:603337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlytravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlytravel.com"; sid:603338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriends.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriends.net"; sid:603339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidghostfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidghostfree.com"; sid:603340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglasses.com"; sid:603341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphreport.com"; sid:603342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-health-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-health-solutions.com"; sid:603343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroes.tech - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroes.tech"; sid:603344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhound.com"; sid:603345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactsurvey.com"; sid:603346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia20.com"; sid:603347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovativeideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovativeideas.com"; sid:603348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintegration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintegration.com"; sid:603349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-map.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-map.site"; sid:603350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnavigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnavigators.com"; sid:603351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnew.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnew.net"; sid:603352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnloaded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnloaded.com"; sid:603353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidollar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidollar.com"; sid:603354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidollars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidollars.com"; sid:603355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinestore.com"; sid:603356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinestore.website - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinestore.website"; sid:603357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-organicherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-organicherbal.com"; sid:603358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.biz"; sid:603359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics-mg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics-mg.com"; sid:603360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.news"; sid:603361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganicsnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganicsnews.com"; sid:603362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorganics.recipes - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorganics.recipes"; sid:603363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverit.com"; sid:603364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.partners - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.partners"; sid:603365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpassgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpassgo.com"; sid:603366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pet.com"; sid:603367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofmask.com"; sid:603368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelaxationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelaxationcenter.com"; sid:603369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevealed.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevealed.net"; sid:603370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrundown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrundown.com"; sid:603371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeearth.com"; sid:603372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafekey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafekey.com"; sid:603373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetraveling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetraveling.com"; sid:603374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetykey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetykey.com"; sid:603375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.life"; sid:603376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeworld.com"; sid:603377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscancode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscancode.com"; sid:603378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschmovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschmovid.com"; sid:603379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscientist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscientist.com"; sid:603380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurelondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurelondon.com"; sid:603381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecuremarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecuremarketplace.com"; sid:603382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecuremarketplace.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecuremarketplace.online"; sid:603383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureoffices.com"; sid:603384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureservices.com"; sid:603385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureshop.com"; sid:603386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsessentials.com"; sid:603387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshooter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshooter.com"; sid:603388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop.xyz"; sid:603389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.website - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.website"; sid:603390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.xyz"; sid:603391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategy.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategy.org"; sid:603392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuperstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuperstore.com"; sid:603393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupporter.com"; sid:603394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtagscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtagscan.com"; sid:603395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest4dentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest4dentists.com"; sid:603396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfordentists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfordentists.com"; sid:603397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestprep.com"; sid:603398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimer.com"; sid:603399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimer.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimer.org"; sid:603400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelcard.com"; sid:603401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelmask.com"; sid:603402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveltest.com"; sid:603403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidword.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidword.info"; sid:603404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatingduringcovid.com"; sid:603405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidclub.com"; sid:603406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctrl-pandemicsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctrl-pandemicsystem.com"; sid:603407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctrl-pandemic.systems - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctrl-pandemic.systems"; sid:603408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacorona.org"; sid:603409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curadocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curadocoronavirus.com"; sid:603410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid2020.com"; sid:603411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid20.com"; sid:603412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronanews.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronanews.info"; sid:603413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendagainstcovid.com"; sid:603414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendcovid.world"; sid:603415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentalcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentalcovidtest.com"; sid:603416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for descovidizate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"descovidizate.com"; sid:603417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidiots.com"; sid:603418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovid19shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovid19shop.com"; sid:603419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotectivedevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotectivedevices.com"; sid:603420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicresistance.com"; sid:603421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsafety.net"; sid:603422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsafety.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsafety.org"; sid:603423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsafety.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsafety.xyz"; sid:603424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiocovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiocovid19.org"; sid:603425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovidtesting.com"; sid:603426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightepidemichero.top - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightepidemichero.top"; sid:603427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingagainstcovid.com"; sid:603428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fit4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fit4pandemic.com"; sid:603429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fit4viralpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fit4viralpandemic.com"; sid:603430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fitforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fitforpandemic.com"; sid:603431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freeviruscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freeviruscovid.com"; sid:603432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gaming4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gaming4covid.com"; sid:603433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getacovid19test.com"; sid:603434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicrelieffund.com"; sid:603435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for glovescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"glovescoronavirus.com"; sid:603436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronacare.com"; sid:603437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtestkits.com"; sid:603438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtostaycoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtostaycoronafree.com"; sid:603439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hubforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hubforcorona.com"; sid:603440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hyperfastcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hyperfastcovidtest.com"; sid:603441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icuredcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icuredcorona.com"; sid:603442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ignitecovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ignitecovid19response.com"; sid:603443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiafightscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiafightscovid19.net"; sid:603444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for interpandemictabourets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"interpandemictabourets.com"; sid:603445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for justpandemicthings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"justpandemicthings.com"; sid:603446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckianacoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckianacoviddata.com"; sid:603447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kolaybasvuru-evdekalsagliginizicincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kolaybasvuru-evdekalsagliginizicincovid.com"; sid:603448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidtestinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidtestinglab.com"; sid:603449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasvegascovidtestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasvegascovidtestingservices.com"; sid:603450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcovid19updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcovid19updates.com"; sid:603451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lekicovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lekicovid19.online"; sid:603452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lekicovid19.top - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lekicovid19.top"; sid:603453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsfightcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsfightcovid19.net"; sid:603454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecovid19.org"; sid:603455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid19in2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid19in2020.com"; sid:603456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingyourbestpandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingyourbestpandemic.net"; sid:603457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for losecovidfat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"losecovidfat.com"; sid:603458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovelifethispandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovelifethispandemic.com"; sid:603459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovid.com"; sid:603460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovidtest.com"; sid:603461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lvcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lvcovidtesting.com"; sid:603462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madagascarcovidorganic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madagascarcovidorganic.com"; sid:603463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapacovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapacovid19.online"; sid:603464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marcoscoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marcoscoronado.com"; sid:603465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid-19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid-19.org"; sid:603466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona-key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona-key.com"; sid:603467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronashop.com"; sid:603468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19memorys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19memorys.com"; sid:603469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidfreekey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidfreekey.com"; sid:603470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypostcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypostcorona.biz"; sid:603471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypostcorona.com"; sid:603472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypostcorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypostcorona.info"; sid:603473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nbacoronastore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nbacoronastore.com"; sid:603474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncorona19.net"; sid:603475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-coronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-coronakey.com"; sid:603476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronakey.com"; sid:603477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notapandemic.com"; sid:603478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notmydreamcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notmydreamcovid19.com"; sid:603479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nowcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nowcovidfree.com"; sid:603480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid.com"; sid:603481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcoviddiet.com"; sid:603482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid.info"; sid:603483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid.net"; sid:603484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid.org"; sid:603485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-911.com"; sid:603486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccycling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccycling.com"; sid:603487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemployment.com"; sid:603488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjacket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjacket.com"; sid:603489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjob.com"; sid:603490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofpay.com"; sid:603491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicset.com"; sid:603492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicset.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicset.xyz"; sid:603493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstate.com"; sid:603494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictransformations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictransformations.com"; sid:603495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicunemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicunemployment.com"; sid:603496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwearco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwearco.com"; sid:603497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.wine - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.wine"; sid:603498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peoplevcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peoplevcorona.com"; sid:603499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoviddestinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoviddestinations.com"; sid:603500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid-expo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid-expo.com"; sid:603501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhack.com"; sid:603502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhack.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhack.net"; sid:603503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidhack.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidhack.org"; sid:603504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovids19.com"; sid:603505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpedal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpedal.com"; sid:603506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppekitforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppekitforcovid19.com"; sid:603507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ppekitforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ppekitforcovid.com"; sid:603508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for princetoncovidexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"princetoncovidexperts.com"; sid:603509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovid19unicorn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovid19unicorn.com"; sid:603510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovidunicorn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovidunicorn.com"; sid:603511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectunicorncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectunicorncovid19.com"; sid:603512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectunicorncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectunicorncovid.com"; sid:603513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for puccovidscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"puccovidscreener.com"; sid:603514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid-test.com"; sid:603515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtestprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtestprep.com"; sid:603516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidtestscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidtestscovid.com"; sid:603517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcovidrisks.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcovidrisks.org"; sid:603518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recoveringfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recoveringfromcorona.com"; sid:603519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliantcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliantcovidtesting.com"; sid:603520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reserbarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reserbarcovid19.com"; sid:603521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for retocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"retocovidfree.com"; sid:603522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sciencebehindcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sciencebehindcovid.com"; sid:603523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selfcoronakit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selfcoronakit.com"; sid:603524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for semcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"semcorona.com"; sid:603525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for serveciocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"serveciocovid19.com"; sid:603526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-stopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-stopcovid.com"; sid:603527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopstopcovid.com"; sid:603528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statepandemic.com"; sid:603529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayfreecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayfreecorona.com"; sid:603530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-boutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-boutique.com"; sid:603531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-boutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-boutique.com"; sid:603532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidboutique.com"; sid:603533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-online.com"; sid:603534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.shop"; sid:603535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid-shop.com"; sid:603536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid-shop.com"; sid:603537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testycovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testycovid19.online"; sid:603538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testycovid19.top - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testycovid19.top"; sid:603539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theanticoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theanticoronaclub.com"; sid:603540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theclassofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theclassofcovid.com"; sid:603541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcollege.com"; sid:603542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidorganics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidorganics.com"; sid:603543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thehappycovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thehappycovidiot.com"; sid:603544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicfocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicfocus.com"; sid:603545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsurvivalgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsurvivalgame.com"; sid:603546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicsurvivalgame.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicsurvivalgame.org"; sid:603547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid19epidemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid19epidemic.info"; sid:603548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid19epidemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid19epidemic.net"; sid:603549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid19epidemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid19epidemic.org"; sid:603550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theworldaftercovid19epidemic.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theworldaftercovid19epidemic.us"; sid:603551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todoparaelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todoparaelcovid19.com"; sid:603552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tomber-enceinte-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tomber-enceinte-covid.info"; sid:603553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for torontocoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"torontocoronaviruscases.com"; sid:603554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcovid19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcovid19.today"; sid:603555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpscovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpscovidplan.com"; sid:603556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicorncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicorncovid19.com"; sid:603557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unicorncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unicorncovid.com"; sid:603558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecoronanow.com"; sid:603559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid.info"; sid:603560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacuna-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacuna-covid-19.com"; sid:603561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunascovid19.com"; sid:603562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wepandemic.com"; sid:603563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhandiaoying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhandiaoying.com"; sid:603564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhi.com"; sid:603565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmeichuan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmeichuan.com"; sid:603566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhannice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhannice.com"; sid:603567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhizhu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhizhu.com"; sid:603568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--adiscorona-ibb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--adiscorona-ibb.com"; sid:603569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidd.com"; sid:603570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abanicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abanicovid.com"; sid:603571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidchronicle.com"; sid:603572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovidapp.com"; sid:603573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airecovidfree.com"; sid:603574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovid-19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovid-19news.com"; sid:603575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amped-covid19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amped-covid19safe.com"; sid:603576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andorracovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andorracovidfree.com"; sid:603577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiesforcoronavirus.com"; sid:603578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodiesforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodiesforcovid19.com"; sid:603579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askaboutcovid.com"; sid:603580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistantcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistantcovid-19.com"; sid:603581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistedlivingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistedlivingcovid.com"; sid:603582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auditofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auditofpandemic.com"; sid:603583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bakethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bakethepandemic.com"; sid:603584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsite.com"; sid:603585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsites.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsites.biz"; sid:603586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsites.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsites.buzz"; sid:603587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19datingsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19datingsites.com"; sid:603588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19sites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19sites.com"; sid:603589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19videodating.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19videodating.biz"; sid:603590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19videodating.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19videodating.buzz"; sid:603591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19videodating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19videodating.com"; sid:603592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchaincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchaincovid19.com"; sid:603593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesswithcovid.com"; sid:603594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidproducts.com"; sid:603595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cairocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cairocovidfree.com"; sid:603596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovid.com"; sid:603597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cert-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cert-covid.com"; sid:603598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedforcovid19.com"; sid:603599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffee.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffee.club"; sid:603600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-inshoku.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-inshoku.club"; sid:603601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-millionaires.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-millionaires.club"; sid:603602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dating.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dating.biz"; sid:603603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-eshop.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-eshop.biz"; sid:603604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidate.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidate.club"; sid:603605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbar.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbar.club"; sid:603606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddating.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddating.biz"; sid:603607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatingsites.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatingsites.biz"; sid:603608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2flyaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2flyaftercovid.com"; sid:603609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaacovid.com"; sid:603610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acquiredbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acquiredbycovid.com"; sid:603611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronashop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronashop.com"; sid:603612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecovid-19.com"; sid:603613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angioplaquepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angioplaquepandemic.com"; sid:603614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcaffespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcaffespray.com"; sid:603615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfogger.com"; sid:603616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkn95.com"; sid:603617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apartamentosprotegidoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apartamentosprotegidoscovid.com"; sid:603618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiancoronavirus.com"; sid:603619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atualizacaocovid19adesao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atualizacaocovid19adesao.com"; sid:603620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bakingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bakingcorona.com"; sid:603621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangkokcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangkokcovidtest.com"; sid:603622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bca-mentalhealth-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bca-mentalhealth-covid-19.com"; sid:603623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcorona.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcorona.africa"; sid:603624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berdamaidengancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berdamaidengancorona.com"; sid:603625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidtesting.com"; sid:603626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bkcovid.com"; sid:603627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid19help.com"; sid:603628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bovedacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bovedacovid.com"; sid:603629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buysolarcoronavirus2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buysolarcoronavirus2021.com"; sid:603630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidiot.com"; sid:603631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcovid19.com"; sid:603632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcovid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcovid19kit.com"; sid:603633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascontracovid.com"; sid:603634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdacovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdacovidrelief.com"; sid:603635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificazionecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificazionecovidfree.com"; sid:603636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificazionenocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificazionenocovid.com"; sid:603637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheerscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheerscovidfree.com"; sid:603638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cidrapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cidrapcovid.com"; sid:603639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincycovid-19run.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincycovid-19run.com"; sid:603640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincycovid-19walk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincycovid-19walk.com"; sid:603641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coexistwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coexistwithcovid.com"; sid:603642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communicatingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communicatingduringcovid.com"; sid:603643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid19peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid19peru.com"; sid:603644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegone.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegone.biz"; sid:603645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-challenger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-challenger.com"; sid:603646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunicationclothes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunicationclothes.com"; sid:603647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunicationclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunicationclothing.com"; sid:603648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-connections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-connections.com"; sid:603649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconservationcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconservationcorp.com"; sid:603650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmar.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmar.app"; sid:603651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dienblad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dienblad.com"; sid:603652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-gutierrez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-gutierrez.com"; sid:603653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoorganic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoorganic.com"; sid:603654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaepidemicdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaepidemicdisease.com"; sid:603655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreenation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreenation.com"; sid:603656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainafrica.com"; sid:603657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainnepal.com"; sid:603658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kikin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kikin.com"; sid:603659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamistsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamistsystems.com"; sid:603660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamo.com"; sid:603661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonstercrap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonstercrap.com"; sid:603662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanizer.com"; sid:603663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitisation.com"; sid:603664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneezeshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneezeshield.com"; sid:603665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastreetjournal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastreetjournal.com"; sid:603666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathalyzers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathalyzers.com"; sid:603667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathtest.com"; sid:603668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathtesting.com"; sid:603669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathtests.com"; sid:603670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-essential-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-essential-ppe.com"; sid:603671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryfund.com"; sid:603672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquest.com"; sid:603673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimer.com"; sid:603674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswaiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswaiver.com"; sid:603675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vorhersage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vorhersage.com"; sid:603676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavows.com"; sid:603677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid03.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid03.com"; sid:603678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid07.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid07.com"; sid:603679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid09.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid09.com"; sid:603680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid14.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid14.com"; sid:603681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcbd.com"; sid:603682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breathalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breathalyzer.com"; sid:603683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathalyzers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathalyzers.com"; sid:603684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breathtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breathtesting.com"; sid:603685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathtesting.com"; sid:603686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathtests.com"; sid:603687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buisnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buisnesscenter.com"; sid:603688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19busnesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19busnesscenter.com"; sid:603689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bussinesscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bussinesscenter.com"; sid:603690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimline.com"; sid:603691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanuppro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanuppro.com"; sid:603692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cruiseindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cruiseindustry.com"; sid:603693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cruiseindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cruiseindustry.com"; sid:603694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19donors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19donors.com"; sid:603695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ellas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ellas.com"; sid:603696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemasksforsale.com"; sid:603697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fogger.com"; sid:603698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freepolicycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freepolicycheck.com"; sid:603699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeproducts.com"; sid:603700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19galicia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19galicia.com"; sid:603701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healed.com"; sid:603702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthscreen.com"; sid:603703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospitality.com"; sid:603704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitalityservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitalityservices.com"; sid:603705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iff.com"; sid:603706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19industrialassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19industrialassessment.com"; sid:603707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19industrialcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19industrialcertification.com"; sid:603708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19itremotesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19itremotesupport.com"; sid:603709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyerlouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyerlouisiana.com"; sid:603710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liabilitywaiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liabilitywaiver.com"; sid:603711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskdesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskdesigns.com"; sid:603712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myst.com"; sid:603713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mysterbooth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mysterbooth.com"; sid:603714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19neurology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19neurology.com"; sid:603715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-prediction.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-prediction.berlin"; sid:603716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19qa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19qa.com"; sid:603717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responsesfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responsesfund.com"; sid:603718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-the-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-the-movie.com"; sid:603719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tunisie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tunisie.com"; sid:603720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usa.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usa.club"; sid:603721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineandcure.com"; sid:603722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vinovi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vinovi.com"; sid:603723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yes.com"; sid:603724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019data.com"; sid:603725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020glasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020glasses.com"; sid:603726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2025movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2025movie.com"; sid:603727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvertising.com"; sid:603728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidresponse.com"; sid:603729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertapp.com"; sid:603730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbegone.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbegone.biz"; sid:603731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboo.com"; sid:603732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathalyzer.com"; sid:603733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathtest.com"; sid:603734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathtests.com"; sid:603735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterspray.com"; sid:603736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcfb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcfb.com"; sid:603737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerphoenix.com"; sid:603738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupny.com"; sid:603739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearchoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearchoice.com"; sid:603740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollegemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollegemasks.com"; sid:603741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomeback.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomeback.club"; sid:603742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackclub.com"; sid:603743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianthotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianthotel.com"; sid:603744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultingcorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultingcorps.com"; sid:603745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercompanies.com"; sid:603746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercompany.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercompany.biz"; sid:603747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopper-company.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopper-company.com"; sid:603748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercompany.com"; sid:603749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercomp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercomp.com"; sid:603750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraze2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraze2020.com"; sid:603751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazee.com"; sid:603752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuriosities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuriosities.com"; sid:603753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddcare.com"; sid:603754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddream2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddream2020.com"; sid:603755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddukan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddukan.com"; sid:603756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforecasting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforecasting.com"; sid:603757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeamerica.com"; sid:603758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebangkok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebangkok.com"; sid:603759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebrazil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebrazil.com"; sid:603760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecertfication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecertfication.com"; sid:603761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreechina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreechina.com"; sid:603762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeeuropa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeeuropa.com"; sid:603763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefrance.com"; sid:603764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreekey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreekey.com"; sid:603765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelasvegas.com"; sid:603766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenevada.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenevada.biz"; sid:603767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenewyork.com"; sid:603768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeparis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeparis.com"; sid:603769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepuntacana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepuntacana.com"; sid:603770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetransfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetransfer.com"; sid:603771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevacations.com"; sid:603772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenvip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenvip.com"; sid:603773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholistic.com"; sid:603774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicin.com"; sid:603775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimeconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimeconsultants.com"; sid:603776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunetravel.com"; sid:603777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunetraveler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunetraveler.com"; sid:603778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunetraveller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunetraveller.com"; sid:603779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinol.com"; sid:603780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotie.com"; sid:603781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobsource.com"; sid:603782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeplan.com"; sid:603783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovechild2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovechild2020.com"; sid:603784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmats.com"; sid:603785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmediaservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmediaservices.com"; sid:603786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalwholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalwholesale.com"; sid:603787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmuralart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmuralart.com"; sid:603788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmyster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmyster.com"; sid:603789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninjas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninjas.com"; sid:603790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopoly19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopoly19.com"; sid:603791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidots.com"; sid:603792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanna.com"; sid:603793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpolls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpolls.com"; sid:603794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescree.com"; sid:603795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescren.com"; sid:603796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdcoalition.com"; sid:603797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rd.com"; sid:603798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycorps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycorps.com"; sid:603799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestauranthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestauranthelp.com"; sid:603800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesolutions.com"; sid:603801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningchicago.com"; sid:603802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningform.com"; sid:603803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureworkplace.com"; sid:603804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecuritysolutionsillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecuritysolutionsillinois.com"; sid:603805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsetu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsetu.com"; sid:603806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspraytunnel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspraytunnel.com"; sid:603807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopshop.com"; sid:603808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgicalmasks.com"; sid:603809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-19.com"; sid:603810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingthailand.com"; sid:603811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestthailand.com"; sid:603812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvienna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvienna.com"; sid:603813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelalliance.com"; sid:603814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelhub.com"; sid:603815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesites.com"; sid:603816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvactionrentalsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvactionrentalsupport.com"; sid:603817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvehiclebarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvehiclebarrier.com"; sid:603818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.africa"; sid:603819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid.art"; sid:603820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidtest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidtest.app"; sid:603821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020worldcovid19pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020worldcovid19pandemic.com"; sid:603822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adriancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adriancorona.com"; sid:603823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aldeafreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aldeafreecovid.com"; sid:603824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidtestmanufacturing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidtestmanufacturing.com"; sid:603825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amortiempocovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amortiempocovid.blog"; sid:603826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamed.com"; sid:603827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-pandemicdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-pandemicdiet.com"; sid:603828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areasincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areasincovid.com"; sid:603829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovid19antibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovid19antibodytest.com"; sid:603830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoschoolcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoschoolcovid.com"; sid:603831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bancovid19.com"; sid:603832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcovid19.com"; sid:603833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcovid-19.com"; sid:603834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beverlyhillscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beverlyhillscovidtesting.com"; sid:603835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhcovidtesting.com"; sid:603836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcoincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcoincovid19.com"; sid:603837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bocovid.com"; sid:603838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for briankempcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"briankempcovid.com"; sid:603839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafecoronareal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafecoronareal.com"; sid:603840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calgary-covid19-emergency-service-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calgary-covid19-emergency-service-support.com"; sid:603841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calltoserviceinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calltoserviceinthetimeofcorona.com"; sid:603842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninecoviddetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninecoviddetection.com"; sid:603843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpetcleaningincoronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpetcleaningincoronadelmar.com"; sid:603844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocoronaprotection.com"; sid:603845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocoronaschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocoronaschutz.com"; sid:603846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centralcovid.com"; sid:603847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19safetycoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19safetycoordinator.com"; sid:603848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidsafetycoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidsafetycoordinator.com"; sid:603849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovid19testkit.com"; sid:603850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coinsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coinsforcovid19.com"; sid:603851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compromisocovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compromisocovidfree.com"; sid:603852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coppercovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coppercovidkey.com"; sid:603853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubpoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubpoker.com"; sid:603854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajuizdefora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajuizdefora.com"; sid:603855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaren.com"; sid:603856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mebel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mebel.com"; sid:603857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-na.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-na.com"; sid:603858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronandquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronandquarantine.com"; sid:603859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectieglas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectieglas.com"; sid:603860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiescherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiescherm.com"; sid:603861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionglass.com"; sid:603862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaryinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaryinstitute.com"; sid:603863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationpropertyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationpropertyservices.com"; sid:603864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapis.com"; sid:603865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapproved.com"; sid:603866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscombat.com"; sid:603867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontacts.com"; sid:603868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontests.com"; sid:603869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusentacna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusentacna.com"; sid:603870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreecarefacility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreecarefacility.com"; sid:603871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cotcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cotcovid19tests.com"; sid:603872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buttons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buttons.com"; sid:603873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carepackage.com"; sid:603874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19digitalmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19digitalmemorial.com"; sid:603875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19encasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19encasa.com"; sid:603876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enfoque.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enfoque.blog"; sid:603877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eraser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eraser.com"; sid:603878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialgear.com"; sid:603879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthproducts.com"; sid:603880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotelsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotelsupplies.com"; sid:603881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19istatistik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19istatistik.com"; sid:603882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-menaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-menaces.com"; sid:603883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ologist.com"; sid:603884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemin.com"; sid:603885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectivegown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectivegown.com"; sid:603886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinehotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinehotel.com"; sid:603887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quarantinelodging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quarantinelodging.com"; sid:603888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19remotejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19remotejobs.com"; sid:603889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyaudit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyaudit.com"; sid:603890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycoordinatorstaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycoordinatorstaffing.com"; sid:603891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetypermit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetypermit.com"; sid:603892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyprotocols.com"; sid:603893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19secureoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19secureoffices.com"; sid:603894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sethygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sethygiene.com"; sid:603895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stats.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stats.cloud"; sid:603896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsathome.com"; sid:603897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracker.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracker.cloud"; sid:603898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-trialresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-trialresults.com"; sid:603899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialresults.com"; sid:603900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvclights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvclights.com"; sid:603901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinestracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinestracker.com"; sid:603902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19violationinspectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19violationinspectors.com"; sid:603903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workspacecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workspacecare.com"; sid:603904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workspacefoggingcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workspacefoggingcare.com"; sid:603905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-yardimaidati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-yardimaidati.com"; sid:603906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020.cloud"; sid:603907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.asia"; sid:603908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-41.com"; sid:603909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9-teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9-teen.com"; sid:603910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairporthotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairporthotel.com"; sid:603911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairporthotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairporthotels.com"; sid:603912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairpurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairpurification.com"; sid:603913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbasin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbasin.com"; sid:603914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuttons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuttons.com"; sid:603915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuzzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuzzer.com"; sid:603916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarairpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarairpurifier.com"; sid:603917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidceilingcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidceilingcleaning.com"; sid:603918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.biz"; sid:603919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clamp.com"; sid:603920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontact-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontact-tracing.com"; sid:603921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoordinators.com"; sid:603922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-critical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-critical.com"; sid:603923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencasa.com"; sid:603924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenvironmenttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenvironmenttest.com"; sid:603925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeadultcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeadultcare.com"; sid:603926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeevent.com"; sid:603927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-events.com"; sid:603928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefogcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefogcare.com"; sid:603929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeny.com"; sid:603930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeproperties.com"; sid:603931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-global-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-global-map.com"; sid:603932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoat.com"; sid:603933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholidays.com"; sid:603934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ireland.com"; sid:603935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobseeker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobseeker.com"; sid:603936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlah.com"; sid:603937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoneymindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoneymindset.com"; sid:603938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteens.com"; sid:603939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficesearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficesearch.com"; sid:603940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoncampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoncampus.com"; sid:603941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpicstick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpicstick.com"; sid:603942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpunchingbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpunchingbag.com"; sid:603943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantinelodging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantinelodging.com"; sid:603944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidselftest.com"; sid:603945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelaunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelaunch.com"; sid:603946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantresource.com"; sid:603947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreturntoworksupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreturntoworksupplies.com"; sid:603948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrna.com"; sid:603949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyprotocols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyprotocols.com"; sid:603950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureworkspaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureworkspaces.com"; sid:603951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsetservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsetservices.com"; sid:603952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield19.com"; sid:603953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignages.com"; sid:603954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidternet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidternet.com"; sid:603955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestamerica.com"; sid:603956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidton.com"; sid:603957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvclights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvclights.com"; sid:603958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinated.com"; sid:603959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacstrax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacstrax.com"; sid:603960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvan.com"; sid:603961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusapproved.com"; sid:603962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldcry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldcry.com"; sid:603963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyucatan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyucatan.com"; sid:603964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid19tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid19tees.com"; sid:603965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalcovid.cat"; sid:603966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppcovid.biz"; sid:603967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19patient.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19patient.cloud"; sid:603968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020-corona-virus.com"; sid:603969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020corona-virus.com"; sid:603970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaimrcovid19response.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaimrcovid19response.com"; sid:603971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abortionpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abortionpandemic.com"; sid:603972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovidexhibition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovidexhibition.com"; sid:603973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudecovid19.com"; sid:603974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcanarias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcanarias.com"; sid:603975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoviddonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoviddonor.com"; sid:603976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkey.com"; sid:603977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asurvivorofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asurvivorofcovid19.com"; sid:603978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidkit.com"; sid:603979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayuda-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayuda-covid.com"; sid:603980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bajuapdcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bajuapdcorona.com"; sid:603981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidfucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidfucks.com"; sid:603982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blancacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blancacoronado.com"; sid:603983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bogna-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bogna-wuhan.com"; sid:603984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesstestingcovid-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesstestingcovid-19.biz"; sid:603985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesstestingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesstestingcovid-19.com"; sid:603986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidsigns.com"; sid:603987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casasposcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casasposcovid.com"; sid:603988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidaway.com"; sid:603989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cognitivelycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cognitivelycovid.com"; sid:603990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comebackfromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comebackfromcorona.com"; sid:603991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comebackfromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comebackfromcovid-19.com"; sid:603992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commercialcleaningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commercialcleaningcoronavirus.com"; sid:603993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparateurmasquescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparateurmasquescoronavirus.com"; sid:603994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparateurmasquescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparateurmasquescovid.com"; sid:603995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congresocovidbaleares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congresocovidbaleares.com"; sid:603996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultantcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultantcovid19.com"; sid:603997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultantcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultantcovid.com"; sid:603998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultantscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultantscovid.com"; sid:603999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultcovid.com"; sid:604000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19kill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19kill.com"; sid:604001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19viruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19viruscleaning.com"; sid:604002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktailbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktailbook.com"; sid:604003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidlatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidlatest.com"; sid:604004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoantiques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoantiques.com"; sid:604005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoboudoir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoboudoir.com"; sid:604006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadult.com"; sid:604007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaearlyretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaearlyretirement.com"; sid:604008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafi8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafi8.com"; sid:604009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeparadise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeparadise.com"; sid:604010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleakz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleakz.com"; sid:604011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamutate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamutate.com"; sid:604012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanostalgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanostalgia.com"; sid:604013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofparties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofparties.com"; sid:604014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarchy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarchy.com"; sid:604015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizer.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizer.club"; sid:604016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizerpro.com"; sid:604017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stamp.com"; sid:604018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastempel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastempel.com"; sid:604019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoday.com"; sid:604020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus254.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus254.com"; sid:604021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbillgates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbillgates.com"; sid:604022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarleasedeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarleasedeal.com"; sid:604023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarleasespecials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarleasespecials.com"; sid:604024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertifiedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertifiedmasks.com"; sid:604025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-info.com"; sid:604026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearlyretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearlyretirement.com"; sid:604027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenetic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenetic.com"; sid:604028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushot.com"; sid:604029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskauai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskauai.com"; sid:604030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskppe.com"; sid:604031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoahu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoahu.com"; sid:604032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresponseportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresponseportal.com"; sid:604033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvival2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvival2020.com"; sid:604034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictimsmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictimsmemorial.com"; sid:604035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxyz.com"; sid:604036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antibodybracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antibodybracelet.com"; sid:604037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19arch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19arch.com"; sid:604038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arch.com"; sid:604039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19architects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19architects.com"; sid:604040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19boneyard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19boneyard.com"; sid:604041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businessassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businessassistance.com"; sid:604042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesstesting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesstesting.biz"; sid:604043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19businesstesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19businesstesting.com"; sid:604044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19buttons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19buttons.com"; sid:604045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carleasedeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carleasedeals.com"; sid:604046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carleasespecials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carleasespecials.com"; sid:604047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdcnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdcnews.com"; sid:604048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claimsforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claimsforbusiness.com"; sid:604049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercialclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercialclean.com"; sid:604050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19compensationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19compensationfund.com"; sid:604051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compfund.com"; sid:604052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontaminationsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontaminationsquad.com"; sid:604053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diets.com"; sid:604054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-discord.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-discord.com"; sid:604055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingrentals.com"; sid:604056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earlyretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earlyretirement.com"; sid:604057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flight.com"; sid:604058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-flight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-flight.com"; sid:604059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19for21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19for21.com"; sid:604060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-form.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-form.com"; sid:604061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-formulaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-formulaire.com"; sid:604062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formulaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formulaire.com"; sid:604063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gig.com"; sid:604064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homedesign.com"; sid:604065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mascarillasymas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mascarillasymas.com"; sid:604066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mist.com"; sid:604067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mls.com"; sid:604068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mobility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mobility.com"; sid:604069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moneysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moneysolutions.com"; sid:604070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nutritionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nutritionplan.com"; sid:604071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-party.com"; sid:604072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passage.com"; sid:604073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppepro.com"; sid:604074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quotes.com"; sid:604075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefplan.com"; sid:604076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskcomms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskcomms.com"; sid:604077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskcommshub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskcommshub.com"; sid:604078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyservices.com"; sid:604079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19storedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19storedesign.com"; sid:604080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storedesign.com"; sid:604081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suppliesstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suppliesstore.com"; sid:604082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveler.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveler.biz"; sid:604083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traveler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traveler.com"; sid:604084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-visu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-visu.com"; sid:604085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wcattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wcattorney.com"; sid:604086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wcattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wcattorneys.com"; sid:604087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wewin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wewin.com"; sid:604088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workcompattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workcompattorneys.com"; sid:604089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workscreen.com"; sid:604090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2022.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2022.com"; sid:604091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20ma.com"; sid:604092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20ny.com"; sid:604093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid30gb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid30gb.com"; sid:604094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandrealestatemarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandrealestatemarket.com"; sid:604095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodynews.com"; sid:604096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantitouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantitouch.com"; sid:604097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-argentina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-argentina.com"; sid:604098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-awareness.com"; sid:604099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaleares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaleares.com"; sid:604100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidballcap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidballcap.com"; sid:604101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidballcaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidballcaps.com"; sid:604102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelgelendirme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelgelendirme.com"; sid:604103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboneyard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboneyard.com"; sid:604104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbridezilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbridezilla.com"; sid:604105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresignage.com"; sid:604106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaresigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaresigns.com"; sid:604107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchicboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchicboutique.com"; sid:604108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcivolution.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcivolution.asia"; sid:604109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsurrey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsurrey.com"; sid:604110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwestsussex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwestsussex.com"; sid:604111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleannearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleannearme.com"; sid:604112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosuresmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosuresmn.com"; sid:604113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliance.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliance.app"; sid:604114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancepartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancepartners.com"; sid:604115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliant.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliant.app"; sid:604116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookie.com"; sid:604117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronamap.com"; sid:604118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorps2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorps2020.com"; sid:604119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrowdfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrowdfund.com"; sid:604120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruze.com"; sid:604121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddnatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddnatest.com"; sid:604122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidearlyretirement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidearlyretirement.com"; sid:604123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideintegratori.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideintegratori.com"; sid:604124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsforyou.com"; sid:604125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfundraisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfundraisers.com"; sid:604126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgig.com"; sid:604127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreetings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreetings.com"; sid:604128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguidancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguidancenow.com"; sid:604129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguideline.com"; sid:604130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintheworld.com"; sid:604131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvestigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvestigators.com"; sid:604132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobseekers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobseekers.com"; sid:604133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillwand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillwand.com"; sid:604134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlgbtq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlgbtq.com"; sid:604135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarshall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarshall.com"; sid:604136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmindset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmindset.com"; sid:604137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn2k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn2k.com"; sid:604138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn99.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn99.com"; sid:604139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcrtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcrtest.com"; sid:604140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionservices.com"; sid:604141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectwear.com"; sid:604142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqualitycustomcreations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqualitycustomcreations.com"; sid:604143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsecare.com"; sid:604144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevolution.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevolution.asia"; sid:604145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19cdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19cdc.com"; sid:604146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.care"; sid:604147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeguarding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeguarding.com"; sid:604148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationsupplies.com"; sid:604149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsiktirgit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsiktirgit.com"; sid:604150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsportsmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsportsmasks.com"; sid:604151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracked.com"; sid:604152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-traveler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-traveler.com"; sid:604153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelers.com"; sid:604154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrends.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrends.app"; sid:604155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccin.com"; sid:604156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvelocity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvelocity.com"; sid:604157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscams.com"; sid:604158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvitality.com"; sid:604159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvitamind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvitamind.com"; sid:604160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoyage.com"; sid:604161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweb.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweb.club"; sid:604162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkppe.com"; sid:604163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danvillecovidhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danvillecovidhelp.com"; sid:604164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dcscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dcscovid19.com"; sid:604165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19tracker.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19tracker.app"; sid:604166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacorona.app"; sid:604167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for recovid.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"recovid.agency"; sid:604168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takowasa-covid19.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takowasa-covid19.click"; sid:604169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virtuescovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virtuescovid.app"; sid:604170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovidtest.com"; sid:604171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottlabscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottlabscovid19.com"; sid:604172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-covid-19.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-covid-19.asia"; sid:604173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronathings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronathings.com"; sid:604174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidthings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidthings.com"; sid:604175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodies-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodies-covid19.com"; sid:604176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidergonomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidergonomics.com"; sid:604177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprendiendocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprendiendocovid19.com"; sid:604178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcencovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcencovid-19.com"; sid:604179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcencovid19.com"; sid:604180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atccovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atccovidtesting.com"; sid:604181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bilancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bilancovid.com"; sid:604182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billcovid19.com"; sid:604183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabis4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabis4covid.com"; sid:604184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashlesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashlesscovid.com"; sid:604185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catalunyasensecovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catalunyasensecovid.cat"; sid:604186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbd-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbd-covid.com"; sid:604187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovid19fogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovid19fogging.com"; sid:604188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidtests.com"; sid:604189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofpandemic.com"; sid:604190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanupcoronaservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanupcoronaservices.com"; sid:604191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedforcovid19.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedforcovid19.africa"; sid:604192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocacovid.com"; sid:604193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultamedicacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultamedicacoronavirus.com"; sid:604194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultamedicacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultamedicacovid19.com"; sid:604195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingincovid19.com"; sid:604196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacbdnutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacbdnutrition.com"; sid:604197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacbdoil.com"; sid:604198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreativesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreativesolutions.com"; sid:604199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuriosities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuriosities.com"; sid:604200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaessentialsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaessentialsusa.com"; sid:604201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafon.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafon.blog"; sid:604202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreendly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreendly.com"; sid:604203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpforlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpforlife.com"; sid:604204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahempcbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahempcbd.com"; sid:604205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotdeals.com"; sid:604206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoharana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoharana.com"; sid:604207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalcommunitas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalcommunitas.com"; sid:604208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifecoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifecoach.com"; sid:604209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalcbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalcbd.com"; sid:604210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoratorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoratorium.com"; sid:604211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonlinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonlinestore.com"; sid:604212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-preferences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-preferences.com"; sid:604213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofconcert.com"; sid:604214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprooffestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprooffestival.com"; sid:604215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofteambuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofteambuilding.com"; sid:604216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectionsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectionsystems.com"; sid:604217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-registration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-registration.com"; sid:604218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevalidatieoss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevalidatieoss.com"; sid:604219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarxcbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarxcbd.com"; sid:604220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaviour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaviour.com"; sid:604221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashower.com"; sid:604222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-teroos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-teroos.com"; sid:604223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcenter19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcenter19.com"; sid:604224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneytexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneytexas.com"; sid:604225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona--virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona--virus.com"; sid:604226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuriosities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuriosities.com"; sid:604227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawyerdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawyerdallas.com"; sid:604228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-signage.com"; sid:604229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid18communitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid18communitytest.com"; sid:604230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-3m.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-3m.com"; sid:604231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19attorneytexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19attorneytexas.com"; sid:604232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classof2020.com"; sid:604233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commumitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commumitytest.com"; sid:604234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communittest.com"; sid:604235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communtytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communtytest.com"; sid:604236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19complianceofficertraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19complianceofficertraining.com"; sid:604237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comunitytest.com"; sid:604238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19delete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19delete.com"; sid:604239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evictionanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evictionanswers.com"; sid:604240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foger.com"; sid:604241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlines.com"; sid:604242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fundsupportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fundsupportgroup.com"; sid:604243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gene.com"; sid:604244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19heartstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19heartstudy.com"; sid:604245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hostgenomesv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hostgenomesv.com"; sid:604246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19immunitycertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19immunitycertificates.com"; sid:604247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.buzz"; sid:604248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inyourhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inyourhome.com"; sid:604249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawyerdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawyerdallas.com"; sid:604250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-livedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-livedata.com"; sid:604251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moratorium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moratorium.com"; sid:604252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-ph.com"; sid:604253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reopeningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reopeningservices.com"; sid:604254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retirementworkshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retirementworkshop.com"; sid:604255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rocks.com"; sid:604256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycheck.com"; sid:604257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-ecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-ecuador.com"; sid:604258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tribute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tribute.com"; sid:604259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacrylichardware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacrylichardware.com"; sid:604260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagainstsanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagainstsanity.com"; sid:604261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamp.com"; sid:604262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestcalifornia.com"; sid:604263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidart19europe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidart19europe.com"; sid:604264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidart19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidart19usa.com"; sid:604265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistancebucket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistancebucket.com"; sid:604266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattest.com"; sid:604267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbanger84.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbanger84.com"; sid:604268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbanner.com"; sid:604269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbling.com"; sid:604270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bound.com"; sid:604271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampeche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampeche.com"; sid:604272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanvas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanvas.com"; sid:604273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chailley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chailley.com"; sid:604274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearshop.com"; sid:604275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-colombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-colombia.com"; sid:604276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitytest.com"; sid:604277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsortia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsortia.com"; sid:604278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornerconversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornerconversation.com"; sid:604279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcozy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcozy.com"; sid:604280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcarddebtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcarddebtrelief.com"; sid:604281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditcarddebts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditcarddebts.com"; sid:604282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-debtrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-debtrelief.com"; sid:604283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtreliefhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtreliefhelp.com"; sid:604284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddovid.com"; sid:604285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideintegratori.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideintegratori.cloud"; sid:604286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencoder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencoder.com"; sid:604287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetective.com"; sid:604288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidex4all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidex4all.com"; sid:604289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidex-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidex-uk.com"; sid:604290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexuk.com"; sid:604291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexx.com"; sid:604292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeclothing.com"; sid:604293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgiveaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgiveaway.com"; sid:604294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-give.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-give.com"; sid:604295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgonenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgonenow.com"; sid:604296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrooming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrooming.com"; sid:604297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguayas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguayas.com"; sid:604298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhighway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhighway.com"; sid:604299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhindi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhindi.com"; sid:604300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholidayrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholidayrefunds.com"; sid:604301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhouseclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhouseclean.com"; sid:604302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhubs.com"; sid:604303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsaliva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsaliva.com"; sid:604304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiocrocy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiocrocy.com"; sid:604305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobster.com"; sid:604306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoinville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoinville.com"; sid:604307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifechoices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifechoices.com"; sid:604308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidllofake.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidllofake.buzz"; sid:604309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlyrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlyrics.com"; sid:604310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaptracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaptracker.com"; sid:604311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaxguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaxguard.com"; sid:604312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigationsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigationsquad.com"; sid:604313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonopoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonopoly.com"; sid:604314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnative.com"; sid:604315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewnormal.com"; sid:604316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicradar.com"; sid:604317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppenow.com"; sid:604318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppeonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppeonline.com"; sid:604319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsv.com"; sid:604320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-psvprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-psvprotect.com"; sid:604321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdconsortia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdconsortia.com"; sid:604322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdconsortium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdconsortium.com"; sid:604323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryteam.com"; sid:604324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenaissanceproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenaissanceproject.com"; sid:604325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrex.com"; sid:604326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrnd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrnd.com"; sid:604327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroadtrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroadtrip.com"; sid:604328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeentry.com"; sid:604329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaliva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaliva.com"; sid:604330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationstation.com"; sid:604331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensitivecontractorassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensitivecontractorassociation.com"; sid:604332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensitivecontractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensitivecontractors.com"; sid:604333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshower.com"; sid:604334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocks.com"; sid:604335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsp.com"; sid:604336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeaks.com"; sid:604337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudents.com"; sid:604338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesrus.com"; sid:604339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxiprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxiprotect.com"; sid:604340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechtools.com"; sid:604341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingscreening.com"; sid:604342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsathome.com"; sid:604343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestscreen.com"; sid:604344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidticketrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidticketrelief.com"; sid:604345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelpassport.com"; sid:604346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelrefunds.com"; sid:604347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideoproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideoproduction.com"; sid:604348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvideosolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvideosolutions.com"; sid:604349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkclearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkclearance.com"; sid:604350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristlet.com"; sid:604351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyogi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyogi.com"; sid:604352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyx.com"; sid:604353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturalcovid.com"; sid:604354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datoscovidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datoscovidmx.com"; sid:604355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datosvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datosvscovid.com"; sid:604356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariodocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariodocoronavirus.com"; sid:604357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2haltcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2haltcoronavirus.com"; sid:604358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2haltpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2haltpandemic.com"; sid:604359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2obtaineua2haltcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2obtaineua2haltcoronavirus.com"; sid:604360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2preventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2preventcoronavirus.com"; sid:604361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidcuddle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidcuddle.com"; sid:604362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adv-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adv-covid.com"; sid:604363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aim-covid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aim-covid19.biz"; sid:604364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aim-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aim-covid19.com"; sid:604365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asb-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asb-covid19.com"; sid:604366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awayfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awayfromcovid.com"; sid:604367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for billcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"billcovid19.cloud"; sid:604368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessespostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessespostcovid.com"; sid:604369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid-organics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid-organics.com"; sid:604370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidorganics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidorganics.com"; sid:604371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ca-covid-r.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ca-covid-r.com"; sid:604372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpetcorona.com"; sid:604373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronas.com"; sid:604374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cofacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cofacovid.com"; sid:604375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comovaelcovidpty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comovaelcovidpty.com"; sid:604376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontingcoronavirus.com"; sid:604377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontingcovid-19.com"; sid:604378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confrontingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confrontingcovid19.com"; sid:604379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareco.com"; sid:604380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleandrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleandrivethru.com"; sid:604381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanenergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanenergy.com"; sid:604382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoachingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoachingcentre.com"; sid:604383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conquer.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conquer.club"; sid:604384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoeduardo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoeduardo.com"; sid:604385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafolk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafolk.com"; sid:604386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafootprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafootprint.com"; sid:604387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forms.com"; sid:604388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreehookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreehookup.com"; sid:604389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagunclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagunclub.com"; sid:604390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalf.com"; sid:604391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalfmarathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalfmarathon.com"; sid:604392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthguard.com"; sid:604393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheld.com"; sid:604394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitto.com"; sid:604395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.club"; sid:604396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-proof-free-germs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-proof-free-germs.com"; sid:604397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarestaurantrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarestaurantrating.com"; sid:604398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashielddc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashielddc.com"; sid:604399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldus.com"; sid:604400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneezeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneezeguard.com"; sid:604401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatusupdate.com"; sid:604402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathewatch.com"; sid:604403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatipping.com"; sid:604404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatunity.com"; sid:604405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineshop.com"; sid:604406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrush.com"; sid:604407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdrivethruhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdrivethruhub.com"; sid:604408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusobstructor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusobstructor.com"; sid:604409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorigins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorigins.com"; sid:604410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscam.com"; sid:604411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest1.com"; sid:604412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update-live.com"; sid:604413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupplies.com"; sid:604414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavivaruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavivaruss.com"; sid:604415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawithlime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawithlime.com"; sid:604416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ace.com"; sid:604417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agents.com"; sid:604418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barricade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barricade.com"; sid:604419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bilgilendirmetr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bilgilendirmetr.com"; sid:604420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-childprotectioncasemanagementmooc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-childprotectioncasemanagementmooc.com"; sid:604421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-chronicles.com"; sid:604422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clientesegurobb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clientesegurobb.com"; sid:604423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19counterwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19counterwave.com"; sid:604424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19economicrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19economicrecovery.com"; sid:604425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freehookup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freehookup.com"; sid:604426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19graphics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19graphics.com"; sid:604427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobsproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobsproject.com"; sid:604428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kitchen.com"; sid:604429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livespread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livespread.com"; sid:604430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19live-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19live-stats.com"; sid:604431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalrelease.com"; sid:604432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalsurvivalguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalsurvivalguide.com"; sid:604433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19motels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19motels.com"; sid:604434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19obstructor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19obstructor.com"; sid:604435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pettest.com"; sid:604436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pet-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pet-test.com"; sid:604437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppelab.com"; sid:604438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppeshop.com"; sid:604439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prodcoexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prodcoexam.com"; sid:604440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refusers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refusers.com"; sid:604441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rehablab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rehablab.com"; sid:604442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19remotelearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19remotelearning.com"; sid:604443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resourcehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resourcehub.com"; sid:604444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rrsfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rrsfund.com"; sid:604445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycertified.com"; sid:604446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyusa.com"; sid:604447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scorecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scorecard.com"; sid:604448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19spreads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19spreads.com"; sid:604449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test1.com"; sid:604450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test2.com"; sid:604451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thewatch.com"; sid:604452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerpro.com"; sid:604453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvbusinessreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvbusinessreport.com"; sid:604454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinated.com"; sid:604455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidace.com"; sid:604456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbags.com"; sid:604457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedbengaluru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedbengaluru.com"; sid:604458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedchennai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedchennai.com"; sid:604459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeddelhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeddelhi.com"; sid:604460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedhyderabad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedhyderabad.com"; sid:604461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedindia.com"; sid:604462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedmumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedmumbai.com"; sid:604463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbedpune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbedpune.com"; sid:604464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioproducts.com"; sid:604465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapture.com"; sid:604466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare19.com"; sid:604467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecleaning.com"; sid:604468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareplan.com"; sid:604469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleandrivthru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleandrivthru.com"; sid:604470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningconsultants.com"; sid:604471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouchpotato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouchpotato.com"; sid:604472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourtships.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourtships.com"; sid:604473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisrescue.com"; sid:604474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd19asistenciaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd19asistenciaa.com"; sid:604475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmcertification.com"; sid:604476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfilmcomplianceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfilmcomplianceprogram.com"; sid:604477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebermuda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebermuda.com"; sid:604478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreebrunei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreebrunei.com"; sid:604479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreekuwait.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreekuwait.com"; sid:604480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelondon.com"; sid:604481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemacao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemacao.com"; sid:604482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeqatar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeqatar.com"; sid:604483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesaudiarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesaudiarabia.com"; sid:604484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesingapore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesingapore.com"; sid:604485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetests.com"; sid:604486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeunitedarabemirates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeunitedarabemirates.com"; sid:604487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeunitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeunitedstates.com"; sid:604488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoje.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoje.com"; sid:604489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidialog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidialog.com"; sid:604490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinabox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinabox.com"; sid:604491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinforme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinforme.com"; sid:604492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotdonaldtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotdonaldtrump.com"; sid:604493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotdumptrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotdumptrump.com"; sid:604494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobguide.com"; sid:604495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidkit.com"; sid:604496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlo.com"; sid:604497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskera.com"; sid:604498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidme.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidme.app"; sid:604499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalrelease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalrelease.com"; sid:604500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobstructor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobstructor.com"; sid:604501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficers.com"; sid:604502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicbankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicbankruptcy.com"; sid:604503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicchapter13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicchapter13.com"; sid:604504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicnews.com"; sid:604505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpdr.com"; sid:604506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pettest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pettest.com"; sid:604507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpet-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpet-test.com"; sid:604508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpole.com"; sid:604509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductioncompliancecourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductioncompliancecourse.com"; sid:604510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseconsulting.com"; sid:604511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevenue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevenue.com"; sid:604512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrs.com"; sid:604513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeglobal.com"; sid:604514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemasks.com"; sid:604515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepros.com"; sid:604516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycertified.com"; sid:604517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanidrop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanidrop.com"; sid:604518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldsystems.com"; sid:604519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskan.com"; sid:604520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriesbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriesbook.com"; sid:604521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriestoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriestoday.com"; sid:604522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalbook.com"; sid:604523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtakeover.com"; sid:604524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtan.com"; sid:604525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteacherkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteacherkit.com"; sid:604526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteenkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteenkit.com"; sid:604527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoday.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoday.app"; sid:604528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelmap.com"; sid:604529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvillage.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvillage.club"; sid:604530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdaily.com"; sid:604531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruslive.com"; sid:604532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruspress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruspress.com"; sid:604533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldradar.com"; sid:604534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptoagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptoagainstcovid.com"; sid:604535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decodingcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decodingcovid-19.com"; sid:604536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decodingthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decodingthecoronavirus.com"; sid:604537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emr4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emr4covid19.com"; sid:604538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for energy2killcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"energy2killcoronavirus.com"; sid:604539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eua2haltcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eua2haltcoronavirus.com"; sid:604540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearofcoronavirus.com"; sid:604541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaweb.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaweb.club"; sid:604542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19byideaad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19byideaad.com"; sid:604543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forsalebycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forsalebycovid.com"; sid:604544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lilymakespandemic.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lilymakespandemic.art"; sid:604545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencorona.app"; sid:604546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.charity - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.charity"; sid:604547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid19.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid19.business"; sid:604548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.agency"; sid:604549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1552coronahill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1552coronahill.com"; sid:604550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99corona.com"; sid:604551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allrecovid.com"; sid:604552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for answerivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"answerivecovid19.com"; sid:604553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovidtests.com"; sid:604554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-shop.com"; sid:604555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-store.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-store.com"; sid:604556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingcovid.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingcovid.africa"; sid:604557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingcovid.com"; sid:604558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for armorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"armorcovid19.com"; sid:604559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovid19tests.com"; sid:604560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovidtests.com"; sid:604561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bancadaticovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bancadaticovid19.com"; sid:604562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedoyo-siagacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedoyo-siagacovid19.com"; sid:604563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19solutions.com"; sid:604564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19testkit.com"; sid:604565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19tests.com"; sid:604566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocleancovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocleancovids.com"; sid:604567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontechcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontechcovid19.com"; sid:604568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosafetycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosafetycovid.com"; sid:604569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bnt162covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bnt162covid19.com"; sid:604570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-corona-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-corona-test.com"; sid:604571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-corona-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-corona-vaccination.com"; sid:604572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cards4covidheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cards4covidheroes.com"; sid:604573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecovid19tests.com"; sid:604574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19.biz"; sid:604575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19guide.com"; sid:604576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19progress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19progress.com"; sid:604577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckgesprek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckgesprek.com"; sid:604578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachela.com"; sid:604579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachelas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachelas.com"; sid:604580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanerindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanerindia.com"; sid:604581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoochie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoochie.com"; sid:604582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19.biz"; sid:604583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrowns.com"; sid:604584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetectors.com"; sid:604585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalert.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalert.app"; sid:604586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproof2020.com"; sid:604587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidresulttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidresulttests.com"; sid:604588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppen.com"; sid:604589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasweeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasweeper.com"; sid:604590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbynumbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbynumbers.com"; sid:604591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliancehr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliancehr.com"; sid:604592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusillesbalears.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusillesbalears.cat"; sid:604593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalnetwork.com"; sid:604594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongtermdisabilityinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongtermdisabilityinsurance.com"; sid:604595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionmasksdesigner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionmasksdesigner.com"; sid:604596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminsurance.com"; sid:604597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustermlifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustermlifeinsurance.com"; sid:604598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoiceover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoiceover.com"; sid:604599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldometer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldometer.com"; sid:604600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alacarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alacarte.com"; sid:604601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistedliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistedliving.com"; sid:604602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicken.com"; sid:604603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19doctorsinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19doctorsinfo.com"; sid:604604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enperu.com"; sid:604605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19funfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19funfacts.com"; sid:604606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hotel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hotel.com"; sid:604607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hotels.com"; sid:604608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotlinemi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotlinemi.com"; sid:604609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jogger.com"; sid:604610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longtermdisabilityinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longtermdisabilityinsurance.com"; sid:604611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manuscripts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manuscripts.com"; sid:604612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nnergog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nnergog.com"; sid:604613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-oh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-oh.com"; sid:604614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-progress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-progress.com"; sid:604615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-progress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-progress.com"; sid:604616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresultstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresultstest.com"; sid:604617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultstests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultstests.com"; sid:604618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskmap.com"; sid:604619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spiketracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spiketracker.com"; sid:604620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sportsmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sportsmasks.com"; sid:604621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stay.com"; sid:604622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stillirise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stillirise.com"; sid:604623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinfo.com"; sid:604624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitsalacarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitsalacarte.com"; sid:604625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ukdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ukdiary.com"; sid:604626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinatedband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinatedband.com"; sid:604627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinatedbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinatedbands.com"; sid:604628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinatedwristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinatedwristband.com"; sid:604629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinatedwristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinatedwristbands.com"; sid:604630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19visual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19visual.com"; sid:604631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19voiceover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19voiceover.com"; sid:604632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4candles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4candles.com"; sid:604633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid90cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid90cleaner.com"; sid:604634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9alert.com"; sid:604635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaspsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaspsolutions.com"; sid:604636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcash365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcash365.com"; sid:604637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchailley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchailley.com"; sid:604638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunicationbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunicationbracelet.com"; sid:604639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompclaim.com"; sid:604640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompclaims.com"; sid:604641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-comp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-comp.com"; sid:604642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancehr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancehr.com"; sid:604643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantbartenderservices.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantbartenderservices.club"; sid:604644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantstaffingagencies.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantstaffingagencies.club"; sid:604645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantstaffingdallas.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantstaffingdallas.club"; sid:604646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona19.biz"; sid:604647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseforce.com"; sid:604648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecals.com"; sid:604649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenperu.com"; sid:604650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocomic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocomic.com"; sid:604651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-era.com"; sid:604652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforclosure.com"; sid:604653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforms.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforms.app"; sid:604654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeapparel.com"; sid:604655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-certification.com"; sid:604656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-clothing.com"; sid:604657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgainz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgainz.com"; sid:604658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthkart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthkart.com"; sid:604659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicals.com"; sid:604660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylawfirms.com"; sid:604661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisthecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisthecure.com"; sid:604662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerharder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerharder.com"; sid:604663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalnetwork.com"; sid:604664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalequipments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalequipments.com"; sid:604665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnieuws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnieuws.com"; sid:604666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidochailley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidochailley.com"; sid:604667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidovation.com"; sid:604668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppealacarte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppealacarte.com"; sid:604669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquats.com"; sid:604670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrage.com"; sid:604671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresultstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresultstest.com"; sid:604672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresultstests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresultstests.com"; sid:604673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresulttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresulttest.com"; sid:604674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresulttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresulttests.com"; sid:604675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieftest.com"; sid:604676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieftests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieftests.com"; sid:604677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultstests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultstests.com"; sid:604678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeguards.com"; sid:604679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyplus.com"; sid:604680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilent.com"; sid:604681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-society.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-society.com"; sid:604682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspacestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspacestation.com"; sid:604683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspin.com"; sid:604684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspotbuys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspotbuys.com"; sid:604685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstreamline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstreamline.com"; sid:604686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingninja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingninja.com"; sid:604687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingninjas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingninjas.com"; sid:604688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthenewnormal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthenewnormal.com"; sid:604689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ukcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ukcleaning.com"; sid:604690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatedband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatedband.com"; sid:604691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatedbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatedbands.com"; sid:604692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatedwristband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatedwristband.com"; sid:604693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatedwristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatedwristbands.com"; sid:604694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarriors2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarriors2020.com"; sid:604695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldreport.com"; sid:604696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruzycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruzycorona.com"; sid:604697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcoronafacecovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcoronafacecovers.com"; sid:604698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid19facecovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid19facecovers.com"; sid:604699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dutchcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dutchcovidvaccine.com"; sid:604700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidbytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidbytesting.com"; sid:604701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epp-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epp-covid-19.com"; sid:604702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examecoronavirus.com"; sid:604703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examecovid.com"; sid:604704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examedocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examedocovid.com"; sid:604705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examescoronavirus.com"; sid:604706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fallecidosxcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fallecidosxcoronavirus.com"; sid:604707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filecovidclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filecovidclaim.com"; sid:604708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filecovidclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filecovidclaims.com"; sid:604709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followcorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followcorona.app"; sid:604710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gegen-corona.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gegen-corona.cloud"; sid:604711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gocoronaworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gocoronaworld.com"; sid:604712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postersforcorona.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postersforcorona.art"; sid:604713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovidi.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovidi.club"; sid:604714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covid19.info"; sid:604715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19vaccine.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19vaccine.club"; sid:604716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidkey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidkey.net"; sid:604717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid-19app.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid-19app.info"; sid:604718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluecovid-19app.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluecovid-19app.net"; sid:604719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseases.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseases.net"; sid:604720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaentschaedigung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaentschaedigung.net"; sid:604721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiameter.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiameter.online"; sid:604722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamail.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamail.best"; sid:604723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamail.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamail.info"; sid:604724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamail.monster - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamail.monster"; sid:604725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasks.ltd - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasks.ltd"; sid:604726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalypse.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalypse.news"; sid:604727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschedule.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschedule.online"; sid:604728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop.link - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop.link"; sid:604729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastress.net"; sid:604730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatherapie.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatherapie.online"; sid:604731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1monitor.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1monitor.online"; sid:604732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvax.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvax.info"; sid:604733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazaken.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazaken.online"; sid:604734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19daily.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19daily.news"; sid:604735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-desinfection.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-desinfection.info"; sid:604736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19enperu.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19enperu.net"; sid:604737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hotels.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hotels.club"; sid:604738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicine.net"; sid:604739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19song.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19song.info"; sid:604740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statuskingcounty.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statuskingcounty.blog"; sid:604741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stay.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stay.net"; sid:604742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wiki.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wiki.info"; sid:604743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019-shop.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019-shop.online"; sid:604744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid360.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid360.life"; sid:604745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.boston - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.boston"; sid:604746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassactions.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassactions.online"; sid:604747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona19.net"; sid:604748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure.health"; sid:604749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseforce.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseforce.online"; sid:604750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessential.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessential.online"; sid:604751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.club"; sid:604752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgard.net"; sid:604753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreset.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreset.life"; sid:604754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspin.net"; sid:604755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.ninja - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.ninja"; sid:604756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackeritalia.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackeritalia.live"; sid:604757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscatsandcoronavirusfamily.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscatsandcoronavirusfamily.blog"; sid:604758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letshangcorona.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letshangcorona.online"; sid:604759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcoronavirus.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcoronavirus.online"; sid:604760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mccovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mccovid.info"; sid:604761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nacorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nacorona.info"; sid:604762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid-19memorial.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid-19memorial.info"; sid:604763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19memorial.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19memorial.info"; sid:604764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid-19memorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid-19memorial.net"; sid:604765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovid19memorial.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovid19memorial.net"; sid:604766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclegalnetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclegalnetwork.net"; sid:604767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsareus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsareus.net"; sid:604768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solutions2020.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solutions2020.info"; sid:604769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solutions2020.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solutions2020.net"; sid:604770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solutions.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solutions.info"; sid:604771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-solutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-solutions.net"; sid:604772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for penanganancovid-19-desagolat.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"penanganancovid-19-desagolat.online"; sid:604773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phcovid19tracker.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phcovid19tracker.live"; sid:604774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalism.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalism.info"; sid:604775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcoronalismus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcoronalismus.info"; sid:604776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-covid19.info"; sid:604777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid.info"; sid:604778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seprotegerducovid.group - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seprotegerducovid.group"; sid:604779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidreset.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidreset.life"; sid:604780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedforcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedforcovid19.net"; sid:604781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronavision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronavision.com"; sid:604782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 45pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"45pandemic.com"; sid:604783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 45spandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"45spandemic.com"; sid:604784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 90daycovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"90daycovidkiller.com"; sid:604785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adecuacioncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adecuacioncovid.com"; sid:604786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africastoppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africastoppandemic.com"; sid:604787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albertacovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albertacovidsurvey.com"; sid:604788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amusicalcoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amusicalcoronation.com"; sid:604789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andthencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andthencorona.com"; sid:604790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidengineering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidengineering.com"; sid:604791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsupplynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsupplynetwork.com"; sid:604792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arrestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arrestcorona.com"; sid:604793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atualizacaocaixacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atualizacaocaixacovid-19.com"; sid:604794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigcovid.com"; sid:604795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boyarskycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boyarskycovidmask.com"; sid:604796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for busstopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"busstopcoronavirus.com"; sid:604797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidproducts.com"; sid:604798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcorona.app"; sid:604799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chooseyourcoronadventure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chooseyourcoronadventure.com"; sid:604800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comfocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comfocovid.com"; sid:604801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseship.com"; sid:604802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurrency.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurrency.center"; sid:604803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomaritimefoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomaritimefoundation.com"; sid:604804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-idees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-idees.com"; sid:604805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaintimidates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaintimidates.com"; sid:604806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameats.com"; sid:604807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanashakdhoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanashakdhoop.com"; sid:604808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafesets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafesets.com"; sid:604809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasexbuddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasexbuddy.com"; sid:604810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailypill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailypill.com"; sid:604811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2.com"; sid:604812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-angels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-angels.com"; sid:604813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19conversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19conversations.com"; sid:604814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iggigm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iggigm.com"; sid:604815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19master.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19master.com"; sid:604816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phobia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phobia.com"; sid:604817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ppesupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ppesupplier.com"; sid:604818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ppesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ppesupplies.com"; sid:604819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selfcheckkiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selfcheckkiosk.com"; sid:604820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shoponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shoponline.com"; sid:604821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signageforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signageforsale.com"; sid:604822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2work.com"; sid:604823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aidlife.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aidlife.care"; sid:604824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aidlife.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aidlife.club"; sid:604825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aidlife.com"; sid:604826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consultations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consultations.com"; sid:604827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure.center"; sid:604828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathpool.com"; sid:604829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialroadmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialroadmap.com"; sid:604830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeclinic.com"; sid:604831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgt.com"; sid:604832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-inhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-inhaler.com"; sid:604833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisation.com"; sid:604834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerco.com"; sid:604835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmegamart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmegamart.com"; sid:604836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prints.com"; sid:604837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreopeningcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreopeningcompliance.com"; sid:604838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantgameplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantgameplan.com"; sid:604839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantstrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantstrategy.com"; sid:604840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrv.com"; sid:604841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrvs.com"; sid:604842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartmask.com"; sid:604843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartmasks.com"; sid:604844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopstop.com"; sid:604845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtempsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtempsupplies.com"; sid:604846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestq.com"; sid:604847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvirginia.com"; sid:604848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermalsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermalsecurity.com"; sid:604849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelessentials.com"; sid:604850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvector.com"; sid:604851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for customcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"customcovid19.com"; sid:604852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidlog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidlog.com"; sid:604853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecografiapoccovid19.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecografiapoccovid19.care"; sid:604854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhanbyg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhanbyg.com"; sid:604855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30dayscovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30dayscovidfree.com"; sid:604856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30dayscovidsecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30dayscovidsecure.com"; sid:604857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for academycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"academycovid.com"; sid:604858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidgoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidgoods.com"; sid:604859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ame-bra-foracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ame-bra-foracovid.com"; sid:604860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ame-fora-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ame-fora-covid-19.com"; sid:604861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirustaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirustaskforce.com"; sid:604862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtienda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtienda.com"; sid:604863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arccovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arccovidcheck.com"; sid:604864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barbadiansagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barbadiansagainstcorona.com"; sid:604865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biascorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biascorona.com"; sid:604866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocovidclinic.com"; sid:604867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biotechcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biotechcovidclinic.com"; sid:604868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizcovidclinic.com"; sid:604869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bizcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bizcovidtest.com"; sid:604870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookaftercovid.com"; sid:604871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruscurenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruscurenow.com"; sid:604872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadaagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadaagainstcorona.com"; sid:604873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadiansagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadiansagainstcorona.com"; sid:604874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cautious4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cautious4covid.com"; sid:604875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charitycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charitycoronavirus.com"; sid:604876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovid.com"; sid:604877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citacovid.com"; sid:604878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citaonlinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citaonlinecovid.com"; sid:604879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidkit.com"; sid:604880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comptagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comptagecovid.com"; sid:604881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cootjans-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cootjans-covid.com"; sid:604882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarshield.com"; sid:604883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacidecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacidecleaners.com"; sid:604884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobusinesscorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobusinesscorp.com"; sid:604885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforce1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforce1.com"; sid:604886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gesundheitspass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gesundheitspass.com"; sid:604887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaja.com"; sid:604888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaleaked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaleaked.com"; sid:604889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogistic.com"; sid:604890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamassejection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamassejection.com"; sid:604891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremarks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremarks.com"; sid:604892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashooshoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashooshoo.com"; sid:604893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskinfo.com"; sid:604894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunappelaureveil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunappelaureveil.com"; sid:604895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192020survivorsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192020survivorsgroup.com"; sid:604896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19auction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19auction.com"; sid:604897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataanalysis.com"; sid:604898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19halloweenmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19halloweenmask.com"; sid:604899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpertz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpertz.com"; sid:604900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19javitscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19javitscenter.com"; sid:604901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masksforsale.com"; sid:604902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorialsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorialsociety.com"; sid:604903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ml.com"; sid:604904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19murderer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19murderer.com"; sid:604905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nortenoroeste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nortenoroeste.com"; sid:604906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pixel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pixel.com"; sid:604907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risk-assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risk-assessment.com"; sid:604908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sm.com"; sid:604909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survialshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survialshop.com"; sid:604910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.cat"; sid:604911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19theuntoldstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19theuntoldstory.com"; sid:604912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19violence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19violence.com"; sid:604913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldday.com"; sid:604914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020thebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020thebook.com"; sid:604915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidable.com"; sid:604916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidazeblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidazeblog.com"; sid:604917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankoverlapsing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankoverlapsing.com"; sid:604918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultantsllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultantsllc.com"; sid:604919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowshare.com"; sid:604920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatablog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatablog.com"; sid:604921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddial.com"; sid:604922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideolife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideolife.com"; sid:604923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideradentistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideradentistry.com"; sid:604924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfall.com"; sid:604925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgizmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgizmo.com"; sid:604926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhindsight-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhindsight-2020.com"; sid:604927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactgroup.com"; sid:604928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpfen.com"; sid:604929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-k.com"; sid:604930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnose.com"; sid:604931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpixels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpixels.com"; sid:604932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprenuer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprenuer.com"; sid:604933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidradar.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidradar.berlin"; sid:604934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryclaims.com"; sid:604935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeswab.com"; sid:604936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreening.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreening.cloud"; sid:604937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureswab.com"; sid:604938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldproducts.com"; sid:604939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshielduk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshielduk.com"; sid:604940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield-usa.com"; sid:604941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionseu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionseu.com"; sid:604942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstraw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstraw.com"; sid:604943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summer.com"; sid:604944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinghouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinghouston.com"; sid:604945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermal.com"; sid:604946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveldatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveldatabase.com"; sid:604947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebsites.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebsites.club"; sid:604948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackingthecovidcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackingthecovidcode.com"; sid:604949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancecovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancecovidsolution.com"; sid:604950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterthepandemicsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterthepandemicsummit.com"; sid:604951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agoodpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agoodpandemic.com"; sid:604952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19madrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19madrid.com"; sid:604953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19online.com"; sid:604954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atulya4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atulya4covid.com"; sid:604955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacovid-19.com"; sid:604956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidwi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidwi.com"; sid:604957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredpandemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredpandemic.club"; sid:604958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bsscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bsscovid19.com"; sid:604959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidcontrol.com"; sid:604960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cars4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cars4covid19.com"; sid:604961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carsforcovid19.com"; sid:604962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovidcare.com"; sid:604963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcovidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcovidsyndrome.com"; sid:604964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china-corona.com"; sid:604965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citascovid.com"; sid:604966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloudvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloudvscovid.com"; sid:604967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloudvscovidmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloudvscovidmarketplace.com"; sid:604968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co2covidfogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co2covidfogger.com"; sid:604969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidrefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidrefunds.com"; sid:604970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorfulcovid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorfulcovid2020.com"; sid:604971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contre-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contre-covid.com"; sid:604972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaahcestquoi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaahcestquoi.com"; sid:604973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankrupctylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankrupctylawyers.com"; sid:604974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabengoshi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabengoshi.com"; sid:604975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabike.com"; sid:604976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuletinnarayanganj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuletinnarayanganj.com"; sid:604977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacobra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacobra.com"; sid:604978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoshorescompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoshorescompany.com"; sid:604979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafaraar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafaraar.com"; sid:604980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-goods-gunma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-goods-gunma.com"; sid:604981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahasan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahasan.com"; sid:604982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahozyokin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahozyokin.com"; sid:604983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectionprotection.com"; sid:604984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfodemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfodemic.com"; sid:604985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakist.com"; sid:604986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawyersonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawyersonline.com"; sid:604987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarentaiproj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarentaiproj.com"; sid:604988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaripalace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaripalace.com"; sid:604989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeapartments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeapartments.com"; sid:604990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafedormitories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafedormitories.com"; sid:604991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafedormitory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafedormitory.com"; sid:604992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafehousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafehousing.com"; sid:604993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaisei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaisei.com"; sid:604994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschermkopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschermkopen.com"; sid:604995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoudan.com"; sid:604996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatality.com"; sid:604997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauvoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauvoutlet.com"; sid:604998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandgilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandgilead.com"; sid:604999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandgileadsciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandgileadsciences.com"; sid:605000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandremdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandremdesivir.com"; sid:605001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandveklury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandveklury.com"; sid:605002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gilead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gilead.com"; sid:605003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-gileadsciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-gileadsciences.com"; sid:605004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmexicotendencias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmexicotendencias.com"; sid:605005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonlineupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonlineupdates.com"; sid:605006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-veklury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-veklury.com"; sid:605007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-1st.com"; sid:605008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-5g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-5g.com"; sid:605009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19accidentcar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19accidentcar.com"; sid:605010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19afeconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19afeconstruction.com"; sid:605011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19alliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19alliance.com"; sid:605012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andremdesivir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andremdesivir.com"; sid:605013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andveklury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andveklury.com"; sid:605014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-bedavainternet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-bedavainternet.com"; sid:605015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanbubble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanbubble.com"; sid:605016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clunkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clunkers.com"; sid:605017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defenseforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defenseforce.com"; sid:605018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destroyertshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destroyertshirt.com"; sid:605019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectfogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectfogging.com"; sid:605020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19faraar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19faraar.com"; sid:605021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-first.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-first.com"; sid:605022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formacion.com"; sid:605023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthwatch.com"; sid:605024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19junkcar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19junkcar.com"; sid:605025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19junk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19junk.com"; sid:605026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitlawyers.com"; sid:605027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyersgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyersgroup.com"; sid:605028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mail.com"; sid:605029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mr.com"; sid:605030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mr.com"; sid:605031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsupdateteam.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsupdateteam.club"; sid:605032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photoid.com"; sid:605033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19return2work.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19return2work.com"; sid:605034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safehousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safehousing.com"; sid:605035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-scanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-scanner.com"; sid:605036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19season.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19season.com"; sid:605037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stateaidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stateaidtracker.com"; sid:605038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symposium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symposium.com"; sid:605039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.center"; sid:605040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thhole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thhole.com"; sid:605041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usedcars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usedcars.com"; sid:605042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvoutlet.com"; sid:605043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veklury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veklury.com"; sid:605044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19walk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19walk.com"; sid:605045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidayr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidayr.com"; sid:605046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeads.com"; sid:605047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeautysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeautysupport.com"; sid:605048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleancouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleancouncil.com"; sid:605049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningpr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningpr.com"; sid:605050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombatants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombatants.com"; sid:605051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-confidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-confidence.com"; sid:605052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-confident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-confident.com"; sid:605053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesignreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesignreview.com"; sid:605054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiningsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiningsolutions.com"; sid:605055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectioncleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectioncleaning.com"; sid:605056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectservices.com"; sid:605057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendz.com"; sid:605058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-faceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-faceshield.com"; sid:605059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoe.com"; sid:605060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedominios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedominios.com"; sid:605061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerides.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerides.club"; sid:605062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoggle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoggle.com"; sid:605063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoggles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoggles.com"; sid:605064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhagen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhagen.com"; sid:605065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-house.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-house.com"; sid:605066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkryptonite.com"; sid:605067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawuk.com"; sid:605068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmontereycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmontereycounty.com"; sid:605069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphotobank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphotobank.com"; sid:605070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpitol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpitol.com"; sid:605071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionplan.com"; sid:605072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductonline.com"; sid:605073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrakshak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrakshak.com"; sid:605074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdalliance.com"; sid:605075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdassociation.com"; sid:605076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdcolab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdcolab.com"; sid:605077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdengine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdengine.com"; sid:605078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdleague.com"; sid:605079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdlink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdlink.com"; sid:605080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdreactor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdreactor.com"; sid:605081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdsynergy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdsynergy.com"; sid:605082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrdunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrdunity.com"; sid:605083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseteamrva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseteamrva.com"; sid:605084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeapartmentscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeapartmentscom.com"; sid:605085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeconstruction.com"; sid:605086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehousingcom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehousingcom.com"; sid:605087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeserve.com"; sid:605088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyclass.com"; sid:605089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycourse.com"; sid:605090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyeducation.com"; sid:605091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscheduler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscheduler.com"; sid:605092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolproducts.com"; sid:605093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilverbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilverbullet.com"; sid:605094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurfacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurfacetest.com"; sid:605095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechfund.com"; sid:605096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteen19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteen19.com"; sid:605097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinfo.com"; sid:605098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthankyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthankyou.com"; sid:605099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidti.com"; sid:605100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeout.com"; sid:605101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrailers.com"; sid:605102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-types.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-types.com"; sid:605103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationinformation.com"; sid:605104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacines.com"; sid:605105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacelaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacelaw.com"; sid:605106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.cloud"; sid:605107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwear.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwear.biz"; sid:605108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2ndwavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2ndwavecovid19.com"; sid:605109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amlie-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amlie-covid19.com"; sid:605110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorealtempodelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorealtempodelcovid19.com"; sid:605111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19bay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19bay.com"; sid:605112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19drugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19drugs.com"; sid:605113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidsupply.com"; sid:605114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabine-desinfection-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabine-desinfection-covid19.com"; sid:605115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsforcovid19grads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsforcovid19grads.com"; sid:605116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchthecovid.com"; sid:605117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checklistforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checklistforcovid19.com"; sid:605118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidhq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidhq.com"; sid:605119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comingoutofcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comingoutofcovidnow.com"; sid:605120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation.biz"; sid:605121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopremier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopremier.com"; sid:605122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageddon.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageddon.biz"; sid:605123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safety-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safety-solution.com"; sid:605124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-untersuchungsausschuss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-untersuchungsausschuss.com"; sid:605125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclue.com"; sid:605126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrystals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrystals.com"; sid:605127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpfen.com"; sid:605128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreps.com"; sid:605129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing-locations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing-locations.com"; sid:605130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-automotive-manufacturing-supply-chain-resilience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-automotive-manufacturing-supply-chain-resilience.com"; sid:605131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19awerness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19awerness.com"; sid:605132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bats.com"; sid:605133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defending.com"; sid:605134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19first.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19first.com"; sid:605135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19incometaxreturn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19incometaxreturn.com"; sid:605136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemi-1000tl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemi-1000tl.com"; sid:605137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetysignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetysignage.com"; sid:605138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutionsltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutionsltd.com"; sid:605139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccination-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccination-france.com"; sid:605140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccinations.com"; sid:605141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanrated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanrated.com"; sid:605142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearcurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearcurtain.com"; sid:605143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomedy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomedy.club"; sid:605144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceza.com"; sid:605145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrystals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrystals.com"; sid:605146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidech.com"; sid:605147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiq.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiq.biz"; sid:605148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkittens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkittens.com"; sid:605149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaw.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaw.blog"; sid:605150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersatl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersatl.com"; sid:605151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersnearme.com"; sid:605152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnanosecure-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnanosecure-masks.com"; sid:605153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyservice.com"; sid:605154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitisers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitisers.com"; sid:605155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sicherheit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sicherheit.com"; sid:605156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneeze.com"; sid:605157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionnews.com"; sid:605158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusdata.com"; sid:605159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine411.com"; sid:605160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimfundnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimfundnearme.com"; sid:605161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crackcancercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crackcancercovid.com"; sid:605162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crowdfundingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crowdfundingcoronavirus.com"; sid:605163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 400yearpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"400yearpandemic.com"; sid:605164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accionfrentealacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accionfrentealacovid.com"; sid:605165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aerocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aerocovid.com"; sid:605166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidsolution.com"; sid:605167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andersoncovidinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andersoncovidinfo.com"; sid:605168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-coronavirus.com"; sid:605169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ariannacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ariannacorona.com"; sid:605170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluehealthauthoritycovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluehealthauthoritycovid-19.com"; sid:605171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluehealthauthoritycovid-19exposurenotification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluehealthauthoritycovid-19exposurenotification.com"; sid:605172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulldogcovidsignups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulldogcovidsignups.com"; sid:605173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashandfoodtosurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashandfoodtosurvivecovid19.com"; sid:605174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clientemisteriosocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clientemisteriosocovid19.com"; sid:605175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cookie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cookie.com"; sid:605176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexperiences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexperiences.com"; sid:605177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforpresident.com"; sid:605178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree-india.com"; sid:605179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-help-blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-help-blog.com"; sid:605180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-intifada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-intifada.com"; sid:605181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerstore.com"; sid:605182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalic.com"; sid:605183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafespace.com"; sid:605184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasand.com"; sid:605185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasolaris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasolaris.com"; sid:605186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastudy2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastudy2020.com"; sid:605187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcompliance.com"; sid:605188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrial2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrial2020.com"; sid:605189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarecompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarecompliance.com"; sid:605190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplianceexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplianceexpert.com"; sid:605191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliances.com"; sid:605192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompliancesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompliancesolutions.com"; sid:605193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic2020triviagamesinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic2020triviagamesinc.com"; sid:605194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussbcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussbcompliance.com"; sid:605195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19caseindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19caseindia.com"; sid:605196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-clientebb-fiqueemcasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-clientebb-fiqueemcasa.com"; sid:605197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceexpert.com"; sid:605198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dare.com"; sid:605199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19esp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19esp.com"; sid:605200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeresorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeresorts.com"; sid:605201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freetravel.com"; sid:605202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthlaw.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthlaw.blog"; sid:605203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthlaw.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthlaw.blog"; sid:605204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthlaw.com"; sid:605205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthlawyers.com"; sid:605206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitor.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitor.app"; sid:605207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemi.com"; sid:605208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbcompliance.com"; sid:605209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sg.com"; sid:605210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signups.com"; sid:605211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19unicorns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19unicorns.com"; sid:605212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19unicorns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19unicorns.com"; sid:605213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vitimins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vitimins.com"; sid:605214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021safespace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021safespace.com"; sid:605215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021safezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021safezone.com"; sid:605216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20world.com"; sid:605217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagentsimulation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagentsimulation.com"; sid:605218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassessmentapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassessmentapp.com"; sid:605219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarshield.com"; sid:605220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclipflagstick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclipflagstick.com"; sid:605221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoldwar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoldwar.com"; sid:605222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancesolutions.com"; sid:605223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantcleaner.com"; sid:605224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcondems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcondems.com"; sid:605225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.biz"; sid:605226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-distancr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-distancr.com"; sid:605227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexstore.com"; sid:605228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforpresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforpresident.com"; sid:605229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-freezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-freezone.com"; sid:605230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiacare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiacare.com"; sid:605231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiq.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiq.app"; sid:605232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlescent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlescent.com"; sid:605233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliner.com"; sid:605234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-operations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-operations.com"; sid:605235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuck.com"; sid:605236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefdeals.com"; sid:605237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelocation.com"; sid:605238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyproductsupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyproductsupplier.com"; sid:605239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsiz.com"; sid:605240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgeryrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgeryrisk.com"; sid:605241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgrisk.com"; sid:605242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteleradiologia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteleradiologia.com"; sid:605243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentstudy.com"; sid:605244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialmap.com"; sid:605245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidunicorns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidunicorns.com"; sid:605246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscontrols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscontrols.com"; sid:605247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovidssurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovidssurvey.com"; sid:605248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duscovid19.com"; sid:605249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for enquetecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"enquetecovid.com"; sid:605250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicneeds.com"; sid:605251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escudocovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escudocovid.app"; sid:605252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findacoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findacoronavaccine.com"; sid:605253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findpeaceduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findpeaceduringcovid.com"; sid:605254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findthecorona.com"; sid:605255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fonkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fonkcorona.com"; sid:605256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundraisercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundraisercovid19.com"; sid:605257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid.biz"; sid:605258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for projectcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"projectcovid.biz"; sid:605259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcovid.app"; sid:605260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovidtesting.com"; sid:605261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acutecoronary360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acutecoronary360.com"; sid:605262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidcare.com"; sid:605263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterepidemic.com"; sid:605264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertacaixacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertacaixacovid-19.com"; sid:605265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycoronavirus.com"; sid:605266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedcovid19.com"; sid:605267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bedcovid.com"; sid:605268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for booktokillcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"booktokillcorona.com"; sid:605269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidselftest.com"; sid:605270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachcovid.com"; sid:605271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocktailscocaineandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocktailscocaineandcovid.com"; sid:605272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovidaec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovidaec.com"; sid:605273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connectcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connectcovid.com"; sid:605274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona009.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona009.com"; sid:605275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020universe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020universe.com"; sid:605276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrolly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrolly.com"; sid:605277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabytes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabytes.com"; sid:605278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancels.com"; sid:605279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacivica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacivica.com"; sid:605280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommunityhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommunityhelp.com"; sid:605281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacouture.com"; sid:605282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeitems.com"; sid:605283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfen.com"; sid:605284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrazy.com"; sid:605285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe1st.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe1st.app"; sid:605286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe1st.com"; sid:605287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizations.com"; sid:605288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaself-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaself-test.com"; sid:605289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaself-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaself-tests.com"; sid:605290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavey.com"; sid:605291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.business"; sid:605292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaliforna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaliforna.com"; sid:605293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-impact.com"; sid:605294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcrtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcrtesting.com"; sid:605295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatistics.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatistics.cloud"; sid:605296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstock.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstock.buzz"; sid:605297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisual.com"; sid:605298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zapper.com"; sid:605299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1619.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1619.com"; sid:605300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19besafeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19besafeshop.com"; sid:605301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bologna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bologna.com"; sid:605302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19check-mg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19check-mg.com"; sid:605303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disclosure.com"; sid:605304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-disease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-disease.com"; sid:605305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emscoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emscoin.com"; sid:605306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fightclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fightclub.com"; sid:605307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-free-resources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-free-resources.com"; sid:605308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-homegym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-homegym.com"; sid:605309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-impact.com"; sid:605310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jetwashing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jetwashing.com"; sid:605311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19miraclesurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19miraclesurvivors.com"; sid:605312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19miraclesurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19miraclesurvivors.com"; sid:605313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officialinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officialinfo.com"; sid:605314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officially.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officially.com"; sid:605315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officialpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officialpage.com"; sid:605316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrkit.com"; sid:605317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrtesting.com"; sid:605318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-reporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-reporter.com"; sid:605319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scientific.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scientific.com"; sid:605320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19self-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19self-tests.com"; sid:605321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-us-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-us-data.com"; sid:605322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019.club"; sid:605323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabyapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabyapparel.com"; sid:605324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbase.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbase.app"; sid:605325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapacities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapacities.com"; sid:605326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare360.com"; sid:605327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare365.com"; sid:605328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcells.com"; sid:605329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck-mg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck-mg.com"; sid:605330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclone.com"; sid:605331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitybingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitybingo.com"; sid:605332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourtesies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourtesies.com"; sid:605333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcues.com"; sid:605334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddenkorun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddenkorun.com"; sid:605335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedesign.com"; sid:605336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthassess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthassess.com"; sid:605337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhub.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhub.club"; sid:605338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotick.com"; sid:605339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidised.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidised.com"; sid:605340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkademi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkademi.com"; sid:605341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlive.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlive.app"; sid:605342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedlogix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedlogix.com"; sid:605343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidq8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidq8.com"; sid:605344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquant.com"; sid:605345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe1st.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe1st.app"; sid:605346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe1st.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe1st.com"; sid:605347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetybarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetybarrier.com"; sid:605348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetybarriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetybarriers.com"; sid:605349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidself-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidself-test.com"; sid:605350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop2020.com"; sid:605351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories-podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories-podcast.com"; sid:605352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoriespodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoriespodcast.com"; sid:605353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingpros.com"; sid:605354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackermexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackermexico.com"; sid:605355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweekly.com"; sid:605356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkstudy.com"; sid:605357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crafts4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crafts4corona.com"; sid:605358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturecovid19.com"; sid:605359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturevscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturevscovid19.com"; sid:605360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturevscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturevscovid.com"; sid:605361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decodecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decodecovid.com"; sid:605362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dequieneslacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dequieneslacorona.com"; sid:605363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for despuescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"despuescovid.com"; sid:605364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detrasdelacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detrasdelacorona.com"; sid:605365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duwuhan.com"; sid:605366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodcovid19.com"; sid:605367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodcovid.com"; sid:605368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodvscovid19.com"; sid:605369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foodvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foodvscovid.com"; sid:605370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronagames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronagames.com"; sid:605371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onestopcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onestopcovid.app"; sid:605372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 27502coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"27502coronado.com"; sid:605373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5coronadocourt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5coronadocourt.com"; sid:605374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 723corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"723corona.com"; sid:605375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acehtanggapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acehtanggapcovid19.com"; sid:605376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorentiempodecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorentiempodecorona.com"; sid:605377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anocorona.com"; sid:605378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcertificate.com"; sid:605379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicwithinapademic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicwithinapademic.com"; sid:605380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretascoronavirusorcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretascoronavirusorcy.com"; sid:605381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celiacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celiacoronado.com"; sid:605382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certianticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certianticovid.com"; sid:605383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificadoracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificadoracovid.com"; sid:605384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certificationanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certificationanticovid.com"; sid:605385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkoncorona.com"; sid:605386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabe.com"; sid:605387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreathguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreathguards.com"; sid:605388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacreditsecrets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacreditsecrets.com"; sid:605389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiningguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiningguards.com"; sid:605390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocanyondentistree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocanyondentistree.com"; sid:605391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafoodguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafoodguards.com"; sid:605392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivestreamconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivestreamconcerts.com"; sid:605393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamile.com"; sid:605394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuktsalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuktsalon.com"; sid:605395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyguards.com"; sid:605396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyshields.com"; sid:605397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmiths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmiths.com"; sid:605398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastruth.com"; sid:605399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalkies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalkies.com"; sid:605400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmenow.com"; sid:605401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatiomnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatiomnb.com"; sid:605402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupcompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupcompanies.com"; sid:605403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurse.com"; sid:605404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19apparelco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19apparelco.com"; sid:605405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bands.com"; sid:605406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19besafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19besafe.com"; sid:605407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19creditrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19creditrelief.com"; sid:605408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19debtrescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19debtrescue.com"; sid:605409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diningguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diningguards.com"; sid:605410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingmanchester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingmanchester.com"; sid:605411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemaskdubai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemaskdubai.com"; sid:605412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemaskuae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemaskuae.com"; sid:605413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodguards.com"; sid:605414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-googleplaystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-googleplaystore.com"; sid:605415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19huertosanantonio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19huertosanantonio.com"; sid:605416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mythbusted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mythbusted.com"; sid:605417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19positivesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19positivesupport.com"; sid:605418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riot.com"; sid:605419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safesigns.com"; sid:605420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shopusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shopusa.com"; sid:605421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sniffer-dogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sniffer-dogs.com"; sid:605422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studynow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studynow.com"; sid:605423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19youanddr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19youanddr.com"; sid:605424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020report.com"; sid:605425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3plymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3plymask.com"; sid:605426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3plymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3plymasks.com"; sid:605427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4kids.com"; sid:605428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcurfews.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcurfews.club"; sid:605429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcurfews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcurfews.com"; sid:605430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbakeoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbakeoff.com"; sid:605431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaking.com"; sid:605432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelgesi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelgesi.com"; sid:605433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidborder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidborder.com"; sid:605434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusting.com"; sid:605435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareco.com"; sid:605436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerschicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerschicago.com"; sid:605437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.biz"; sid:605438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleartests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleartests.com"; sid:605439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantworkplace.com"; sid:605440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontactkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontactkiller.com"; sid:605441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookoff.com"; sid:605442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddent.com"; sid:605443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiningguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiningguards.com"; sid:605444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-equipement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-equipement.com"; sid:605445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideworldfight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideworldfight.com"; sid:605446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfabinews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfabinews.com"; sid:605447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehongkong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehongkong.com"; sid:605448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesex.com"; sid:605449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetv.com"; sid:605450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhhh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhhh.com"; sid:605451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidscanchangetheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidscanchangetheworld.com"; sid:605452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitbd.com"; sid:605453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlax.com"; sid:605454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaids.com"; sid:605455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanufacturingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanufacturingsolutions.com"; sid:605456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascarillas19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascarillas19.com"; sid:605457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskreview.com"; sid:605458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskreviews.com"; sid:605459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-memories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-memories.com"; sid:605460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmastudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmastudy.com"; sid:605461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreservation.com"; sid:605462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionfacemask.com"; sid:605463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesforschools.com"; sid:605464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriots.com"; sid:605465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskscore.com"; sid:605466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafencr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafencr.com"; sid:605467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetests.com"; sid:605468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycompliance.com"; sid:605469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetylancet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetylancet.com"; sid:605470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshelterrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshelterrights.com"; sid:605471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorshop.com"; sid:605472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxsolution.com"; sid:605473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxsolutions.com"; sid:605474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsmart.com"; sid:605475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-time.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-time.com"; sid:605476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerss.com"; sid:605477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduv-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduv-protection.com"; sid:605478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfacemask.com"; sid:605479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvox.com"; sid:605480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiz.com"; sid:605481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovidchallengei4a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovidchallengei4a.com"; sid:605482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-covid19-mlm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-covid19-mlm.com"; sid:605483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alarmacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alarmacovid.com"; sid:605484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid-19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid-19ppe.com"; sid:605485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedppecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedppecovid-19.com"; sid:605486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aptcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aptcovid19.com"; sid:605487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barneselectricllcincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barneselectricllcincorona.com"; sid:605488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for basecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"basecovid.com"; sid:605489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidcompliance.com"; sid:605490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidcompliancecoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidcompliancecoordinators.com"; sid:605491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccscaacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccscaacovid-19.com"; sid:605492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachcovid19.com"; sid:605493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeekillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeekillscoronavirus.com"; sid:605494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlacceso-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlacceso-coronavirus.com"; sid:605495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for control-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"control-coronavirus.com"; sid:605496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controltemperatura-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controltemperatura-coronavirus.com"; sid:605497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheck-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheck-in.com"; sid:605498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadataindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadataindia.com"; sid:605499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafashionables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafashionables.com"; sid:605500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskfailed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskfailed.com"; sid:605501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamilagra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamilagra.com"; sid:605502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapasta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapasta.com"; sid:605503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaravayat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaravayat.com"; sid:605504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarevayat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarevayat.com"; sid:605505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasales.com"; sid:605506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasclinic.com"; sid:605507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnood.com"; sid:605508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavilleignitingthoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavilleignitingthoughts.com"; sid:605509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuretybonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuretybonds.com"; sid:605510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustracersuretybonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustracersuretybonds.com"; sid:605511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldtracker.com"; sid:605512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192kissimmee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192kissimmee.com"; sid:605513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19actapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19actapp.com"; sid:605514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.casino - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.casino"; sid:605515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.christmas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.christmas"; sid:605516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cross.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cross.com"; sid:605517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19donationfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19donationfund.com"; sid:605518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inretail.com"; sid:605519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19instanttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19instanttestkit.com"; sid:605520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labreport.com"; sid:605521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labreports.com"; sid:605522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19licensebonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19licensebonds.com"; sid:605523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nycpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nycpro.com"; sid:605524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-perros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-perros.com"; sid:605525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalprotection.com"; sid:605526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plus-apps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plus-apps.com"; sid:605527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppedistributor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppedistributor.com"; sid:605528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reporting.com"; sid:605529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risktools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risktools.com"; sid:605530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.amsterdam"; sid:605531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testcenter.com"; sid:605532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testvirus.com"; sid:605533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracerbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracerbonds.com"; sid:605534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracersuretybonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracersuretybonds.com"; sid:605535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerbonds.com"; sid:605536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19winkel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19winkel.com"; sid:605537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid419.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid419.com"; sid:605538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalarma.com"; sid:605539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandheat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandheat.com"; sid:605540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-blogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-blogs.com"; sid:605541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcito.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcito.com"; sid:605542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomeup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomeup.com"; sid:605543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconga.com"; sid:605544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidderby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidderby.com"; sid:605545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpertwitnesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpertwitnesses.com"; sid:605546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightersindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightersindia.com"; sid:605547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightersworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightersworld.com"; sid:605548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecleaners.com"; sid:605549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefun.com"; sid:605550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehomecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehomecleaners.com"; sid:605551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeopenhouses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeopenhouses.com"; sid:605552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreerv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreerv.com"; sid:605553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeepout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeepout.com"; sid:605554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kiosk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kiosk.com"; sid:605555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-krise.com"; sid:605556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkrise.com"; sid:605557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-memorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-memorials.com"; sid:605558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mu.com"; sid:605559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidncare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidncare.com"; sid:605560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparentingsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparentingsupport.com"; sid:605561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskconsultant.com"; sid:605562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskteam.com"; sid:605563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisktools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisktools.com"; sid:605564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safety-print.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safety-print.com"; sid:605565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safety-signage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safety-signage.com"; sid:605566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafve.com"; sid:605567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsci.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsci.com"; sid:605568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservicesmumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservicesmumbai.com"; sid:605569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestforless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestforless.com"; sid:605570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtocurfew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtocurfew.com"; sid:605571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemumbai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemumbai.com"; sid:605572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaxine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaxine.com"; sid:605573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davidscovidart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davidscovidart.com"; sid:605574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delhicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delhicorona.com"; sid:605575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid.app"; sid:605576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.click"; sid:605577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4ucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4ucovid19.com"; sid:605578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abrcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abrcorona.com"; sid:605579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid20.com"; sid:605580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigencovid.com"; sid:605581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asuransicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asuransicovid19.com"; sid:605582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbdrcoronavirussanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbdrcoronavirussanitization.com"; sid:605583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19essentials.com"; sid:605584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidshield.com"; sid:605585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co-covid19.com"; sid:605586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidbox.com"; sid:605587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatecovidbrasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatecovidbrasil.com"; sid:605588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidtesting.com"; sid:605589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containingcovid.com"; sid:605590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid.app"; sid:605591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona13.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona13.com"; sid:605592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabullshitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabullshitz.com"; sid:605593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cookies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cookies.com"; sid:605594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrank.com"; sid:605595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadebthelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadebthelpers.com"; sid:605596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocaysluxuryhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocaysluxuryhomes.com"; sid:605597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadojones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadojones.com"; sid:605598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreesaudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreesaudi.com"; sid:605599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-keks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-keks.com"; sid:605600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kekse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kekse.com"; sid:605601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitstore.com"; sid:605602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrisenutzen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrisenutzen.com"; sid:605603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronandcovidkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronandcovidkids.com"; sid:605604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapicasso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapicasso.com"; sid:605605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarott.com"; sid:605606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeguards.com"; sid:605607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spray.com"; sid:605608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateinfo.com"; sid:605609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateworld.com"; sid:605610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskassessments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskassessments.com"; sid:605611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19complianceofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19complianceofficer.com"; sid:605612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceofficer.com"; sid:605613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceofficers.com"; sid:605614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19copingday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19copingday.com"; sid:605615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectant.com"; sid:605616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fabinews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fabinews.com"; sid:605617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killedtheradiostar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killedtheradiostar.com"; sid:605618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksandsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksandsigns.com"; sid:605619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pap.com"; sid:605620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventionguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventionguide.com"; sid:605621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protestrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protestrelief.com"; sid:605622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resultssl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resultssl.com"; sid:605623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultssl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultssl.com"; sid:605624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskassesments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskassesments.com"; sid:605625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeuk.com"; sid:605626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srl.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srl.blog"; sid:605627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srl.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srl.club"; sid:605628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test-kits-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test-kits-usa.com"; sid:605629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidallclear.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidallclear.biz"; sid:605630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaovivo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaovivo.com"; sid:605631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clear-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clear-tests.com"; sid:605632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcerndesignatedperson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcerndesignatedperson.com"; sid:605633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcornucopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcornucopia.com"; sid:605634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-employeetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-employeetesting.com"; sid:605635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployeetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployeetests.com"; sid:605636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.cloud"; sid:605637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeyuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeyuk.com"; sid:605638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-kiosk-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-kiosk-app.com"; sid:605639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkscore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkscore.com"; sid:605640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabresults.com"; sid:605641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaresource.com"; sid:605642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlatorre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlatorre.com"; sid:605643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covido19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covido19.com"; sid:605644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmabank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmabank.com"; sid:605645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprom2k20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprom2k20.com"; sid:605646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealities.com"; sid:605647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrott.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrott.com"; sid:605648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyform.com"; sid:605649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureworkplace.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureworkplace.biz"; sid:605650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldgame.com"; sid:605651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoapshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoapshop.com"; sid:605652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteaches.com"; sid:605653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingconcierge.com"; sid:605654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwagon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwagon.com"; sid:605655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defiendetedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defiendetedelcovid19.com"; sid:605656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectacovid.com"; sid:605657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicready.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicready.cloud"; sid:605658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahfcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahfcovid19.com"; sid:605659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtool.com"; sid:605660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenecacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenecacovid19.com"; sid:605661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenecacovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenecacovid19vaccine.com"; sid:605662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenecacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenecacovid.com"; sid:605663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenecacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenecacovidvaccine.com"; sid:605664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlanticcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlanticcovid-19.com"; sid:605665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avocat-koc-assurance-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avocat-koc-assurance-covid-19.com"; sid:605666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beawareofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beawareofcorona.com"; sid:605667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benidormcovid19protocolon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benidormcovid19protocolon.com"; sid:605668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19ppe.com"; sid:605669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidtestingfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidtestingfunds.com"; sid:605670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasscovidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasscovidkey.com"; sid:605671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidcure.com"; sid:605672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casco-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casco-covid.com"; sid:605673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cascocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cascocovid.com"; sid:605674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classycoviddividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classycoviddividers.com"; sid:605675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classycovidtabledividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classycovidtabledividers.com"; sid:605676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clotbustingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clotbustingcovid19.com"; sid:605677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comecorona.com"; sid:605678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contacttracingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contacttracingcovid.com"; sid:605679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for continuidadasistencialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"continuidadasistencialcovid.com"; sid:605680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona77.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona77.biz"; sid:605681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaremasks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaremasks.biz"; sid:605682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaremasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaremasks.com"; sid:605683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.cat"; sid:605684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconjob.com"; sid:605685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathupdate.com"; sid:605686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarrootcanaltreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarrootcanaltreatments.com"; sid:605687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hermann.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hermann.com"; sid:605688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaias.com"; sid:605689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-innovations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-innovations.com"; sid:605690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaolx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaolx.com"; sid:605691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaavr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaavr.com"; sid:605692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafecowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafecowork.com"; sid:605693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-supplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-supplier.com"; sid:605694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemizle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemizle.com"; sid:605695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tortenmesser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tortenmesser.com"; sid:605696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tortenschaufel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tortenschaufel.com"; sid:605697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelcheck.com"; sid:605698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusactionsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusactionsupport.com"; sid:605699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses.buzz"; sid:605700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfriendship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfriendship.com"; sid:605701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaui.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaui.com"; sid:605702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelcheck.com"; sid:605703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawareness.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawareness.biz"; sid:605704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19classactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19classactions.com"; sid:605705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-cleaners.com"; sid:605706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninginc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninginc.com"; sid:605707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningserviceinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningserviceinc.com"; sid:605708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-gloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-gloves.com"; sid:605709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gun.com"; sid:605710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impactonmetroatlantaschooldistricts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impactonmetroatlantaschooldistricts.com"; sid:605711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nasalspray.com"; sid:605712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasma.com"; sid:605713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skills.com"; sid:605714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smarttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smarttest.com"; sid:605715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-supplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-supplier.com"; sid:605716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingla.com"; sid:605717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thesocialexperiment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thesocialexperiment.com"; sid:605718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesideeffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesideeffect.com"; sid:605719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.art"; sid:605720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasco.com"; sid:605721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles19.com"; sid:605722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaninternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaninternational.com"; sid:605723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanintl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanintl.com"; sid:605724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurated.com"; sid:605725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcure.biz"; sid:605726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemmeubairro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemmeubairro.com"; sid:605727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gloves.com"; sid:605728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeskit.com"; sid:605729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousetest.com"; sid:605730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo4gh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo4gh.com"; sid:605731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfosupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfosupply.com"; sid:605732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativemerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativemerch.com"; sid:605733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpistol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpistol.com"; sid:605734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanners.com"; sid:605735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebalivillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebalivillas.com"; sid:605736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevillasbali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevillasbali.com"; sid:605737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignboards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignboards.com"; sid:605738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsrx.com"; sid:605739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsploit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsploit.com"; sid:605740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtabledividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtabledividers.com"; sid:605741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxs.com"; sid:605742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcalculator.com"; sid:605743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcalculator.com"; sid:605744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmanager.com"; sid:605745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelnews.com"; sid:605746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduel.com"; sid:605747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisingaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisingaftercoronavirus.com"; sid:605748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discriminationpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discriminationpandemic.com"; sid:605749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispensadorgelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispensadorgelcovid19.com"; sid:605750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doc4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doc4covid19.com"; sid:605751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 72coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"72coronado.com"; sid:605752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 800gotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"800gotcovid.com"; sid:605753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidreset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidreset.com"; sid:605754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aseguramientocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aseguramientocovid19.com"; sid:605755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontech-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontech-covid19.com"; sid:605756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boredbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boredbycovid.com"; sid:605757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campo-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campo-corona.com"; sid:605758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chandicovid19hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chandicovid19hub.com"; sid:605759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleankillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleankillscovid.com"; sid:605760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidtest.com"; sid:605761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companycovidtesting.com"; sid:605762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compliancecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compliancecovid-19.com"; sid:605763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compliancecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compliancecovid19.com"; sid:605764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congresocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congresocoronavirus.com"; sid:605765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsultingsds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsultingsds.com"; sid:605766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadev.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadev.club"; sid:605767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexports.com"; sid:605768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpnewyork.com"; sid:605769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakal.com"; sid:605770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerbox.com"; sid:605771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakindnessvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakindnessvirus.com"; sid:605772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatio.com"; sid:605773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalents.com"; sid:605774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraffic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraffic.com"; sid:605775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatez.com"; sid:605776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverhalen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverhalen.com"; sid:605777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-audit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-audit.com"; sid:605778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cleanup-los-angeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cleanup-los-angeles.com"; sid:605779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublicenquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublicenquiry.com"; sid:605780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-walrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-walrus.com"; sid:605781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andracism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andracism.com"; sid:605782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19audits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19audits.com"; sid:605783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19automation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19automation.com"; sid:605784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19capstone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19capstone.com"; sid:605785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cleaningservices.com"; sid:605786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-free-air.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-free-air.com"; sid:605787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeair.com"; sid:605788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grad.com"; sid:605789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hktest.com"; sid:605790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kano.com"; sid:605791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskusa.com"; sid:605792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19officer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19officer.com"; sid:605793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyshields.com"; sid:605794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tattoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tattoo.com"; sid:605795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19techsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19techsolutions.com"; sid:605796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transitionarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transitionarts.com"; sid:605797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usstatepolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usstatepolicy.com"; sid:605798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine-tracker.com"; sid:605799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacino.com"; sid:605800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-22group.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-22group.com"; sid:605801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbiogenetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbiogenetics.com"; sid:605802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecklondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecklondon.com"; sid:605803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningandsanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningandsanitising.com"; sid:605804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningva.com"; sid:605805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleanup-los-angeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleanup-los-angeles.com"; sid:605806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortinn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortinn.com"; sid:605807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooked.com"; sid:605808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfraudster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfraudster.com"; sid:605809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglione.com"; sid:605810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiani.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiani.com"; sid:605811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterrupters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterrupters.com"; sid:605812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjerk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjerk.com"; sid:605813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnightlifeguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnightlifeguide.com"; sid:605814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidologos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidologos.com"; sid:605815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plasmadonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plasmadonor.com"; sid:605816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductskerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductskerala.com"; sid:605817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprovid.com"; sid:605818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealitynews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealitynews.com"; sid:605819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredundancyclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredundancyclaim.com"; sid:605820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretailproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretailproducts.com"; sid:605821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-returntowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-returntowork.com"; sid:605822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriotrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriotrelief.com"; sid:605823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroundsca.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroundsca.biz"; sid:605824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroundsca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroundsca.com"; sid:605825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesummersportsclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesummersportsclinics.com"; sid:605826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitationva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitationva.com"; sid:605827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglondon.com"; sid:605828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitcenter.com"; sid:605829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimespicayune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimespicayune.com"; sid:605830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracing2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracing2020.com"; sid:605831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackca.com"; sid:605832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgivemymomcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgivemymomcovid19.com"; sid:605833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for managecovidca.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"managecovidca.biz"; sid:605834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covid19.com"; sid:605835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 918coronacrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"918coronacrew.com"; sid:605836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacovid19news.com"; sid:605837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americanpandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americanpandemicmemorial.com"; sid:605838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aunacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aunacovid.com"; sid:605839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcmcovid.com"; sid:605840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcovid.com"; sid:605841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bradescosegurosprecoespecialcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bradescosegurosprecoespecialcovid.club"; sid:605842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chilecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chilecovid.com"; sid:605843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimsforcorona.com"; sid:605844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19stats.com"; sid:605845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-blue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-blue.com"; sid:605846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconga.com"; sid:605847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocaricatures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocaricatures.com"; sid:605848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakits2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakits2go.com"; sid:605849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitstogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitstogo.com"; sid:605850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedhunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedhunt.com"; sid:605851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamitos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamitos.com"; sid:605852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-proof-chauffeur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-proof-chauffeur.com"; sid:605853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproof-chauffeur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproof-chauffeur.com"; sid:605854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofchauffeur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofchauffeur.com"; sid:605855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofchauffeurservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofchauffeurservices.com"; sid:605856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safe-event.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safe-event.com"; sid:605857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeevent.com"; sid:605858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviren-stopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviren-stopp.com"; sid:605859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateindia.com"; sid:605860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavodcast.com"; sid:605861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bw.com"; sid:605862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19changedtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19changedtheworld.com"; sid:605863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleannyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleannyc.com"; sid:605864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19officeclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19officeclean.com"; sid:605865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19protectionstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19protectionstore.com"; sid:605866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protect-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protect-solutions.com"; sid:605867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectsolutions.com"; sid:605868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultfl.com"; sid:605869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsf.com"; sid:605870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsl.com"; sid:605871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transition.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transition.art"; sid:605872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uce.com"; sid:605873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadomicilio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadomicilio.com"; sid:605874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarihant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarihant.com"; sid:605875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutfgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutfgh.com"; sid:605876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidegg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidegg.com"; sid:605877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-lie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-lie.com"; sid:605878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedhunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedhunt.com"; sid:605879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqna.com"; sid:605880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryiowa.com"; sid:605881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidturn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidturn.com"; sid:605882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuddlecovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuddlecovidlife.com"; sid:605883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dialogueoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dialogueoncovid.com"; sid:605884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dialoguewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dialoguewithcovid.com"; sid:605885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcorona.com"; sid:605886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovidbazaar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovidbazaar.com"; sid:605887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectsofcorona.com"; sid:605888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicofracism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicofracism.com"; sid:605889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovidng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovidng.com"; sid:605890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germfreepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germfreepandemic.com"; sid:605891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid-relief.com"; sid:605892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for al-covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"al-covidlawyers.com"; sid:605893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19colombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19colombia.com"; sid:605894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurance-covid-16.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurance-covid-16.com"; sid:605895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biwuhan.com"; sid:605896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidfree.com"; sid:605897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19relief.com"; sid:605898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ca-covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ca-covidlawyers.com"; sid:605899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classofcovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classofcovid2019.com"; sid:605900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablog.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablog.buzz"; sid:605901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare33.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare33.com"; sid:605902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare-eg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare-eg.com"; sid:605903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chek.com"; sid:605904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoordinator.com"; sid:605905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogolfcarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogolfcarts.com"; sid:605906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadolistedandsoldproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadolistedandsoldproperties.com"; sid:605907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpressmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpressmail.com"; sid:605908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafurm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafurm.com"; sid:605909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-producten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-producten.com"; sid:605910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitising.com"; sid:605911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmelltest.com"; sid:605912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastresssyndrome.com"; sid:605913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatech24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatech24.com"; sid:605914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatowel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatowel.com"; sid:605915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanteam.com"; sid:605916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fakenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fakenews.com"; sid:605917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspublicinquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspublicinquiry.com"; sid:605918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawindow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawindow.com"; sid:605919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andhealth.com"; sid:605920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessservices.com"; sid:605921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19documentaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19documentaries.com"; sid:605922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eraquarantineblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eraquarantineblog.com"; sid:605923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financerecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financerecovery.com"; sid:605924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19financialrecoverygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19financialrecoverygroup.com"; sid:605925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthplan.com"; sid:605926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitattorney.com"; sid:605927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitinfo.com"; sid:605928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitlawyer.com"; sid:605929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19malpracticegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19malpracticegroup.com"; sid:605930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19manhattan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19manhattan.com"; sid:605931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19molesorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19molesorg.com"; sid:605932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nycnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nycnow.com"; sid:605933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recoverygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recoverygroup.com"; sid:605934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourcesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourcesusa.com"; sid:605935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19securesystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19securesystems.com"; sid:605936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smelltest2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smelltest2020.com"; sid:605937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-smelltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-smelltest.com"; sid:605938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidb2b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidb2b.com"; sid:605939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampervacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampervacation.com"; sid:605940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcivilsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcivilsuit.com"; sid:605941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbeverlyhills.com"; sid:605942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningllc.com"; sid:605943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning-services.com"; sid:605944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningwinstonsalem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningwinstonsalem.com"; sid:605945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclik.com"; sid:605946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommercialcleaningwinstonsalem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommercialcleaningwinstonsalem.com"; sid:605947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantsuppliesdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantsuppliesdirect.com"; sid:605948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-equipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-equipment.com"; sid:605949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandstand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandstand.com"; sid:605950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyeronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyeronline.com"; sid:605951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerusa.com"; sid:605952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleads.com"; sid:605953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpracticelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpracticelawyers.com"; sid:605954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmcpcsuae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmcpcsuae.com"; sid:605955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-negligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-negligence.com"; sid:605956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegligencenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegligencenow.com"; sid:605957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpouch.com"; sid:605958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotection.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotection.club"; sid:605959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sale.com"; sid:605960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementinfo.com"; sid:605961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsettlementnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsettlementnow.com"; sid:605962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatstracker.com"; sid:605963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestgov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestgov.com"; sid:605964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheatrethinktank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheatrethinktank.com"; sid:605965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraumasurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraumasurvivors.com"; sid:605966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacancy.com"; sid:605967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebinarproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebinarproject.com"; sid:605968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid19relief.com"; sid:605969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ct-covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ct-covidlawyers.com"; sid:605970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovidrelief.com"; sid:605971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cypruscoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cypruscoronamap.com"; sid:605972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derivecovid19.com"; sid:605973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetesandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetesandcovid19.com"; sid:605974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diariocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diariocovid.com"; sid:605975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examenescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examenescovid.com"; sid:605976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fermiamoilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fermiamoilcovid.com"; sid:605977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovid19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovid19relief.com"; sid:605978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidattorneys.com"; sid:605979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidlawsuit.com"; sid:605980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fl-covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fl-covidlawyers.com"; sid:605981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ga-covidlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ga-covidlawyers.com"; sid:605982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for highinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"highinthetimeofcorona.com"; sid:605983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adhdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adhdcovid19.com"; sid:605984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aduanacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aduanacovid.com"; sid:605985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcompany.com"; sid:605986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcurtain.com"; sid:605987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arabicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arabicorona.com"; sid:605988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaporcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaporcovid.com"; sid:605989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barbadoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barbadoscovid.com"; sid:605990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betweenoccupyandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betweenoccupyandcovid19.com"; sid:605991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bkcovid19.com"; sid:605992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bronxcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bronxcovid19.com"; sid:605993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovideo.com"; sid:605994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buy-corona-germ.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buy-corona-germ.com"; sid:605995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyrepaircoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyrepaircoronavirus.com"; sid:605996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calvarycoronakids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calvarycoronakids.com"; sid:605997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cameragainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cameragainstcovid19.com"; sid:605998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovidtest.com"; sid:605999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccsujrnpandemicreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccsujrnpandemicreport.com"; sid:606000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chcovidtest.com"; sid:606001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovidstore.com"; sid:606002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningservicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningservicescovid19.com"; sid:606003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloisonscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloisonscovid.com"; sid:606004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlaforocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlaforocovid.com"; sid:606005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for convertcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"convertcorona.com"; sid:606006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bumper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bumper.com"; sid:606007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanaltour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanaltour.com"; sid:606008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanservices.com"; sid:606009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureteam.com"; sid:606010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoekjes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoekjes.com"; sid:606011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafingerprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafingerprint.com"; sid:606012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagermblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagermblog.com"; sid:606013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatrol.com"; sid:606014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprevenzione.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprevenzione.com"; sid:606015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroast.com"; sid:606016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarondvaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarondvaart.com"; sid:606017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaundersokning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaundersokning.com"; sid:606018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaurunleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaurunleri.com"; sid:606019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdisinfectionservices.com"; sid:606020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectionservices.com"; sid:606021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawiper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawiper.com"; sid:606022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-assessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-assessment.com"; sid:606023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19customs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19customs.com"; sid:606024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datasource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datasource.com"; sid:606025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-digitaltransformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-digitaltransformation.com"; sid:606026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-essential-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-essential-products.com"; sid:606027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmcoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmcoordinator.com"; sid:606028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filming.com"; sid:606029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filmtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filmtraining.com"; sid:606030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guide.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guide.club"; sid:606031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livecasetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livecasetracker.com"; sid:606032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newupdateteam.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newupdateteam.club"; sid:606033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinecourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinecourses.com"; sid:606034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rating.com"; sid:606035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relievefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relievefund.com"; sid:606036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskratecalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskratecalculator.com"; sid:606037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safesthospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safesthospitals.com"; sid:606038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safesthotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safesthotels.com"; sid:606039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomscensus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomscensus.com"; sid:606040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teamnewsupdate.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teamnewsupdate.club"; sid:606041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingprotection.com"; sid:606042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thailandconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thailandconference.com"; sid:606043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidusa.com"; sid:606044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbabybaby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbabybaby.com"; sid:606045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-brasil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-brasil.com"; sid:606046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-br.com"; sid:606047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcausation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcausation.com"; sid:606048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckinapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckinapp.com"; sid:606049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecking.com"; sid:606050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheeseparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheeseparty.com"; sid:606051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompo.com"; sid:606052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoveragemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoveragemexico.com"; sid:606053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-diagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-diagnostic.com"; sid:606054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectionservices.com"; sid:606055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetechelles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetechelles.com"; sid:606056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosuredefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosuredefense.com"; sid:606057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemerch.com"; sid:606058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgummies.com"; sid:606059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthinsurancemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthinsurancemexico.com"; sid:606060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthinsurancemx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthinsurancemx.com"; sid:606061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhilfe24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhilfe24.com"; sid:606062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersalabama.com"; sid:606063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersflorida.com"; sid:606064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersillinois.com"; sid:606065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerstexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerstexas.com"; sid:606066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.com"; sid:606067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmexicohealthcoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmexicohealthcoverage.com"; sid:606068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobit.com"; sid:606069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproteinprofile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproteinprofile.com"; sid:606070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseng.com"; sid:606071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskratecalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskratecalculator.com"; sid:606072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscura.com"; sid:606073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidserologicaltests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidserologicaltests.com"; sid:606074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstresssyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstresssyndrome.com"; sid:606075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsweeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsweeper.com"; sid:606076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test-now.com"; sid:606077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker.africa"; sid:606078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwin.com"; sid:606079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiper.com"; sid:606080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldmemorial.com"; sid:606081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cronicascovidianas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cronicascovidianas.com"; sid:606082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protocolocovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protocolocovid.cat"; sid:606083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rip-covid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rip-covid19.app"; sid:606084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webeatcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webeatcovid.club"; sid:606085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14974coronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14974coronadelmar.com"; sid:606086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 159coronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"159coronation.com"; sid:606087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidproductos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidproductos.com"; sid:606088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arirangcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arirangcovid.com"; sid:606089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19stats.com"; sid:606090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berkahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berkahcorona.com"; sid:606091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclipsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclipsusa.com"; sid:606092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobaptist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobaptist.com"; sid:606093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroids.com"; sid:606094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelguides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelguides.com"; sid:606095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingpros.com"; sid:606096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestpros.com"; sid:606097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinestudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinestudies.com"; sid:606098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkerscompensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkerscompensationclaims.com"; sid:606099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxin.com"; sid:606100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-assure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-assure.com"; sid:606101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bct.com"; sid:606102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19default.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19default.com"; sid:606103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guide2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guide2020.com"; sid:606104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-homecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-homecare.com"; sid:606105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nomundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nomundo.com"; sid:606106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizingactionteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizingactionteam.com"; sid:606107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testpros.com"; sid:606108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinestudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinestudies.com"; sid:606109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weirdwinsmetacommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weirdwinsmetacommerce.com"; sid:606110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workerscompensationclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workerscompensationclaims.com"; sid:606111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchanges2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchanges2020.com"; sid:606112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckin.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckin.app"; sid:606113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddateideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddateideas.com"; sid:606114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-deepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-deepclean.com"; sid:606115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemergencyrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemergencyrelief.com"; sid:606116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventriskmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventriskmodel.com"; sid:606117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexs.com"; sid:606118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gov.com"; sid:606119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgtrack.com"; sid:606120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidin60.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidin60.com"; sid:606121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfolibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfolibrary.com"; sid:606122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilleruv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilleruv.com"; sid:606123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillingmachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillingmachines.com"; sid:606124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkits19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkits19.com"; sid:606125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresources.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresources.care"; sid:606126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyplan.com"; sid:606127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safety-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safety-solutions.com"; sid:606128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaftey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaftey.com"; sid:606129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsancharsamuha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsancharsamuha.com"; sid:606130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-savegate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-savegate.com"; sid:606131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscamdemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscamdemic.com"; sid:606132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstateuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstateuniversity.com"; sid:606133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-style.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-style.com"; sid:606134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvie.com"; sid:606135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbristol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbristol.com"; sid:606136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker101.com"; sid:606137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwaitlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwaitlist.com"; sid:606138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cycovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cycovideo.com"; sid:606139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19-coronavirus.com"; sid:606140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmx.com"; sid:606141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidcleaning.com"; sid:606142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovidcleaning.com"; sid:606143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlcovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlcovidcleanup.com"; sid:606144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avtoolkitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avtoolkitcovid19.com"; sid:606145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bendcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bendcovid19testing.com"; sid:606146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berts-corona-praesentation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berts-corona-praesentation.com"; sid:606147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brunchintheageofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brunchintheageofcovid.com"; sid:606148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buypandemicinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buypandemicinsurance.com"; sid:606149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsagainstthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsagainstthepandemic.com"; sid:606150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carscreencovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carscreencovidprotection.com"; sid:606151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartagobernadorescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartagobernadorescovid19.com"; sid:606152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashflowdespitecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashflowdespitecovid.com"; sid:606153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinapandemicinquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinapandemicinquiry.com"; sid:606154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitiesandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitiesandcovid.com"; sid:606155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprartestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprartestcovid.com"; sid:606156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cant-stop-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cant-stop-us.com"; sid:606157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareathome.com"; sid:606158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainarabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainarabic.com"; sid:606159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainthebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainthebox.com"; sid:606160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetycheck.com"; sid:606161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoolkit-av.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoolkit-av.com"; sid:606162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedyhour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedyhour.com"; sid:606163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesnewstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesnewstoday.com"; sid:606164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustvseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustvseries.com"; sid:606165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazid.com"; sid:606166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airline.com"; sid:606167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airline.com"; sid:606168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airlinesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airlinesafety.com"; sid:606169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bars.com"; sid:606170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19basictraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19basictraining.com"; sid:606171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-beauftragter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-beauftragter.com"; sid:606172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19condochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19condochallenge.com"; sid:606173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dj.com"; sid:606174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eutive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eutive.com"; sid:606175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19issue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19issue.com"; sid:606176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mining.com"; sid:606177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertymanagers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertymanagers.com"; sid:606178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rce.com"; sid:606179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19refresh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19refresh.com"; sid:606180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19region.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19region.com"; sid:606181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19resultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19resultsfl.com"; sid:606182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-shemer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-shemer.com"; sid:606183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemd.com"; sid:606184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedical.com"; sid:606185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedic.com"; sid:606186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicine.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicine.center"; sid:606187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-theguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-theguide.com"; sid:606188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thepoliticalflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thepoliticalflu.com"; sid:606189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wecare.com"; sid:606190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20bay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20bay.com"; sid:606191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandtravel.com"; sid:606192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-beauftragter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-beauftragter.com"; sid:606193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesstools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesstools.com"; sid:606194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcroakie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcroakie.com"; sid:606195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-disinfectant.com"; sid:606196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideolose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideolose.com"; sid:606197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgcc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgcc.com"; sid:606198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhatersclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhatersclub.com"; sid:606199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hogar-y-salud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hogar-y-salud.com"; sid:606200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstanttesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstanttesting.com"; sid:606201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-items.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-items.com"; sid:606202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotouch.com"; sid:606203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficesafety.com"; sid:606204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionwears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionwears.com"; sid:606205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefresh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefresh.com"; sid:606206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultsfl.com"; sid:606207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecorridor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecorridor.com"; sid:606208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetables.com"; sid:606209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspike.com"; sid:606210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingkitsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingkitsusa.com"; sid:606211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitathome.com"; sid:606212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackker.com"; sid:606213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchml.com"; sid:606214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwiseguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwiseguy.com"; sid:606215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curiousifyouhadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curiousifyouhadcovid19.com"; sid:606216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curiousifyouhadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curiousifyouhadcovid.com"; sid:606217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccovidtesting.com"; sid:606218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcovidchecklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcovidchecklist.com"; sid:606219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalcovidpreparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalcovidpreparedness.com"; sid:606220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for respostacovid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"respostacovid19.cat"; sid:606221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1223coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1223coronavirus.com"; sid:606222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 224covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"224covid19.com"; sid:606223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 91covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"91covid.com"; sid:606224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aepidemic.com"; sid:606225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronasalon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronasalon.com"; sid:606226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alittlelightpandemicreading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alittlelightpandemicreading.com"; sid:606227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alongcamecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alongcamecovid.com"; sid:606228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amateurpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amateurpandemic.com"; sid:606229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19web.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19web.com"; sid:606230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artthruthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artthruthepandemic.com"; sid:606231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19defense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19defense.com"; sid:606232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19defenseproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19defenseproducts.com"; sid:606233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blmcoronafest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blmcoronafest.com"; sid:606234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for braceforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"braceforcovid19.com"; sid:606235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasilcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasilcovid.com"; sid:606236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carlos-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carlos-corona.com"; sid:606237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carloscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carloscorona.com"; sid:606238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19studies.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19studies.app"; sid:606239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for httpsfacebookcovid19helpshumain.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"httpsfacebookcovid19helpshumain.club"; sid:606240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nannycovid.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nannycovid.agency"; sid:606241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020blmprotestsandcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020blmprotestsandcovid-19.com"; sid:606242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3coronas.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3coronas.biz"; sid:606243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aivscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aivscovid.com"; sid:606244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aldeacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aldeacovidfree.com"; sid:606245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaoven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaoven.com"; sid:606246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for audits-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"audits-covid.com"; sid:606247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azemercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azemercovid19.com"; sid:606248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoworkcovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoworkcovidclear.com"; sid:606249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bescreenedforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bescreenedforcovid.com"; sid:606250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casapostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casapostcovid.com"; sid:606251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casaspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casaspostcovid.com"; sid:606252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe.club"; sid:606253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.clinic"; sid:606254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milancovidfree.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milancovidfree.cloud"; sid:606255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milanocovidfree.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milanocovidfree.cloud"; sid:606256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wearecovidfree.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wearecovidfree.cloud"; sid:606257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1-checkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1-checkcovid.com"; sid:606258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20scolscoronaalll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20scolscoronaalll.com"; sid:606259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911-856-73-773-ecsccscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911-856-73-773-ecsccscovid19.com"; sid:606260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazon-update-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazon-update-for-covid19.com"; sid:606261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidtest.com"; sid:606262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asoecovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asoecovida.com"; sid:606263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avatarcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avatarcovid19.com"; sid:606264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronaxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronaxy.com"; sid:606265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for before-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"before-covid.com"; sid:606266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidtest.com"; sid:606267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campspandemiccleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campspandemiccleaning.com"; sid:606268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcovid19shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcovid19shield.com"; sid:606269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cignacovidanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cignacovidanswers.com"; sid:606270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coderedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coderedcovid.com"; sid:606271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collaranticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collaranticovid.com"; sid:606272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-carxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-carxe.com"; sid:606273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarfamilyoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarfamilyoffice.com"; sid:606274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarfamilyoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarfamilyoffices.com"; sid:606275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaderi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaderi.com"; sid:606276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofamilyoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofamilyoffice.com"; sid:606277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofamilyoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofamilyoffices.com"; sid:606278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaizer.com"; sid:606279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatude.com"; sid:606280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavires-london2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavires-london2020.com"; sid:606281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscleaning.com"; sid:606282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousecleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousecleaning.com"; sid:606283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate1.com"; sid:606284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-amazon-3r233.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-amazon-3r233.com"; sid:606285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analytix.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analytix.app"; sid:606286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistmortgagefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistmortgagefamily.com"; sid:606287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chrysalis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chrysalis.com"; sid:606288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19everify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19everify.com"; sid:606289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsafety.com"; sid:606290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsafetykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsafetykits.com"; sid:606291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infocentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infocentre.com"; sid:606292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalbenefits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalbenefits.com"; sid:606293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mall.com"; sid:606294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19njjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19njjobs.com"; sid:606295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onset.com"; sid:606296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsitecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsitecheck.com"; sid:606297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsitetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsitetest.com"; sid:606298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onsitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onsitetesting.com"; sid:606299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-onsitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-onsitetesting.com"; sid:606300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onsite-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onsite-testing.com"; sid:606301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppekits.com"; sid:606302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sitestesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sitestesting.com"; sid:606303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teeshirts.com"; sid:606304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ask.com"; sid:606305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-assure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-assure.com"; sid:606306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearedbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearedbusiness.com"; sid:606307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceofficer.com"; sid:606308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddegree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddegree.com"; sid:606309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddegrees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddegrees.com"; sid:606310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiploma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiploma.com"; sid:606311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiplomas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiplomas.com"; sid:606312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgearusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgearusa.com"; sid:606313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiabregistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiabregistry.com"; sid:606314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia.biz"; sid:606315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlimitedcapacity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlimitedcapacity.com"; sid:606316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nortedeminas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nortedeminas.com"; sid:606317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-psyop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-psyop.com"; sid:606318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidrelief.com"; sid:606319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadytravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadytravel.com"; sid:606320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultprohealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultprohealth.com"; sid:606321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.cat"; sid:606322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeincentives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeincentives.com"; sid:606323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtee19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtee19.com"; sid:606324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransformation.com"; sid:606325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrendlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrendlines.com"; sid:606326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-wedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-wedding.com"; sid:606327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativeagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativeagainstcovid19.com"; sid:606328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delhicovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delhicovidsupply.com"; sid:606329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectarsanitizarcovidluzuv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectarsanitizarcovidluzuv.com"; sid:606330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovid19.info"; sid:606331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biblical-vermin-plague-is-potus-dev-mouse-iso4-covid19.space - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biblical-vermin-plague-is-potus-dev-mouse-iso4-covid19.space"; sid:606332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for braceletcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"braceletcovid.net"; sid:606333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-at-adl.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-at-adl.net"; sid:606334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabruiloft.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabruiloft.online"; sid:606335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollapse.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollapse.app"; sid:606336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compensatie.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compensatie.net"; sid:606337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compensatie.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compensatie.site"; sid:606338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoop.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoop.org"; sid:606339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeestje.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeestje.online"; sid:606340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.fit - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.fit"; sid:606341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglass.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglass.net"; sid:606342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.icu"; sid:606343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-untersuchungsausschuss.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-untersuchungsausschuss.org"; sid:606344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverjaardag.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverjaardag.online"; sid:606345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-pandemic.net"; sid:606346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatsaroundtheworld.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatsaroundtheworld.net"; sid:606347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19harita.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19harita.online"; sid:606348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19matters.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19matters.shop"; sid:606349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19onsitetesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19onsitetesting.net"; sid:606350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shrff.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shrff.org"; sid:606351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistics.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistics.online"; sid:606352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testing.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testing.nyc"; sid:606353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.nyc"; sid:606354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aware.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aware.org"; sid:606355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbharat.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbharat.net"; sid:606356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelet.net"; sid:606357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelets.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelets.net"; sid:606358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsent.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsent.club"; sid:606359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiabregistry.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiabregistry.info"; sid:606360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiabregistry.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiabregistry.net"; sid:606361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiabregistry.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiabregistry.org"; sid:606362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindia.net"; sid:606363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller.icu"; sid:606364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.digital"; sid:606365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.mobi"; sid:606366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscann.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscann.online"; sid:606367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting.nyc"; sid:606368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnyc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnyc.info"; sid:606369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupcovid.info"; sid:606370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupcovid.net"; sid:606371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for groupcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"groupcovid.org"; sid:606372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovid19tracker.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovid19tracker.live"; sid:606373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovid.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovid.site"; sid:606374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusoutlook.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusoutlook.net"; sid:606375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidjourney.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidjourney.info"; sid:606376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covidclass2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covidclass2020.com"; sid:606377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesscovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesscovidapp.com"; sid:606378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actions-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actions-covid19.com"; sid:606379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiapandemiccongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiapandemiccongress.com"; sid:606380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awascovid.com"; sid:606381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batursawesomecovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batursawesomecovidapp.com"; sid:606382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatzcorona.com"; sid:606383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19testing.com"; sid:606384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19testingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19testingnearme.com"; sid:606385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19vaccines.com"; sid:606386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bethscovid19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bethscovid19blog.com"; sid:606387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blmcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blmcovid-19.com"; sid:606388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakdownofbullshitcovidphases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakdownofbullshitcovidphases.com"; sid:606389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calcovid-19.com"; sid:606390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturecovid.com"; sid:606391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carepackageforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carepackageforcovid.com"; sid:606392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caring4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caring4covid.com"; sid:606393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claimfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claimfromcovid.com"; sid:606394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19student.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19student.cloud"; sid:606395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhan.com"; sid:606396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411-coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411-coronado.com"; sid:606397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gandcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gandcovid19.com"; sid:606398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 866333covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"866333covid.com"; sid:606399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancedcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancedcovidclean.com"; sid:606400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidnowwhat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidnowwhat.com"; sid:606401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americandreampandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americandreampandemic.com"; sid:606402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibacovid.com"; sid:606403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronatape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronatape.com"; sid:606404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicmademeconfrontmymentalillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicmademeconfrontmymentalillness.com"; sid:606405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azruncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azruncovid.com"; sid:606406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banreservascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banreservascovid19.com"; sid:606407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronalessons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronalessons.com"; sid:606408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaware.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaware.biz"; sid:606409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidufa.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidufa.biz"; sid:606410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidufa.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidufa.club"; sid:606411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paydayloanscoronaca.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paydayloanscoronaca.biz"; sid:606412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid-19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid-19.club"; sid:606413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ufacovid.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ufacovid.asia"; sid:606414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcovid19.club"; sid:606415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14800coronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14800coronadelmar.com"; sid:606416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 815covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"815covid.com"; sid:606417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arewedonewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arewedonewithcovid.com"; sid:606418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20.blog"; sid:606419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashrelief.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashrelief.biz"; sid:606420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnew.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnew.asia"; sid:606421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.asia"; sid:606422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpanties.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpanties.club"; sid:606423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1safetysigncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1safetysigncovid.com"; sid:606424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcoronahelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcoronahelp.com"; sid:606425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aguardientecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aguardientecoronado.com"; sid:606426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americainthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americainthetimeofcorona.com"; sid:606427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusmedicine.com"; sid:606428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atworkinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atworkinapandemic.com"; sid:606429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autempsducovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autempsducovid.com"; sid:606430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calzado6coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calzado6coronas.com"; sid:606431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for can-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"can-covid.com"; sid:606432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronair.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronair.club"; sid:606433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesting.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesting.app"; sid:606434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.app"; sid:606435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbros.band - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbros.band"; sid:606436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnosis.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnosis.biz"; sid:606437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.app"; sid:606438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harvestrockcorona.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harvestrockcorona.church"; sid:606439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecovidtest.com"; sid:606440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecovidtests.com"; sid:606441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3acovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3acovidcare.com"; sid:606442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adenocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adenocovid.com"; sid:606443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-covid-accm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-covid-accm.com"; sid:606444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-covid-valleedesbauxalpilles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-covid-valleedesbauxalpilles.com"; sid:606445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apres-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apres-pandemic.com"; sid:606446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprespandemic.com"; sid:606447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovidcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovidcount.com"; sid:606448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aventuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aventuscovid19.com"; sid:606449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidbusters.com"; sid:606450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bellacovid19sellerfb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bellacovid19sellerfb.com"; sid:606451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerdepressionandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerdepressionandcovid.com"; sid:606452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.club"; sid:606453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commercial.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commercial.cleaning"; sid:606454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19commercialcleaning.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19commercialcleaning.biz"; sid:606455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietcovid.club"; sid:606456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhang.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhang.club"; sid:606457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2hourcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2hourcovidtest.com"; sid:606458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 50statescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"50statescovid.com"; sid:606459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovidtest.com"; sid:606460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amicovidimmune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amicovidimmune.com"; sid:606461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anchoragecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anchoragecovidtesting.com"; sid:606462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidtests.com"; sid:606463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asianlegalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asianlegalcovid.com"; sid:606464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudaespiritualcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudaespiritualcovid.com"; sid:606465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidcleaners.com"; sid:606466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidcleaning.com"; sid:606467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidpros.com"; sid:606468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brik-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brik-covid.com"; sid:606469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brikcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brikcovid.com"; sid:606470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cluelessaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cluelessaboutcovid.com"; sid:606471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadispute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadispute.com"; sid:606472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoelectricvehicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoelectricvehicles.com"; sid:606473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoev.com"; sid:606474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsnow.com"; sid:606475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalbag.com"; sid:606476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingteam.com"; sid:606477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-news.com"; sid:606478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldrules.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldrules.com"; sid:606479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analytic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analytic.com"; sid:606480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19besttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19besttestkit.com"; sid:606481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaning.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaning.business"; sid:606482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consent.com"; sid:606483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19couture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19couture.com"; sid:606484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoaxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoaxes.com"; sid:606485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inside.com"; sid:606486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kungflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kungflu.com"; sid:606487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2cv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2cv.com"; sid:606488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2world.com"; sid:606489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcampaign2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcampaign2020.com"; sid:606490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning20.com"; sid:606491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningaz.com"; sid:606492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningstar.com"; sid:606493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcertsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcertsolutions.com"; sid:606494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouturier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouturier.com"; sid:606495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderous.com"; sid:606496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventsolutions.com"; sid:606497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfestivalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfestivalsolutions.com"; sid:606498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfight.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfight.club"; sid:606499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightshop.com"; sid:606500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfogservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfogservice.com"; sid:606501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitychecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitychecker.com"; sid:606502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactusa.com"; sid:606503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiser.com"; sid:606504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisor.com"; sid:606505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidizor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidizor.com"; sid:606506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkungflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkungflu.com"; sid:606507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmybutt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmybutt.com"; sid:606508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficecleaners.com"; sid:606509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprosaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprosaz.com"; sid:606510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrallies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrallies.com"; sid:606511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrxyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrxyz.com"; sid:606512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolsolutions.com"; sid:606513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscleaning.com"; sid:606514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions11.com"; sid:606515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvan.com"; sid:606516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelupdate.com"; sid:606517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingsolutions.com"; sid:606518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkrights.com"; sid:606519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncorona.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncorona.asia"; sid:606520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovid19.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovid19.asia"; sid:606521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncovid19.club"; sid:606522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19.club"; sid:606523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidfight.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidfight.club"; sid:606524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altempodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altempodelcoronavirus.com"; sid:606525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19herbaltea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19herbaltea.com"; sid:606526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arealcovidscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arealcovidscams.com"; sid:606527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blgcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blgcovidtest.com"; sid:606528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecovid1929.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecovid1929.com"; sid:606529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for col-a-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"col-a-covid.com"; sid:606530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoevgolfcarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoevgolfcarts.com"; sid:606531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafda.com"; sid:606532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafdatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafdatest.com"; sid:606533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronago.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronago.asia"; sid:606534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagosolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagosolutions.com"; sid:606535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthcaresupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthcaresupply.com"; sid:606536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecaresupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecaresupply.com"; sid:606537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infrared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infrared.com"; sid:606538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfrared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfrared.com"; sid:606539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaluke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaluke.com"; sid:606540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasgo.com"; sid:606541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestfda.com"; sid:606542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscustommasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscustommasks.com"; sid:606543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksfirst.com"; sid:606544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnelmondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnelmondo.com"; sid:606545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ye.com"; sid:606546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcounting.com"; sid:606547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beehindbars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beehindbars.com"; sid:606548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningplus.com"; sid:606549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19esultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19esultsfl.com"; sid:606550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19for.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19for.com"; sid:606551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecollectiontestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecollectiontestkit.com"; sid:606552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masksfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masksfirst.com"; sid:606553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masksinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masksinc.com"; sid:606554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rat.com"; sid:606555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rats.com"; sid:606556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reportsforyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reportsforyou.com"; sid:606557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resulgtsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resulgtsfl.com"; sid:606558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rsultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rsultsfl.com"; sid:606559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanation.com"; sid:606560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccountability.com"; sid:606561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarmask.com"; sid:606562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidble.com"; sid:606563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareus.com"; sid:606564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck-gemotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck-gemotest.com"; sid:606565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchemsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchemsource.com"; sid:606566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanliness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanliness.com"; sid:606567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideotech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideotech.com"; sid:606568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfda.com"; sid:606569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfdatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfdatest.com"; sid:606570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeel.com"; sid:606571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfor.com"; sid:606572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeliving.com"; sid:606573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcaresupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcaresupply.com"; sid:606574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecaresupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecaresupply.com"; sid:606575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigitalization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigitalization.com"; sid:606576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinformatics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinformatics.com"; sid:606577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkoozie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkoozie.com"; sid:606578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskbreath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskbreath.com"; sid:606579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-meter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-meter.com"; sid:606580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopenforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopenforum.com"; sid:606581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientsnotrecovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientsnotrecovered.com"; sid:606582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidress.com"; sid:606583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalization.com"; sid:606584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthrive.com"; sid:606585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrainingworkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrainingworkers.com"; sid:606586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinerelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinerelief.com"; sid:606587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxnews.com"; sid:606588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovidtest19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovidtest19test.com"; sid:606589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacorona.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacorona.asia"; sid:606590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peacovid-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peacovid-19.cat"; sid:606591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amstcovidculture.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amstcovidculture.blog"; sid:606592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninesforcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninesforcovid.org"; sid:606593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovid.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovid.icu"; sid:606594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeye.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeye.online"; sid:606595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jp.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jp.org"; sid:606596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kid.net"; sid:606597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kid.org"; sid:606598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-learnings.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-learnings.net"; sid:606599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovel.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovel.net"; sid:606600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clean.equipment - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clean.equipment"; sid:606601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19for.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19for.net"; sid:606602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19log4p.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19log4p.org"; sid:606603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saferspaces.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saferspaces.org"; sid:606604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19so.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19so.org"; sid:606605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareus.net"; sid:606606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfor.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfor.net"; sid:606607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlyrestaurants.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlyrestaurants.info"; sid:606608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlyrestaurants.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlyrestaurants.org"; sid:606609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlink.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlink.info"; sid:606610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlink.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlink.org"; sid:606611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidly.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidly.net"; sid:606612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mgmt.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mgmt.info"; sid:606613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.live"; sid:606614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-politics.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-politics.info"; sid:606615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker.cloud"; sid:606616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsupplies.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsupplies.online"; sid:606617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funceicoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funceicoronavirus.info"; sid:606618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcorona.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcorona.online"; sid:606619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcovid.info"; sid:606620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid.online"; sid:606621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.info"; sid:606622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidcredential.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidcredential.net"; sid:606623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.live"; sid:606624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for response2covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"response2covid19.net"; sid:606625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testescovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testescovid19.info"; sid:606626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinecovid19.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinecovid19.live"; sid:606627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for with-corona.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"with-corona.life"; sid:606628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcovidclaim.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcovidclaim.online"; sid:606629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3059viadelcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3059viadelcoronado.com"; sid:606630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allegheneycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allegheneycovidtesting.com"; sid:606631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anoncovidtexts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anoncovidtexts.com"; sid:606632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associationsbeyondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associationsbeyondcovid.com"; sid:606633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidcrisis.com"; sid:606634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaciao.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaciao.cat"; sid:606635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblog.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblog.club"; sid:606636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidperu.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidperu.app"; sid:606637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidready.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidready.biz"; sid:606638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19fightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19fightingcovid19.com"; sid:606639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gisthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gisthecoronavirus.com"; sid:606640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6280coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6280coronado.com"; sid:606641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amcovid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amcovid-free.com"; sid:606642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidmasks.com"; sid:606643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aquahcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aquahcovid19.com"; sid:606644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansaacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansaacovid.com"; sid:606645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baseballpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baseballpandemic.com"; sid:606646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid19cleaning.com"; sid:606647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for broadeningperspectivesoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"broadeningperspectivesoncovid-19.com"; sid:606648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burnerepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burnerepidemic.com"; sid:606649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calculatecovidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calculatecovidrisk.com"; sid:606650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidcouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidcouncil.com"; sid:606651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chennaicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chennaicorona.com"; sid:606652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comcovid.com"; sid:606653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.club"; sid:606654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cummerbundepidemic.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cummerbundepidemic.buzz"; sid:606655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.care"; sid:606656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telephonecorona.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telephonecorona.buzz"; sid:606657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1124coronadoterrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1124coronadoterrace.com"; sid:606658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afipcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afipcovid19.com"; sid:606659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for app-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"app-covid19.com"; sid:606660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovid19cleaning.com"; sid:606661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocadcovid.com"; sid:606662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for averycovidchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"averycovidchristmas.com"; sid:606663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canigetacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canigetacovid19test.com"; sid:606664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceasecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceasecorona.com"; sid:606665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovidclinic.com"; sid:606666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cinemateatrocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cinemateatrocorona.com"; sid:606667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cobrezinccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cobrezinccovid19.com"; sid:606668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperzinccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperzinccovid19.com"; sid:606669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadversity.com"; sid:606670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaberechnungen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaberechnungen.com"; sid:606671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersli.com"; sid:606672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaliforniapainters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaliforniapainters.com"; sid:606673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcorpuschristi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcorpuschristi.com"; sid:606674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoachandcounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoachandcounsel.com"; sid:606675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontradictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontradictions.com"; sid:606676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoenterprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoenterprise.com"; sid:606677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoflavor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoflavor.com"; sid:606678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoperformance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoperformance.com"; sid:606679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotradingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotradingco.com"; sid:606680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeast.com"; sid:606681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreechennai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreechennai.com"; sid:606682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglasscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglasscleaner.com"; sid:606683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahessen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahessen.com"; sid:606684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairony.com"; sid:606685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krieger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krieger.com"; sid:606686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrieger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrieger.com"; sid:606687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronango.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronango.com"; sid:606688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanonprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanonprofits.com"; sid:606689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-prev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-prev.com"; sid:606690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarechte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarechte.com"; sid:606691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarfid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarfid.com"; sid:606692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas4corona.com"; sid:606693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasharing.com"; sid:606694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneezing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneezing.com"; sid:606695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalkshows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalkshows.com"; sid:606696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingsolutions.com"; sid:606697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcorpuschristi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcorpuschristi.com"; sid:606698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcrkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcrkit.com"; sid:606699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couplingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couplingduringcovid.com"; sid:606700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19admemoriamfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19admemoriamfoundation.com"; sid:606701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19benefitsreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19benefitsreview.com"; sid:606702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcorpuschristi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcorpuschristi.com"; sid:606703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningcorpus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningcorpus.com"; sid:606704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coating.com"; sid:606705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19datamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19datamap.com"; sid:606706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalessentials.com"; sid:606707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionsupply.com"; sid:606708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-laboratoriojavierbajaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-laboratoriojavierbajaire.com"; sid:606709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalactions.com"; sid:606710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalanswers.com"; sid:606711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalassist.com"; sid:606712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legal-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legal-help.com"; sid:606713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-legalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-legalinfo.com"; sid:606714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legallaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legallaw.com"; sid:606715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskmart.com"; sid:606716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maskshop.com"; sid:606717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskshops.com"; sid:606718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19persistent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19persistent.com"; sid:606719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitising.com"; sid:606720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19signsplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19signsplus.com"; sid:606721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smile.com"; sid:606722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sterilisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sterilisation.com"; sid:606723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storeindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storeindia.com"; sid:606724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sussex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sussex.com"; sid:606725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcenterlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcenterlocator.com"; sid:606726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19training1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19training1.com"; sid:606727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19training2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19training2.com"; sid:606728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transition.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transition.art"; sid:606729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19validhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19validhelp.com"; sid:606730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeathsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeathsuit.com"; sid:606731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactions.com"; sid:606732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalumni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalumni.com"; sid:606733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantikropp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantikropp.com"; sid:606734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbenefitsreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbenefitsreview.com"; sid:606735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburials.com"; sid:606736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburning.com"; sid:606737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalorie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalorie.com"; sid:606738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalories.com"; sid:606739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandle.com"; sid:606740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.center"; sid:606741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.biz"; sid:606742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.club"; sid:606743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersf.com"; sid:606744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanerssf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanerssf.com"; sid:606745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanseltd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanseltd.com"; sid:606746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantesting.com"; sid:606747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolumn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolumn.com"; sid:606748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconclusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconclusion.com"; sid:606749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontradiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontradiction.com"; sid:606750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontradictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontradictions.com"; sid:606751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoozie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoozie.com"; sid:606752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounsellor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounsellor.com"; sid:606753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcounsellors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcounsellors.com"; sid:606754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfector.com"; sid:606755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideast.com"; sid:606756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomist.com"; sid:606757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomists.com"; sid:606758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidereignisse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidereignisse.com"; sid:606759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevangelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevangelist.com"; sid:606760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevangelists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevangelists.com"; sid:606761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaelle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaelle.com"; sid:606762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilyguide.com"; sid:606763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilymasks.com"; sid:606764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfortresses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfortresses.com"; sid:606765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatekeeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatekeeper.com"; sid:606766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgathering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgathering.com"; sid:606767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenomics.com"; sid:606768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglasscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglasscleaner.com"; sid:606769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoneusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoneusa.com"; sid:606770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp2020.com"; sid:606771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp2021.com"; sid:606772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhilfen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhilfen.com"; sid:606773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecooking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecooking.com"; sid:606774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhqafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhqafrica.com"; sid:606775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioactive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioactive.com"; sid:606776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirony.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirony.com"; sid:606777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidishere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidishere.com"; sid:606778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoke.com"; sid:606779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitusa.com"; sid:606780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlecture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlecture.com"; sid:606781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlectures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlectures.com"; sid:606782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskclassaction.com"; sid:606783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurder.com"; sid:606784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneccessities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneccessities.com"; sid:606785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninteenvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninteenvirus.com"; sid:606786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnonprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnonprofits.com"; sid:606787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnwo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnwo.com"; sid:606788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobesitywebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobesitywebinar.com"; sid:606789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpathway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpathway.com"; sid:606790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersistent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersistent.com"; sid:606791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprofiteer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprofiteer.com"; sid:606792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefuge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefuge.com"; sid:606793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrehabtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrehabtv.com"; sid:606794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsenp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsenp.com"; sid:606795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsibility.com"; sid:606796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeaccredidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeaccredidation.com"; sid:606797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferegistrar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferegistrar.com"; sid:606798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferegistry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferegistry.com"; sid:606799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsharing.com"; sid:606800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsil.com"; sid:606801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneezing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneezing.com"; sid:606802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialets.com"; sid:606803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialevents.com"; sid:606804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeech.com"; sid:606805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspreader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspreader.com"; sid:606806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspreaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspreaders.com"; sid:606807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatistiken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatistiken.com"; sid:606808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatsnow.com"; sid:606809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsterilisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsterilisation.com"; sid:606810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsue.com"; sid:606811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupermart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupermart.com"; sid:606812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuspects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuspects.com"; sid:606813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalkshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalkshow.com"; sid:606814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtalkshows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtalkshows.com"; sid:606815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestchain.com"; sid:606816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestledger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestledger.com"; sid:606817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsdirect.com"; sid:606818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestva.com"; sid:606819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurls.com"; sid:606820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacsil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacsil.com"; sid:606821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidverantwortung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidverantwortung.com"; sid:606822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoyager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoyager.com"; sid:606823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarroom.com"; sid:606824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwest.com"; sid:606825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwonder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwonder.com"; sid:606826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwonders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwonders.com"; sid:606827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursodeactualizacionenmedicinaentiemposdecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursodeactualizacionenmedicinaentiemposdecovid19.com"; sid:606828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvscovid.com"; sid:606829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iltempodelcovid19.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iltempodelcovid19.art"; sid:606830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 805covid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"805covid19cleaning.com"; sid:606831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activeagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activeagainstcovid.com"; sid:606832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronacoat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronacoat.com"; sid:606833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcoat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcoat.com"; sid:606834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aretheycovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aretheycovidsafe.com"; sid:606835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for art4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"art4corona.com"; sid:606836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arubacovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arubacovidinsurance.com"; sid:606837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspire-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspire-covid19.com"; sid:606838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid-19.com"; sid:606839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beverlyhillscovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beverlyhillscovid19cleaning.com"; sid:606840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncovidcoalition.com"; sid:606841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bscovid19.com"; sid:606842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bscovid.com"; sid:606843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for business40covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"business40covid.com"; sid:606844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessstartduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessstartduringcovid.com"; sid:606845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19disinfectant.com"; sid:606846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19cleaning.com"; sid:606847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calmthecovid19storm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calmthecovid19storm.com"; sid:606848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casascovid.com"; sid:606849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcoronavirusanxietyanddepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcoronavirusanxietyanddepression.com"; sid:606850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certicovid.com"; sid:606851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for complycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"complycovid19.com"; sid:606852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona15.com"; sid:606853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19cash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19cash.com"; sid:606854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersny.com"; sid:606855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-christmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-christmas.com"; sid:606856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsciousconcerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsciousconcerts.com"; sid:606857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontactonderzoek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontactonderzoek.com"; sid:606858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelectronics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelectronics.com"; sid:606859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaal.com"; sid:606860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocos.com"; sid:606861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanitrilegloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanitrilegloves.com"; sid:606862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregels.com"; sid:606863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresources.com"; sid:606864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testzentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testzentrum.com"; sid:606865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgv.com"; sid:606866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvisiblekiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvisiblekiller.com"; sid:606867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinekills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinekills.com"; sid:606868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-xmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-xmas.com"; sid:606869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costacoronadoresidencial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costacoronadoresidencial.com"; sid:606870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19365income2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19365income2020.com"; sid:606871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19anime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19anime.com"; sid:606872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19anime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19anime.com"; sid:606873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19balancingact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19balancingact.com"; sid:606874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliancegroup.com"; sid:606875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingfl.com"; sid:606876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inmegen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inmegen.com"; sid:606877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-news-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-news-update.com"; sid:606878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19parfum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19parfum.com"; sid:606879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pronow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pronow.com"; sid:606880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19racism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19racism.com"; sid:606881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19readyusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19readyusa.com"; sid:606882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safeattorney.com"; sid:606883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeatwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeatwork.com"; sid:606884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safebusiness.com"; sid:606885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safechiropractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safechiropractor.com"; sid:606886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safechiropractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safechiropractors.com"; sid:606887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safecontractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safecontractor.com"; sid:606888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safehelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safehelpers.com"; sid:606889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safelawyers.com"; sid:606890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storeww.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storeww.com"; sid:606891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testmalaysia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testmalaysia.com"; sid:606892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testturkiye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testturkiye.com"; sid:606893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinekills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinekills.com"; sid:606894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worksafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worksafe.com"; sid:606895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019facts.com"; sid:606896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021secure.com"; sid:606897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2026.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2026.com"; sid:606898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid225.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid225.com"; sid:606899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid911call.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid911call.com"; sid:606900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactionflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactionflorida.com"; sid:606901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaxe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaxe.com"; sid:606902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterusa.com"; sid:606903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarenetwork.com"; sid:606904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupboise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupboise.com"; sid:606905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanuplosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanuplosangeles.com"; sid:606906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupnewyorkcity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupnewyorkcity.com"; sid:606907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupportland.com"; sid:606908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanuproseville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanuproseville.com"; sid:606909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupsacramento.com"; sid:606910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupsanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupsanjose.com"; sid:606911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceofficerdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceofficerdatabase.com"; sid:606912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconveyors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconveyors.com"; sid:606913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooler.com"; sid:606914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoolers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoolers.com"; sid:606915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisgroup.com"; sid:606916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddongle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddongle.com"; sid:606917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecleanuptuscon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecleanuptuscon.com"; sid:606918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviderify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviderify.com"; sid:606919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloyd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloyd.com"; sid:606920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfob.com"; sid:606921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemenu.com"; sid:606922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcompliance.com"; sid:606923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelmetbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelmetbag.com"; sid:606924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help-book.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help-book.com"; sid:606925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiqtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiqtest.com"; sid:606926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisalie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisalie.com"; sid:606927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisbs.com"; sid:606928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkounter.com"; sid:606929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayid.com"; sid:606930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphoenix.com"; sid:606931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprosolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprosolutions.com"; sid:606932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionmzt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionmzt.com"; sid:606933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidclean.com"; sid:606934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapiddiagnostictest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapiddiagnostictest.com"; sid:606935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeattorney.com"; sid:606936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe.biz"; sid:606937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebusinesses.com"; sid:606938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafechiropractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafechiropractor.com"; sid:606939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafechiropractors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafechiropractors.com"; sid:606940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecontractor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecontractor.com"; sid:606941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehelpers.com"; sid:606942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafelawyers.com"; sid:606943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety2020.com"; sid:606944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyvideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyvideos.com"; sid:606945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafey2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafey2020.com"; sid:606946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscheduling.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscheduling.club"; sid:606947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscheduling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscheduling.com"; sid:606948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsdgfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsdgfinance.com"; sid:606949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsetsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsetsafety.com"; sid:606950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthwest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthwest.com"; sid:606951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtempsensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtempsensor.com"; sid:606952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinekills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinekills.com"; sid:606953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwtf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwtf.com"; sid:606954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crf-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crf-covid.com"; sid:606955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuzcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuzcovid.com"; sid:606956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacccovid-19.com"; sid:606957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designcoronaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designcoronaa.com"; sid:606958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedcovidtest19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedcovidtest19.com"; sid:606959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-corona.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-corona.clinic"; sid:606960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for withcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"withcorona.biz"; sid:606961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidforcovid19.com"; sid:606962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirus-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirus-medicine.com"; sid:606963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for authenticcoronatips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"authenticcoronatips.com"; sid:606964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecovidkit.com"; sid:606965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caiocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caiocovid19.com"; sid:606966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chaocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chaocovid19.com"; sid:606967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comebackcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comebackcovid19.com"; sid:606968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comebackcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comebackcovid.com"; sid:606969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovid.com"; sid:606970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalertus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalertus.com"; sid:606971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabitch20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabitch20.com"; sid:606972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-burnout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-burnout.com"; sid:606973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasita.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasita.com"; sid:606974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomesampling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomesampling.com"; sid:606975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarydessert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarydessert.com"; sid:606976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashindia.com"; sid:606977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus1x1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus1x1.com"; sid:606978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninganddisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninganddisinfection.com"; sid:606979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisbullsht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisbullsht.com"; sid:606980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitaminb3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitaminb3.com"; sid:606981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ab.com"; sid:606982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abs.com"; sid:606983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19accessories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19accessories.com"; sid:606984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bus.com"; sid:606985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningdisinfection.com"; sid:606986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19condom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19condom.com"; sid:606987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ender.com"; sid:606988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunecaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunecaregivers.com"; sid:606989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19immunern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19immunern.com"; sid:606990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livecase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livecase.com"; sid:606991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mandate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mandate.com"; sid:606992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19odds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19odds.com"; sid:606993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid--19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid--19relief.com"; sid:606994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefunds.com"; sid:606995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19take.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19take.com"; sid:606996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19terminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19terminators.com"; sid:606997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-updateee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-updateee.com"; sid:606998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vitaminb3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vitaminb3.com"; sid:606999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldstatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldstatistics.com"; sid:607000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xtra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xtra.com"; sid:607001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbootcamp.com"; sid:607002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bus.com"; sid:607003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuses.com"; sid:607004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardco.com"; sid:607005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchris.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchris.com"; sid:607006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcottage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcottage.com"; sid:607007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcritters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcritters.com"; sid:607008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuration.com"; sid:607009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensehome.com"; sid:607010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19.club"; sid:607011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidender.com"; sid:607012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeessentials.com"; sid:607013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguestbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguestbook.com"; sid:607014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguide.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguide.app"; sid:607015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunecaregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunecaregiver.com"; sid:607016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunecaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunecaregivers.com"; sid:607017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunern.com"; sid:607018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity.biz"; sid:607019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidity.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidity.center"; sid:607020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditycenter.com"; sid:607021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditydirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditydirectory.com"; sid:607022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidityexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidityexpert.com"; sid:607023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidityme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidityme.com"; sid:607024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditysolutions.com"; sid:607025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditysupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditysupport.com"; sid:607026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditytechnology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditytechnology.com"; sid:607027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditytips.com"; sid:607028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitty.com"; sid:607029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliberia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliberia.com"; sid:607030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmandate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmandate.com"; sid:607031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskasap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskasap.com"; sid:607032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmath19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmath19.com"; sid:607033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessenger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessenger.com"; sid:607034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewspost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewspost.com"; sid:607035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositivecaregivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositivecaregivers.com"; sid:607036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproxima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproxima.com"; sid:607037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantreviews.com"; sid:607038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskplanner.com"; sid:607039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepubs.com"; sid:607040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscheduling.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscheduling.app"; sid:607041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecret.com"; sid:607042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsover.com"; sid:607043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtake.com"; sid:607044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestrgv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestrgv.com"; sid:607045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvseverybody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvseverybody.com"; sid:607046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deltacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deltacovid.com"; sid:607047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designerfacemasks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designerfacemasks-covid19.com"; sid:607048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ensemblecontrecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ensemblecontrecorona.com"; sid:607049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicalert.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicalert.app"; sid:607050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 32coronaroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"32coronaroad.com"; sid:607051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activeagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activeagainstcovid-19.com"; sid:607052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alohaepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alohaepidemic.com"; sid:607053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amicovid.com"; sid:607054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidoffers.com"; sid:607055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19essentials.com"; sid:607056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawayuvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawayuvc.com"; sid:607057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-control-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-control-game.com"; sid:607058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrol-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrol-game.com"; sid:607059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrolgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrolgame.com"; sid:607060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaengenharia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaengenharia.com"; sid:607061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamelder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamelder.com"; sid:607062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanano.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanano.com"; sid:607063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-new.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-new.com"; sid:607064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnap.com"; sid:607065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasome3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasome3.com"; sid:607066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasome.com"; sid:607067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplies101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplies101.com"; sid:607068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveltips.com"; sid:607069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatyzer.com"; sid:607070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralinfection.com"; sid:607071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivestreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivestreams.com"; sid:607072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-near-me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-near-me.com"; sid:607073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinecure.com"; sid:607074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavision.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavision.com"; sid:607075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomecash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomecash.com"; sid:607076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athomemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athomemoney.com"; sid:607077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bouncer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bouncer.com"; sid:607078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningexperts.com"; sid:607079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19com.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19com.com"; sid:607080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comm.com"; sid:607081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19completesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19completesolution.com"; sid:607082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailycheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailycheck.com"; sid:607083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dietplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dietplus.com"; sid:607084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19educate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19educate.com"; sid:607085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19explored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19explored.com"; sid:607086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19explored.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19explored.com"; sid:607087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19feverdetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19feverdetection.com"; sid:607088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19feverdetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19feverdetection.com"; sid:607089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19howarewedoing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19howarewedoing.com"; sid:607090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-near-me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-near-me.com"; sid:607091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineclinic.com"; sid:607092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19runway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19runway.com"; sid:607093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supplies101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supplies101.com"; sid:607094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomscheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomscheck.com"; sid:607095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tag.com"; sid:607096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tek.com"; sid:607097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermaldetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermaldetection.com"; sid:607098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tvbusinessnewsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tvbusinessnewsreport.com"; sid:607099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineregister.com"; sid:607100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccines.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccines.app"; sid:607101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartsandthoughts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartsandthoughts.com"; sid:607102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathomeincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathomeincome.com"; sid:607103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathomemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathomemoney.com"; sid:607104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathomemoneymaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathomemoneymaker.com"; sid:607105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbouncer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbouncer.com"; sid:607106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbouncers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbouncers.com"; sid:607107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuys.com"; sid:607108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcdccleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcdccleaning.com"; sid:607109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompletesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompletesolution.com"; sid:607110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsul.com"; sid:607111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcostus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcostus.com"; sid:607112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreationclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreationclub.com"; sid:607113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddaycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddaycare.com"; sid:607114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesn.com"; sid:607115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomemoney.com"; sid:607116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomemoneymaker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomemoneymaker.com"; sid:607117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalunr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalunr.com"; sid:607118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfor19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfor19.com"; sid:607119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloupe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloupe.com"; sid:607120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonald2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonald2020.com"; sid:607121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonald.com"; sid:607122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplayhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplayhouse.com"; sid:607123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionassociation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionassociation.com"; sid:607124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyofficer.com"; sid:607125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecuretravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecuretravel.com"; sid:607126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskint.com"; sid:607127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatstx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatstx.com"; sid:607128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies101.com"; sid:607129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrace360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrace360.com"; sid:607130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrades.com"; sid:607131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaporiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaporiser.com"; sid:607132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaporizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaporizer.com"; sid:607133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danniipandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danniipandemic.com"; sid:607134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davespandemicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davespandemicblog.com"; sid:607135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decovidoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decovidoffers.com"; sid:607136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidkillers.com"; sid:607137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ditestingmx-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ditestingmx-covid.com"; sid:607138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diy-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diy-covid19.com"; sid:607139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earnaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earnaftercovid.com"; sid:607140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espacovidaplena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espacovidaplena.com"; sid:607141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for executivecovid-19report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"executivecovid-19report.com"; sid:607142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fashionweekcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fashionweekcovid19.com"; sid:607143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flockcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flockcovid19.com"; sid:607144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ftothecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ftothecovid.com"; sid:607145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for funcovidtshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"funcovidtshirts.com"; sid:607146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swisscovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swisscovid.app"; sid:607147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcorona.com"; sid:607148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidtesting.com"; sid:607149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtesting.com"; sid:607150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4484coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4484coronado.com"; sid:607151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abortcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abortcovid.com"; sid:607152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircocorona.com"; sid:607153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorealtempodelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorealtempodelcovid19.com"; sid:607154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticadimoralacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticadimoralacorona.com"; sid:607155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansacovid.com"; sid:607156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayurvedandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayurvedandcorona.com"; sid:607157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronatests.com"; sid:607158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19tests.com"; sid:607159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtests.com"; sid:607160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootypandemic.com"; sid:607161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid.com"; sid:607162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brick-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brick-covid.com"; sid:607163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brickcovid.com"; sid:607164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusmaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusmaskonline.com"; sid:607165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidvp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidvp.com"; sid:607166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canceled-by-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canceled-by-covid.com"; sid:607167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chainofcovidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chainofcovidity.com"; sid:607168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.blue"; sid:607169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassam.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassam.club"; sid:607170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregister.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregister.africa"; sid:607171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-resource.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-resource.center"; sid:607172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcovid19.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcovid19.asia"; sid:607173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcovid19.cloud"; sid:607174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021pandemics.com"; sid:607175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4484coronadoave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4484coronadoave.com"; sid:607176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accessorycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accessorycovid19.com"; sid:607177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accovidtest.com"; sid:607178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidclean.com"; sid:607179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidcleaning.com"; sid:607180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alanmcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alanmcoronado.com"; sid:607181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alatdeteksicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alatdeteksicorona.com"; sid:607182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazom-update-date-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazom-update-date-covid19.com"; sid:607183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus2020.com"; sid:607184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicchronicle.com"; sid:607185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiapandemic.com"; sid:607186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiapandemicexpo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiapandemicexpo.com"; sid:607187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincoronaclean.com"; sid:607188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlingcovid.com"; sid:607189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronatests.com"; sid:607190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19products.com"; sid:607191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for big-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"big-corona.com"; sid:607192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidconference.com"; sid:607193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bradscovid19protectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bradscovid19protectors.com"; sid:607194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid19safety.com"; sid:607195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid19safetyrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid19safetyrating.com"; sid:607196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callahancovidcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callahancovidcert.com"; sid:607197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcovidppe.com"; sid:607198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisagainstcorona.com"; sid:607199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscurescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscurescoronavirus.com"; sid:607200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscurescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscurescovid.com"; sid:607201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcovid19.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcovid19.art"; sid:607202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcovid19.club"; sid:607203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcovid19.com"; sid:607204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chiefcovidkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chiefcovidkiller.com"; sid:607205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china-wuhan.com"; sid:607206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascovid.com"; sid:607207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ckcovid19medicalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ckcovid19medicalsupplies.com"; sid:607208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanaftercovid.com"; sid:607209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidsop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidsop.com"; sid:607210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcovidsop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcovidsop.com"; sid:607211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningforcovid.com"; sid:607212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combactcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combactcorona.com"; sid:607213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completelycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completelycovid.com"; sid:607214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contacttracingforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contacttracingforcovid19.com"; sid:607215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coppercovidring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coppercovidring.com"; sid:607216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19karachi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19karachi.com"; sid:607217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19medicine.com"; sid:607218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaakberlol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaakberlol.com"; sid:607219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashapp.com"; sid:607220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanexpert.com"; sid:607221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanhelp.com"; sid:607222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacombact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacombact.com"; sid:607223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidandhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidandhealth.com"; sid:607224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacowards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacowards.com"; sid:607225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadawai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadawai.com"; sid:607226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoase.com"; sid:607227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaears.com"; sid:607228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedirectory.com"; sid:607229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotelistanbul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotelistanbul.com"; sid:607230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info.club"; sid:607231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajohnson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajohnson.com"; sid:607232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerspbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerspbc.com"; sid:607233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamab.com"; sid:607234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamainspanishsda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamainspanishsda.com"; sid:607235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicinemexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicinemexico.com"; sid:607236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ole.com"; sid:607237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapcrtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapcrtestkit.com"; sid:607238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartfilm.com"; sid:607239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcentre.com"; sid:607240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestsla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestsla.com"; sid:607241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestspro.com"; sid:607242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronausdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronausdata.com"; sid:607243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavideoproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavideoproduction.com"; sid:607244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusasi.com"; sid:607245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningspray.com"; sid:607246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-updates.com"; sid:607247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskholder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskholder.com"; sid:607248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsdigest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsdigest.com"; sid:607249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatestingkit.com"; sid:607250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmartnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmartnews.com"; sid:607251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacinne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacinne.com"; sid:607252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10resultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10resultsfl.com"; sid:607253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid111.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid111.com"; sid:607254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-asik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-asik.com"; sid:607255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bootcamp.com"; sid:607256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bustergroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bustergroup.com"; sid:607257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bustersusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bustersusa.com"; sid:607258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careathome.com"; sid:607259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cowards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cowards.com"; sid:607260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dawai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dawai.com"; sid:607261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19expose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19expose.com"; sid:607262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fog.com"; sid:607263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fogdisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fogdisinfect.com"; sid:607264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fucker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fucker.com"; sid:607265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grantshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grantshelp.com"; sid:607266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19highriskwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19highriskwear.com"; sid:607267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hkg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hkg.com"; sid:607268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19karachi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19karachi.com"; sid:607269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifeins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifeins.com"; sid:607270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lightt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lightt.com"; sid:607271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19livestats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19livestats.com"; sid:607272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lv.com"; sid:607273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ochealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ochealthinfo.com"; sid:607274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19okay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19okay.com"; sid:607275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pepstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pepstudy.com"; sid:607276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pp.com"; sid:607277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventions.com"; sid:607278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pulsependant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pulsependant.com"; sid:607279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultflorida.com"; sid:607280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safelisting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safelisting.com"; sid:607281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safelistingmethod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safelistingmethod.com"; sid:607282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safelistings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safelistings.com"; sid:607283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatestingkit.com"; sid:607284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizationprocedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizationprocedures.com"; sid:607285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19singlelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19singlelife.com"; sid:607286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19steamer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19steamer.com"; sid:607287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19surfacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19surfacetest.com"; sid:607288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfraud.com"; sid:607289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingfraud.com"; sid:607290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19texassports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19texassports.com"; sid:607291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelspecials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelspecials.com"; sid:607292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vieques.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vieques.com"; sid:607293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zoom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zoom.com"; sid:607294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020insights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020insights.com"; sid:607295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagentonset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagentonset.com"; sid:607296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbasic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbasic.com"; sid:607297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessalliance.com"; sid:607298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustergroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustergroup.com"; sid:607299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuyerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuyerplan.com"; sid:607300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidin.com"; sid:607301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidine.com"; sid:607302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclarify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclarify.com"; sid:607303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassroomprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassroomprotection.com"; sid:607304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnow.com"; sid:607305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsop.com"; sid:607306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansop.com"; sid:607307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicalstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicalstudy.com"; sid:607308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcloser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcloser.com"; sid:607309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclosers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclosers.com"; sid:607310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollegekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollegekit.com"; sid:607311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolorbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolorbands.com"; sid:607312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolourbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolourbands.com"; sid:607313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolours.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolours.com"; sid:607314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortcolors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortcolors.com"; sid:607315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortmask.com"; sid:607316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceofficers.com"; sid:607317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnie.com"; sid:607318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoochies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoochies.com"; sid:607319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountysim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountysim.com"; sid:607320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowards.com"; sid:607321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazys.com"; sid:607322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrise.com"; sid:607323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-critical-icu-dev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-critical-icu-dev.com"; sid:607324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-death.com"; sid:607325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddelete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddelete.com"; sid:607326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddirectsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddirectsuppliers.com"; sid:607327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisclosures.com"; sid:607328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectantexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectantexperts.com"; sid:607329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectantpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectantpros.com"; sid:607330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfektant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfektant.com"; sid:607331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfektants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfektants.com"; sid:607332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideasyregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideasyregister.com"; sid:607333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsnotfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsnotfear.com"; sid:607334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiltration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiltration.com"; sid:607335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinacal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinacal.com"; sid:607336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreealliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreealliance.com"; sid:607337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehyderabad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehyderabad.com"; sid:607338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepbc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepbc.com"; sid:607339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesop.com"; sid:607340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidg4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidg4.com"; sid:607341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhacks2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhacks2020.com"; sid:607342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthmask.com"; sid:607343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthtrack.com"; sid:607344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomescreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomescreens.com"; sid:607345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimab.com"; sid:607346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancequote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancequote.com"; sid:607347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidirishdancefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidirishdancefestival.com"; sid:607348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-killer.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-killer.us"; sid:607349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitstampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitstampa.com"; sid:607350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskshirts.com"; sid:607351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksppe.com"; sid:607352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeandadam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeandadam.com"; sid:607353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmediahype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmediahype.com"; sid:607354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmetter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmetter.com"; sid:607355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnax.com"; sid:607356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsdigest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsdigest.com"; sid:607357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteencharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteencharts.com"; sid:607358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidninteenproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidninteenproject.com"; sid:607359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidones.com"; sid:607360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonset.com"; sid:607361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-onsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-onsite.com"; sid:607362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-onsitetrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-onsitetrial.com"; sid:607363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plasmastudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plasmastudies.com"; sid:607364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppegroup.com"; sid:607365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductcentral.com"; sid:607366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts4u.com"; sid:607367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pros.com"; sid:607368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpysop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpysop.com"; sid:607369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rating.com"; sid:607370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreduction.com"; sid:607371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchinstitute.com"; sid:607372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidringpick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidringpick.com"; sid:607373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecamp.com"; sid:607374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeevent.com"; sid:607375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeindonesia.com"; sid:607376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-savar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-savar.com"; sid:607377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoollunch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoollunch.com"; sid:607378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure21.com"; sid:607379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservicesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservicesolutions.com"; sid:607380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield360.com"; sid:607381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield365.com"; sid:607382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoundtrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoundtrack.com"; sid:607383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategic.com"; sid:607384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudies.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudies.us"; sid:607385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudyrecruit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudyrecruit.com"; sid:607386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstuff4salecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstuff4salecom.com"; sid:607387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliez.com"; sid:607388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplygroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplygroup.com"; sid:607389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsclub.com"; sid:607390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymposium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymposium.com"; sid:607391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtargets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtargets.com"; sid:607392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-team.com"; sid:607393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidter.com"; sid:607394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcentres.com"; sid:607395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestedinburgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestedinburgh.com"; sid:607396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestevent.com"; sid:607397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfraud.com"; sid:607398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestglasgow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestglasgow.com"; sid:607399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingfraud.com"; sid:607400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestisfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestisfraud.com"; sid:607401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestscotland.com"; sid:607402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsny.com"; sid:607403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtvns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtvns.com"; sid:607404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacinne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacinne.com"; sid:607405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus-stats.com"; sid:607406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingsandevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingsandevents.com"; sid:607407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-weddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-weddings.com"; sid:607408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidedasuavidacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidedasuavidacovid19.com"; sid:607409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataoncovid.com"; sid:607410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhlwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhlwuhan.com"; sid:607411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for directcovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"directcovidppe.com"; sid:607412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid10test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid10test.com"; sid:607413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19teat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19teat.com"; sid:607414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for embrywomenscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"embrywomenscovidtesting.com"; sid:607415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etihad-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etihad-covid19.com"; sid:607416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etihadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etihadcovid19.com"; sid:607417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eventcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eventcovidtest.com"; sid:607418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridahealthcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridahealthcovid-19.com"; sid:607419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for g4eah1n1pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"g4eah1n1pandemic.com"; sid:607420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for g4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"g4pandemic.com"; sid:607421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for g4swineflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"g4swineflupandemic.com"; sid:607422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gagetmycovidresult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gagetmycovidresult.com"; sid:607423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globeagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globeagainstcovid.com"; sid:607424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocontaincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocontaincovid.com"; sid:607425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocovidclean.com"; sid:607426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icscovid19.com"; sid:607427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ilovethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ilovethepandemic.com"; sid:607428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for karencoronalcsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"karencoronalcsw.com"; sid:607429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killacorona.com"; sid:607430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lnjpcoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lnjpcoviddata.com"; sid:607431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovidchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovidchronicle.com"; sid:607432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovethepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovethepandemic.com"; sid:607433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronakits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronakits.com"; sid:607434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovid19testingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovid19testingservices.com"; sid:607435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtestingservices.com"; sid:607436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicgarden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicgarden.com"; sid:607437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidetest.com"; sid:607438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mytestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mytestcovid.com"; sid:607439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcovidrelief.com"; sid:607440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcovidattorney.com"; sid:607441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for over-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"over-covid.com"; sid:607442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoach.com"; sid:607443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicessentialplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicessentialplus.com"; sid:607444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicg4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicg4.com"; sid:607445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgaming.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgaming.club"; sid:607446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgardenseeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgardenseeds.com"; sid:607447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpest.com"; sid:607448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpotential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpotential.com"; sid:607449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprocup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprocup.com"; sid:607450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectiveproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectiveproducts.com"; sid:607451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicseeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicseeds.com"; sid:607452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsources.com"; sid:607453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvegetableseeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvegetableseeds.com"; sid:607454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvibrations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvibrations.com"; sid:607455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvibrationscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvibrationscom.com"; sid:607456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for petcovidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"petcovidpro.com"; sid:607457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pigcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pigcorona.com"; sid:607458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for previnassedocoronavirusficaemcasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"previnassedocoronavirusficaemcasa.com"; sid:607459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulsecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulsecovid19.com"; sid:607460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reagiraocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reagiraocovid.com"; sid:607461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safemaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safemaskcorona.com"; sid:607462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safetykits-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safetykits-covid19.com"; sid:607463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for santa-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"santa-corona.com"; sid:607464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolduringcovid.com"; sid:607465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecoronapro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecoronapro.com"; sid:607466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seecovid19pro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seecovid19pro.com"; sid:607467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoothillcovidtrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoothillcovidtrace.com"; sid:607468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shoothillcovidtracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shoothillcovidtracer.com"; sid:607469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statecoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statecoviddata.com"; sid:607470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopthecovidscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopthecovidscam.com"; sid:607471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for swineflupandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"swineflupandemic.com"; sid:607472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syneoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syneoscovid19.com"; sid:607473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for syneoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"syneoscovid.com"; sid:607474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusgoodnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusgoodnews.com"; sid:607475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid-key.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid-key.com"; sid:607476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidrelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidrelieffund.com"; sid:607477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thrucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thrucovid19.com"; sid:607478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tmccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tmccovidtest.com"; sid:607479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for totallycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"totallycovid.com"; sid:607480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uncoronalivable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uncoronalivable.com"; sid:607481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for valleycovidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"valleycovidaid.com"; sid:607482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vircovid19study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vircovid19study.com"; sid:607483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for website-floridacovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"website-floridacovidaction.com"; sid:607484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wecoverorwecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wecoverorwecovid.com"; sid:607485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehadcovid.com"; sid:607486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan8090.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan8090.com"; sid:607487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanmtc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanmtc.com"; sid:607488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanpentuji.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanpentuji.com"; sid:607489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantuan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantuan.club"; sid:607490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanxys58.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanxys58.com"; sid:607491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for youandmecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"youandmecovid.com"; sid:607492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovid19journey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovid19journey.com"; sid:607493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zacoviderta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zacoviderta.com"; sid:607494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscovid-19.com"; sid:607495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afterpandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afterpandemic2020.com"; sid:607496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-covidrelance-valleedesbauxalpilles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-covidrelance-valleedesbauxalpilles.com"; sid:607497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airductcleaningservicescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airductcleaningservicescorona.com"; sid:607498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazon-update-for-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazon-update-for-covid19.com"; sid:607499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amecomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amecomcoronavirus.com"; sid:607500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for animalsinthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"animalsinthepandemic.com"; sid:607501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronafolie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronafolie.com"; sid:607502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprendizajesdelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprendizajesdelcoronavirus.com"; sid:607503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcvcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcvcovid-19.com"; sid:607504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidlawyer.com"; sid:607505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookcovidtest.com"; sid:607506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessreboundfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessreboundfromcovid.com"; sid:607507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecovid-19.com"; sid:607508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19baby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19baby.com"; sid:607509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19recovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19recovery.com"; sid:607510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeyedoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeyedoc.com"; sid:607511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivetoday.com"; sid:607512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskkit.com"; sid:607513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskshopping.com"; sid:607514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatranslation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatranslation.com"; sid:607515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmandate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmandate.com"; sid:607516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnonsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnonsense.com"; sid:607517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspayoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspayoff.com"; sid:607518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestfailure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestfailure.com"; sid:607519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapeutic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapeutic.com"; sid:607520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustherapeuticnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustherapeuticnews.com"; sid:607521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvlamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvlamps.com"; sid:607522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuvrays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuvrays.com"; sid:607523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosmiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosmiccovid.com"; sid:607524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-alien-menace-film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-alien-menace-film.com"; sid:607525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-asik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-asik.com"; sid:607526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessrecoverypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessrecoverypack.com"; sid:607527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19costaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19costaff.com"; sid:607528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19elections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19elections.com"; sid:607529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19environmental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19environmental.com"; sid:607530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19glam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19glam.com"; sid:607531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeoffice.com"; sid:607532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19initiatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19initiatives.com"; sid:607533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qure.com"; sid:607534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reaultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reaultsfl.com"; sid:607535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-recovery-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-recovery-plan.com"; sid:607536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resulfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resulfl.com"; sid:607537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rwsultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rwsultsfl.com"; sid:607538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stimuluschecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stimuluschecks.com"; sid:607539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stories.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stories.blog"; sid:607540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surviving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surviving.com"; sid:607541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesusa.com"; sid:607542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineupdate.com"; sid:607543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-worldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-worldnews.com"; sid:607544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20lies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20lies.com"; sid:607545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid38.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid38.com"; sid:607546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccess.com"; sid:607547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacpcarehomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacpcarehomes.com"; sid:607548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanz.com"; sid:607549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessrebound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessrebound.com"; sid:607550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcfl.com"; sid:607551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchroniclespodcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchroniclespodcast.com"; sid:607552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclapper.com"; sid:607553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaus.com"; sid:607554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanlimousinecarservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanlimousinecarservice.com"; sid:607555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanscfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanscfl.com"; sid:607556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolkits.com"; sid:607557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouturedesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouturedesigns.com"; sid:607558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemocracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemocracy.com"; sid:607559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialsindia.com"; sid:607560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforgovernor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforgovernor.com"; sid:607561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-hig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-hig.com"; sid:607562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiainfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiainfo.com"; sid:607563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinresidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinresidence.com"; sid:607564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotz.com"; sid:607565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeuring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeuring.com"; sid:607566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkit2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkit2go.com"; sid:607567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliars.com"; sid:607568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskonline.com"; sid:607569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmistreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmistreatment.com"; sid:607570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneutralizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneutralizers.com"; sid:607571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-orlando.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-orlando.com"; sid:607572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutfromhome.com"; sid:607573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayoff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayoff.com"; sid:607574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplannedrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplannedrecovery.com"; sid:607575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprayerline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprayerline.com"; sid:607576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionsussex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionsussex.com"; sid:607577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductsdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductsdirect.com"; sid:607578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebound.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebound.biz"; sid:607579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefugee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefugee.com"; sid:607580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefugees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefugees.com"; sid:607581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedds.com"; sid:607582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedentist2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedentist2020.com"; sid:607583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedestination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedestination.com"; sid:607584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedestinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedestinations.com"; sid:607585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeonline.com"; sid:607586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizespecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizespecialist.com"; sid:607587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstage.com"; sid:607588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplydrop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplydrop.com"; sid:607589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sweeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sweeper.com"; sid:607590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemtratamentosim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemtratamentosim.com"; sid:607591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtherapeutic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtherapeutic.com"; sid:607592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtinyhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtinyhome.com"; sid:607593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvlamps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvlamps.com"; sid:607594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvrays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvrays.com"; sid:607595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationnews.com"; sid:607596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovidcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovidcollective.com"; sid:607597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroyscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroyscovid-19.com"; sid:607598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for devoted2covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"devoted2covid.biz"; sid:607599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for devotedtocovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"devotedtocovid.biz"; sid:607600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidstudy.com"; sid:607601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for effectivecovidcleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"effectivecovidcleanup.com"; sid:607602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid19.blog"; sid:607603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid19.club"; sid:607604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid.blog"; sid:607605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidclean.com"; sid:607606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arewestillcoviding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arewestillcoviding.com"; sid:607607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudacovidbolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudacovidbolivia.com"; sid:607608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidproof.com"; sid:607609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bengalurufightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bengalurufightscorona.com"; sid:607610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campingtrotzcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campingtrotzcorona.com"; sid:607611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscoronavirus.com"; sid:607612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabiscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabiscovid.com"; sid:607613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisforcorona.com"; sid:607614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisforcoronavirus.com"; sid:607615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisforcovid-19.com"; sid:607616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisforcovid19.com"; sid:607617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisvscorona.com"; sid:607618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisvscoronavirus.com"; sid:607619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisvscovid.com"; sid:607620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdforcoronavirus.com"; sid:607621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdvscorona.com"; sid:607622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdvscoronavirus.com"; sid:607623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colorcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colorcovid.com"; sid:607624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colourcovid.com"; sid:607625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confirmedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confirmedcovidfree.com"; sid:607626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conqueringcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conqueringcovid-19.com"; sid:607627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1x1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1x1.com"; sid:607628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinladen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinladen.com"; sid:607629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardtech.com"; sid:607630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogolfcourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogolfcourse.com"; sid:607631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometestingkit.com"; sid:607632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronairus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronairus.com"; sid:607633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakadha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakadha.com"; sid:607634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelemarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelemarketing.com"; sid:607635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestdistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestdistributors.com"; sid:607636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinestore.com"; sid:607637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaching.com"; sid:607638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathing.com"; sid:607639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscontamination.com"; sid:607640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdistancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdistancing.com"; sid:607641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusethnicity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusethnicity.com"; sid:607642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgob.com"; sid:607643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushousehold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushousehold.com"; sid:607644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicaid.com"; sid:607645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutcomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutcomes.com"; sid:607646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecuperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecuperation.com"; sid:607647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmell.com"; sid:607648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstroke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstroke.com"; sid:607649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuits.com"; sid:607650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaste.com"; sid:607651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesthomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesthomekit.com"; sid:607652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitcost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitcost.com"; sid:607653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitforhome.com"; sid:607654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkitonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkitonline.com"; sid:607655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-training.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-training.com"; sid:607656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebdesign.com"; sid:607657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carmask.com"; sid:607658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carshield.com"; sid:607659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cough.com"; sid:607660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19form.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19form.com"; sid:607661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gcar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gcar.com"; sid:607662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gshield.com"; sid:607663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infections.com"; sid:607664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifesavers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifesavers.com"; sid:607665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lungs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lungs.com"; sid:607666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicaid.com"; sid:607667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicare.com"; sid:607668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19paincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19paincare.com"; sid:607669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19procedure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19procedure.com"; sid:607670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reaults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reaults.com"; sid:607671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rooms.com"; sid:607672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smell.com"; sid:607673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19spittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19spittest.com"; sid:607674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19srs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19srs.com"; sid:607675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taste.com"; sid:607676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19temperature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19temperature.com"; sid:607677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapeutics.com"; sid:607678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19transmission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19transmission.com"; sid:607679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbima.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbima.com"; sid:607680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbyzipcode.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbyzipcode.com"; sid:607681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecollaborative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecollaborative.com"; sid:607682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremexico.com"; sid:607683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraps.com"; sid:607684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecoproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecoproducts.com"; sid:607685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecothings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecothings.com"; sid:607686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemdr.com"; sid:607687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-flx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-flx.com"; sid:607688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunitywristbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunitywristbands.com"; sid:607689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinhomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinhomecare.com"; sid:607690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivere.com"; sid:607691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkarens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkarens.com"; sid:607692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnourishment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnourishment.com"; sid:607693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprojekt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprojekt.com"; sid:607694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregisters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregisters.com"; sid:607695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalivatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalivatesting.com"; sid:607696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstateorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstateorders.com"; sid:607697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthomekit.com"; sid:607698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduberlandia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduberlandia.com"; sid:607699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyouthsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyouthsurvey.com"; sid:607700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dellacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dellacorona.com"; sid:607701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designercoronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designercoronamasks.com"; sid:607702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elamorenlostiemposdelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elamorenlostiemposdelcovid.com"; sid:607703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidtoday.com"; sid:607704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovidcure.com"; sid:607705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidvictims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidvictims.com"; sid:607706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fortcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fortcovid.com"; sid:607707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemics.com"; sid:607708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grupocorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grupocorona.biz"; sid:607709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanrc.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanrc.club"; sid:607710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800flcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800flcovid.com"; sid:607711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcorona.com"; sid:607712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidtesting.com"; sid:607713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtesting.com"; sid:607714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4484coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4484coronado.com"; sid:607715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abortcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abortcovid.com"; sid:607716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidsafeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidsafeworld.com"; sid:607717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acucovid.com"; sid:607718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircocorona.com"; sid:607719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorealtempodelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorealtempodelcovid19.com"; sid:607720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anthraxpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anthraxpandemic.com"; sid:607721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticadimoralacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticadimoralacorona.com"; sid:607722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansacovid.com"; sid:607723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ashevillecovidnarcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ashevillecovidnarcs.com"; sid:607724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayurvedandcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayurvedandcorona.com"; sid:607725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronatests.com"; sid:607726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19tests.com"; sid:607727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtests.com"; sid:607728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootypandemic.com"; sid:607729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcovid.com"; sid:607730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brick-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brick-covid.com"; sid:607731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brickcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brickcovid.com"; sid:607732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusmaskonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusmaskonline.com"; sid:607733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidvp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidvp.com"; sid:607734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canceled-by-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canceled-by-covid.com"; sid:607735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carnitasuruapancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carnitasuruapancorona.com"; sid:607736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chainofcovidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chainofcovidity.com"; sid:607737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chemokidscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chemokidscorona.com"; sid:607738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmaswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmaswithcovid.com"; sid:607739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidtest.com"; sid:607740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidtest.com"; sid:607741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constructoracoronacabrera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constructoracoronacabrera.com"; sid:607742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultingcovid.com"; sid:607743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookinginthetimeofcorona.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookinginthetimeofcorona.blog"; sid:607744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19statuskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19statuskit.com"; sid:607745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabluttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabluttest.com"; sid:607746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-champions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-champions.com"; sid:607747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachollos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachollos.com"; sid:607748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanme.com"; sid:607749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondom.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondom.biz"; sid:607750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacre.com"; sid:607751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrunchies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrunchies.com"; sid:607752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacures19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacures19.com"; sid:607753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarvacation.com"; sid:607754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadodems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadodems.com"; sid:607755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextra.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextra.berlin"; sid:607756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiesta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiesta.com"; sid:607757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info-center.com"; sid:607758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalearningexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalearningexperience.com"; sid:607759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskcouture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskcouture.com"; sid:607760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamobilesweepers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamobilesweepers.com"; sid:607761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanla.com"; sid:607762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapremiergolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapremiergolf.com"; sid:607763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareplenishments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareplenishments.com"; sid:607764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascustomironwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascustomironwork.com"; sid:607765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastatuskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastatuskit.com"; sid:607766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavengers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavengers.com"; sid:607767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventilatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventilatie.com"; sid:607768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventilation.com"; sid:607769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-academy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-academy.com"; sid:607770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusdisinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusdisinfections.com"; sid:607771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfections.com"; sid:607772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfearr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfearr.com"; sid:607773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgaziantep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgaziantep.com"; sid:607774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionprotection.com"; sid:607775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-learningexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-learningexperience.com"; sid:607776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstatuskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstatuskit.com"; sid:607777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tax-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tax-center.com"; sid:607778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-taxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-taxinfo.com"; sid:607779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldreport.com"; sid:607780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworksafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworksafe.com"; sid:607781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19airlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19airlines.com"; sid:607782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodyteststl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodyteststl.com"; sid:607783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aust.com"; sid:607784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19banks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19banks.com"; sid:607785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19carinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19carinsurance.com"; sid:607786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checkins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checkins.com"; sid:607787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checks.com"; sid:607788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinicalaccelerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinicalaccelerator.com"; sid:607789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19completeinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19completeinfo.com"; sid:607790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceservices.com"; sid:607791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19criticare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19criticare.com"; sid:607792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eliminated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eliminated.com"; sid:607793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eventtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eventtesting.com"; sid:607794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19flights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19flights.com"; sid:607795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19flresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19flresults.com"; sid:607796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hackathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hackathon.com"; sid:607797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19highriskclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19highriskclothing.com"; sid:607798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19highrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19highrisk.com"; sid:607799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19highrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19highrisk.com"; sid:607800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19highriskwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19highriskwear.com"; sid:607801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19holiday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19holiday.com"; sid:607802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19holidays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19holidays.com"; sid:607803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19insurancebrokers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19insurancebrokers.com"; sid:607804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19isolate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19isolate.com"; sid:607805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-johnshopkins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-johnshopkins.com"; sid:607806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lifeinsurance.com"; sid:607807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mascarillasymas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mascarillasymas.com"; sid:607808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mister.com"; sid:607809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19misters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19misters.com"; sid:607810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19misters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19misters.com"; sid:607811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19misting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19misting.com"; sid:607812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19misting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19misting.com"; sid:607813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mistings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mistings.com"; sid:607814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mistings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mistings.com"; sid:607815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nose.com"; sid:607816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ochealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ochealth.com"; sid:607817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19regulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19regulations.com"; sid:607818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19restrictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19restrictions.com"; sid:607819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resulysfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resulysfl.com"; sid:607820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safeguarding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safeguarding.com"; sid:607821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safeguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safeguards.com"; sid:607822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schools.com"; sid:607823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shops.com"; sid:607824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statuskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statuskit.com"; sid:607825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tax-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tax-center.com"; sid:607826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsforevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsforevents.com"; sid:607827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thanksgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thanksgiving.com"; sid:607828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19travelling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19travelling.com"; sid:607829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19usadecontamtination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19usadecontamtination.com"; sid:607830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacationinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacationinsurance.com"; sid:607831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19xmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19xmas.com"; sid:607832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid239.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid239.com"; sid:607833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid305.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid305.com"; sid:607834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid954.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid954.com"; sid:607835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacrossamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacrossamerica.com"; sid:607836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodydiagnoctics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodydiagnoctics.com"; sid:607837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodyteststl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodyteststl.com"; sid:607838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbadges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbadges.com"; sid:607839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbricks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbricks.com"; sid:607840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbytrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbytrump.com"; sid:607841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarcleaner.com"; sid:607842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareconsultants.com"; sid:607843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarehome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarehome.com"; sid:607844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarspray.com"; sid:607845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcero.com"; sid:607846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchambers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchambers.com"; sid:607847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-christmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-christmas.com"; sid:607848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanup.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanup.us"; sid:607849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearglobal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearglobal.com"; sid:607850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcloths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcloths.com"; sid:607851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomparison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomparison.com"; sid:607852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcon5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcon5.com"; sid:607853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercoat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercoat.com"; sid:607854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercoater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercoater.com"; sid:607855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercoaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercoaters.com"; sid:607856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercoating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercoating.com"; sid:607857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperdisinfector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperdisinfector.com"; sid:607858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperdisinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperdisinfectors.com"; sid:607859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperelectroplater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperelectroplater.com"; sid:607860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperelectroplaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperelectroplaters.com"; sid:607861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperelectroplating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperelectroplating.com"; sid:607862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperexterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperexterminator.com"; sid:607863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperexterminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperexterminators.com"; sid:607864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperkiller.com"; sid:607865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperkillers.com"; sid:607866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperkilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperkilling.com"; sid:607867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperknobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperknobs.com"; sid:607868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppermonster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppermonster.com"; sid:607869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppermonsters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppermonsters.com"; sid:607870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperplate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperplate.com"; sid:607871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperplater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperplater.com"; sid:607872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperplaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperplaters.com"; sid:607873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperplating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperplating.com"; sid:607874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppersanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppersanitizer.com"; sid:607875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppersanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppersanitizers.com"; sid:607876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperterminator.com"; sid:607877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopperterminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopperterminators.com"; sid:607878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidctscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidctscan.com"; sid:607879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-datahouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-datahouse.com"; sid:607880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddidit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddidit.com"; sid:607881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dividers.com"; sid:607882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddraftbackup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddraftbackup.com"; sid:607883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecon.com"; sid:607884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetox.com"; sid:607885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventtesting.com"; sid:607886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfantasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfantasy.com"; sid:607887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfantasyfootball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfantasyfootball.com"; sid:607888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfasttesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfasttesting.com"; sid:607889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforthepeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforthepeople.com"; sid:607890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholiday2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholiday2020.com"; sid:607891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholidays2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholidays2020.com"; sid:607892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidics.com"; sid:607893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiam.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiam.art"; sid:607894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindiamart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindiamart.com"; sid:607895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info-center.com"; sid:607896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylawfirm.com"; sid:607897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinperspective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinperspective.com"; sid:607898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancequotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancequotes.com"; sid:607899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintheworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintheworkplace.com"; sid:607900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotmasks.com"; sid:607901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkowboy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkowboy.com"; sid:607902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlandlordlegalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlandlordlegalcare.com"; sid:607903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaptopshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaptopshields.com"; sid:607904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlessdubai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlessdubai.com"; sid:607905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghaulers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghaulers.com"; sid:607906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanagementsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanagementsolutions.com"; sid:607907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarkers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarkers.com"; sid:607908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmisting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmisting.com"; sid:607909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmistings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmistings.com"; sid:607910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnaked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnaked.com"; sid:607911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-news-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-news-now.com"; sid:607912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-numbers.com"; sid:607913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidorcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidorcover.com"; sid:607914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutofwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutofwork.com"; sid:607915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanicapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanicapparel.com"; sid:607916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonesex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonesex.com"; sid:607917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-proximity-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-proximity-tracing.com"; sid:607918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpuppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpuppy.com"; sid:607919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidlab.com"; sid:607920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidlabs.com"; sid:607921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadyconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadyconsulting.com"; sid:607922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremover.com"; sid:607923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantmenus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantmenus.com"; sid:607924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidroomdividers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidroomdividers.com"; sid:607925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeclosings.com"; sid:607926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeinplymouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeinplymouth.com"; sid:607927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sars.com"; sid:607928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsciencesummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsciencesummit.com"; sid:607929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshopmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshopmania.com"; sid:607930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshowmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshowmanagement.com"; sid:607931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsindia.com"; sid:607932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitetesting.com"; sid:607933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstaq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstaq.com"; sid:607934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatuskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatuskit.com"; sid:607935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstream21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstream21.com"; sid:607936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplys.com"; sid:607937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivors.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivors.club"; sid:607938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsvaccine.com"; sid:607939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest305.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest305.com"; sid:607940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfromhome.com"; sid:607941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinganytime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinganytime.com"; sid:607942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingeasy.com"; sid:607943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingrentals.com"; sid:607944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsforevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsforevents.com"; sid:607945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsforrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsforrent.com"; sid:607946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststogo.com"; sid:607947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtotalcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtotalcontrol.com"; sid:607948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtti.com"; sid:607949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineanswers.com"; sid:607950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedateguess.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedateguess.com"; sid:607951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelawfirm.com"; sid:607952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisuals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisuals.com"; sid:607953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx.africa"; sid:607954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushthecovid.com"; sid:607955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danicecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danicecovidsolutions.com"; sid:607956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dapsonecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dapsonecovid.com"; sid:607957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmwuhan.com"; sid:607958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovidtesting.com"; sid:607959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecovidmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecovidmx.com"; sid:607960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbpowerballpandemicrelieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbpowerballpandemicrelieffunds.com"; sid:607961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid19mask.com"; sid:607962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcovid19masks.com"; sid:607963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fearandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fearandcovid.com"; sid:607964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19cases.com"; sid:607965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid19results.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid19results.com"; sid:607966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidcases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidcases.com"; sid:607967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flycoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flycoronafree.com"; sid:607968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for focovidasan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"focovidasan.com"; sid:607969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forthepeoplecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forthepeoplecovid19.com"; sid:607970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fsny-covidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fsny-covidcompliance.com"; sid:607971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fueracovidct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fueracovidct.com"; sid:607972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for futurewithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"futurewithcorona.com"; sid:607973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gagetcovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gagetcovidresults.com"; sid:607974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gagetmycovidtestresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gagetmycovidtestresults.com"; sid:607975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamersfightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamersfightingcovid19.com"; sid:607976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gentlecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gentlecovidtesting.com"; sid:607977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ggacovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ggacovidcare.com"; sid:607978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for go-corona-go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"go-corona-go.com"; sid:607979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hasilcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hasilcovid19.com"; sid:607980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for havecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"havecovid.com"; sid:607981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid.club"; sid:607982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jhucovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jhucovidmap.com"; sid:607983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juancoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juancoronado.com"; sid:607984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for korea-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"korea-covid19.com"; sid:607985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lascarnitasuruapancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lascarnitasuruapancorona.com"; sid:607986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latiendacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latiendacovid19.com"; sid:607987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavida-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavida-corona.com"; sid:607988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavorocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavorocovid.com"; sid:607989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinglavidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinglavidacorona.com"; sid:607990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livinlavidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livinlavidacorona.com"; sid:607991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lolcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lolcovidmasks.com"; sid:607992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longhaulcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longhaulcovid.com"; sid:607993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for love-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"love-corona.com"; sid:607994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makeamericacovidfreeagain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makeamericacovidfreeagain.com"; sid:607995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mjscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mjscovid.com"; sid:607996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for morriscountycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"morriscountycovidtest.com"; sid:607997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19survey.com"; sid:607998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidprotection.com"; sid:607999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidprotections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidprotections.com"; sid:608000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidsurvey.com"; sid:608001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mynameiscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mynameiscovid-19.com"; sid:608002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemiclovestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemiclovestory.com"; sid:608003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypluscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypluscovidtest.com"; sid:608004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myquestcovidtext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myquestcovidtext.com"; sid:608005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ndeecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ndeecovid19.com"; sid:608006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nopaincovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nopaincovidtesting.com"; sid:608007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onceuponacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onceuponacovid19.com"; sid:608008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecountycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecountycovid.com"; sid:608009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for painfreecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"painfreecovid.com"; sid:608010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for painfreecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"painfreecovidtesting.com"; sid:608011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for painlesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"painlesscovid.com"; sid:608012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for painlesscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"painlesscovidtesting.com"; sid:608013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbooty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbooty.com"; sid:608014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccountermeasures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccountermeasures.com"; sid:608015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicheatmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicheatmap.com"; sid:608016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmotors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmotors.com"; sid:608017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprophylactic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprophylactic.com"; sid:608018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for phxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"phxcovidtest.com"; sid:608019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for polandagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"polandagainstcovid.com"; sid:608020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.biz"; sid:608021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovid19.biz"; sid:608022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for q8covidaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"q8covidaid.com"; sid:608023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovid19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovid19clinic.com"; sid:608024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidcovidclinic.com"; sid:608025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rethink-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rethink-corona.com"; sid:608026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seguimiento-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seguimiento-covid19.com"; sid:608027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sey-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sey-covid.com"; sid:608028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siliconnitridecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siliconnitridecoronavirus.com"; sid:608029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siliconnitridecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siliconnitridecovid19.com"; sid:608030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stockvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stockvscovid.com"; sid:608031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stylishcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stylishcovidmasks.com"; sid:608032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovidhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovidhealth.com"; sid:608033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for terminatecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"terminatecovid-19.com"; sid:608034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaplay.com"; sid:608035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for todosnoscontraocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"todosnoscontraocorona.com"; sid:608036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacovid19stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacovid19stats.com"; sid:608037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovid19certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovid19certification.com"; sid:608038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vidacorona.com"; sid:608039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjinjia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjinjia.com"; sid:608040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanklan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanklan.club"; sid:608041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlianhua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlianhua.com"; sid:608042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanug.com"; sid:608043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yeswecleancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yeswecleancovid19.com"; sid:608044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidessentials.com"; sid:608045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zonaanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zonaanticovid.com"; sid:608046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidtogether.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidtogether.org"; sid:608047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinacovid19classactionlawsuit.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinacovid19classactionlawsuit.org"; sid:608048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocopahcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocopahcovid.org"; sid:608049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copperkillscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copperkillscovid.info"; sid:608050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclean.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclean.app"; sid:608051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondom.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondom.shop"; sid:608052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextra.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextra.email"; sid:608053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextra.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextra.site"; sid:608054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeed.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeed.live"; sid:608055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafon.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafon.info"; sid:608056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fragebogen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fragebogen.info"; sid:608057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gina.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gina.app"; sid:608058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapulse.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapulse.net"; sid:608059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronata.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronata.info"; sid:608060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistance.monster - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistance.monster"; sid:608061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsonline.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsonline.info"; sid:608062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusonline.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusonline.guru"; sid:608063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinic.org"; sid:608064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19feed.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19feed.live"; sid:608065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truths.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truths.org"; sid:608066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.news"; sid:608067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooster.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooster.org"; sid:608068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.page"; sid:608069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.agency"; sid:608070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.dev - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.dev"; sid:608071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-critical.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-critical.org"; sid:608072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlie.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlie.org"; sid:608073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefloan.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefloan.org"; sid:608074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-r-us.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-r-us.biz"; sid:608075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shields.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shields.org"; sid:608076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.fyi"; sid:608077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidupdates.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidupdates.app"; sid:608078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzonasur.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzonasur.info"; sid:608079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for giveforcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"giveforcovid.org"; sid:608080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcovid19.net"; sid:608081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunecovid.net"; sid:608082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovatingforcovid.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovatingforcovid.africa"; sid:608083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itcovidsurvey.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itcovidsurvey.info"; sid:608084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovid19fund.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovid19fund.org"; sid:608085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidfunds.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidfunds.org"; sid:608086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laregionalcovidfund.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laregionalcovidfund.org"; sid:608087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for miamimedcovidhelp.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"miamimedcovidhelp.org"; sid:608088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19risk.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19risk.org"; sid:608089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.app"; sid:608090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovidvax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovidvax.net"; sid:608091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-tool.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-tool.net"; sid:608092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for poolsan-anti-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"poolsan-anti-covid.info"; sid:608093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stoppingcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stoppingcovid.net"; sid:608094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopsecondhandcoronavirus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopsecondhandcoronavirus.org"; sid:608095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving2020pandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving2020pandemic.org"; sid:608096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronapapers.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronapapers.org"; sid:608097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for touspartenairescovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"touspartenairescovid.org"; sid:608098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m-covid19.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m-covid19.center"; sid:608099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artforcovidnyc.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artforcovidnyc.org"; sid:608100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-pandemic.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-pandemic.online"; sid:608101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christianheritagecorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christianheritagecorona.org"; sid:608102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovid.org"; sid:608103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocopahcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocopahcovid.net"; sid:608104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-enquete.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-enquete.org"; sid:608105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mythen.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mythen.org"; sid:608106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaregels.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaregels.online"; sid:608107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavac.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavac.blog"; sid:608108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspro.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspro.live"; sid:608109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zum-trotz.help - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zum-trotz.help"; sid:608110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zum-trotz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zum-trotz.info"; sid:608111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costofapandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costofapandemic.org"; sid:608112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cafe.net"; sid:608113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19intelengine.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19intelengine.live"; sid:608114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionfoundation.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionfoundation.org"; sid:608115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stop.net"; sid:608116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentfoundation.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentfoundation.org"; sid:608117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecure.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecure.info"; sid:608118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeds.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeds.org"; sid:608119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooster.net"; sid:608120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.live"; sid:608121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.marketing - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.marketing"; sid:608122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpress.net"; sid:608123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.flights - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.flights"; sid:608124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactdashboard.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactdashboard.info"; sid:608125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeinsurance.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeinsurance.online"; sid:608126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-maladie.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-maladie.online"; sid:608127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmunicipal.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmunicipal.live"; sid:608128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieffund.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieffund.online"; sid:608129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-r-us.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-r-us.net"; sid:608130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftest.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftest.online"; sid:608131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivalstore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivalstore.net"; sid:608132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuidatucovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuidatucovid.org"; sid:608133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for markedbycovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"markedbycovid.org"; sid:608134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid19.net"; sid:608135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickcovidtesting.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickcovidtesting.info"; sid:608136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surviving2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surviving2020pandemic.net"; sid:608137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for touspartenairescovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"touspartenairescovid.net"; sid:608138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for visualizecovid19.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"visualizecovid19.live"; sid:608139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidtesting.com"; sid:608140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovid-19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovid-19rapidtest.com"; sid:608141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovid19rapidtest.com"; sid:608142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovid-19test.com"; sid:608143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covid-19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covid-19respirator.com"; sid:608144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covid19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covid19respirator.com"; sid:608145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covid-19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covid-19respirators.com"; sid:608146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covid19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covid19respirators.com"; sid:608147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covidrespirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covidrespirator.com"; sid:608148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3m8210covidrespirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3m8210covidrespirators.com"; sid:608149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-198210respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-198210respirator.com"; sid:608150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid198210respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid198210respirator.com"; sid:608151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-198210respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-198210respirators.com"; sid:608152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid198210respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid198210respirators.com"; sid:608153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19facemask.com"; sid:608154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19facemask.com"; sid:608155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19facemasks.com"; sid:608156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19facemasks.com"; sid:608157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19filter.com"; sid:608158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19filter.com"; sid:608159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19filters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19filters.com"; sid:608160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19filters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19filters.com"; sid:608161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19mask.com"; sid:608162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19mask.com"; sid:608163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19maskfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19maskfilter.com"; sid:608164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19maskfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19maskfilter.com"; sid:608165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19maskfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19maskfilters.com"; sid:608166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19maskfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19maskfilters.com"; sid:608167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19masks.com"; sid:608168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19masks.com"; sid:608169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19medical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19medical.com"; sid:608170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19medical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19medical.com"; sid:608171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19medicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19medicalmask.com"; sid:608172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19medicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19medicalmask.com"; sid:608173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19medicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19medicalmasks.com"; sid:608174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19medicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19medicalmasks.com"; sid:608175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19medicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19medicals.com"; sid:608176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19medicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19medicals.com"; sid:608177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95.com"; sid:608178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95.com"; sid:608179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95mask.com"; sid:608180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95mask.com"; sid:608181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95masks.com"; sid:608182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95masks.com"; sid:608183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95respirator.com"; sid:608184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95respirator.com"; sid:608185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95respirators.com"; sid:608186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95respirators.com"; sid:608187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19n95s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19n95s.com"; sid:608188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19n95s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19n95s.com"; sid:608189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19protection.com"; sid:608190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19protection.com"; sid:608191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19protections.com"; sid:608192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19protections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19protections.com"; sid:608193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respirator.com"; sid:608194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respirator.com"; sid:608195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respiratorfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respiratorfilter.com"; sid:608196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respiratorfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respiratorfilter.com"; sid:608197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respiratorfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respiratorfilters.com"; sid:608198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respiratorfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respiratorfilters.com"; sid:608199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respiratormask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respiratormask.com"; sid:608200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respiratormask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respiratormask.com"; sid:608201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respiratormasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respiratormasks.com"; sid:608202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respiratormasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respiratormasks.com"; sid:608203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid-19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid-19respirators.com"; sid:608204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid19respirators.com"; sid:608205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid8210respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid8210respirator.com"; sid:608206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovid8210respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovid8210respirators.com"; sid:608207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidfacemask.com"; sid:608208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidfacemasks.com"; sid:608209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidfilter.com"; sid:608210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidfilters.com"; sid:608211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmask.com"; sid:608212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmaskfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmaskfilter.com"; sid:608213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmaskfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmaskfilters.com"; sid:608214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmasks.com"; sid:608215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmedical.com"; sid:608216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmedicalmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmedicalmask.com"; sid:608217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmedicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmedicalmasks.com"; sid:608218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidmedicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidmedicals.com"; sid:608219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95.com"; sid:608220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95mask.com"; sid:608221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95masks.com"; sid:608222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95respirator.com"; sid:608223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95respirators.com"; sid:608224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidn95s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidn95s.com"; sid:608225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidprotection.com"; sid:608226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidprotections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidprotections.com"; sid:608227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespirator.com"; sid:608228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespiratorfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespiratorfilter.com"; sid:608229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespiratorfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespiratorfilters.com"; sid:608230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespiratormask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespiratormask.com"; sid:608231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespiratormasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespiratormasks.com"; sid:608232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mcovidrespirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mcovidrespirators.com"; sid:608233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovid-19mask.com"; sid:608234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovid19mask.com"; sid:608235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovid-19masks.com"; sid:608236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovid19masks.com"; sid:608237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovidmask.com"; sid:608238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mmedicalcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mmedicalcovidmasks.com"; sid:608239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid-19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid-19mask.com"; sid:608240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid19mask.com"; sid:608241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid-19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid-19masks.com"; sid:608242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid19masks.com"; sid:608243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid-19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid-19respirator.com"; sid:608244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid19respirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid19respirator.com"; sid:608245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid-19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid-19respirators.com"; sid:608246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covid19respirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covid19respirators.com"; sid:608247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covidmask.com"; sid:608248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covidmasks.com"; sid:608249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covidrespirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covidrespirator.com"; sid:608250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3mn95covidrespirators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3mn95covidrespirators.com"; sid:608251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agrobotigacovides.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agrobotigacovides.com"; sid:608252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anothercovid19report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anothercovid19report.com"; sid:608253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aplicacionhistorialclinicocovidhonduras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aplicacionhistorialclinicocovidhonduras.com"; sid:608254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidvaccine.com"; sid:608255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidvaccineinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidvaccineinitiative.com"; sid:608256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidclean.com"; sid:608257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidcleaning.com"; sid:608258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidvaccine.com"; sid:608259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidvaccineinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidvaccineinitiative.com"; sid:608260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudadelvallecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudadelvallecovid.com"; sid:608261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19clean.com"; sid:608262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19cleaning.com"; sid:608263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareacovid19testing.com"; sid:608264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biosphere-pandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biosphere-pandemics.com"; sid:608265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bolsonarocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bolsonarocoronavirus.com"; sid:608266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brokeoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brokeoncovid.com"; sid:608267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for budesonideforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"budesonideforcovid19.com"; sid:608268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19cahealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19cahealthinfo.com"; sid:608269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninecovid.com"; sid:608270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chefcollectiveforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chefcollectiveforcovid.com"; sid:608271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanarizonacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanarizonacovid19.com"; sid:608272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanphoenixcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanphoenixcovid19.com"; sid:608273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearpandemicsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearpandemicsolutions.com"; sid:608274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comingbackfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comingbackfromcovid.com"; sid:608275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanerscomplete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanerscomplete.com"; sid:608276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cluster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cluster.com"; sid:608277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoshell1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoshell1.com"; sid:608278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirefighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirefighters.com"; sid:608279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecertificate.com"; sid:608280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahilfe-steuerberater.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahilfe-steuerberater.berlin"; sid:608281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaindiaforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaindiaforum.com"; sid:608282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-israelpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-israelpost.com"; sid:608283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-livestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-livestream.com"; sid:608284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamelder.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamelder.app"; sid:608285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamelder.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamelder.art"; sid:608286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanimakeruna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanimakeruna.com"; sid:608287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-services.com"; sid:608288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfuneral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfuneral.com"; sid:608289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatled.com"; sid:608290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirologist.com"; sid:608291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruhomeschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruhomeschooling.com"; sid:608292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnebulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnebulizer.com"; sid:608293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatecovid.com"; sid:608294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984now.com"; sid:608295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airfilter.com"; sid:608296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airfilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airfilters.com"; sid:608297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analyst.com"; sid:608298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bookmarks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bookmarks.com"; sid:608299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carepacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carepacks.com"; sid:608300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningarizona.com"; sid:608301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19credit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19credit.com"; sid:608302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curfew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curfew.com"; sid:608303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employeerapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employeerapidtest.com"; sid:608304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employeerapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employeerapidtest.com"; sid:608305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fasttesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fasttesting.com"; sid:608306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19goldstarfamlies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19goldstarfamlies.com"; sid:608307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haskilledmoreamericansthan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haskilledmoreamericansthan.com"; sid:608308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpneeded.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpneeded.com"; sid:608309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19imune.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19imune.com"; sid:608310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inhaler.com"; sid:608311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19integritystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19integritystaffing.com"; sid:608312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kpis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kpis.com"; sid:608313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19laser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19laser.com"; sid:608314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nebulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nebulizer.com"; sid:608315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rank.com"; sid:608316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19related.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19related.com"; sid:608317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19related.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19related.com"; sid:608318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliefund.com"; sid:608319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reopen.com"; sid:608320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultssfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultssfl.com"; sid:608321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resutsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resutsfl.com"; sid:608322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19retailsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19retailsigns.com"; sid:608323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19roofers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19roofers.com"; sid:608324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safelistingmethods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safelistingmethods.com"; sid:608325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scheme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scheme.com"; sid:608326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stance.com"; sid:608327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19standing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19standing.com"; sid:608328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19standing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19standing.com"; sid:608329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strategicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strategicplan.com"; sid:608330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strategicplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strategicplanning.com"; sid:608331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strategicplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strategicplans.com"; sid:608332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecare.com"; sid:608333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdatesindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdatesindia.com"; sid:608334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1resultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1resultsfl.com"; sid:608335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid219vacc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid219vacc.com"; sid:608336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidahn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidahn.com"; sid:608337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytestingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytestingnearme.com"; sid:608338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantichrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantichrist.com"; sid:608339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbatle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbatle.com"; sid:608340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblockteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblockteam.com"; sid:608341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrainhealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrainhealing.com"; sid:608342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanaries.com"; sid:608343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandleco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandleco.com"; sid:608344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandlecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandlecompany.com"; sid:608345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcards2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcards2020.com"; sid:608346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasualities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasualities.com"; sid:608347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharge.com"; sid:608348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearcertification.com"; sid:608349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinicmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinicmarketing.com"; sid:608350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompanytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompanytesting.com"; sid:608351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomparisons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomparisons.com"; sid:608352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcool.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcool.biz"; sid:608353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazy19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazy19.com"; sid:608354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-crazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-crazy.com"; sid:608355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedc19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedc19.com"; sid:608356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedstates.com"; sid:608357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescrow.com"; sid:608358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexposuretracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexposuretracker.com"; sid:608359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgotyoudown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgotyoudown.com"; sid:608360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrades.com"; sid:608361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthsurvey.com"; sid:608362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp4us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp4us.com"; sid:608363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidherogear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidherogear.com"; sid:608364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschoolct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschoolct.com"; sid:608365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschoolnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschoolnj.com"; sid:608366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeschoolny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeschoolny.com"; sid:608367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidillness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidillness.com"; sid:608368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstatest.com"; sid:608369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillinglights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillinglights.com"; sid:608370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidle.com"; sid:608371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliyiz.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliyiz.biz"; sid:608372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnebulizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnebulizer.com"; sid:608373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobliterator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobliterator.com"; sid:608374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinetutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinetutor.com"; sid:608375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpal.com"; sid:608376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregstudy.com"; sid:608377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductionservices.com"; sid:608378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectstore.com"; sid:608379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-psyopexposeevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-psyopexposeevil.com"; sid:608380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurantapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurantapp.com"; sid:608381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresurgence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresurgence.com"; sid:608382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeplaylists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeplaylists.com"; sid:608383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureapp.com"; sid:608384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurityops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurityops.com"; sid:608385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartkids.com"; sid:608386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmellcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmellcheck.com"; sid:608387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnapshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnapshot.com"; sid:608388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolved.com"; sid:608389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategicplan.com"; sid:608390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategicplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategicplanning.com"; sid:608391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategicplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategicplans.com"; sid:608392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingok.com"; sid:608393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmami.com"; sid:608394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarior.com"; sid:608395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creditandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creditandcovid.com"; sid:608396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.app"; sid:608397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for texascovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"texascovid.app"; sid:608398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 106coronadacircle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"106coronadacircle.com"; sid:608399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronavirusvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronavirusvirus.com"; sid:608400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alphagraphicscovidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alphagraphicscovidproducts.com"; sid:608401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronatowel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronatowel.com"; sid:608402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidote.com"; sid:608403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidcleaners.com"; sid:608404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtobusinesswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtobusinesswithcovid.com"; sid:608405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoclasswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoclasswithcovid.com"; sid:608406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtocollegewithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtocollegewithcovid.com"; sid:608407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoschoolwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoschoolwithcovid19.com"; sid:608408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buhbyecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buhbyecovid.com"; sid:608409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovidcaregiver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovidcaregiver.com"; sid:608410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdcupdatescovid2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdcupdatescovid2019.com"; sid:608411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocoronavirusmodel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocoronavirusmodel.com"; sid:608412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcoronavirus.com"; sid:608413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvances.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvances.com"; sid:608414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaz.com"; sid:608415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoranchhoa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoranchhoa.com"; sid:608416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadote.com"; sid:608417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-healthcare.com"; sid:608418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaopoly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaopoly.com"; sid:608419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareopen.com"; sid:608420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetystuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetystuff.com"; sid:608421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatechservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatechservices.com"; sid:608422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauto.com"; sid:608423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020moneymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020moneymachine.com"; sid:608424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscdccompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscdccompliant.com"; sid:608425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobloss2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobloss2020.com"; sid:608426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoney2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoney2020.com"; sid:608427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneyadvantage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneyadvantage.com"; sid:608428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneymachine.com"; sid:608429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoneymaker020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoneymaker020.com"; sid:608430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-opportunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-opportunity.com"; sid:608431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic2020moneymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic2020moneymachine.com"; sid:608432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmoneymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmoneymachine.com"; sid:608433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionnetwork.com"; sid:608434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelforecast.com"; sid:608435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswuhans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswuhans.com"; sid:608436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaivers.com"; sid:608437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aircleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aircleaner.com"; sid:608438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airpurifier.com"; sid:608439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-bankruptcy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-bankruptcy.com"; sid:608440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beegone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beegone.com"; sid:608441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cdccompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cdccompliant.com"; sid:608442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cdccompliant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cdccompliant.com"; sid:608443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chamber.com"; sid:608444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crusher.com"; sid:608445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curtains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curtains.com"; sid:608446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-drive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-drive.com"; sid:608447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosuredefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosuredefense.com"; sid:608448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19igloo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19igloo.com"; sid:608449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insaliva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insaliva.com"; sid:608450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liabilitysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liabilitysigns.com"; sid:608451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks4sale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks4sale.com"; sid:608452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19orphans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19orphans.com"; sid:608453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protectionchamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protectionchamber.com"; sid:608454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief1.com"; sid:608455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reliffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reliffund.com"; sid:608456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsdl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsdl.com"; sid:608457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-screens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-screens.com"; sid:608458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19super-spreader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19super-spreader.com"; sid:608459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19suraksha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19suraksha.com"; sid:608460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19technologies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19technologies.com"; sid:608461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingform.com"; sid:608462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vanish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vanish.com"; sid:608463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zap.com"; sid:608464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantifraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantifraud.com"; sid:608465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantivaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantivaccine.com"; sid:608466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarriertent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarriertent.com"; sid:608467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbirthdaycandle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbirthdaycandle.com"; sid:608468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbirthdaycandles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbirthdaycandles.com"; sid:608469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidborderaccountability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidborderaccountability.com"; sid:608470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters19.com"; sid:608471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalnetwork.com"; sid:608472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare19-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare19-updates.com"; sid:608473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarecentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarecentre.com"; sid:608474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarestat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarestat.com"; sid:608475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckdr.com"; sid:608476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckerapp.com"; sid:608477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecksapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecksapp.com"; sid:608478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimnotpaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimnotpaid.com"; sid:608479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearvendors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearvendors.com"; sid:608480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomparisons.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomparisons.app"; sid:608481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconduct.com"; sid:608482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcovidontencule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcovidontencule.com"; sid:608483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-curtains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-curtains.com"; sid:608484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddocuments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddocuments.com"; sid:608485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddontcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddontcare.com"; sid:608486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-drive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-drive.com"; sid:608487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemployeerapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemployeerapidtest.com"; sid:608488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemploymenttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemploymenttest.com"; sid:608489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenvironmentalservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenvironmentalservice.com"; sid:608490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideyes.com"; sid:608491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfibrosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfibrosis.com"; sid:608492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepurifier.com"; sid:608493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepurifiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepurifiers.com"; sid:608494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoons.com"; sid:608495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgraphicsandsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgraphicsandsigns.com"; sid:608496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-green.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-green.com"; sid:608497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhepafilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhepafilters.com"; sid:608498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunityapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunityapp.com"; sid:608499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ins.com"; sid:608500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstructions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstructions.com"; sid:608501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliabilitysigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliabilitysigns.com"; sid:608502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliex.com"; sid:608503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmallorca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmallorca.com"; sid:608504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksforkids.com"; sid:608505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegatives.com"; sid:608506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartysupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartysupply.com"; sid:608507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpc.com"; sid:608508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpositives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpositives.com"; sid:608509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppes.com"; sid:608510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckapp.com"; sid:608511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckdoctorapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckdoctorapp.com"; sid:608512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckdr.com"; sid:608513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckerapps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckerapps.com"; sid:608514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecksapp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecksapp.club"; sid:608515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecksapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecksapp.com"; sid:608516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescansapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescansapp.com"; sid:608517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventative.com"; sid:608518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventiontips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventiontips.com"; sid:608519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventivemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventivemedicine.com"; sid:608520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionchamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionchamber.com"; sid:608521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpruebastucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpruebastucson.com"; sid:608522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpulsera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpulsera.com"; sid:608523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-questionnaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-questionnaire.com"; sid:608524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquestionsandanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquestionsandanswers.com"; sid:608525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliever.com"; sid:608526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrivethru.com"; sid:608527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrop.com"; sid:608528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepurifier.com"; sid:608529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsars2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsars2019.com"; sid:608530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftestllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftestllc.com"; sid:608531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstops.com"; sid:608532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivornetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivornetwork.com"; sid:608533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sv.com"; sid:608534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtechtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtechtest.com"; sid:608535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingflorida.com"; sid:608536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmichigan.com"; sid:608537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingonsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingonsite.com"; sid:608538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheater.com"; sid:608539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheatre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheatre.com"; sid:608540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermo.com"; sid:608541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthru.com"; sid:608542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracer.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracer.biz"; sid:608543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrapandkill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrapandkill.com"; sid:608544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduni.com"; sid:608545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineresearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineresearch.com"; sid:608546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacetest.com"; sid:608547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplacetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplacetesting.com"; sid:608548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyacovid.com"; sid:608549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealwithcovid-19.com"; sid:608550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealwithcovid19.com"; sid:608551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealwithcovid.com"; sid:608552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doibeedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doibeedacovid19test.com"; sid:608553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doimeedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doimeedacovid19test.com"; sid:608554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid18test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid18test.com"; sid:608555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19tst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19tst.com"; sid:608556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedtogetacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedtogetacovid19test.com"; sid:608557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineefacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineefacovid19test.com"; sid:608558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doortodoorcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doortodoorcovidtesting.com"; sid:608559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidstories.com"; sid:608560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aicovidrecoverycenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aicovidrecoverycenters.com"; sid:608561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaherbs.com"; sid:608562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovid19survivalcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovid19survivalcalculator.com"; sid:608563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcovidsafe.com"; sid:608564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomecovidfree.com"; sid:608565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathecovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathecovidfree.com"; sid:608566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brs-covid-19-proximity-notifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brs-covid-19-proximity-notifier.com"; sid:608567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brs-covid19-proximity-notifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brs-covid19-proximity-notifier.com"; sid:608568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidcleaners.com"; sid:608569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidcleaning.com"; sid:608570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcarepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcarepostcovid.com"; sid:608571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coolcovidcatsandkittens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coolcovidcatsandkittens.com"; sid:608572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantikoerpertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantikoerpertest.com"; sid:608573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-concierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-concierge.com"; sid:608574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocourts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocourts.com"; sid:608575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerbox.com"; sid:608576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronantikoerpertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronantikoerpertest.com"; sid:608577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyplanner.com"; sid:608578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockpicks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockpicks.com"; sid:608579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.asia"; sid:608580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxsoftware.com"; sid:608581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxsolutions.com"; sid:608582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcalifornia.com"; sid:608583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingcalifornia.com"; sid:608584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronattorneys.com"; sid:608585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirischristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirischristmas.com"; sid:608586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbubbles.com"; sid:608587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalhealth.com"; sid:608588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmonsenorinforma4b.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmonsenorinforma4b.com"; sid:608589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionetwork.com"; sid:608590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawahrheit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawahrheit.com"; sid:608591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ai.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ai.cloud"; sid:608592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ai.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ai.cloud"; sid:608593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ais.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ais.com"; sid:608594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ais.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ais.com"; sid:608595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aisolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aisolutions.com"; sid:608596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aisolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aisolutions.com"; sid:608597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carepackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carepackages.com"; sid:608598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chinavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chinavirus.com"; sid:608599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanuppropertyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanuppropertyservices.com"; sid:608600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facecondom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facecondom.com"; sid:608601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hakkinda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hakkinda.com"; sid:608602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instanttesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instanttesting.com"; sid:608603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawlab.com"; sid:608604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medi.com"; sid:608605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pandemictimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pandemictimeline.com"; sid:608606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preservationandpropertyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preservationandpropertyservices.com"; sid:608607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19propertypreservationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19propertypreservationservices.com"; sid:608608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxsoftware.com"; sid:608609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testbd.com"; sid:608610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testskitsng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testskitsng.com"; sid:608611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelerstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelerstest.com"; sid:608612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruss.com"; sid:608613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid3minutetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid3minutetest.com"; sid:608614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid911kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid911kit.com"; sid:608615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassaytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassaytest.com"; sid:608616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassaytests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassaytests.com"; sid:608617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbig10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbig10.com"; sid:608618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcake.com"; sid:608619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcans.com"; sid:608620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentertesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentertesting.com"; sid:608621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanandsterile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanandsterile.com"; sid:608622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningbroward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningbroward.com"; sid:608623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningfla.com"; sid:608624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanupgainesvillega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanupgainesvillega.com"; sid:608625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomebackacademy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomebackacademy.com"; sid:608626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazykids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazykids.com"; sid:608627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditfixed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditfixed.com"; sid:608628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-creditrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-creditrecovery.com"; sid:608629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcslt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcslt.com"; sid:608630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd19antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd19antivirus.com"; sid:608631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailytips.com"; sid:608632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseshield.com"; sid:608633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19resultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19resultsfl.com"; sid:608634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacecondom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacecondom.com"; sid:608635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactfiction.com"; sid:608636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfloat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfloat.com"; sid:608637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglue.com"; sid:608638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhabitate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhabitate.com"; sid:608639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsoap.com"; sid:608640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhappens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhappens.com"; sid:608641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthmd.com"; sid:608642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidholdem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidholdem.com"; sid:608643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhurtlawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhurtlawyers.com"; sid:608644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryusa.com"; sid:608645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjuryus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjuryus.com"; sid:608646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabmx.com"; sid:608647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawlab.com"; sid:608648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecycle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecycle.com"; sid:608649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifein.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifein.com"; sid:608650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlymom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlymom.com"; sid:608651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskmanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskmanners.com"; sid:608652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmusthave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmusthave.com"; sid:608653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnashville.com"; sid:608654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpokernight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpokernight.com"; sid:608655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckdr.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckdr.app"; sid:608656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheckdrapp.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheckdrapp.app"; sid:608657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecker.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecker.app"; sid:608658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprechecks.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprechecks.app"; sid:608659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquery.com"; sid:608660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestme.com"; sid:608661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafegt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafegt.com"; sid:608662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizingfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizingfla.com"; sid:608663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsarstesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsarstesting.com"; sid:608664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsciencenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsciencenews.com"; sid:608665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselling.com"; sid:608666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshielddefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshielddefense.com"; sid:608667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskydiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskydiving.com"; sid:608668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-supervisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-supervisor.com"; sid:608669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsnetwork.com"; sid:608670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxsoftware.com"; sid:608671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdelivered.com"; sid:608672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestjax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestjax.com"; sid:608673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsocal.com"; sid:608674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoolbox.com"; sid:608675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelerstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelerstest.com"; sid:608676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveltest.com"; sid:608677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraveltesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraveltesting.com"; sid:608678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwearline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwearline.com"; sid:608679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dawuhantong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dawuhantong.com"; sid:608680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearcoviddiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearcoviddiary.com"; sid:608681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dearpandemicdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dearpandemicdiary.com"; sid:608682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovidmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovidmemorial.com"; sid:608683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dfwcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dfwcovidcare.com"; sid:608684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosticandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosticandcovid.com"; sid:608685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disabledcovidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disabledcovidsurvivor.com"; sid:608686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dmvcovid19sellplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dmvcovid19sellplan.com"; sid:608687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19testing.com"; sid:608688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eaudecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eaudecovid19.com"; sid:608689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eldercarepostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eldercarepostcovid.com"; sid:608690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espacios-covidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espacios-covidfree.com"; sid:608691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidsurvivor.com"; sid:608692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afgcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afgcorona.com"; sid:608693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airfiltersforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airfiltersforcovid.com"; sid:608694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelescontraelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelescontraelcovid.com"; sid:608695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anotherpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anotherpandemic.com"; sid:608696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ashcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ashcovid19.com"; sid:608697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athome-covid19kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athome-covid19kit.com"; sid:608698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovidtest.com"; sid:608699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovidtesting.com"; sid:608700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avenuecovidhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avenuecovidhospital.com"; sid:608701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovidtest.com"; sid:608702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casacoronamenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casacoronamenu.com"; sid:608703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidathome.com"; sid:608704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidsupply.com"; sid:608705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codenotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codenotcovid.com"; sid:608706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for companycovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"companycovid19testing.com"; sid:608707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for convidasincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"convidasincovid.com"; sid:608708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanablecurtain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanablecurtain.com"; sid:608709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomforter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomforter.com"; sid:608710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosf.com"; sid:608711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotelecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotelecom.com"; sid:608712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeyedoctors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeyedoctors.com"; sid:608713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-filter.com"; sid:608714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajane.com"; sid:608715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajohn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajohn.com"; sid:608716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajon.com"; sid:608717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofmoney.com"; sid:608718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraksha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraksha.com"; sid:608719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascomics.com"; sid:608720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trackers.com"; sid:608721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2ndwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2ndwave.com"; sid:608722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusblog.com"; sid:608723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscajeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscajeme.com"; sid:608724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-filter.com"; sid:608725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-filters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-filters.com"; sid:608726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19admissionguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19admissionguru.com"; sid:608727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ai.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ai.asia"; sid:608728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ai.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ai.asia"; sid:608729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentestkit.com"; sid:608730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigentestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigentestkits.com"; sid:608731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blacks.com"; sid:608732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19congress2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19congress2020.com"; sid:608733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cos.com"; sid:608734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemicinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemicinfo.com"; sid:608735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-get-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-get-ppe.com"; sid:608736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-guards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-guards.com"; sid:608737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonhometest.com"; sid:608738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorktestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorktestkit.com"; sid:608739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigenkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigenkit.com"; sid:608740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigenkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigenkits.com"; sid:608741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigentesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigentesting.com"; sid:608742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigentestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigentestkit.com"; sid:608743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigentestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigentestkits.com"; sid:608744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidantigentests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidantigentests.com"; sid:608745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidttestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidttestkit.com"; sid:608746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sneezeguardsguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sneezeguardsguards.com"; sid:608747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19texashometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19texashometest.com"; sid:608748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4trump.com"; sid:608749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandgoliath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandgoliath.com"; sid:608750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanswers4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanswers4u.com"; sid:608751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarabic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarabic.com"; sid:608752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasyst.com"; sid:608753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelt.com"; sid:608754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblacks.com"; sid:608755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterssanitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterssanitation.com"; sid:608756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomforter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomforter.com"; sid:608757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityhelp.com"; sid:608758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurious.com"; sid:608759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddash19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddash19.com"; sid:608760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscoverytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscoverytest.com"; sid:608761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedsc.com"; sid:608762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemr.com"; sid:608763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-filter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-filter.com"; sid:608764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-filters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-filters.com"; sid:608765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidharvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidharvest.com"; sid:608766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-id.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-id.app"; sid:608767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjane.com"; sid:608768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjohn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjohn.com"; sid:608769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjon.com"; sid:608770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjsas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjsas.com"; sid:608771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillers.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillers.cleaning"; sid:608772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerscleaning.com"; sid:608773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatt.com"; sid:608774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobileclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobileclinic.com"; sid:608775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidone9.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidone9.app"; sid:608776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmastudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmastudies.com"; sid:608777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcodefest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcodefest.com"; sid:608778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreportingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreportingservice.com"; sid:608779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchsa.com"; sid:608780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearchtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearchtx.com"; sid:608781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-risk-index.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-risk-index.com"; sid:608782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebiz.com"; sid:608783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecanada.com"; sid:608784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sandiego.com"; sid:608785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestaustin.com"; sid:608786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnv.com"; sid:608787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestscanada.com"; sid:608788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthermometerreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthermometerreview.com"; sid:608789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscleanup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscleanup.com"; sid:608790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwalls.com"; sid:608791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diabetesandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diabetesandcovid.com"; sid:608792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for entertainmentpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"entertainmentpandemic.com"; sid:608793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicofbeing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicofbeing.com"; sid:608794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicofhappiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicofhappiness.com"; sid:608795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-of-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-of-health.com"; sid:608796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicoflove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicoflove.com"; sid:608797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicofmindfulness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicofmindfulness.com"; sid:608798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicofwellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicofwellness.com"; sid:608799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicpatterns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicpatterns.com"; sid:608800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for explorecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"explorecovidcare.com"; sid:608801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacoronanews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacoronanews.com"; sid:608802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fridaynightpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fridaynightpandemic.com"; sid:608803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geracaocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geracaocovid.com"; sid:608804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gorillacovidcleaningsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gorillacovidcleaningsandiego.com"; sid:608805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haciendacoronalynnmenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haciendacoronalynnmenu.com"; sid:608806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksnotcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksnotcovid.app"; sid:608807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksspreadlovenotcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksspreadlovenotcovid.app"; sid:608808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vnchienthangcovid19.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vnchienthangcovid19.buzz"; sid:608809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for addisoncountycovidrecovery.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"addisoncountycovidrecovery.org"; sid:608810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovid.online"; sid:608811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovid.org"; sid:608812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid.us"; sid:608813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafakten.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafakten.net"; sid:608814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalonely.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalonely.us"; sid:608815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamta.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamta.online"; sid:608816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteril.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteril.online"; sid:608817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayersupport.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayersupport.info"; sid:608818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayersupport.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayersupport.org"; sid:608819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalstudios.xyz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalstudios.xyz"; sid:608820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovidoficial.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovidoficial.online"; sid:608821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovid.online"; sid:608822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovid.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovid.site"; sid:608823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovid.space - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovid.space"; sid:608824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cf.store - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cf.store"; sid:608825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hub.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hub.live"; sid:608826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nebulizer.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nebulizer.info"; sid:608827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nebulizer.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nebulizer.org"; sid:608828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineshop.net"; sid:608829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppe.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppe.supplies"; sid:608830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefloans.cash - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefloans.cash"; sid:608831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-updates.net"; sid:608832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine.net"; sid:608833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.support"; sid:608834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarts.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarts.org"; sid:608835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantschool.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantschool.org"; sid:608836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantschools.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantschools.org"; sid:608837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddataindex.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddataindex.org"; sid:608838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtrelief.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtrelief.org"; sid:608839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideducationproject.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideducationproject.org"; sid:608840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.energy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.energy"; sid:608841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidex.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidex.biz"; sid:608842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideye.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideye.app"; sid:608843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelife.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelife.online"; sid:608844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerscleaning.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerscleaning.net"; sid:608845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.llc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.llc"; sid:608846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductskochi.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductskochi.online"; sid:608847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreporting.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreporting.org"; sid:608848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisk.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisk.info"; sid:608849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsos.net"; sid:608850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatest.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatest.online"; sid:608851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrack.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrack.network"; sid:608852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fbcovid-19.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fbcovid-19.site"; sid:608853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid19.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid19.page"; sid:608854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foiocovidizer.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foiocovidizer.online"; sid:608855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for francovideogames.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"francovideogames.org"; sid:608856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpingthrucovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpingthrucovid.org"; sid:608857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksnotcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksnotcovid.net"; sid:608858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksspreadlovenotcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksspreadlovenotcovid.net"; sid:608859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronaviruswebsite.lol - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronaviruswebsite.lol"; sid:608860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondefazcovid19.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondefazcovid19.life"; sid:608861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlylovewillconquercovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlylovewillconquercovid.net"; sid:608862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofincome.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofincome.net"; sid:608863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofing.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofing.info"; sid:608864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rehabcovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rehabcovid19.online"; sid:608865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soloelamorconquistaracovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soloelamorconquistaracovid.net"; sid:608866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidsafe.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidsafe.info"; sid:608867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidsafe.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidsafe.org"; sid:608868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.info"; sid:608869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid.online"; sid:608870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpivot.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpivot.net"; sid:608871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid19.info"; sid:608872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid19.org"; sid:608873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid.info"; sid:608874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid.org"; sid:608875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid19.info"; sid:608876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid19.org"; sid:608877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid.info"; sid:608878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid.org"; sid:608879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aduanacovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aduanacovid.org"; sid:608880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austincovidemail.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austincovidemail.org"; sid:608881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona119.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona119.shop"; sid:608882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronab2b.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronab2b.shop"; sid:608883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckup.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckup.info"; sid:608884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaextra.beer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaextra.beer"; sid:608885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidioten.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidioten.org"; sid:608886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidiots.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidiots.org"; sid:608887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.shop"; sid:608888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mta.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mta.online"; sid:608889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayersupport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayersupport.net"; sid:608890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovid.cat"; sid:608891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovid.fun - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovid.fun"; sid:608892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdelcovidoficial.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdelcovidoficial.cat"; sid:608893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ai.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ai.net"; sid:608894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthsolutions.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthsolutions.org"; sid:608895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nebulizer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nebulizer.net"; sid:608896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.link - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.link"; sid:608897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.email"; sid:608898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.services - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.services"; sid:608899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vacuna.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vacuna.org"; sid:608900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whitemask.monster - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whitemask.monster"; sid:608901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid411pro.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid411pro.net"; sid:608902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvocates.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvocates.org"; sid:608903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatcuny.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatcuny.org"; sid:608904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet19.club"; sid:608905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssolutions.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssolutions.page"; sid:608906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcode.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcode.net"; sid:608907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowboy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowboy.net"; sid:608908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustoms.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustoms.org"; sid:608909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjusticefund.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjusticefund.org"; sid:608910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts.shop"; sid:608911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotector.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotector.net"; sid:608912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshop.ovh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshop.ovh"; sid:608913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsusa.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsusa.org"; sid:608914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurveync.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurveync.org"; sid:608915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidware.net"; sid:608916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data-coronavirus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data-coronavirus.org"; sid:608917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcoronavirus.net"; sid:608918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19vaccination.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19vaccination.info"; sid:608919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19vaccination.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19vaccination.org"; sid:608920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-covid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-covid19.cloud"; sid:608921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacovidaloca.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacovidaloca.net"; sid:608922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mococovidtesting.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mococovidtesting.org"; sid:608923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for museumofcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"museumofcovid.org"; sid:608924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecountycovidtest.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecountycovidtest.info"; sid:608925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecountycovidtest.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecountycovidtest.org"; sid:608926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for osteopathypostcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"osteopathypostcovid.org"; sid:608927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for proves-covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"proves-covid.online"; sid:608928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid.info"; sid:608929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebas-coronavirus.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebas-coronavirus.online"; sid:608930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebas-covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebas-covid.online"; sid:608931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for staycovidsafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"staycovidsafe.net"; sid:608932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidiots.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidiots.org"; sid:608933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.clinic"; sid:608934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.dental - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.dental"; sid:608935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.dentist - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.dentist"; sid:608936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testerapidocovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testerapidocovid19.net"; sid:608937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid19.net"; sid:608938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetocurecovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetocurecovid.net"; sid:608939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid19.net"; sid:608940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitetopreventcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitetopreventcovid.net"; sid:608941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamchienthangcovid19.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamchienthangcovid19.buzz"; sid:608942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamchienthangcovid19.cyou - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamchienthangcovid19.cyou"; sid:608943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamchienthangcovid19.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamchienthangcovid19.icu"; sid:608944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aduanacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aduanacovid.net"; sid:608945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albanycovid.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albanycovid.live"; sid:608946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliveaftercovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliveaftercovid.club"; sid:608947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid.org"; sid:608948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelescontraelcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelescontraelcovid.org"; sid:608949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidarchitecture.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidarchitecture.org"; sid:608950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcity.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcity.org"; sid:608951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asocovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asocovid.org"; sid:608952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campingwithcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campingwithcovid.org"; sid:608953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ausschuss.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ausschuss.live"; sid:608954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado.club"; sid:608955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado.run - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado.run"; sid:608956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplein.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplein.info"; sid:608957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprozess.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprozess.org"; sid:608958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaremodeling.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaremodeling.info"; sid:608959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrial.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrial.org"; sid:608960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverus.org"; sid:608961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.cards - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.cards"; sid:608962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passport.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passport.biz"; sid:608963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19passport.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19passport.info"; sid:608964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radar.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radar.net"; sid:608965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.health"; sid:608966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet19.net"; sid:608967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalendars.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalendars.net"; sid:608968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmas.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmas.net"; sid:608969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomics.net"; sid:608970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceofficer.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceofficer.org"; sid:608971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcpwr.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcpwr.org"; sid:608972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustoms.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustoms.net"; sid:608973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfake.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfake.news"; sid:608974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeassist.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeassist.org"; sid:608975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-omics.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-omics.app"; sid:608976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutlook.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutlook.info"; sid:608977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutlook.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutlook.org"; sid:608978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftest.abbott - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftest.abbott"; sid:608979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsticker.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsticker.org"; sid:608980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdelivered.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdelivered.org"; sid:608981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsites.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsites.info"; sid:608982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststore.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststore.net"; sid:608983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for data-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"data-covid19.net"; sid:608984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacorona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacorona.info"; sid:608985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacorona.org"; sid:608986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirus.info"; sid:608987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19vaccination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19vaccination.net"; sid:608988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montessoripandemicpartners.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montessoripandemicpartners.org"; sid:608989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidcompliance.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidcompliance.org"; sid:608990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalcovidprotocol.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalcovidprotocol.org"; sid:608991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirustaskforce.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirustaskforce.org"; sid:608992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcovid19.info"; sid:608993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orangecountycovidtest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orangecountycovidtest.net"; sid:608994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-academics.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-academics.org"; sid:608995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.market - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.market"; sid:608996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpivotpartners.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpivotpartners.org"; sid:608997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrestaurant.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrestaurant.org"; sid:608998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebarapidacovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebarapidacovid19.org"; sid:608999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statuscovid19.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statuscovid19.live"; sid:609000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surveycovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surveycovid19.info"; sid:609001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpassport.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpassport.org"; sid:609002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for webwingercovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"webwingercovid.org"; sid:609003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for workfromhomecovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"workfromhomecovid19.net"; sid:609004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusrealtimestats.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusrealtimestats.live"; sid:609005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yourcovidstatus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yourcovidstatus.org"; sid:609006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 04covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"04covid19.com"; sid:609007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecoronavirustest.com"; sid:609008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1hourcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1hourcovidtest.com"; sid:609009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360pandemic.com"; sid:609010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesocovid.com"; sid:609011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesscovid.com"; sid:609012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adhscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adhscovid19test.com"; sid:609013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asucovid19commons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asucovid19commons.com"; sid:609014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asucovidcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asucovidcommons.com"; sid:609015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbcovidcare.com"; sid:609016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidcures4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidcures4u.com"; sid:609017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boyiwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boyiwuhan.com"; sid:609018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidfoggers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidfoggers.com"; sid:609019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cares4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cares4covid.com"; sid:609020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagolandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagolandcovid.com"; sid:609021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china2blame4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china2blame4covid.com"; sid:609022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecovidpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecovidpredictor.com"; sid:609023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cism2019wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cism2019wuhan.com"; sid:609024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cismwuhan2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cismwuhan2019.com"; sid:609025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona76ers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona76ers.com"; sid:609026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabhagaoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabhagaoo.com"; sid:609027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuster.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuster.biz"; sid:609028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusting.com"; sid:609029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare365.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare365.com"; sid:609030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaceltics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaceltics.com"; sid:609031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacent.com"; sid:609032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-csa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-csa.com"; sid:609033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoplumbing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoplumbing.com"; sid:609034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagro.com"; sid:609035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupport.com"; sid:609036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillindia.com"; sid:609037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamba.com"; sid:609038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamouse.com"; sid:609039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaornament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaornament.com"; sid:609040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofretail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofretail.com"; sid:609041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofstore.com"; sid:609042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofstores.com"; sid:609043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaurus-vex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaurus-vex.com"; sid:609044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaurusvex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaurusvex.com"; sid:609045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesti.com"; sid:609046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusornament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusornament.com"; sid:609047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentialsnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentialsnyc.com"; sid:609048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19proofing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19proofing.com"; sid:609049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskok.com"; sid:609050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safetytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safetytips.com"; sid:609051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlondon.com"; sid:609052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelawyers.com"; sid:609053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbazar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbazar.com"; sid:609054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbh2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbh2020.com"; sid:609055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidborn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidborn.com"; sid:609056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusted.com"; sid:609057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-candle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-candle.com"; sid:609058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidegroup.com"; sid:609059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcityclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcityclean.com"; sid:609060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearidaho.com"; sid:609061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoffeeclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoffeeclub.com"; sid:609062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortable.com"; sid:609063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancestaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancestaff.com"; sid:609064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruiser.com"; sid:609065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurebook.com"; sid:609066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcures4sure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcures4sure.com"; sid:609067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveupatx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveupatx.com"; sid:609068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveupsatx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveupsatx.com"; sid:609069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveuptx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveuptx.com"; sid:609070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoggingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoggingservice.com"; sid:609071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecatering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecatering.com"; sid:609072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecc.com"; sid:609073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeconsignment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeconsignment.com"; sid:609074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecrafty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecrafty.com"; sid:609075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemovies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemovies.com"; sid:609076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgood.com"; sid:609077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrinch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrinch.com"; sid:609078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgroupcalc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgroupcalc.com"; sid:609079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpcommunication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpcommunication.com"; sid:609080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitaldata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitaldata.com"; sid:609081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfomail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfomail.com"; sid:609082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotinchief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotinchief.com"; sid:609083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjurist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjurist.com"; sid:609084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkorunma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkorunma.com"; sid:609085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkurumsal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkurumsal.com"; sid:609086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmademebuildthis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmademebuildthis.com"; sid:609087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalzemeleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalzemeleri.com"; sid:609088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonkey.com"; sid:609089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouse.com"; sid:609090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidokay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidokay.com"; sid:609091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoxium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoxium.com"; sid:609092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescreener.com"; sid:609093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqualified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqualified.com"; sid:609094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestingkits.com"; sid:609095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreschedule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreschedule.com"; sid:609096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultfl.com"; sid:609097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolsignage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolsignage.com"; sid:609098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsconsulting.com"; sid:609099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsepeti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsepeti.com"; sid:609100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageforchools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageforchools.com"; sid:609101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignageforrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignageforrestaurants.com"; sid:609102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutiongroup.com"; sid:609103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsonar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsonar.com"; sid:609104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportauto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportauto.com"; sid:609105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsymptomindex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsymptomindex.com"; sid:609106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtedbir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtedbir.com"; sid:609107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglosangeles.com"; sid:609108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestrx.com"; sid:609109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracerus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracerus.com"; sid:609110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruck.com"; sid:609111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccard.com"; sid:609112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelosangeles.com"; sid:609113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovid-19.com"; sid:609114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deniedcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deniedcovid19test.com"; sid:609115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouneedacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouneedacovidtest.com"; sid:609116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparent.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparent.club"; sid:609117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.biz"; sid:609118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcovid.com"; sid:609119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5thstreetcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5thstreetcoronado.com"; sid:609120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 797ncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"797ncorona.com"; sid:609121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidland.com"; sid:609122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidsurveillanceservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidsurveillanceservice.com"; sid:609123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronatravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronatravelkit.com"; sid:609124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19travelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19travelkit.com"; sid:609125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtravelkit.com"; sid:609126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansas-covidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansas-covidvaccine.com"; sid:609127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidvacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidvacine.com"; sid:609128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asilentepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asilentepidemic.com"; sid:609129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtest.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtest.club"; sid:609130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecorona-virus.com"; sid:609131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecovidland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecovidland.com"; sid:609132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidshields.com"; sid:609133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcovid.com"; sid:609134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bronxcovid19oralhistoryproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bronxcovid19oralhistoryproject.com"; sid:609135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidlifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidlifeinsurance.com"; sid:609136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidlifeinsurancenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidlifeinsurancenow.com"; sid:609137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovidnow.com"; sid:609138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancellingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancellingcovid.com"; sid:609139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catcovid.com"; sid:609140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdthcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdthcovid19testing.com"; sid:609141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovidmasks.com"; sid:609142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check4covid19.com"; sid:609143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christiancovid-19consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christiancovid-19consultant.com"; sid:609144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christiancovidconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christiancovidconsultant.com"; sid:609145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coexistingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coexistingwithcorona.com"; sid:609146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coexistingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coexistingwithcovid19.com"; sid:609147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepak.com"; sid:609148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanies.com"; sid:609149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoartificialturf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoartificialturf.com"; sid:609150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobrotherslawncare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobrotherslawncare.com"; sid:609151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobrothersll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobrothersll.com"; sid:609152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriendlyevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriendlyevents.com"; sid:609153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidslife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidslife.com"; sid:609154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamysterybox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamysterybox.com"; sid:609155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprosthetics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprosthetics.com"; sid:609156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-security-score.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-security-score.com"; sid:609157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscanadadecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscanadadecontamination.com"; sid:609158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailypost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailypost.com"; sid:609159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesincentive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesincentive.com"; sid:609160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprocleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprocleaners.com"; sid:609161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelmap.com"; sid:609162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10minute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10minute.com"; sid:609163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10minutetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10minutetests.com"; sid:609164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19act.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19act.com"; sid:609165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19confusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19confusion.com"; sid:609166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultant.com"; sid:609167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eventrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eventrisk.com"; sid:609168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fallacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fallacy.com"; sid:609169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fresh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fresh.com"; sid:609170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isnotreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isnotreal.com"; sid:609171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mentalhealthawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mentalhealthawareness.com"; sid:609172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobiletestingunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobiletestingunits.com"; sid:609173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oksuruktesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oksuruktesti.com"; sid:609174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pic.com"; sid:609175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19procleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19procleaners.com"; sid:609176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quicktest.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quicktest.club"; sid:609177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19re-entry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19re-entry.com"; sid:609178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19says.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19says.com"; sid:609179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19smartsewa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19smartsewa.com"; sid:609180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19swifttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19swifttest.com"; sid:609181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testdate.com"; sid:609182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testfortravelers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testfortravelers.com"; sid:609183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfortravelers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfortravelers.com"; sid:609184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingcentersinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingcentersinc.com"; sid:609185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvcgi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvcgi.com"; sid:609186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19uvgi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19uvgi.com"; sid:609187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelife.com"; sid:609188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinetrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinetrial.com"; sid:609189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wakegov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wakegov.com"; sid:609190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldshop.com"; sid:609191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-6969.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-6969.com"; sid:609192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ap.com"; sid:609193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapp.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapp.cat"; sid:609194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrands.com"; sid:609195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburnout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburnout.com"; sid:609196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbwfc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbwfc.com"; sid:609197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalmingmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalmingmask.com"; sid:609198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareerconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareerconversations.com"; sid:609199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-chile.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-chile.app"; sid:609200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchile.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchile.app"; sid:609201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsteam.com"; sid:609202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleantoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleantoday.com"; sid:609203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancemanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancemanagement.com"; sid:609204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancemgmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancemgmt.com"; sid:609205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-concept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-concept.com"; sid:609206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsul.com"; sid:609207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolcenter.com"; sid:609208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolguide.com"; sid:609209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.club"; sid:609210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidentrysign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidentrysign.com"; sid:609211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideovaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideovaccinelawyer.com"; sid:609212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedelmarva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedelmarva.com"; sid:609213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeze.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeze.com"; sid:609214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-glass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-glass.com"; sid:609215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrit.com"; sid:609216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpil.com"; sid:609217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpillinois.com"; sid:609218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomequicktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomequicktests.com"; sid:609219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousequicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousequicktest.com"; sid:609220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkat.com"; sid:609221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitpro.com"; sid:609222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeinsuranceagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeinsuranceagent.com"; sid:609223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlunacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlunacy.com"; sid:609224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedfraud.com"; sid:609225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedscam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedscam.com"; sid:609226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmustend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmustend.com"; sid:609227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmxapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmxapi.com"; sid:609228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnco.com"; sid:609229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativepresurechamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativepresurechamber.com"; sid:609230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativepresureprotectionchamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativepresureprotectionchamber.com"; sid:609231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnpc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnpc.com"; sid:609232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnppc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnppc.com"; sid:609233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingjobs.com"; sid:609234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpathology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpathology.com"; sid:609235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivacyalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivacyalert.com"; sid:609236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublicspacesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublicspacesolutions.com"; sid:609237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquench.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquench.com"; sid:609238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquicktest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquicktest.center"; sid:609239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquiktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquiktest.com"; sid:609240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredirect.com"; sid:609241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreentry.com"; sid:609242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponedataportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponedataportal.com"; sid:609243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsedataportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsedataportal.com"; sid:609244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultcard.com"; sid:609245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultscard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultscard.com"; sid:609246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafedecal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafedecal.com"; sid:609247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsays.com"; sid:609248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscript.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscript.com"; sid:609249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidselftest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidselftest.center"; sid:609250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshock.com"; sid:609251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sixtynine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sixtynine.com"; sid:609252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskismart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskismart.com"; sid:609253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnappytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnappytest.com"; sid:609254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedytest.com"; sid:609255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurveillanceservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurveillanceservices.com"; sid:609256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsgroup.com"; sid:609257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsvaccinelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsvaccinelawyer.com"; sid:609258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteammitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteammitigation.com"; sid:609259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestedcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestedcard.com"; sid:609260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesteventbrite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesteventbrite.com"; sid:609261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfortravelers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfortravelers.com"; sid:609262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestin.com"; sid:609263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtarrantcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtarrantcounty.com"; sid:609264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresultcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresultcard.com"; sid:609265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresultscard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresultscard.com"; sid:609266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtour2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtour2020.com"; sid:609267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtriallawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtriallawyers.com"; sid:609268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-truths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-truths.com"; sid:609269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduncorked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduncorked.com"; sid:609270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineattorneys.com"; sid:609271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineclaims.com"; sid:609272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecruise.com"; sid:609273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecruises.com"; sid:609274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelife.com"; sid:609275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusvaccines.com"; sid:609276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cruisecoronavac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cruisecoronavac.com"; sid:609277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidcold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidcold.com"; sid:609278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovidnow.com"; sid:609279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cupsagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cupsagainstcovid.com"; sid:609280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovidscreening.com"; sid:609281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danielacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danielacoronado.com"; sid:609282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datenschutz-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datenschutz-corona.com"; sid:609283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctor-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctor-covid19.com"; sid:609284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedabcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedabcovid19test.com"; sid:609285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedtogogettestedforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedtogogettestedforcovid.com"; sid:609286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dsgvo-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dsgvo-corona.com"; sid:609287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for due2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"due2covid.com"; sid:609288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringcovidland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringcovidland.com"; sid:609289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovidtests.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovidtests.club"; sid:609290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovidantibodytest.com"; sid:609291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcoronavirustest.com"; sid:609292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcovidtest.com"; sid:609293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcoronavirustest.com"; sid:609294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtest.com"; sid:609295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidtravel.com"; sid:609296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovid19vaccine.com"; sid:609297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athleteswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athleteswithcovid.com"; sid:609298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid9teen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid9teen.com"; sid:609299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidfast.com"; sid:609300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidsolution.com"; sid:609301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestrapidcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestrapidcovidtest.com"; sid:609302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestrapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestrapidcovidtesting.com"; sid:609303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulkcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulkcovidmask.com"; sid:609304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulkcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulkcovidmasks.com"; sid:609305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19survivor.com"; sid:609306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsforcoronaville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsforcoronaville.com"; sid:609307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cardsincoronaville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cardsincoronaville.com"; sid:609308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartaspandemicas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartaspandemicas.com"; sid:609309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caymancovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caymancovid19.com"; sid:609310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chennaicovidhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chennaicovidhospital.com"; sid:609311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coaching-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coaching-corona.com"; sid:609312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachingpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachingpandemic.com"; sid:609313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantigerm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantigerm.com"; sid:609314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusinesshelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusinesshelp.com"; sid:609315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-cfs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-cfs.com"; sid:609316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanair.com"; sid:609317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasesolutions.com"; sid:609318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosoccerhotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosoccerhotels.com"; sid:609319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaled.com"; sid:609320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskmaps.com"; sid:609321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronam.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronam.buzz"; sid:609322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaosrp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaosrp.com"; sid:609323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-purifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-purifier.com"; sid:609324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-reiniger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-reiniger.com"; sid:609325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareiniger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareiniger.com"; sid:609326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-saigai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-saigai.com"; sid:609327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasback.com"; sid:609328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashielddpm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashielddpm.com"; sid:609329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatextmessage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatextmessage.com"; sid:609330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatri.com"; sid:609331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-turbotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-turbotest.com"; sid:609332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturbotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturbotest.com"; sid:609333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattire.com"; sid:609334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathaliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathaliser.com"; sid:609335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplianceofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplianceofficer.com"; sid:609336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomplianceofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomplianceofficers.com"; sid:609337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthconsequences.com"; sid:609338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslifeboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslifeboat.com"; sid:609339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskmap.com"; sid:609340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskmaps.com"; sid:609341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprincipal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprincipal.com"; sid:609342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprincipals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprincipals.com"; sid:609343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19assurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19assurance.com"; sid:609344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bigdiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bigdiscount.com"; sid:609345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blaster.com"; sid:609346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blasters.com"; sid:609347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathaliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathaliser.com"; sid:609348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathilyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathilyzer.com"; sid:609349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buildingcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buildingcleaning.com"; sid:609350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certfication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certfication.com"; sid:609351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninggeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninggeorgia.com"; sid:609352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnorthfulton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnorthfulton.com"; sid:609353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningnow.com"; sid:609354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commandcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commandcenter.com"; sid:609355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19commandcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19commandcentral.com"; sid:609356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cremations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cremations.com"; sid:609357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disenfectinggeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disenfectinggeorgia.com"; sid:609358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ensuszapatos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ensuszapatos.com"; sid:609359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthconsequences.com"; sid:609360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthconsequences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthconsequences.com"; sid:609361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19knowyourstatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19knowyourstatus.com"; sid:609362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mobile.com"; sid:609363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobilemedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobilemedical.com"; sid:609364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobileunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobileunit.com"; sid:609365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr-test.com"; sid:609366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfunds.com"; sid:609367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorswag.com"; sid:609368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine.biz"; sid:609369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vakcina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vakcina.com"; sid:609370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weddingpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weddingpackage.com"; sid:609371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4workforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4workforce.com"; sid:609372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidkit.com"; sid:609373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaircleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaircleaners.com"; sid:609374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairpurifiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairpurifiers.com"; sid:609375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantigenselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantigenselftest.com"; sid:609376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassured.com"; sid:609377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbham.com"; sid:609378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathaliser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathaliser.com"; sid:609379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathilyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathilyzer.com"; sid:609380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidburger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidburger.com"; sid:609381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapitalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapitalism.com"; sid:609382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarega.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarega.com"; sid:609383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashback.com"; sid:609384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificationclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificationclass.com"; sid:609385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificationclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificationclasses.com"; sid:609386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-church.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-church.com"; sid:609387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanzone.com"; sid:609388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearone.com"; sid:609389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfy.com"; sid:609390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunityresponseccr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunityresponseccr.com"; sid:609391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookingsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookingsupplies.com"; sid:609392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrazeemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrazeemask.com"; sid:609393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcremations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcremations.com"; sid:609394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddesigntoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddesigntoolkit.com"; sid:609395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddispensary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddispensary.com"; sid:609396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddukaan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddukaan.com"; sid:609397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideducator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideducator.com"; sid:609398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelementary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelementary.com"; sid:609399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoclub.com"; sid:609400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessentialsaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessentialsaustralia.com"; sid:609401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgetters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgetters.com"; sid:609402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhardfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhardfacts.com"; sid:609403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthproducts.com"; sid:609404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotstore.com"; sid:609405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidismycopliot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidismycopliot.com"; sid:609406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidscoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidscoop.com"; sid:609407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkim.com"; sid:609408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiosks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiosks.com"; sid:609409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitim.com"; sid:609410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-life.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-life.biz"; sid:609411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlife.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlife.biz"; sid:609412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliteracy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliteracy.com"; sid:609413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloanfundingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloanfundingnow.com"; sid:609414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskmap.com"; sid:609415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksales.com"; sid:609416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksforpets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksforpets.com"; sid:609417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-mobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-mobile.com"; sid:609418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilemedical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilemedical.com"; sid:609419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletrailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletrailer.com"; sid:609420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobileunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobileunit.com"; sid:609421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.blog"; sid:609422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnuringconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnuringconsultants.com"; sid:609423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingconsultants.com"; sid:609424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplaydates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplaydates.com"; sid:609425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionkits.com"; sid:609426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquo.com"; sid:609427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreusablefacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreusablefacemasks.com"; sid:609428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreusablemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreusablemasks.com"; sid:609429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskband.com"; sid:609430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskbands.com"; sid:609431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyessentials.com"; sid:609432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanta.com"; sid:609433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsclean.com"; sid:609434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen19.com"; sid:609435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigortasi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigortasi.com"; sid:609436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstars.com"; sid:609437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliesnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliesnow.com"; sid:609438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestconnector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestconnector.com"; sid:609439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestocala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestocala.com"; sid:609440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpalmcoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpalmcoast.com"; sid:609441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststjohns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststjohns.com"; sid:609442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-travelkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-travelkits.com"; sid:609443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentsc.com"; sid:609444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrump2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrump2020.com"; sid:609445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidundercontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidundercontrol.com"; sid:609446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-versicherung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-versicherung.com"; sid:609447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidversicherung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidversicherung.com"; sid:609448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwenotme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwenotme.com"; sid:609449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorscovidtest.com"; sid:609450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorscovidtesting.com"; sid:609451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid29test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid29test.com"; sid:609452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovidnineteentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovidnineteentest.com"; sid:609453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doncovid.com"; sid:609454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyourpartcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyourpartcoronavirus.com"; sid:609455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dyeingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dyeingforcovid.com"; sid:609456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dyeingtofightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dyeingtofightcovid.com"; sid:609457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcovid.com"; sid:609458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcovidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcovidsupply.com"; sid:609459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arknsascovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arknsascovidvaccine.com"; sid:609460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidingcorona.com"; sid:609461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b-covidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b-covidsmart.com"; sid:609462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomingcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomingcoronado.com"; sid:609463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackandbrownpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackandbrownpostcovid.com"; sid:609464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid.com"; sid:609465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bronxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bronxcovidtest.com"; sid:609466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidrapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidrapid.com"; sid:609467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calicovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calicovidtesting.com"; sid:609468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercovid.com"; sid:609469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidmasks.com"; sid:609470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesinus.com"; sid:609471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasesus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasesus.com"; sid:609472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-comeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-comeback.com"; sid:609473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebangladesh.com"; sid:609474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisnotcool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisnotcool.com"; sid:609475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakavachpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakavachpolicy.com"; sid:609476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoneyearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoneyearning.com"; sid:609477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaonderzoek.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaonderzoek.amsterdam"; sid:609478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatria.com"; sid:609479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnotcool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnotcool.com"; sid:609480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheclown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheclown.com"; sid:609481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax123.com"; sid:609482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviralmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviralmasks.com"; sid:609483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesout.com"; sid:609484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliveliveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliveliveupdate.com"; sid:609485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussterilizationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussterilizationservices.com"; sid:609486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinesafety.com"; sid:609487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid10min.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid10min.com"; sid:609488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15weightloss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15weightloss.com"; sid:609489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19barelyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19barelyle.com"; sid:609490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contractdisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contractdisputes.com"; sid:609491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-destekodemlerial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-destekodemlerial.com"; sid:609492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facialmask.com"; sid:609493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facialmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facialmasks.com"; sid:609494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19functionpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19functionpredictor.com"; sid:609495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeprick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeprick.com"; sid:609496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impactpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impactpredictor.com"; sid:609497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kryptonite.com"; sid:609498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oral.com"; sid:609499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemidestek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemidestek.com"; sid:609500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemidesteklerial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemidesteklerial.com"; sid:609501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19priktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19priktests.com"; sid:609502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prisonoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prisonoutbreak.com"; sid:609503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qrcodegenerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qrcodegenerator.com"; sid:609504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quick.com"; sid:609505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quickprick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quickprick.com"; sid:609506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reliefint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reliefint.com"; sid:609507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningquestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningquestions.com"; sid:609508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sensitivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sensitivity.com"; sid:609509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sensitivitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sensitivitypredictor.com"; sid:609510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19skryptonite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19skryptonite.com"; sid:609511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19smartsewa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19smartsewa.com"; sid:609512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stuffs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stuffs.com"; sid:609513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tablet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tablet.com"; sid:609514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnow.com"; sid:609515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testquick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testquick.com"; sid:609516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testshome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testshome.com"; sid:609517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine2021.com"; sid:609518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinenearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinenearme.com"; sid:609519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesafety.com"; sid:609520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimsmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimsmemorial.com"; sid:609521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldshop.com"; sid:609522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcolleges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcolleges.com"; sid:609523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristian.com"; sid:609524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclc.com"; sid:609525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcodegenerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcodegenerator.com"; sid:609526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cola.com"; sid:609527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortkits.com"; sid:609528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-coup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-coup.com"; sid:609529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoup.com"; sid:609530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushing.com"; sid:609531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-curriculum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-curriculum.com"; sid:609532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcutouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcutouts.com"; sid:609533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcv.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcv.app"; sid:609534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcv.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcv.club"; sid:609535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cyprus.com"; sid:609536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefencer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefencer.com"; sid:609537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gears.com"; sid:609538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgotmechunky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgotmechunky.com"; sid:609539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelplinehosur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelplinehosur.com"; sid:609540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelplinekolkata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelplinekolkata.com"; sid:609541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidin360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidin360.com"; sid:609542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitforcollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitforcollege.com"; sid:609543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitforcolleges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitforcolleges.com"; sid:609544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsforcollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsforcollege.com"; sid:609545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitstocollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitstocollege.com"; sid:609546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkittocollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkittocollege.com"; sid:609547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghauler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghauler.com"; sid:609548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidman.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidman.biz"; sid:609549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidman.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidman.club"; sid:609550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasked.com"; sid:609551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskerade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskerade.com"; sid:609552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidminorityhealthcareinitative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidminorityhealthcareinitative.com"; sid:609553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenfree.com"; sid:609554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-observations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-observations.com"; sid:609555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidologie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidologie.com"; sid:609556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidout.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidout.cloud"; sid:609557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpantymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpantymask.com"; sid:609558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmatrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmatrial.com"; sid:609559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqrcodegenerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqrcodegenerator.com"; sid:609560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickprick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickprick.com"; sid:609561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisktool.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisktool.app"; sid:609562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secure.biz"; sid:609563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortsalefreedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortsalefreedom.com"; sid:609564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmell.com"; sid:609565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionshawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionshawaii.com"; sid:609566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteeshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteeshop.com"; sid:609567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestboca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestboca.com"; sid:609568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testcyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testcyprus.com"; sid:609569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfast.com"; sid:609570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttube.com"; sid:609571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransportmedium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransportmedium.com"; sid:609572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtube2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtube2020.com"; sid:609573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinenearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinenearme.com"; sid:609574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csfcovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csfcovidscreening.com"; sid:609575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danke-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danke-corona.com"; sid:609576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davicovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davicovid20.com"; sid:609577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealercovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealercovidkit.com"; sid:609578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discountcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discountcovid19vaccine.com"; sid:609579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for discountcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"discountcovidvaccine.com"; sid:609580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovidtes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovidtes.com"; sid:609581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatescovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatescovid-19.com"; sid:609582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminatescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminatescovid19.com"; sid:609583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elitecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elitecovidtesting.com"; sid:609584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecovid19thegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecovid19thegame.com"; sid:609585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttrackcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttrackcovidvaccine.com"; sid:609586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovid19vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovid19vax.com"; sid:609587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for geocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"geocovid19.com"; sid:609588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for harveyscovid-19help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"harveyscovid-19help.com"; sid:609589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparents.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparents.club"; sid:609590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanqun.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanqun.club"; sid:609591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidcenter.com"; sid:609592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covid.club"; sid:609593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidweb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidweb.com"; sid:609594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidcayman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidcayman.com"; sid:609595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidworld.com"; sid:609596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2gocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2gocoronavirus.com"; sid:609597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2gocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2gocovid-19.com"; sid:609598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2gocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2gocovid19.com"; sid:609599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abc7covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abc7covid.com"; sid:609600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adviceaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adviceaboutcovid.com"; sid:609601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronacoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronacoin.com"; sid:609602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidcleartesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidcleartesting.com"; sid:609603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronavirusarmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronavirusarmy.com"; sid:609604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbv152covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbv152covid.com"; sid:609605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessadviceaboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessadviceaboutcovid.com"; sid:609606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buymasksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buymasksforcovid19.com"; sid:609607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for captiancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"captiancovid.com"; sid:609608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchingcovid.com"; sid:609609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityplacecovid-19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityplacecovid-19testing.com"; sid:609610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collgecovidrefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collgecovidrefund.com"; sid:609611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacioncristorey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacioncristorey.com"; sid:609612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomecarepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomecarepack.com"; sid:609613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronall.com"; sid:609614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-macarona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-macarona.com"; sid:609615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseperator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseperator.com"; sid:609616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldas.com"; sid:609617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasokuhou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasokuhou.com"; sid:609618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastreetgarage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastreetgarage.com"; sid:609619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19.blog"; sid:609620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvissors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvissors.com"; sid:609621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advissors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advissors.com"; sid:609622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blowout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blowout.com"; sid:609623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fight.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fight.club"; sid:609624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19g4s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19g4s.com"; sid:609625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19helpinghands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19helpinghands.com"; sid:609626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19instantmobiletesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19instantmobiletesting.com"; sid:609627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19managementsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19managementsystems.com"; sid:609628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relief.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relief.blog"; sid:609629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultsca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultsca.com"; sid:609630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycleaning.com"; sid:609631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetycourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetycourse.com"; sid:609632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thenewnorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thenewnorm.com"; sid:609633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19treater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19treater.com"; sid:609634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treater.com"; sid:609635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victoria.com"; sid:609636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19worldnewera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19worldnewera.com"; sid:609637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadvissors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadvissors.com"; sid:609638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcane.com"; sid:609639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleandfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleandfw.com"; sid:609640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanhub.com"; sid:609641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning.business"; sid:609642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcougars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcougars.com"; sid:609643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustody.com"; sid:609644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddread.com"; sid:609645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideothon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideothon.com"; sid:609646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidepic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidepic.com"; sid:609647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhaccp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhaccp.com"; sid:609648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandler.com"; sid:609649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhangout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhangout.com"; sid:609650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhawk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhawk.com"; sid:609651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididcheck.com"; sid:609652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintheusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintheusa.com"; sid:609653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkalaburagi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkalaburagi.com"; sid:609654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloghub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloghub.com"; sid:609655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogin.com"; sid:609656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmdhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmdhub.com"; sid:609657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsservice.com"; sid:609658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmelbourne.com"; sid:609659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalrehab.com"; sid:609660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagereliefprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagereliefprogram.com"; sid:609661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnepalessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnepalessentials.com"; sid:609662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnotifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnotifier.com"; sid:609663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursingcenter.com"; sid:609664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnursinghub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnursinghub.com"; sid:609665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparentingtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparentingtime.com"; sid:609666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpepper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpepper.com"; sid:609667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionnetwork.com"; sid:609668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductionplan.com"; sid:609669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeschools.com"; sid:609670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscougar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscougar.com"; sid:609671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseperator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseperator.com"; sid:609672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsozluk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsozluk.com"; sid:609673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudioplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudioplan.com"; sid:609674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsvirusbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsvirusbusters.com"; sid:609675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfernandina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfernandina.com"; sid:609676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestself.com"; sid:609677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthing.com"; sid:609678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtize.com"; sid:609679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtizeyourbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtizeyourbiz.com"; sid:609680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackingdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackingdata.com"; sid:609681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchers.com"; sid:609682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinner.com"; sid:609683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkhub.com"; sid:609684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatingcovid19.com"; sid:609685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatingcovid.com"; sid:609686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvd19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvd19-pandemic.com"; sid:609687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dashboardforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dashboardforcovid19.com"; sid:609688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donationsforcovidfairfaxcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donationsforcovidfairfaxcounty.com"; sid:609689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for earlycoviddetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"earlycoviddetection.com"; sid:609690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcovidnoesuncuento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcovidnoesuncuento.com"; sid:609691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feelingcovidy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feelingcovidy.com"; sid:609692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finding-love-during-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finding-love-during-covid-19.com"; sid:609693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findingloveduringcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findingloveduringcovid-19.com"; sid:609694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getmycovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getmycovidreport.com"; sid:609695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpulse.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpulse.club"; sid:609696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1437coronaplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1437coronaplace.com"; sid:609697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcoronatest.com"; sid:609698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 8884covidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"8884covidlaw.com"; sid:609699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 888covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"888covid19.com"; sid:609700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcoronavirus.com"; sid:609701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcovid19.com"; sid:609702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidlifematters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidlifematters.com"; sid:609703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altcovidclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altcovidclassroom.com"; sid:609704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anadelpilarcoronadosuarez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anadelpilarcoronadosuarez.com"; sid:609705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidesk.com"; sid:609706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apineycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apineycovid.com"; sid:609707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidcare.com"; sid:609708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviruscorona.com"; sid:609709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafefromcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafefromcovid-19.com"; sid:609710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidcleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidcleaningservice.com"; sid:609711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birracovid.com"; sid:609712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for budesonidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"budesonidecovid.com"; sid:609713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for butlercountyohiocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"butlercountyohiocovid.com"; sid:609714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinasanticovid.com"; sid:609715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compliance4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compliance4coronavirus.com"; sid:609716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copyright-instagramcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copyright-instagramcovid19.com"; sid:609717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanes.com"; sid:609718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomovers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomovers.com"; sid:609719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoperformance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoperformance.com"; sid:609720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagency.com"; sid:609721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-geschichten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-geschichten.com"; sid:609722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalloweencostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalloweencostumes.com"; sid:609723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kensa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kensa.com"; sid:609724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalogistcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalogistcs.com"; sid:609725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldla.com"; sid:609726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunmask.com"; sid:609727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatravelupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatravelupdate.com"; sid:609728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.clinic"; sid:609729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesupplies.com"; sid:609730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-way.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-way.com"; sid:609731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19abc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19abc.com"; sid:609732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninggalway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninggalway.com"; sid:609733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningspecialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningspecialists.com"; sid:609734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19covaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19covaxin.com"; sid:609735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19covaxin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19covaxin.com"; sid:609736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19easy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19easy.com"; sid:609737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeschools.com"; sid:609738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inpiiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inpiiot.com"; sid:609739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19managementsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19managementsolutions.com"; sid:609740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19menus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19menus.com"; sid:609741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19report.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19report.center"; sid:609742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settings.com"; sid:609743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-siparadigm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-siparadigm.com"; sid:609744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19syndrom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19syndrom.com"; sid:609745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tutorsofflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tutorsofflorida.com"; sid:609746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vih.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vih.com"; sid:609747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenconnection.com"; sid:609748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaustralia.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaustralia.app"; sid:609749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailoutracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailoutracker.com"; sid:609750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbirra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbirra.com"; sid:609751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashier.com"; sid:609752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantfitness.com"; sid:609753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconciergeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconciergeservice.com"; sid:609754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecom.com"; sid:609755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecomm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecomm.com"; sid:609756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecommerce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecommerce.com"; sid:609757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-exam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-exam.com"; sid:609758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeschool.com"; sid:609759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhalloweencostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhalloweencostumes.com"; sid:609760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelplinemysore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelplinemysore.com"; sid:609761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindade.com"; sid:609762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiots.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiots.app"; sid:609763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscancelled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscancelled.com"; sid:609764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitorialservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitorialservice.com"; sid:609765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitorialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitorialservices.com"; sid:609766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobmarket.com"; sid:609767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocked.com"; sid:609768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanagementgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanagementgroup.com"; sid:609769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarshalls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarshalls.com"; sid:609770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnetworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnetworking.com"; sid:609771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffset.com"; sid:609772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoints.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoints.com"; sid:609773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublisher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublisher.com"; sid:609774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpublishing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpublishing.com"; sid:609775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsiblebusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsiblebusinesses.com"; sid:609776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyguidance.com"; sid:609777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafevisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafevisit.com"; sid:609778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsenseint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsenseint.com"; sid:609779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsewagetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsewagetesting.com"; sid:609780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmelltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmelltherapy.com"; sid:609781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmelltraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmelltraining.com"; sid:609782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmstracker.com"; sid:609783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstorehouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstorehouse.com"; sid:609784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportlist.com"; sid:609785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtacora.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtacora.com"; sid:609786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting1.com"; sid:609787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting305.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting305.com"; sid:609788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingappointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingappointment.com"; sid:609789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testing-at-home.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testing-at-home.com"; sid:609790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingforfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingforfree.com"; sid:609791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracker2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracker2020.com"; sid:609792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtutorsofflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtutorsofflorida.com"; sid:609793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurucuca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurucuca.com"; sid:609794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.clinic"; sid:609795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineusa.com"; sid:609796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusdisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusdisinfection.com"; sid:609797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirussurvivors.com"; sid:609798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceventplanner.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceventplanner.app"; sid:609799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfitnessparty.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfitnessparty.app"; sid:609800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamchienthangcovid2020.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamchienthangcovid2020.buzz"; sid:609801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamdaithangcovid19.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamdaithangcovid19.buzz"; sid:609802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100dollarcoronachallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100dollarcoronachallenge.com"; sid:609803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpoems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpoems.com"; sid:609804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2coronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2coronas.com"; sid:609805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hrcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hrcovidtesting.com"; sid:609806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for basicsofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"basicsofcorona.com"; sid:609807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid19-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid19-free.com"; sid:609808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforethecovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforethecovid19virus.com"; sid:609809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforethesepandemicdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforethesepandemicdays.com"; sid:609810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathingforcovid.com"; sid:609811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribbeancovidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribbeancovidguide.com"; sid:609812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christine-and-eric-covid19-plan-a.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christine-and-eric-covid19-plan-a.com"; sid:609813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascovidmask.com"; sid:609814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascovidmasks.com"; sid:609815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquestcorona.com"; sid:609816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.cloud"; sid:609817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclense.com"; sid:609818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontemporarywitnesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontemporarywitnesses.com"; sid:609819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoexchange.com"; sid:609820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadorealtyllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadorealtyllc.com"; sid:609821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosrl19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosrl19.com"; sid:609822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-edu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-edu.com"; sid:609823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaendnara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaendnara.com"; sid:609824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafeber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafeber.com"; sid:609825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighterclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighterclub.com"; sid:609826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardhealth.com"; sid:609827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahaircenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahaircenter.com"; sid:609828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapass.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapass.biz"; sid:609829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproef.com"; sid:609830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseltzeroffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseltzeroffer.com"; sid:609831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaswiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaswiss.com"; sid:609832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatracer.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatracer.africa"; sid:609833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacilitydecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacilitydecontamination.com"; sid:609834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfloridakeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfloridakeys.com"; sid:609835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobsitedecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobsitedecontamination.com"; sid:609836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeywest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeywest.com"; sid:609837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmagazine4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmagazine4u.com"; sid:609838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnest.com"; sid:609839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecessionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecessionprotection.com"; sid:609840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswarehousedecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswarehousedecontamination.com"; sid:609841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisionnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisionnyc.com"; sid:609842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andcannabis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andcannabis.com"; sid:609843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bodycount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bodycount.com"; sid:609844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-crime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-crime.com"; sid:609845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dataus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dataus.com"; sid:609846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19feber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19feber.com"; sid:609847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19floridakeys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19floridakeys.com"; sid:609848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fond.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fond.com"; sid:609849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freehospitality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freehospitality.com"; sid:609850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-igairport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-igairport.com"; sid:609851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19keywest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19keywest.com"; sid:609852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lacleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lacleaning.com"; sid:609853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalfacts.com"; sid:609854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recessionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recessionprotection.com"; sid:609855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sam.com"; sid:609856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sequential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sequential.com"; sid:609857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sheild.com"; sid:609858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-telangana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-telangana.com"; sid:609859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tempmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tempmed.com"; sid:609860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-therapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-therapist.com"; sid:609861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tourismprotocols.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tourismprotocols.cat"; sid:609862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usstac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usstac.com"; sid:609863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineattorneys.com"; sid:609864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineinjury.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineinjury.biz"; sid:609865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinelawyers.com"; sid:609866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineuk.com"; sid:609867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19victimsremembered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19victimsremembered.com"; sid:609868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19victimsremembered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19victimsremembered.com"; sid:609869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusdefencesheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusdefencesheild.com"; sid:609870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusdefenceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusdefenceshield.com"; sid:609871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusdefenseshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusdefenseshield.com"; sid:609872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19weddingband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19weddingband.com"; sid:609873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaged.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaged.com"; sid:609874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibacterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibacterial.com"; sid:609875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanywhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanywhere.com"; sid:609876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapplacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapplacation.com"; sid:609877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbailouttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbailouttracker.com"; sid:609878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessbootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessbootcamp.com"; sid:609879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashoffer.com"; sid:609880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanhorrycounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanhorrycounty.com"; sid:609881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsc.com"; sid:609882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanmyrtlebeach.com"; sid:609883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansc.com"; sid:609884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearbd.com"; sid:609885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectbands.com"; sid:609886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowgirls.com"; sid:609887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddecontaminationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddecontaminationservice.com"; sid:609888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelderly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelderly.com"; sid:609889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendequalitybegin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendequalitybegin.com"; sid:609890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19vaccine.com"; sid:609891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfeber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfeber.com"; sid:609892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreergv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreergv.com"; sid:609893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpsyr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpsyr.com"; sid:609894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeassist.com"; sid:609895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididiot19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididiot19.com"; sid:609896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthebasin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthebasin.com"; sid:609897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotsdaily.com"; sid:609898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotswag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotswag.com"; sid:609899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidivor.com"; sid:609900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitor.com"; sid:609901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitorservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitorservice.com"; sid:609902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjanitorservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjanitorservices.com"; sid:609903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkings.com"; sid:609904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkool-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkool-aid.com"; sid:609905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigationexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigationexpert.com"; sid:609906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlitigationexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlitigationexperts.com"; sid:609907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketim.com"; sid:609908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnality.com"; sid:609909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecessionprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecessionprotection.com"; sid:609910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-reshape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-reshape.com"; sid:609911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe100.com"; sid:609912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestoresvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestoresvt.com"; sid:609913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafety.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafety.biz"; sid:609914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshield100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshield100.com"; sid:609915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshiftpartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshiftpartner.com"; sid:609916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsign-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsign-in.com"; sid:609917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspintowin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspintowin.com"; sid:609918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstickersaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstickersaustralia.com"; sid:609919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stickers.com"; sid:609920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurance.com"; sid:609921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestga.com"; sid:609922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-throws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-throws.com"; sid:609923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsite.com"; sid:609924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-turbotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-turbotest.com"; sid:609925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidturbotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidturbotest.com"; sid:609926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineattorney.com"; sid:609927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineupdate.com"; sid:609928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvigilantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvigilantes.com"; sid:609929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrapitup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrapitup.com"; sid:609930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for radarcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"radarcovid.app"; sid:609931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpuppy.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpuppy.blog"; sid:609932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamdayluicovid365.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamdayluicovid365.buzz"; sid:609933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2corona-fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2corona-fund.com"; sid:609934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 8380ecoronadotrail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"8380ecoronadotrail.com"; sid:609935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidlife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidlife.com"; sid:609936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affordablecovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affordablecovidcleaning.com"; sid:609937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinecovidtest.com"; sid:609938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinecovidtesting.com"; sid:609939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airlinescovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airlinescovidtest.com"; sid:609940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amcovid.com"; sid:609941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.bio - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.bio"; sid:609942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.city"; sid:609943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antonio-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antonio-corona.com"; sid:609944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anytimecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anytimecovidtest.com"; sid:609945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcoviddriveup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcoviddriveup.com"; sid:609946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcovidtest.com"; sid:609947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidtrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidtrust.com"; sid:609948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidwill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidwill.com"; sid:609949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bascovidales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bascovidales.com"; sid:609950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for basicbitchcovidcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"basicbitchcovidcentral.com"; sid:609951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloomcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloomcovidtests.com"; sid:609952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookofcovidicus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookofcovidicus.com"; sid:609953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for butcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"butcovid.com"; sid:609954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecorona19.com"; sid:609955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capturecovidcontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capturecovidcontact.com"; sid:609956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribbeancovidguide.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribbeancovidguide.app"; sid:609957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casoscovidcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casoscovidcr.com"; sid:609958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicaltrialsforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicaltrialsforcovid19.com"; sid:609959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusters19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusters19.com"; sid:609960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacasa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacasa.com"; sid:609961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaciondelaestrella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaciondelaestrella.com"; sid:609962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstructionllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstructionllc.com"; sid:609963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobusinessdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobusinessdirectory.com"; sid:609964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobusinesses.com"; sid:609965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosphotography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosphotography.com"; sid:609966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krisenmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krisenmanagement.com"; sid:609967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadad.com"; sid:609968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamadeusdoit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamadeusdoit.com"; sid:609969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronambti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronambti.com"; sid:609970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuz.com"; sid:609971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapianostudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapianostudio.com"; sid:609972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapropertytaxchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapropertytaxchallenge.com"; sid:609973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseltzertumbleroffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseltzertumbleroffer.com"; sid:609974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashutout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashutout.com"; sid:609975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasimleague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasimleague.com"; sid:609976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxchallenge.com"; sid:609977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxpin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxpin.com"; sid:609978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19lockdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19lockdown.com"; sid:609979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cure-for-sale.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cure-for-sale.biz"; sid:609980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexplanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexplanation.com"; sid:609981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacebook.com"; sid:609982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisbullshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisbullshit.com"; sid:609983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andresearchers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andresearchers.com"; sid:609984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careproducts.com"; sid:609985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-certification.com"; sid:609986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-certification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-certification.com"; sid:609987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicalafamilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicalafamilia.com"; sid:609988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-disinfectingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-disinfectingservices.com"; sid:609989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dnatestsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dnatestsites.com"; sid:609990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-informationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-informationusa.com"; sid:609991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19livetracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19livetracker.com"; sid:609992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mitigationplanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mitigationplanners.com"; sid:609993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlineproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlineproduct.com"; sid:609994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19payrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19payrelief.com"; sid:609995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19productonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19productonline.com"; sid:609996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresponsetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresponsetest.com"; sid:609997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresponsetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresponsetesting.com"; sid:609998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidresponsetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidresponsetests.com"; sid:609999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reentry.com"; sid:610000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolsupplies.com"; sid:610001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19silverbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19silverbullet.com"; sid:610002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-summer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-summer.com"; sid:610003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxappeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxappeal.com"; sid:610004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taxchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taxchallenge.com"; sid:610005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tm.com"; sid:610006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelawsuits.com"; sid:610007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020view.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020view.com"; sid:610008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaria.com"; sid:610009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartists.com"; sid:610010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatherm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatherm.com"; sid:610011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaventuratest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaventuratest.com"; sid:610012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bioscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bioscreen.com"; sid:610013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbioscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbioscreen.com"; sid:610014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarepaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarepaks.com"; sid:610015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchex.com"; sid:610016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassicsgolf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassicsgolf.com"; sid:610017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcondommask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcondommask.com"; sid:610018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcones.com"; sid:610019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsiderations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsiderations.com"; sid:610020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraftsbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraftsbook.com"; sid:610021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisisresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisisresponse.com"; sid:610022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveupaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveupaustin.com"; sid:610023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacewear.com"; sid:610024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamility.com"; sid:610025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfieldhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfieldhospital.com"; sid:610026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfieldtrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfieldtrip.com"; sid:610027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfieldtrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfieldtrips.com"; sid:610028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeeventsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeeventsusa.com"; sid:610029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreewedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreewedding.com"; sid:610030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreen.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreen.app"; sid:610031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeoffer.com"; sid:610032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigen.com"; sid:610033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinquiry.com"; sid:610034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisbullshit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisbullshit.com"; sid:610035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsrock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsrock.com"; sid:610036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsrule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsrule.com"; sid:610037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitppe.com"; sid:610038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlaptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlaptest.com"; sid:610039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidldonation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidldonation.com"; sid:610040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecrisis.com"; sid:610041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasking.com"; sid:610042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmotionpicture.com"; sid:610043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurderer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurderer.com"; sid:610044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmurderers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmurderers.com"; sid:610045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmycompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmycompany.com"; sid:610046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnist.com"; sid:610047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnistpig.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnistpig.com"; sid:610048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffnow.com"; sid:610049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoffpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoffpro.com"; sid:610050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonsitetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonsitetest.com"; sid:610051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-opps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-opps.com"; sid:610052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplacebo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplacebo.com"; sid:610053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplacebomask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplacebomask.com"; sid:610054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpropertytaxchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpropertytaxchallenge.com"; sid:610055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresponsetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresponsetest.com"; sid:610056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresponsetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresponsetesting.com"; sid:610057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresponsetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresponsetests.com"; sid:610058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidregister.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidregister.biz"; sid:610059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrentals.com"; sid:610060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenthelp.com"; sid:610061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrepository.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrepository.com"; sid:610062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriot.com"; sid:610063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids19masks.com"; sid:610064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-access.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-access.com"; sid:610065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsgadget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsgadget.com"; sid:610066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshanti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshanti.com"; sid:610067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshields19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshields19.com"; sid:610068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshutout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshutout.com"; sid:610069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsiverbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsiverbullet.com"; sid:610070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.cleaning"; sid:610071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspankerhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspankerhandsanitizer.com"; sid:610072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsprayer.com"; sid:610073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsquid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsquid.com"; sid:610074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstoppedtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstoppedtheworld.com"; sid:610075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxchallenge.com"; sid:610076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestatx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestatx.com"; sid:610077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestforvip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestforvip.com"; sid:610078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthelp.com"; sid:610079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingarcpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingarcpoint.com"; sid:610080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingarcpointlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingarcpointlabs.com"; sid:610081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingeastbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingeastbay.com"; sid:610082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingrightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingrightnow.com"; sid:610083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsolutions.com"; sid:610084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestonsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestonsite.com"; sid:610085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestrightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestrightnow.com"; sid:610086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststucson.com"; sid:610087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineappointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineappointment.com"; sid:610088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineaustralia.com"; sid:610089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelawsuit.com"; sid:610090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineschedule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineschedule.com"; sid:610091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxcentral.com"; sid:610092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxclinic.com"; sid:610093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxlocator.com"; sid:610094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxmax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxmax.com"; sid:610095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxpin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxpin.com"; sid:610096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxpins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxpins.com"; sid:610097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidversary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidversary.com"; sid:610098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwives.com"; sid:610099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkforcesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkforcesolutions.com"; sid:610100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for d614gcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"d614gcovid.com"; sid:610101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dccorona.com"; sid:610102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronamission.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronamission.com"; sid:610103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defendagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defendagainstcorona.com"; sid:610104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deportcovid.com"; sid:610105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-re.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-re.art"; sid:610106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acurecovidppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acurecovidppe.com"; sid:610107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aetnacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aetnacovid.com"; sid:610108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antalyacovidtesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antalyacovidtesti.com"; sid:610109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.app"; sid:610110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aperucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aperucovid.com"; sid:610111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apreslacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apreslacovid.com"; sid:610112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascovidid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascovidid.com"; sid:610113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayurvedaforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayurvedaforcovid.com"; sid:610114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boatstoragecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boatstoragecoronado.com"; sid:610115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bridalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bridalpandemic.com"; sid:610116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carkitcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carkitcovid.com"; sid:610117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchthecovidthrows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchthecovidthrows.com"; sid:610118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chevronpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chevronpandemic.com"; sid:610119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chihuahuadellacoronadisanmichele.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chihuahuadellacoronadisanmichele.com"; sid:610120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cohortcovidsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cohortcovidsurvey.com"; sid:610121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprasparacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprasparacovid.com"; sid:610122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cooneyscovidconversations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cooneyscovidconversations.com"; sid:610123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheightsfilms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheightsfilms.com"; sid:610124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomegate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomegate.com"; sid:610125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifesafer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifesafer.com"; sid:610126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofbuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofbuilding.com"; sid:610127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarica.com"; sid:610128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas.bar - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas.bar"; sid:610129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermotrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermotrace.com"; sid:610130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatovending.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatovending.com"; sid:610131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavillagerestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavillagerestaurants.com"; sid:610132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesidler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesidler.com"; sid:610133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgibill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgibill.com"; sid:610134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19atx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19atx.com"; sid:610135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathalysernearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathalysernearme.com"; sid:610136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cancer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cancer.com"; sid:610137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19careerssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19careerssupport.com"; sid:610138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-era.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-era.com"; sid:610139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facebook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facebook.com"; sid:610140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fightback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fightback.com"; sid:610141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobsearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobsearch.com"; sid:610142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killa.com"; sid:610143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19menswear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19menswear.com"; sid:610144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onwheel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onwheel.com"; sid:610145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onwheels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onwheels.com"; sid:610146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scamdemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scamdemic.com"; sid:610147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scrubbingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scrubbingservices.com"; sid:610148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19showedus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19showedus.com"; sid:610149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19taughtus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19taughtus.com"; sid:610150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairchange.com"; sid:610151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaxa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaxa.com"; sid:610152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-bandit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-bandit.com"; sid:610153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathalyzernearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathalyzernearme.com"; sid:610154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-business.com"; sid:610155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustin.com"; sid:610156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremexico.com"; sid:610157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cutie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cutie.com"; sid:610158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddebtcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddebtcare.com"; sid:610159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeskcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeskcover.com"; sid:610160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeskdivider.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeskdivider.com"; sid:610161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiseases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiseases.com"; sid:610162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexcuse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexcuse.com"; sid:610163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarsi.com"; sid:610164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeelpaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeelpaso.com"; sid:610165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreekitchen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreekitchen.com"; sid:610166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemoving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemoving.com"; sid:610167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlyproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlyproductions.com"; sid:610168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfromtraumatohealing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfromtraumatohealing.com"; sid:610169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeocaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeocaching.com"; sid:610170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthproject.com"; sid:610171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinners.com"; sid:610172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditude.com"; sid:610173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkinknetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkinknetwork.com"; sid:610174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitexpert.com"; sid:610175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidley.com"; sid:610176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifestyleco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifestyleco.com"; sid:610177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasklawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasklawsuit.com"; sid:610178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskporn.com"; sid:610179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskslawsuit.com"; sid:610180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasksluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasksluts.com"; sid:610181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmerchandmore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmerchandmore.com"; sid:610182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmustdie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmustdie.com"; sid:610183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnormallife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnormallife.com"; sid:610184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidopreneur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidopreneur.com"; sid:610185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemicpreventions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemicpreventions.com"; sid:610186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecruiting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecruiting.com"; sid:610187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelief.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelief.center"; sid:610188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearches.com"; sid:610189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskmgmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskmgmt.com"; sid:610190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemeetings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemeetings.com"; sid:610191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferetreats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferetreats.com"; sid:610192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycrew.com"; sid:610193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safeworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safeworkplace.com"; sid:610194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsantaclaus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsantaclaus.com"; sid:610195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshowedus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshowedus.com"; sid:610196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sluts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sluts.com"; sid:610197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolution.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolution.app"; sid:610198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsundays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsundays.com"; sid:610199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaughtus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaughtus.com"; sid:610200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingresultsfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingresultsfl.com"; sid:610201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthrows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthrows.com"; sid:610202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineclassaction.com"; sid:610203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineslawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineslawsuit.com"; sid:610204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvest.com"; sid:610205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvst.com"; sid:610206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhores.com"; sid:610207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curing-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curing-corona.com"; sid:610208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovid19twst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovid19twst.com"; sid:610209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doineedacovidest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doineedacovidest.com"; sid:610210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparenting.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparenting.academy"; sid:610211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparenting.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparenting.club"; sid:610212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpods.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpods.club"; sid:610213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcbeforecovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcbeforecovid.org"; sid:610214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for browardcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"browardcovid19.info"; sid:610215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessagainstcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessagainstcovid.org"; sid:610216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campuscovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campuscovid.info"; sid:610217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bazooka.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bazooka.net"; sid:610218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadodental.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadodental.org"; sid:610219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosphotography.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosphotography.net"; sid:610220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakings.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakings.net"; sid:610221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-register.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-register.net"; sid:610222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslayerhq.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslayerhq.info"; sid:610223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataisaku.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataisaku.info"; sid:610224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathermotrace.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathermotrace.net"; sid:610225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-times.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-times.news"; sid:610226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauscs.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauscs.org"; sid:610227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.network"; sid:610228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavpn.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavpn.org"; sid:610229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19breathalyzernearme.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19breathalyzernearme.page"; sid:610230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessimpact.page - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessimpact.page"; sid:610231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19care.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19care.care"; sid:610232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19care.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19care.center"; sid:610233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19countysim.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19countysim.org"; sid:610234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencykit.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencykit.site"; sid:610235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hk.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hk.info"; sid:610236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecare.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecare.org"; sid:610237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-outbreak.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-outbreak.info"; sid:610238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19policyplaybook.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19policyplaybook.org"; sid:610239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vpn.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vpn.org"; sid:610240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapollo.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapollo.org"; sid:610241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapplicationsdhc.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapplicationsdhc.org"; sid:610242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbodycount.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbodycount.org"; sid:610243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcare.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcare.care"; sid:610244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcases.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcases.claims"; sid:610245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceapp.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceapp.info"; sid:610246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceapp.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceapp.org"; sid:610247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsortium.global - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsortium.global"; sid:610248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsortium.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsortium.health"; sid:610249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsortium.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsortium.healthcare"; sid:610250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontysim.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontysim.org"; sid:610251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoolaid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoolaid.info"; sid:610252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountrysim.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountrysim.org"; sid:610253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountsim.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountsim.org"; sid:610254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoutysim.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoutysim.org"; sid:610255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoodnyc.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoodnyc.org"; sid:610256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreemoving.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreemoving.net"; sid:610257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthproject.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthproject.net"; sid:610258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-help.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-help.live"; sid:610259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurancethailand.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurancethailand.site"; sid:610260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot.republican - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot.republican"; sid:610261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjourneys.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjourneys.org"; sid:610262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkink.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkink.net"; sid:610263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlesson.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlesson.org"; sid:610264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-outbreak.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-outbreak.org"; sid:610265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanner.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanner.org"; sid:610266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoliticallyincorrect.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoliticallyincorrect.org"; sid:610267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprevention.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprevention.network"; sid:610268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearches.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearches.net"; sid:610269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponse.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponse.network"; sid:610270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetycrew.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetycrew.net"; sid:610271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmap.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmap.org"; sid:610272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-the-musical.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-the-musical.org"; sid:610273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-themusical.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-themusical.org"; sid:610274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthemusical.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthemusical.org"; sid:610275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trained.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trained.org"; sid:610276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrained.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrained.org"; sid:610277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvpn.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvpn.org"; sid:610278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for croatiacovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"croatiacovid19.info"; sid:610279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donateplasmaforcoronavirus.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donateplasmaforcoronavirus.org"; sid:610280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dronescovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dronescovid19.org"; sid:610281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmcovidsafe.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmcovidsafe.net"; sid:610282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guiamunicipioscovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guiamunicipioscovid19.info"; sid:610283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronatests.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronatests.org"; sid:610284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid-19test.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid-19test.org"; sid:610285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.guru"; sid:610286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.pro"; sid:610287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.site"; sid:610288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kidscovidessentials.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kidscovidessentials.org"; sid:610289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lessonofcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lessonofcovid.org"; sid:610290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needlesscoviddeaths.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needlesscoviddeaths.info"; sid:610291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needlesscoviddeaths.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needlesscoviddeaths.org"; sid:610292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiscgolf.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiscgolf.org"; sid:610293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpod.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpod.net"; sid:610294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpod.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpod.org"; sid:610295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsports.net"; sid:610296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid.network"; sid:610297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tcovidtest.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tcovidtest.org"; sid:610298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-depistage-covid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-depistage-covid19.org"; sid:610299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-depistage-covid19.ovh - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-depistage-covid19.ovh"; sid:610300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-depistage-covid19.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-depistage-covid19.shop"; sid:610301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidteat.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidteat.org"; sid:610302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for txcovidtet.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"txcovidtet.org"; sid:610303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for upyourscorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"upyourscorona.org"; sid:610304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronamask.com"; sid:610305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronamasks.com"; sid:610306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21stcenturycovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21stcenturycovidcare.com"; sid:610307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advisercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advisercorona.com"; sid:610308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africafightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africafightingcovid.com"; sid:610309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronastuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronastuff.com"; sid:610310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annavescovidesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annavescovidesign.com"; sid:610311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artofthepandemic.com"; sid:610312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycovidtracker.com"; sid:610313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boundbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boundbycovid.com"; sid:610314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19complianceofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19complianceofficer.com"; sid:610315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcovid.com"; sid:610316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childcovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childcovidtracker.com"; sid:610317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clasesincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clasesincovid.com"; sid:610318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clasessincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clasessincovid.com"; sid:610319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consejoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consejoscovid.com"; sid:610320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafifteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafifteen.com"; sid:610321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahometools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahometools.com"; sid:610322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-nomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-nomics.com"; sid:610323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus192020help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus192020help.com"; sid:610324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentandcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentandcure.com"; sid:610325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covi-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covi-coronavirus.com"; sid:610326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19destroyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19destroyers.com"; sid:610327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longhaulers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longhaulers.com"; sid:610328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19poem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19poem.com"; sid:610329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventative.com"; sid:610330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventive.com"; sid:610331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19researcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19researcher.com"; sid:610332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seniorcarestlouis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seniorcarestlouis.com"; sid:610333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19throatspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19throatspray.com"; sid:610334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatandprevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatandprevent.com"; sid:610335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viptest.com"; sid:610336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wg.com"; sid:610337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaddy.com"; sid:610338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalyzer.com"; sid:610339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaba.com"; sid:610340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardboard.com"; sid:610341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaremall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaremall.com"; sid:610342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconciergegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconciergegroup.com"; sid:610343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurefgh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurefgh.com"; sid:610344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiscussionguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiscussionguide.com"; sid:610345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covide19usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covide19usa.com"; sid:610346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemics.com"; sid:610347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreevaccine.com"; sid:610348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidftw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidftw.com"; sid:610349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhi.com"; sid:610350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhk.com"; sid:610351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhungerrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhungerrelief.com"; sid:610352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiahealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiahealth.com"; sid:610353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitspro.com"; sid:610354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskdeals.com"; sid:610355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorialwebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorialwebsite.com"; sid:610356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoilecul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoilecul.com"; sid:610357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlinecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlinecare.com"; sid:610358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpods.com"; sid:610359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpooledtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpooledtesting.com"; sid:610360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpooltesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpooltesting.com"; sid:610361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestusa.com"; sid:610362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefservice.com"; sid:610363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurants.com"; sid:610364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyplans.com"; sid:610365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmarttouch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmarttouch.com"; sid:610366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-strongcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-strongcollective.com"; sid:610367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportservices.com"; sid:610368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-the-musical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-the-musical.com"; sid:610369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-themusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-themusical.com"; sid:610370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-therapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-therapist.com"; sid:610371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrailing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrailing.com"; sid:610372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrump-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrump-covid-19.com"; sid:610373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpiscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpiscovid-19.com"; sid:610374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpiscovid19.com"; sid:610375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovidhometest.com"; sid:610376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecotestecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecotestecovid19.com"; sid:610377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for etui-masque-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"etui-masque-coronavirus.com"; sid:610378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidhometest.com"; sid:610379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findmycoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findmycoronavirusvaccine.com"; sid:610380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findmycovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findmycovid19vaccine.com"; sid:610381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hkcovid.com"; sid:610382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid19society.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid19society.biz"; sid:610383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid19society.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid19society.com"; sid:610384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondpandemicbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondpandemicbook.com"; sid:610385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brentwoodcovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brentwoodcovidlabs.com"; sid:610386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccovidsyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccovidsyndrome.com"; sid:610387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovid19labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovid19labs.com"; sid:610388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovidlabs.com"; sid:610389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constructionclaimscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constructionclaimscovid.com"; sid:610390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidnomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidnomore.com"; sid:610391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaexpressbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaexpressbook.com"; sid:610392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fakeviewer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fakeviewer.com"; sid:610393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafitnes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafitnes.com"; sid:610394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahardseltzertravelblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahardseltzertravelblog.com"; sid:610395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholed.com"; sid:610396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-jewels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-jewels.com"; sid:610397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestmarokko.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestmarokko.com"; sid:610398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalyzer.com"; sid:610399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalyzers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalyzers.com"; sid:610400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussampler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussampler.com"; sid:610401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sars.com"; sid:610402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertcovid.com"; sid:610403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cook.com"; sid:610404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseanddefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseanddefense.com"; sid:610405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-shots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-shots.com"; sid:610406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinecenter.com"; sid:610407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinenow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinenow.com"; sid:610408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineus.com"; sid:610409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccins.com"; sid:610410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19wedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19wedding.com"; sid:610411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19weddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19weddings.com"; sid:610412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019vaccines.com"; sid:610413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20pandemic.com"; sid:610414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidad19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidad19.com"; sid:610415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-analyzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-analyzer.com"; sid:610416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxienty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxienty.com"; sid:610417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartsproject.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartsproject.blog"; sid:610418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblokr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblokr.com"; sid:610419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrainwashed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrainwashed.com"; sid:610420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardinals2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardinals2020.com"; sid:610421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclaimsconstruction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclaimsconstruction.com"; sid:610422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomiccon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomiccon.com"; sid:610423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancetaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancetaskforce.com"; sid:610424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconciergeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconciergeservices.com"; sid:610425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronanomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronanomore.com"; sid:610426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreation.com"; sid:610427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetection.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetection.app"; sid:610428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemail.com"; sid:610429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideraart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideraart.com"; sid:610430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfire.com"; sid:610431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-gap-year.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-gap-year.com"; sid:610432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhousewives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhousewives.com"; sid:610433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicusurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicusurvivor.com"; sid:610434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicusurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicusurvivors.com"; sid:610435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidintheblack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidintheblack.com"; sid:610436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjedi.com"; sid:610437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeytool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeytool.com"; sid:610438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeguard.com"; sid:610439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivestreams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivestreams.com"; sid:610440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghaul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghaul.com"; sid:610441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskprotect.com"; sid:610442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-nomore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-nomore.com"; sid:610443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobservation.com"; sid:610444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidobservations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidobservations.com"; sid:610445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparodies.com"; sid:610446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparody.com"; sid:610447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpete.com"; sid:610448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpi.com"; sid:610449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppefast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppefast.com"; sid:610450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.church"; sid:610451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsampler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsampler.com"; sid:610452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolsolution.com"; sid:610453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-service-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-service-online.com"; sid:610454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsilverbillet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsilverbillet.com"; sid:610455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsliverbullet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsliverbullet.com"; sid:610456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialanxienty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialanxienty.com"; sid:610457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsite.com"; sid:610458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestproviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestproviders.com"; sid:610459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrainingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrainingcenter.com"; sid:610460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusamask.com"; sid:610461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusms.com"; sid:610462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesla.com"; sid:610463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestracker.com"; sid:610464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictors.com"; sid:610465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cynkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cynkcovid19.com"; sid:610466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cynkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cynkcovid.com"; sid:610467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19news.com"; sid:610468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dolneedacovid-19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dolneedacovid-19test.com"; sid:610469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donotneedacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donotneedacovidtest.com"; sid:610470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for download-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"download-covid.com"; sid:610471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for download-covid-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"download-covid-vaccine.com"; sid:610472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for droppandemicpounds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"droppandemicpounds.com"; sid:610473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familycovid.com"; sid:610474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flordacovidaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flordacovidaction.com"; sid:610475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for franklincovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"franklincovidlabs.com"; sid:610476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fueracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fueracoronavirus.com"; sid:610477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickcovid.app"; sid:610478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidupdate.com"; sid:610479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30mincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30mincovid.com"; sid:610480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for affordablecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"affordablecovidtesting.com"; sid:610481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allovercovid.com"; sid:610482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid19society.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid19society.club"; sid:610483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcoronado.com"; sid:610484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backstagecovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backstagecovidcompliance.com"; sid:610485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bamli-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bamli-covid.com"; sid:610486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bamlicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bamlicovid.com"; sid:610487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bari-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bari-covid.com"; sid:610488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baricovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baricovid.com"; sid:610489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid2ndwave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid2ndwave.com"; sid:610490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burgerimsouthcoronatogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burgerimsouthcoronatogo.com"; sid:610491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidtest.com"; sid:610492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for butthencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"butthencovid.com"; sid:610493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for c19pandemickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"c19pandemickit.com"; sid:610494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabocovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabocovid19test.com"; sid:610495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabocovidtest.com"; sid:610496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabocovidtesting.com"; sid:610497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for castandcrewcovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"castandcrewcovidcompliance.com"; sid:610498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cervezacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cervezacorona.com"; sid:610499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidlabs.com"; sid:610500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincinnaticovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincinnaticovidlabs.com"; sid:610501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscovidlabs.com"; sid:610502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabatch.com"; sid:610503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommercialcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommercialcleaners.com"; sid:610504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovidforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovidforum.com"; sid:610505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheightshaven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheightshaven.com"; sid:610506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivatests.com"; sid:610507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweddingplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweddingplanner.com"; sid:610508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-chronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-chronicles.com"; sid:610509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicals.com"; sid:610510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designtoolkit.com"; sid:610511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19electionsnb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19electionsnb.com"; sid:610512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regform001.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regform001.com"; sid:610513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regform002.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regform002.com"; sid:610514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regform004.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regform004.com"; sid:610515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rnbv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rnbv.com"; sid:610516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sicilia.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sicilia.cloud"; sid:610517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sicilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sicilia.com"; sid:610518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spitkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spitkit.com"; sid:610519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19togo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19togo.com"; sid:610520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassistancegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassistancegroup.com"; sid:610521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchargeback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchargeback.com"; sid:610522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancecompany.com"; sid:610523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomerlog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomerlog.com"; sid:610524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddem.com"; sid:610525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddi.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddi.cloud"; sid:610526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidemence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidemence.com"; sid:610527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidencolombia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidencolombia.com"; sid:610528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfck.com"; sid:610529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgrantassist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgrantassist.com"; sid:610530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhandsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhandsafe.com"; sid:610531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestingnow.com"; sid:610532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoustontest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoustontest.com"; sid:610533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkmask.com"; sid:610534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivingsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivingsolutions.com"; sid:610535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskamerica.com"; sid:610536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskinfo.com"; sid:610537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreportcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreportcards.com"; sid:610538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrequiredtraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrequiredtraining.com"; sid:610539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrnbv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrnbv.com"; sid:610540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecircle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecircle.com"; sid:610541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecircles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecircles.com"; sid:610542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemart.com"; sid:610543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferpromos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferpromos.com"; sid:610544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscompliance.com"; sid:610545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsicilia.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsicilia.cloud"; sid:610546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsicilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsicilia.com"; sid:610547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudentscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudentscreening.com"; sid:610548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucksclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucksclothing.com"; sid:610549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-taisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-taisaku.com"; sid:610550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestedwedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestedwedding.com"; sid:610551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesteurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesteurope.com"; sid:610552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingafrica.com"; sid:610553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingamerica.com"; sid:610554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingasia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingasia.com"; sid:610555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingchina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingchina.com"; sid:610556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcommons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcommons.com"; sid:610557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtheworld.com"; sid:610558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinhouston.com"; sid:610559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrainingonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrainingonline.com"; sid:610560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for danangthangcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"danangthangcovid19.club"; sid:610561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designs-corona.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designs-corona.best"; sid:610562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicateepidemic.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicateepidemic.club"; sid:610563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10minutecovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10minutecovidresults.com"; sid:610564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovid19test.com"; sid:610565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidly.com"; sid:610566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudascovid-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudascovid-19.cat"; sid:610567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidteam.com"; sid:610568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedfdacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedfdacovidtest.com"; sid:610569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcovidfree.com"; sid:610570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidminnesota.com"; sid:610571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidmn.com"; sid:610572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirusattorneys.com"; sid:610573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruslawfirm.com"; sid:610574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruslawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruslawfirms.com"; sid:610575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidpromos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidpromos.com"; sid:610576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bierausschank-coronaschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bierausschank-coronaschutz.com"; sid:610577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackandsurvivingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackandsurvivingcovid.com"; sid:610578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for branchcovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"branchcovidiots.com"; sid:610579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidlabs.com"; sid:610580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19safety.com"; sid:610581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cadcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cadcovid.com"; sid:610582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartillacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartillacovid19.com"; sid:610583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cartillacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cartillacovid.com"; sid:610584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocovidlabs.com"; sid:610585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidrelief.com"; sid:610586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comoteodiocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comoteodiocorona.com"; sid:610587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabigeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabigeasy.com"; sid:610588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19glass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19glass.com"; sid:610589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarcondos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarcondos.com"; sid:610590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadictatuur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadictatuur.com"; sid:610591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoneighborhood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoneighborhood.com"; sid:610592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflammae.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflammae.com"; sid:610593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainthebigeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainthebigeasy.com"; sid:610594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillingmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillingmask.com"; sid:610595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapoli.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapoli.com"; sid:610596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapuritytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapuritytest.com"; sid:610597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stocklots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stocklots.com"; sid:610598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19glass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19glass.com"; sid:610599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglass.com"; sid:610600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfluenza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfluenza.com"; sid:610601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitattorney.com"; sid:610602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetydevice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetydevice.com"; sid:610603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetydevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetydevices.com"; sid:610604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymachine.com"; sid:610605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymachines.com"; sid:610606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-wahrheit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-wahrheit.com"; sid:610607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-walk-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-walk-in.com"; sid:610608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for countercovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"countercovidmask.com"; sid:610609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytestnow.com"; sid:610610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19getwell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19getwell.com"; sid:610611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-globalclinicaltrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-globalclinicaltrials.com"; sid:610612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infosharing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infosharing.com"; sid:610613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ivf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ivf.com"; sid:610614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killingmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killingmask.com"; sid:610615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longhaulerstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longhaulerstracker.com"; sid:610616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mituv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mituv.com"; sid:610617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19productsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19productsnow.com"; sid:610618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19regform005.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19regform005.com"; sid:610619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reo.com"; sid:610620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetydevice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetydevice.com"; sid:610621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetydevices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetydevices.com"; sid:610622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymachine.com"; sid:610623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymachines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymachines.com"; sid:610624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sanitizingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sanitizingservices.com"; sid:610625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screeningsoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screeningsoftware.com"; sid:610626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statlab.com"; sid:610627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upgrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upgrade.com"; sid:610628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19upgrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19upgrades.com"; sid:610629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineusatrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineusatrial.com"; sid:610630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineusaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineusaupdate.com"; sid:610631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinevideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinevideo.com"; sid:610632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19world-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19world-usa.com"; sid:610633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-yobou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-yobou.com"; sid:610634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid76.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid76.com"; sid:610635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairsystem.com"; sid:610636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairsystems.com"; sid:610637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbelge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbelge.com"; sid:610638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareathome.com"; sid:610639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareguide.com"; sid:610640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.ceo - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.ceo"; sid:610641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckmyrestaurant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckmyrestaurant.com"; sid:610642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanaegis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanaegis.com"; sid:610643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceonset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceonset.com"; sid:610644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliancepro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliancepro.com"; sid:610645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomerregister.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomerregister.com"; sid:610646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcustomerregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcustomerregistration.com"; sid:610647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardner.com"; sid:610648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgetwell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgetwell.com"; sid:610649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhurdles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhurdles.com"; sid:610650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitattorney.com"; sid:610651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawsuitlawyer.com"; sid:610652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketi.com"; sid:610653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobiletests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobiletests.com"; sid:610654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouthconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouthconnection.com"; sid:610655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnd.com"; sid:610656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomepara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomepara.com"; sid:610657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficershollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficershollywood.com"; sid:610658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidofficersla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidofficersla.com"; sid:610659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoner.com"; sid:610660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonsetsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonsetsafety.com"; sid:610661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidontheblock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidontheblock.com"; sid:610662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpillows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpillows.com"; sid:610663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplan4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplan4you.com"; sid:610664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprepplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprepplan.com"; sid:610665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreo.com"; sid:610666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesonline.com"; sid:610667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidretesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidretesting.com"; sid:610668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskassessments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskassessments.com"; sid:610669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskplan.com"; sid:610670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafescreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafescreen.com"; sid:610671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafespots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafespots.com"; sid:610672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsensors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsensors.com"; sid:610673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshots4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshots4u.com"; sid:610674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsignstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsignstoday.com"; sid:610675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsportstracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsportstracker.com"; sid:610676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyonline.com"; sid:610677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurakshaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurakshaproducts.com"; sid:610678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtatoo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtatoo.com"; sid:610679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaxadvise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaxadvise.com"; sid:610680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteletherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteletherapy.com"; sid:610681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenn.com"; sid:610682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestyourself.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestyourself.com"; sid:610683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruth2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruth2020.com"; sid:610684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruth2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruth2021.com"; sid:610685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinefinder.com"; sid:610686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineqld.com"; sid:610687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacin.com"; sid:610688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxqld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxqld.com"; sid:610689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventilationsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventilationsystems.com"; sid:610690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidveritas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidveritas.com"; sid:610691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddinggiveaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddinggiveaway.com"; sid:610692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwizard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwizard.com"; sid:610693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deactivatecovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deactivatecovidmask.com"; sid:610694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentistcovid19antibody.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentistcovid19antibody.com"; sid:610695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcovidlabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcovidlabs.com"; sid:610696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.cash - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.cash"; sid:610697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.brussels"; sid:610698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.center"; sid:610699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hcovid.com"; sid:610700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcovidkit.com"; sid:610701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 365online-coronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"365online-coronavirus19.com"; sid:610702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 365online-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"365online-coronavirus.com"; sid:610703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 365online-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"365online-covid19.com"; sid:610704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid19testing.com"; sid:610705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazon-covid-reliefcustomer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazon-covid-reliefcustomer.com"; sid:610706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artistsversuspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artistsversuspandemic.com"; sid:610707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azithromycinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azithromycinecovid.com"; sid:610708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batascovid.com"; sid:610709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bikelifepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bikelifepandemic.com"; sid:610710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohitcovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohitcovid19rapidtest.com"; sid:610711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohitcovid19testsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohitcovid19testsupplies.com"; sid:610712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohitcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohitcovidtest.com"; sid:610713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohitcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohitcovidtesting.com"; sid:610714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohitcovidtestsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohitcovidtestsupplies.com"; sid:610715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackrhinocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackrhinocovid.com"; sid:610716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brightwellnavigatorrsea-admin-claimcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brightwellnavigatorrsea-admin-claimcovid19.com"; sid:610717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeforcovid.com"; sid:610718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changetocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changetocovid.com"; sid:610719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congressmancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congressmancovid.com"; sid:610720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaborealgrup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaborealgrup.com"; sid:610721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoaviation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoaviation.com"; sid:610722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobikerental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobikerental.com"; sid:610723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogym.com"; sid:610724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoperformingarts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoperformingarts.com"; sid:610725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafearfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafearfree.com"; sid:610726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gr.com"; sid:610727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainternationalbrokerage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainternationalbrokerage.com"; sid:610728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapotus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapotus.com"; sid:610729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofdiscounter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofdiscounter.com"; sid:610730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safety-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safety-kit.com"; sid:610731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test.africa"; sid:610732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandpolitics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandpolitics.com"; sid:610733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusters19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusters19.com"; sid:610734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-studies.com"; sid:610735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustape.com"; sid:610736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebpy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebpy.com"; sid:610737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984movie.com"; sid:610738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19btoblink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19btoblink.com"; sid:610739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-destek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-destek.com"; sid:610740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-destek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-destek.com"; sid:610741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthing.com"; sid:610742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19identification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19identification.com"; sid:610743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isthecrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isthecrown.com"; sid:610744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicalcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicalcleaning.com"; sid:610745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19partyrental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19partyrental.com"; sid:610746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19processservers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19processservers.com"; sid:610747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recent.com"; sid:610748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-relieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-relieffund.com"; sid:610749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sempozyumu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sempozyumu.com"; sid:610750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivorsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivorsnetwork.com"; sid:610751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19veklury.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19veklury.blog"; sid:610752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wahat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wahat.com"; sid:610753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warriror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warriror.com"; sid:610754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19webmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19webmeeting.com"; sid:610755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplacecoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplacecoordinator.com"; sid:610756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacecoordinator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacecoordinator.com"; sid:610757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplacecoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplacecoordinators.com"; sid:610758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workplacecoordinators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workplacecoordinators.com"; sid:610759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9teenshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9teenshop.com"; sid:610760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covida19guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covida19guard.com"; sid:610761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ag.com"; sid:610762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandvoted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandvoted.com"; sid:610763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeautymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeautymask.com"; sid:610764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeautymasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeautymasks.com"; sid:610765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbowl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbowl.com"; sid:610766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracket.com"; sid:610767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracketology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracketology.com"; sid:610768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcafoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcafoundation.com"; sid:610769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaptured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaptured.com"; sid:610770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarryall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarryall.com"; sid:610771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarryon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarryon.com"; sid:610772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcb.com"; sid:610773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckmark.com"; sid:610774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclassroomutah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclassroomutah.com"; sid:610775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommonsensemama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommonsensemama.com"; sid:610776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoolingcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoolingcare.com"; sid:610777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcouple.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcouple.club"; sid:610778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcringle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcringle.com"; sid:610779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcushion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcushion.com"; sid:610780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddogtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddogtest.com"; sid:610781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideoproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideoproduction.com"; sid:610782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemaskup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemaskup.com"; sid:610783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesanitization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesanitization.com"; sid:610784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeshirts.com"; sid:610785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesince.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesince.com"; sid:610786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunizations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunizations.com"; sid:610787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmunize.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmunize.com"; sid:610788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinamerica.com"; sid:610789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidketo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidketo.com"; sid:610790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillsfatpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillsfatpeople.com"; sid:610791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-korea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-korea.com"; sid:610792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkringle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkringle.com"; sid:610793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifeprotector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifeprotector.com"; sid:610794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskbags.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskbags.com"; sid:610795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentions.com"; sid:610796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativepressurecapsule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativepressurecapsule.com"; sid:610797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnegativepressurechamber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnegativepressurechamber.com"; sid:610798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomad.com"; sid:610799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartyrental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartyrental.com"; sid:610800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprescreeningforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprescreeningforms.com"; sid:610801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductioncompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductioncompliance.com"; sid:610802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrefusers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrefusers.com"; sid:610803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreusable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreusable.com"; sid:610804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferbiz.com"; sid:610805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferbusinesses.com"; sid:610806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldcertificate.com"; sid:610807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldcertification.com"; sid:610808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsteunpunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsteunpunt.com"; sid:610809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-suits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-suits.com"; sid:610810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurviverkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurviverkit.com"; sid:610811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorkits.com"; sid:610812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest30.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest30.com"; sid:610813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestdrive.com"; sid:610814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsolution.com"; sid:610815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttampa.com"; sid:610816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrakker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrakker.com"; sid:610817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-u.com"; sid:610818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxnow.com"; sid:610819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvexin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvexin.com"; sid:610820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-visual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-visual.com"; sid:610821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarriror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarriror.com"; sid:610822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkplaceforms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkplaceforms.com"; sid:610823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creatingincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creatingincovid.com"; sid:610824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushthefearpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushthefearpandemic.com"; sid:610825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davidallencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davidallencovid.com"; sid:610826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnacovid.com"; sid:610827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorsdontfearcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorsdontfearcovid.com"; sid:610828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascoronavirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascoronavirus.biz"; sid:610829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascoronavirus.club"; sid:610830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veklurycovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veklurycovid19.blog"; sid:610831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aca-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aca-covid19.com"; sid:610832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorencorona.com"; sid:610833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birminghamcovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birminghamcovidclinic.com"; sid:610834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretasvscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretasvscovid19.com"; sid:610835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conditioningundercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conditioningundercovid.com"; sid:610836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaccounting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaccounting.com"; sid:610837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvertising.com"; sid:610838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacardealer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacardealer.com"; sid:610839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanplay.com"; sid:610840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrooners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrooners.com"; sid:610841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-handschuhe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-handschuhe.com"; sid:610842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskenshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskenshop.com"; sid:610843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphysicaltherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphysicaltherapy.com"; sid:610844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepcenter.com"; sid:610845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sensor.com"; sid:610846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfunebresbogota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfunebresbogota.com"; sid:610847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaventas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaventas.com"; sid:610848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathlawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathlawsuitlawyer.com"; sid:610849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathlawyer.com"; sid:610850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslonghaulers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslonghaulers.com"; sid:610851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalpracticelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalpracticelawyer.com"; sid:610852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstopswithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstopswithme.com"; sid:610853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathlawsuit.com"; sid:610854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeathlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeathlawyer.com"; sid:610855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweeddelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweeddelivery.com"; sid:610856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodybiosensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodybiosensor.com"; sid:610857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19biosecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19biosecure.com"; sid:610858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19consultantsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19consultantsgroup.com"; sid:610859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19courtesy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19courtesy.com"; sid:610860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cricketseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cricketseries.com"; sid:610861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19disinfectnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19disinfectnow.com"; sid:610862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earningway2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earningway2020.com"; sid:610863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19friendly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19friendly.com"; sid:610864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labbroker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labbroker.com"; sid:610865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labforsale.com"; sid:610866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labinvestors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labinvestors.com"; sid:610867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labsforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labsforsale.com"; sid:610868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-near-you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-near-you.com"; sid:610869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19responseatsentara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19responseatsentara.com"; sid:610870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19socialanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19socialanxiety.com"; sid:610871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19stopswithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19stopswithme.com"; sid:610872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stopswithme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stopswithme.com"; sid:610873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelab.com"; sid:610874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020childcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020childcare.com"; sid:610875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid30hrs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid30hrs.com"; sid:610876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidambassador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidambassador.com"; sid:610877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantiseptic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantiseptic.com"; sid:610878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesscosultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesscosultants.com"; sid:610879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessolutions.com"; sid:610880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningandprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningandprevention.com"; sid:610881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortproducts.com"; sid:610882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnectication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnectication.com"; sid:610883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultantsgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultantsgroup.com"; sid:610884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultantsonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultantsonline.com"; sid:610885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathlawsuit.com"; sid:610886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathlawsuitlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathlawsuitlawyer.com"; sid:610887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathlawyer.com"; sid:610888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectantspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectantspray.com"; sid:610889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectantwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectantwipes.com"; sid:610890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenquiry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenquiry.com"; sid:610891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideocompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideocompliance.com"; sid:610892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideyeshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideyeshields.com"; sid:610893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeforever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeforever.com"; sid:610894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfrontlinetesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfrontlinetesting.com"; sid:610895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgear19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgear19.com"; sid:610896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometestnow.com"; sid:610897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhse.com"; sid:610898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiotcountry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiotcountry.com"; sid:610899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmalpracticelawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmalpracticelawyer.com"; sid:610900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmeasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmeasure.com"; sid:610901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicroschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicroschool.com"; sid:610902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmicroschooling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmicroschooling.com"; sid:610903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmirrors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmirrors.com"; sid:610904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-near-you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-near-you.com"; sid:610905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteenppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteenppe.com"; sid:610906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductsinturkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductsinturkey.com"; sid:610907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrentalequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrentalequipment.com"; sid:610908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidruinseverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidruinseverything.com"; sid:610909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsac.com"; sid:610910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsack.com"; sid:610911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecap.com"; sid:610912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecaps.com"; sid:610913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafespray.com"; sid:610914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyspray.com"; sid:610915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetywipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetywipes.com"; sid:610916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafewipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafewipes.com"; sid:610917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizespray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizespray.com"; sid:610918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizewipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizewipes.com"; sid:610919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscentscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscentscreen.com"; sid:610920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolpod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolpod.com"; sid:610921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolpods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolpods.com"; sid:610922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseasonsloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseasonsloans.com"; sid:610923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sensor.com"; sid:610924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudynola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudynola.com"; sid:610925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorskit.com"; sid:610926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmia.com"; sid:610927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemonitoring.com"; sid:610928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestudy1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestudy1.com"; sid:610929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwebcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwebcompany.com"; sid:610930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrongfuldeathattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrongfuldeathattorney.com"; sid:610931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwrongfuldeathlawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwrongfuldeathlawsuit.com"; sid:610932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culpablecovidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culpablecovidiots.com"; sid:610933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacoecovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacoecovid19tracker.com"; sid:610934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dadescovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dadescovid.cat"; sid:610935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.club"; sid:610936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpresents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpresents.com"; sid:610937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 777covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"777covid.com"; sid:610938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accountableforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accountableforcovid.com"; sid:610939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altocovid.com"; sid:610940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpaper.com"; sid:610941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areacovid.com"; sid:610942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcovid.com"; sid:610943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-covid-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-covid-attorney.com"; sid:610944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidattorney.com"; sid:610945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidgear.com"; sid:610946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafemedcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafemedcoronado.com"; sid:610947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretacovidoficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretacovidoficial.com"; sid:610948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chungtaydayluicovid.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chungtaydayluicovid.asia"; sid:610949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofcoronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofcoronadelmar.com"; sid:610950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classroompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classroompandemic.com"; sid:610951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcoronavirus.com"; sid:610952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coastcovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coastcovidsurvivors.com"; sid:610953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecoronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecoronavaccines.com"; sid:610954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecovidvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecovidvaccines.com"; sid:610955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommandments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommandments.com"; sid:610956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconciergeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconciergeservice.com"; sid:610957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconciergeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconciergeservices.com"; sid:610958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gurgel-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gurgel-test.com"; sid:610959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagurgeltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagurgeltest.com"; sid:610960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heimtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heimtest.com"; sid:610961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pcr-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pcr-sos.com"; sid:610962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarycoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarycoach.com"; sid:610963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspoolservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspoolservice.com"; sid:610964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasync.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasync.com"; sid:610965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tutors.com"; sid:610966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysandiego.com"; sid:610967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschicagoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschicagoattorney.com"; sid:610968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdallasattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdallasattorney.com"; sid:610969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoustonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoustonattorney.com"; sid:610970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmsandiego.com"; sid:610971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosangelesattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosangelesattorney.com"; sid:610972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkcityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkcityattorney.com"; sid:610973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphiladelphiaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphiladelphiaattorney.com"; sid:610974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoenixattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoenixattorney.com"; sid:610975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiegoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiegoattorney.com"; sid:610976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiegolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiegolawfirm.com"; sid:610977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfranciscoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfranciscoattorney.com"; sid:610978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseattleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseattleattorney.com"; sid:610979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentprevention.com"; sid:610980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashingtondcattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashingtondcattorney.com"; sid:610981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebseries.com"; sid:610982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatecovidsolutions.com"; sid:610983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costaricacovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costaricacovidinsurance.com"; sid:610984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984film.com"; sid:610985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysandiego.com"; sid:610986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicagoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicagoattorney.com"; sid:610987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicagolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicagolawfirm.com"; sid:610988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultant.com"; sid:610989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisisrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisisrelief.com"; sid:610990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallasattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallasattorney.com"; sid:610991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallaslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallaslawfirm.com"; sid:610992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dillon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dillon.com"; sid:610993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drinkingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drinkingteam.com"; sid:610994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonattorney.com"; sid:610995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonlawfirm.com"; sid:610996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inaustralia.com"; sid:610997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmsandiego.com"; sid:610998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifestories.com"; sid:610999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losangelesattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losangelesattorney.com"; sid:611000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losangeleslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losangeleslawfirm.com"; sid:611001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkcityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkcityattorney.com"; sid:611002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkcitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkcitylawfirm.com"; sid:611003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outcomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outcomes.com"; sid:611004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philadelphiaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philadelphiaattorney.com"; sid:611005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philadelphialawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philadelphialawfirm.com"; sid:611006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixattorney.com"; sid:611007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixlawfirm.com"; sid:611008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physiciansafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physiciansafe.com"; sid:611009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ptsdrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ptsdrecovery.com"; sid:611010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptsdrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptsdrecovery.com"; sid:611011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reaponsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reaponsegroup.com"; sid:611012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sandiegoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sandiegoattorney.com"; sid:611013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sandiegolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sandiegolawfirm.com"; sid:611014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanfranciscoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanfranciscoattorney.com"; sid:611015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanfranciscolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanfranciscolawfirm.com"; sid:611016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattleattorney.com"; sid:611017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattlelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattlelawfirm.com"; sid:611018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19test.center"; sid:611019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tm.com"; sid:611020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvclights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvclights.com"; sid:611021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistribution.com"; sid:611022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistributor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistributor.com"; sid:611023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistributors.com"; sid:611024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washingtondcattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washingtondcattorney.com"; sid:611025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washingtondclawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washingtondclawfirm.com"; sid:611026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid48.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid48.com"; sid:611027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidability.com"; sid:611028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboonker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboonker.com"; sid:611029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-btc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-btc.com"; sid:611030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareplus.com"; sid:611031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanliving.com"; sid:611032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.club"; sid:611033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontinues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontinues.com"; sid:611034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatesolutions.com"; sid:611035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathmatch.com"; sid:611036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrinkingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrinkingteam.com"; sid:611037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforme.com"; sid:611038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardusaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardusaclub.com"; sid:611039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoogles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoogles.com"; sid:611040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthresources.com"; sid:611041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesph.com"; sid:611042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idiot.com"; sid:611043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idiots.com"; sid:611044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthetimeoflove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthetimeoflove.com"; sid:611045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisc.com"; sid:611046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkokua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkokua.com"; sid:611047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlesbian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlesbian.com"; sid:611048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecoverage.com"; sid:611049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinewatch.com"; sid:611050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigationservices.com"; sid:611051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmrna1273.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmrna1273.com"; sid:611052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-myalgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-myalgia.com"; sid:611053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnostra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnostra.com"; sid:611054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidos.com"; sid:611055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmatrials.com"; sid:611056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrejuvenise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrejuvenise.com"; sid:611057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotejob.com"; sid:611058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultnow.com"; sid:611059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeoffices.com"; sid:611060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesolution.com"; sid:611061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyeyewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyeyewear.com"; sid:611062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyglasses.com"; sid:611063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetygoggles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetygoggles.com"; sid:611064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscoreandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscoreandme.com"; sid:611065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secured.com"; sid:611066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secure-workplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secure-workplace.com"; sid:611067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-see.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-see.com"; sid:611068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsee.com"; sid:611069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshades.com"; sid:611070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskool.com"; sid:611071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthflorida.com"; sid:611072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterminatarz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterminatarz.com"; sid:611073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest911.com"; sid:611074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthawaii.com"; sid:611075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsouthflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsouthflorida.com"; sid:611076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestors.com"; sid:611077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvaulthealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvaulthealth.com"; sid:611078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthirteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthirteen.com"; sid:611079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelcover.com"; sid:611080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelocations.com"; sid:611081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemrna1273.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemrna1273.com"; sid:611082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinequestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinequestions.com"; sid:611083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesafe.com"; sid:611084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxusa.com"; sid:611085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetest.com"; sid:611086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetests.com"; sid:611087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataodcovid.com"; sid:611088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitisationincovid19-wiewlite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitisationincovid19-wiewlite.com"; sid:611089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dingteacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dingteacorona.com"; sid:611090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridahealthcovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridahealthcovid19.app"; sid:611091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid.cloud"; sid:611092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.app"; sid:611093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14mincovidtest.com"; sid:611094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidscan.com"; sid:611095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 16mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"16mincovidtest.com"; sid:611096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20mincovidtest.com"; sid:611097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrail.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrail.app"; sid:611098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 101covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"101covid.com"; sid:611099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19world.com"; sid:611100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicpresents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicpresents.com"; sid:611101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 305covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"305covid.com"; sid:611102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 777covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"777covid.com"; sid:611103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accountableforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accountableforcovid.com"; sid:611104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altocovid.com"; sid:611105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoviddiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoviddiet.com"; sid:611106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidliving.com"; sid:611107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpaper.com"; sid:611108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areacovid.com"; sid:611109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurancescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurancescovid.com"; sid:611110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assurancevoyagecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assurancevoyagecovid.com"; sid:611111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcovid.com"; sid:611112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovid.com"; sid:611113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-covid-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-covid-attorney.com"; sid:611114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidattorney.com"; sid:611115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidgear.com"; sid:611116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidvaccine.com"; sid:611117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafemedcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafemedcoronado.com"; sid:611118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caretacovidoficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caretacovidoficial.com"; sid:611119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofcoronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofcoronadelmar.com"; sid:611120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classroompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classroompandemic.com"; sid:611121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidguard.com"; sid:611122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearcovidguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearcovidguards.com"; sid:611123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedofcovid.com"; sid:611124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcoronavirus.com"; sid:611125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coastcovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coastcovidsurvivors.com"; sid:611126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecoronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecoronavaccines.com"; sid:611127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comparecovidvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comparecovidvaccines.com"; sid:611128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocoa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocoa.com"; sid:611129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacommandments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacommandments.com"; sid:611130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconciergeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconciergeservice.com"; sid:611131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconciergeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconciergeservices.com"; sid:611132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadofamilydentist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadofamilydentist.com"; sid:611133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomailparcelcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomailparcelcenter.com"; sid:611134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopopwarner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopopwarner.com"; sid:611135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gurgel-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gurgel-test.com"; sid:611136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagurgeltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagurgeltest.com"; sid:611137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heimtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heimtest.com"; sid:611138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahitz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahitz.com"; sid:611139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pcr-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pcr-sos.com"; sid:611140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanners.com"; sid:611141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarycoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarycoach.com"; sid:611142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaskid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaskid.com"; sid:611143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas-kids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas-kids.com"; sid:611144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspoolservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspoolservice.com"; sid:611145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasync.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasync.com"; sid:611146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tutors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tutors.com"; sid:611147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirulence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirulence.com"; sid:611148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbuquerqueattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbuquerqueattorney.com"; sid:611149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbuquerquelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbuquerquelawfirm.com"; sid:611150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlantaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlantaattorney.com"; sid:611151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlantalawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlantalawfirm.com"; sid:611152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyalbuquerque.com"; sid:611153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyatlanta.com"; sid:611154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneybaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneybaltimore.com"; sid:611155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyindianapolis.com"; sid:611156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneykansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneykansascity.com"; sid:611157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneylouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneylouisville.com"; sid:611158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneymemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneymemphis.com"; sid:611159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneymilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneymilwaukee.com"; sid:611160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneynashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneynashville.com"; sid:611161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyportland.com"; sid:611162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneyraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneyraleigh.com"; sid:611163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysacramento.com"; sid:611164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysandiego.com"; sid:611165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneytucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneytucson.com"; sid:611166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaltimoreattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaltimoreattorney.com"; sid:611167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaltimorelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaltimorelawfirm.com"; sid:611168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschicagoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschicagoattorney.com"; sid:611169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdallasattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdallasattorney.com"; sid:611170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoustonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoustonattorney.com"; sid:611171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindianapolisattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindianapolisattorney.com"; sid:611172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindianapolislawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindianapolislawfirm.com"; sid:611173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansascityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansascityattorney.com"; sid:611174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansascitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansascitylawfirm.com"; sid:611175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmalbuquerque.com"; sid:611176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmatlanta.com"; sid:611177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmbaltimore.com"; sid:611178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmindianapolis.com"; sid:611179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmkansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmkansascity.com"; sid:611180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmlouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmlouisville.com"; sid:611181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmmemphis.com"; sid:611182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmmilwaukee.com"; sid:611183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmnashville.com"; sid:611184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmportland.com"; sid:611185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmraleigh.com"; sid:611186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmsacramento.com"; sid:611187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmsandiego.com"; sid:611188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmtucson.com"; sid:611189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosangelesattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosangelesattorney.com"; sid:611190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisvilleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisvilleattorney.com"; sid:611191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisvillelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisvillelawfirm.com"; sid:611192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphisattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphisattorney.com"; sid:611193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphislawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphislawfirm.com"; sid:611194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilwaukeeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilwaukeeattorney.com"; sid:611195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilwaukeelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilwaukeelawfirm.com"; sid:611196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnashvilleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnashvilleattorney.com"; sid:611197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnashvillelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnashvillelawfirm.com"; sid:611198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkcityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkcityattorney.com"; sid:611199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphiladelphiaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphiladelphiaattorney.com"; sid:611200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoenixattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoenixattorney.com"; sid:611201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportlandattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportlandattorney.com"; sid:611202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportlandlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportlandlawfirm.com"; sid:611203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusraleighattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusraleighattorney.com"; sid:611204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusraleighlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusraleighlawfirm.com"; sid:611205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussacramentoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussacramentoattorney.com"; sid:611206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussacramentolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussacramentolawfirm.com"; sid:611207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiegoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiegoattorney.com"; sid:611208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiegolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiegolawfirm.com"; sid:611209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfranciscoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfranciscoattorney.com"; sid:611210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseattleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseattleattorney.com"; sid:611211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentprevention.com"; sid:611212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustucsonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustucsonattorney.com"; sid:611213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustucsonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustucsonlawfirm.com"; sid:611214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashingtondcattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashingtondcattorney.com"; sid:611215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawebseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawebseries.com"; sid:611216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corporatecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corporatecovidsolutions.com"; sid:611217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for costaricacovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"costaricacovidinsurance.com"; sid:611218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984film.com"; sid:611219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19activeresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19activeresults.com"; sid:611220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19albuquerqueattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19albuquerqueattorney.com"; sid:611221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19albuquerquelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19albuquerquelawfirm.com"; sid:611222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19altereddeathcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19altereddeathcertificate.com"; sid:611223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-approvedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-approvedmasks.com"; sid:611224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-approvedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-approvedmasks.com"; sid:611225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atlantaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atlantaattorney.com"; sid:611226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19atlantalawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19atlantalawfirm.com"; sid:611227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyalbuquerque.com"; sid:611228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyatlanta.com"; sid:611229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneybaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneybaltimore.com"; sid:611230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyindianapolis.com"; sid:611231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneykansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneykansascity.com"; sid:611232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneylouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneylouisville.com"; sid:611233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneymemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneymemphis.com"; sid:611234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneymilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneymilwaukee.com"; sid:611235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneynashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneynashville.com"; sid:611236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyportland.com"; sid:611237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneyraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneyraleigh.com"; sid:611238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysacramento.com"; sid:611239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneysandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneysandiego.com"; sid:611240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneytucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneytucson.com"; sid:611241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baltimoreattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baltimoreattorney.com"; sid:611242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19baltimorelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19baltimorelawfirm.com"; sid:611243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bestfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bestfacemask.com"; sid:611244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certificadodedefuncionalterado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certificadodedefuncionalterado.com"; sid:611245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicagoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicagoattorney.com"; sid:611246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicagolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicagolawfirm.com"; sid:611247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningni.com"; sid:611248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensacion.com"; sid:611249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19consultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19consultant.com"; sid:611250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisisrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisisrelief.com"; sid:611251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallasattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallasattorney.com"; sid:611252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dallaslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dallaslawfirm.com"; sid:611253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19demandealhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19demandealhospital.com"; sid:611254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dillon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dillon.com"; sid:611255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19drinkingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19drinkingteam.com"; sid:611256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19effectonchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19effectonchildren.com"; sid:611257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19eliminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19eliminator.com"; sid:611258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-exposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-exposure.com"; sid:611259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freevaccine.com"; sid:611260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19haberleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19haberleri.com"; sid:611261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitaldemanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitaldemanda.com"; sid:611262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hospitallawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hospitallawsuit.com"; sid:611263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonattorney.com"; sid:611264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19houstonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19houstonlawfirm.com"; sid:611265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inaustralia.com"; sid:611266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indianapolisattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indianapolisattorney.com"; sid:611267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indianapolislawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indianapolislawfirm.com"; sid:611268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kansascityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kansascityattorney.com"; sid:611269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kansascitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kansascitylawfirm.com"; sid:611270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmalbuquerque.com"; sid:611271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmatlanta.com"; sid:611272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmbaltimore.com"; sid:611273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmindianapolis.com"; sid:611274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmkansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmkansascity.com"; sid:611275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmlouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmlouisville.com"; sid:611276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmmemphis.com"; sid:611277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmmilwaukee.com"; sid:611278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmnashville.com"; sid:611279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmportland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmportland.com"; sid:611280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmraleigh.com"; sid:611281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmsacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmsacramento.com"; sid:611282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmsandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmsandiego.com"; sid:611283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmtucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmtucson.com"; sid:611284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifestories.com"; sid:611285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19logger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19logger.com"; sid:611286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losangelesattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losangelesattorney.com"; sid:611287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losangeleslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losangeleslawfirm.com"; sid:611288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19louisvilleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19louisvilleattorney.com"; sid:611289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19louisvillelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19louisvillelawfirm.com"; sid:611290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memphisattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memphisattorney.com"; sid:611291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memphislawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memphislawfirm.com"; sid:611292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milwaukeeattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milwaukeeattorney.com"; sid:611293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19milwaukeelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19milwaukeelawfirm.com"; sid:611294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nashvilleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nashvilleattorney.com"; sid:611295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nashvillelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nashvillelawfirm.com"; sid:611296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newsus.com"; sid:611297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkcityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkcityattorney.com"; sid:611298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newyorkcitylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newyorkcitylawfirm.com"; sid:611299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19outcomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19outcomes.com"; sid:611300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philadelphiaattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philadelphiaattorney.com"; sid:611301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philadelphialawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philadelphialawfirm.com"; sid:611302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixattorney.com"; sid:611303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixlawfirm.com"; sid:611304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physiciansafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physiciansafe.com"; sid:611305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19plasmamatching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19plasmamatching.com"; sid:611306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portlandattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portlandattorney.com"; sid:611307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19portlandlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19portlandlawfirm.com"; sid:611308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ptsdrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ptsdrecovery.com"; sid:611309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptsdrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptsdrecovery.com"; sid:611310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raleighattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raleighattorney.com"; sid:611311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19raleighlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19raleighlawfirm.com"; sid:611312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidclear.com"; sid:611313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reaponsegroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reaponsegroup.com"; sid:611314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sacramentoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sacramentoattorney.com"; sid:611315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sacramentolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sacramentolawfirm.com"; sid:611316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-safemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-safemasks.com"; sid:611317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-safemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-safemasks.com"; sid:611318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sandiegoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sandiegoattorney.com"; sid:611319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sandiegolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sandiegolawfirm.com"; sid:611320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanfranciscoattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanfranciscoattorney.com"; sid:611321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanfranciscolawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanfranciscolawfirm.com"; sid:611322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattleattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattleattorney.com"; sid:611323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19seattlelawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19seattlelawfirm.com"; sid:611324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19souls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19souls.com"; sid:611325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19terminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19terminator.com"; sid:611326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tm.com"; sid:611327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tucsonattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tucsonattorney.com"; sid:611328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tucsonlawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tucsonlawfirm.com"; sid:611329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uvclights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uvclights.com"; sid:611330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistribution.com"; sid:611331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistributor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistributor.com"; sid:611332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistributors.com"; sid:611333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viccine.com"; sid:611334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washingtondcattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washingtondcattorney.com"; sid:611335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washingtondclawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washingtondclawfirm.com"; sid:611336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-watch.com"; sid:611337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid321.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid321.com"; sid:611338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid48.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid48.com"; sid:611339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidability.com"; sid:611340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-airpurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-airpurification.com"; sid:611341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalteredeathcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalteredeathcertificate.com"; sid:611342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanjingedan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanjingedan.com"; sid:611343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapprove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapprove.com"; sid:611344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidas20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidas20.com"; sid:611345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawaymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawaymask.com"; sid:611346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboonker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboonker.com"; sid:611347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-btc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-btc.com"; sid:611348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcane20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcane20.com"; sid:611349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareplus.com"; sid:611350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertificadodefuncionalterado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertificadodefuncionalterado.com"; sid:611351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanliving.com"; sid:611352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompatible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompatible.com"; sid:611353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompensacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompensacion.com"; sid:611354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontinues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontinues.com"; sid:611355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorporatesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorporatesolutions.com"; sid:611356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeathmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeathmatch.com"; sid:611357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddemanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddemanda.com"; sid:611358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddemandealhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddemandealhospital.com"; sid:611359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectionteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectionteam.com"; sid:611360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrinkingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrinkingteam.com"; sid:611361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideisschale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideisschale.com"; sid:611362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesk.com"; sid:611363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpressresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpressresults.com"; sid:611364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforme.com"; sid:611365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuneralcoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuneralcoverage.com"; sid:611366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardusaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardusaclub.com"; sid:611367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidggn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidggn.com"; sid:611368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidghiaccio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidghiaccio.com"; sid:611369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgilantes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgilantes.com"; sid:611370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoogles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoogles.com"; sid:611371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthpack.com"; sid:611372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthresources.com"; sid:611373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesph.com"; sid:611374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhielo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhielo.com"; sid:611375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitaldemanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitaldemanda.com"; sid:611376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidice.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidice.biz"; sid:611377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idiot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idiot.com"; sid:611378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-idiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-idiots.com"; sid:611379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthetimeoflove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthetimeoflove.com"; sid:611380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisc.com"; sid:611381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsusa.com"; sid:611382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkokua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkokua.com"; sid:611383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkure.com"; sid:611384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlesbian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlesbian.com"; sid:611385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlifecoverage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlifecoverage.com"; sid:611386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinewatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinewatch.com"; sid:611387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlp.com"; sid:611388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmania.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmania.biz"; sid:611389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmirage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmirage.com"; sid:611390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigationservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigationservices.com"; sid:611391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmrna1273.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmrna1273.com"; sid:611392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-myalgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-myalgia.com"; sid:611393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnakedtees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnakedtees.com"; sid:611394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnostra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnostra.com"; sid:611395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidos.com"; sid:611396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatable.com"; sid:611397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmatrials.com"; sid:611398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadi.com"; sid:611399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrejuvenise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrejuvenise.com"; sid:611400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremotejob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremotejob.com"; sid:611401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultnow.com"; sid:611402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresultsin10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresultsin10.com"; sid:611403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeoffices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeoffices.com"; sid:611404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesolution.com"; sid:611405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyeyewear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyeyewear.com"; sid:611406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyglasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyglasses.com"; sid:611407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetygoggles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetygoggles.com"; sid:611408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsapproved.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsapproved.com"; sid:611409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolpolicy.com"; sid:611410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscoreandme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscoreandme.com"; sid:611411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secured.com"; sid:611412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-secure-workplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-secure-workplace.com"; sid:611413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-see.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-see.com"; sid:611414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsee.com"; sid:611415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshades.com"; sid:611416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskids.com"; sid:611417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskool.com"; sid:611418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsouthflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsouthflorida.com"; sid:611419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsportsmedhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsportsmedhelp.com"; sid:611420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-squad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-squad.com"; sid:611421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-success.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-success.com"; sid:611422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidterminatarz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidterminatarz.com"; sid:611423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest911.com"; sid:611424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthawaii.com"; sid:611425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsouthflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsouthflorida.com"; sid:611426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestors.com"; sid:611427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestvaulthealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestvaulthealth.com"; sid:611428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthirteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthirteen.com"; sid:611429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerz.com"; sid:611430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelcover.com"; sid:611431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelab.com"; sid:611432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelocations.com"; sid:611433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemrna1273.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemrna1273.com"; sid:611434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinequestions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinequestions.com"; sid:611435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesafe.com"; sid:611436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacscene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacscene.com"; sid:611437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxkills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxkills.com"; sid:611438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxreadi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxreadi.com"; sid:611439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxready.com"; sid:611440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxusa.com"; sid:611441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisionquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisionquest.com"; sid:611442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetest.com"; sid:611443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetests.com"; sid:611444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetest.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetest.us"; sid:611445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx9.com"; sid:611446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxnine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxnine.com"; sid:611447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cursoprotocolocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cursoprotocolocovid.com"; sid:611448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cz-covidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cz-covidtracker.com"; sid:611449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dataodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dataodcovid.com"; sid:611450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitisationincovid19-wiewlite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitisationincovid19-wiewlite.com"; sid:611451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dingteacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dingteacorona.com"; sid:611452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidnow.com"; sid:611453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectionforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectionforcovid.com"; sid:611454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ellumecovidhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ellumecovidhometest.com"; sid:611455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyeshieldcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyeshieldcovid19.com"; sid:611456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecovid19vaccine.com"; sid:611457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidconcierge.com"; sid:611458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for foreclosurepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"foreclosurepandemic.com"; sid:611459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronamedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronamedicine.com"; sid:611460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidmedicine.com"; sid:611461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtestingdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtestingdallas.com"; sid:611462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freemeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freemeofcovid.com"; sid:611463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuck-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuck-corona.com"; sid:611464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidcure.com"; sid:611465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotmycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotmycovidvaccine.com"; sid:611466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greensagainstcovidrepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greensagainstcovidrepression.com"; sid:611467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gulfcoastcovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gulfcoastcovidsurvivors.com"; sid:611468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for halloweencovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"halloweencovidmask.com"; sid:611469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hellonewlifecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hellonewlifecorona.com"; sid:611470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help2becovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help2becovidfree.com"; sid:611471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpcovid19hurtbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpcovid19hurtbusiness.com"; sid:611472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamaliveisurvivedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamaliveisurvivedcovid19.com"; sid:611473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamaliveisurvivedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamaliveisurvivedcovid.com"; sid:611474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for igotmycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"igotmycovidvaccine.com"; sid:611475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunoseqt-mapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunoseqt-mapcovid.com"; sid:611476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immunoseqtmapcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immunoseqtmapcovid.com"; sid:611477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for imovercovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"imovercovid19.com"; sid:611478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovidforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovidforum.com"; sid:611479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiancovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiancovidsurvivors.com"; sid:611480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infinitepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infinitepandemic.com"; sid:611481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inhomerapidcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inhomerapidcovidtest.com"; sid:611482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwastherecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwastherecovid-19.com"; sid:611483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jencoronacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jencoronacion.com"; sid:611484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jennifercoronacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jennifercoronacion.com"; sid:611485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for joannacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"joannacoronado.com"; sid:611486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kickittocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kickittocovid.com"; sid:611487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercovidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercovidkit.com"; sid:611488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for limit-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"limit-covid-19.com"; sid:611489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidrecovery.com"; sid:611490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidsupport.com"; sid:611491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makemasksofpandemicoptional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makemasksofpandemicoptional.com"; sid:611492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mein-corona-tagebuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mein-corona-tagebuch.com"; sid:611493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidswab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidswab.com"; sid:611494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mouthcovidconnection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mouthcovidconnection.com"; sid:611495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidjourney.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidjourney.us"; sid:611496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalremedyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalremedyforcoronavirus.com"; sid:611497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navajocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navajocovid19.com"; sid:611498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noninvasivecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noninvasivecoronavirustest.com"; sid:611499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noninvasivecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noninvasivecovid19test.com"; sid:611500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noninvasivecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noninvasivecovidtest.com"; sid:611501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdurhamcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdurhamcovid.com"; sid:611502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panamacovidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panamacovidinsurance.com"; sid:611503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicclassroom.com"; sid:611504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-computing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-computing.com"; sid:611505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccomputing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccomputing.com"; sid:611506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfly.com"; sid:611507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicglam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicglam.com"; sid:611508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmusicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmusicfestival.com"; sid:611509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparcel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparcel.com"; sid:611510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparentingsucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparentingsucks.com"; sid:611511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpillows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpillows.com"; sid:611512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpods.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpods.us"; sid:611513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpresents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpresents.com"; sid:611514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofadvertising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofadvertising.com"; sid:611515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproofspeaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproofspeaking.com"; sid:611516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics-borders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics-borders.com"; sid:611517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstreetwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstreetwear.com"; sid:611518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvoting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvoting.com"; sid:611519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pruebacovid--19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pruebacovid--19.com"; sid:611520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pulseracovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pulseracovid-19.com"; sid:611521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qthecoviddoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qthecoviddoc.com"; sid:611522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raisingawarenessofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raisingawarenessofcovid-19.com"; sid:611523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rapidinhomecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rapidinhomecovidtest.com"; sid:611524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rastreocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rastreocovid19.com"; sid:611525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcoronafraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcoronafraud.com"; sid:611526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safecovidsensors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safecovidsensors.com"; sid:611527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sanoficovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sanoficovid19vaccine.com"; sid:611528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shareyourcovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shareyourcovidstories.com"; sid:611529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sincovid.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sincovid.us"; sid:611530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for snortcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"snortcovid.com"; sid:611531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for statcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"statcovidtest.com"; sid:611532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stepidemics.com"; sid:611533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for steppingtogetherthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"steppingtogetherthrucovid.com"; sid:611534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for summitsafetycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"summitsafetycovid19.com"; sid:611535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenkasi-covidopdtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenkasi-covidopdtracker.com"; sid:611536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tenkasi-covidopttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tenkasi-covidopttracker.com"; sid:611537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidpromise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidpromise.com"; sid:611538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for theimpactofcovid19onbipoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"theimpactofcovid19onbipoc.com"; sid:611539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicgame.com"; sid:611540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemickids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemickids.com"; sid:611541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicprofessor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicprofessor.com"; sid:611542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcovidlaw.com"; sid:611543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tristatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tristatecovid19.com"; sid:611544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unmaskingcovid-19podcast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unmaskingcovid-19podcast.com"; sid:611545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidvaccine.com"; sid:611546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidvax.com"; sid:611547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for votingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"votingduringcovid.com"; sid:611548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancy.com"; sid:611549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanjingjun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanjingjun.com"; sid:611550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantiaoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantiaoma.com"; sid:611551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhengke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhengke.com"; sid:611552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanzhi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanzhi.com"; sid:611553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwdolneedacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwdolneedacovid19test.com"; sid:611554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xpowercovidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xpowercovidshields.com"; sid:611555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360covidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360covidcare.com"; sid:611556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcausescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcausescoronavirus.com"; sid:611557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a4covidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a4covidsupplies.com"; sid:611558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aurorcovidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aurorcovidvax.com"; sid:611559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for best-corona-solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"best-corona-solutions.com"; sid:611560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bildwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bildwuhan.com"; sid:611561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingandsellingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingandsellingduringcovid.com"; sid:611562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingduringcovid19.com"; sid:611563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyingduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyingduringcovid.com"; sid:611564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninecovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninecovidscreening.com"; sid:611565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caninecovidstoppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caninecovidstoppers.com"; sid:611566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carolinacovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carolinacovidtesting.com"; sid:611567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovidcompliance.com"; sid:611568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawichser.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawichser.club"; sid:611569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillers.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillers.app"; sid:611570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnews.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnews.app"; sid:611571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.biz"; sid:611572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviz.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviz.app"; sid:611573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovidalert.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovidalert.app"; sid:611574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicussion.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicussion.blog"; sid:611575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.blog"; sid:611576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidlies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidlies.com"; sid:611577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24covid.com"; sid:611578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360rapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360rapidcovidtesting.com"; sid:611579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afercovid.com"; sid:611580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amdcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amdcovid.com"; sid:611581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americaspandemic2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americaspandemic2020.com"; sid:611582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigencovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigencovid19.com"; sid:611583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigencovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigencovid19test.com"; sid:611584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigencovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigencovidtest.com"; sid:611585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigencovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigencovidtesting.com"; sid:611586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arequipa-contra-el-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arequipa-contra-el-covid.com"; sid:611587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atlantacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atlantacovidtest.com"; sid:611588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronasolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronasolutions.com"; sid:611589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19biz.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19biz.buzz"; sid:611590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19biz.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19biz.club"; sid:611591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19biz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19biz.com"; sid:611592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestpandemicbiz.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestpandemicbiz.buzz"; sid:611593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestpandemicbiz.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestpandemicbiz.club"; sid:611594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestpandemicbiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestpandemicbiz.com"; sid:611595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidarcovidhelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidarcovidhelpline.com"; sid:611596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathsciencecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathsciencecovid.com"; sid:611597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandfrederick.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandfrederick.club"; sid:611598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2021.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2021.cloud"; sid:611599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus21.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus21.cloud"; sid:611600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetest.app"; sid:611601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvoicetests.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvoicetests.app"; sid:611602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccioncovid.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccioncovid.cleaning"; sid:611603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teocuitatiandecorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teocuitatiandecorona.club"; sid:611604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidtestlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidtestlocations.com"; sid:611605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona2021.com"; sid:611606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19socialclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19socialclub.com"; sid:611607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for associazionecoronavirus.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"associazionecoronavirus.cloud"; sid:611608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atualizacaodeadesaocaixacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atualizacaodeadesaocaixacovid19.com"; sid:611609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b4covid2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b4covid2020.com"; sid:611610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcoronafree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcoronafree.com"; sid:611611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for befreeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"befreeofcorona.com"; sid:611612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blamethecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blamethecovid.com"; sid:611613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blowcovid.com"; sid:611614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidvaccine.com"; sid:611615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascovids.com"; sid:611616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.blog"; sid:611617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portraitofapandemic.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portraitofapandemic.blog"; sid:611618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidtests.com"; sid:611619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidsex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidsex.com"; sid:611620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for areyoucovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"areyoucovidsafe.com"; sid:611621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsafe.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsafe.care"; sid:611622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigboxretailcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigboxretailcovid.com"; sid:611623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blainecovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blainecovidstudy.com"; sid:611624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blankduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blankduringcovid.com"; sid:611625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camcovid.com"; sid:611626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchflightsnotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchflightsnotcovid.com"; sid:611627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesevoicescovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesevoicescovid19.com"; sid:611628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida.biz"; sid:611629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoffee.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoffee.club"; sid:611630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddate.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddate.app"; sid:611631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask.cloud"; sid:611632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.attorney - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.attorney"; sid:611633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpass.cash - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpass.cash"; sid:611634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceshop.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceshop.buzz"; sid:611635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 16covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"16covidtest.com"; sid:611636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20pandemic20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20pandemic20.com"; sid:611637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidprotection.com"; sid:611638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmayorista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmayorista.com"; sid:611639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsystems.com"; sid:611640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antypandemic.com"; sid:611641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidantigentest.com"; sid:611642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtestcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtestcenter.com"; sid:611643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareapandemicpod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareapandemicpod.com"; sid:611644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerkillscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerkillscorona.com"; sid:611645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cchcicovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cchcicovidtesting.com"; sid:611646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanerspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanerspro.com"; sid:611647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontrole.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontrole.app"; sid:611648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelmarseniorservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelmarseniorservices.com"; sid:611649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamobiledetailing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamobiledetailing.com"; sid:611650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovingservices.com"; sid:611651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-questions.com"; sid:611652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastudent.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastudent.blog"; sid:611653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19salivatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19salivatests.com"; sid:611654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectingservices.com"; sid:611655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelp.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelp.agency"; sid:611656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhole.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhole.com"; sid:611657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspraydisinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspraydisinfectant.com"; sid:611658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.blog"; sid:611659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19survival.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19survival.biz"; sid:611660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19survival.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19survival.club"; sid:611661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15mincovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15mincovidresults.com"; sid:611662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4411coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4411coronado.com"; sid:611663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anadelpilarcoronadosuarez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anadelpilarcoronadosuarez.com"; sid:611664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaprotection.com"; sid:611665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bonheur-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bonheur-covid.com"; sid:611666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chickemocovidmural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chickemocovidmural.com"; sid:611667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collincountycovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collincountycovidtests.com"; sid:611668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comeinfromthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comeinfromthecovid.com"; sid:611669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclinic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclinic.biz"; sid:611670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compensatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compensatie.com"; sid:611671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-construction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-construction.com"; sid:611672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadream.com"; sid:611673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahuntsman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahuntsman.com"; sid:611674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidkey.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidkey.app"; sid:611675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidkey.com"; sid:611676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillerportugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillerportugal.com"; sid:611677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilleruvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilleruvc.com"; sid:611678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutfits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutfits.com"; sid:611679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdenavidadparapuertas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdenavidadparapuertas.com"; sid:611680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-todohuken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-todohuken.com"; sid:611681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackerapp.com"; sid:611682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusear.com"; sid:611683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecoveryplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecoveryplan.com"; sid:611684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrijkamperen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrijkamperen.com"; sid:611685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couponcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couponcovid.com"; sid:611686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-15mintest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-15mintest.com"; sid:611687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronaworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronaworldwide.com"; sid:611688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19designfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19designfund.com"; sid:611689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19evictionandforeclosureorders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19evictionandforeclosureorders.com"; sid:611690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fwits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fwits.com"; sid:611691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19islavista.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19islavista.com"; sid:611692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid24x7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid24x7.com"; sid:611693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-control.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-control.biz"; sid:611694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidear.com"; sid:611695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventstest.com"; sid:611696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididkey.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididkey.app"; sid:611697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididkey.com"; sid:611698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidition.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidition.club"; sid:611699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeyid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeyid.com"; sid:611700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillerbeer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillerbeer.com"; sid:611701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsforsale.com"; sid:611702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidornaments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidornaments.com"; sid:611703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatefinancing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatefinancing.com"; sid:611704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefdesignfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefdesignfund.com"; sid:611705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidruinedeverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidruinedeverything.com"; sid:611706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetested.com"; sid:611707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsidehustles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsidehustles.com"; sid:611708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsm.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsm.art"; sid:611709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportgrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportgrant.com"; sid:611710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestequipment.com"; sid:611711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestevents.com"; sid:611712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingevents.com"; sid:611713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtinder.com"; sid:611714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrack.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrack.biz"; sid:611715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrishield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrishield.com"; sid:611716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidulations.com"; sid:611717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxx.com"; sid:611718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatedcovidcertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatedcovidcertification.com"; sid:611719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatlacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatlacovid.com"; sid:611720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derotacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derotacovid19.com"; sid:611721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derotaelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derotaelcovid.com"; sid:611722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derottacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derottacovid.com"; sid:611723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derrotacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derrotacovid19.com"; sid:611724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derrotacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derrotacovid.com"; sid:611725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for derrotalacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"derrotalacovid.com"; sid:611726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diggels-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diggels-covid.com"; sid:611727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diggelsobl-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diggelsobl-covid.com"; sid:611728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onoranzefunebricatania-coronasrls.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onoranzefunebricatania-coronasrls.business"; sid:611729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for relatoscovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"relatoscovid19.blog"; sid:611730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30mincovidtest.com"; sid:611731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircoronabook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircoronabook.com"; sid:611732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bikepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bikepandemic.com"; sid:611733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceibacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceibacoronavirus.com"; sid:611734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comeinoutofthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comeinoutofthecovid.com"; sid:611735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidtests.com"; sid:611736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-air.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-air.com"; sid:611737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablox.com"; sid:611738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-customer-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-customer-support.com"; sid:611739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomarketplace.com"; sid:611740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaelementary2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaelementary2020.com"; sid:611741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaformulier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaformulier.com"; sid:611742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahsa.com"; sid:611743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahse.com"; sid:611744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-scam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-scam.com"; sid:611745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingapp.com"; sid:611746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneysiliconvalley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneysiliconvalley.com"; sid:611747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushsa.com"; sid:611748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirmsiliconvalley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirmsiliconvalley.com"; sid:611749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussiliconvalleyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussiliconvalleyattorney.com"; sid:611750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussiliconvalleylawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussiliconvalleylawfirm.com"; sid:611751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawfirmsiliconvalley.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawfirmsiliconvalley.com"; sid:611752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nasalsprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nasalsprays.com"; sid:611753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19siliconvalleyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19siliconvalleyattorney.com"; sid:611754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travel.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travel.buzz"; sid:611755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-yoshio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-yoshio.com"; sid:611756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ajg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ajg.com"; sid:611757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcardamom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcardamom.com"; sid:611758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandcasinos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandcasinos.com"; sid:611759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterz.com"; sid:611760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuying.com"; sid:611761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcalisthenics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcalisthenics.com"; sid:611762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearevents.com"; sid:611763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcolleges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcolleges.com"; sid:611764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceplan.com"; sid:611765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceplans.com"; sid:611766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcups.com"; sid:611767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureindustries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureindustries.com"; sid:611768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideography.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideography.com"; sid:611769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventtest.com"; sid:611770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictionattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictionattorney.com"; sid:611771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictionlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictionlaw.com"; sid:611772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevictionrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevictionrights.com"; sid:611773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedose.com"; sid:611774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreepin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreepin.com"; sid:611775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhawaiitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhawaiitest.com"; sid:611776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpinghands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpinghands.com"; sid:611777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinthesipp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinthesipp.com"; sid:611778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjoker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjoker.com"; sid:611779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawcorp.com"; sid:611780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawpros.com"; sid:611781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalfirm.com"; sid:611782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnasalsprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnasalsprays.com"; sid:611783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonline.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonline.club"; sid:611784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonthego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonthego.com"; sid:611785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpayday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpayday.com"; sid:611786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidposmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidposmd.com"; sid:611787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidresultsmobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidresultsmobile.com"; sid:611788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestingevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestingevents.com"; sid:611789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyprogram.com"; sid:611790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsym.com"; sid:611791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest808.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest808.com"; sid:611792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkailua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkailua.com"; sid:611793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestoahu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestoahu.com"; sid:611794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackinghawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackinghawaii.com"; sid:611795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtri.com"; sid:611796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruthseekers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruthseekers.com"; sid:611797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduniversities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduniversities.com"; sid:611798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworklaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworklaw.com"; sid:611799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doindeedacovidtest19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doindeedacovidtest19.com"; sid:611800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flycovid19.com"; sid:611801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1daycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1daycovidtest.com"; sid:611802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2daycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2daycovidtest.com"; sid:611803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3daycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3daycovidtest.com"; sid:611804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcovidclean.com"; sid:611805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleghenycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleghenycovid.com"; sid:611806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-spray.com"; sid:611807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beapandemicsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beapandemicsurvivor.com"; sid:611808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid-19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid-19now.com"; sid:611809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovidtesting.com"; sid:611810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.barcelona - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.barcelona"; sid:611811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19helpdesk.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19helpdesk.biz"; sid:611812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spain.barcelona - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spain.barcelona"; sid:611813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevengeparties.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevengeparties.app"; sid:611814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for creativeepidemic.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"creativeepidemic.app"; sid:611815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourpandemicplan.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourpandemicplan.app"; sid:611816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for top-corona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"top-corona.club"; sid:611817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovid.com"; sid:611818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aeoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aeoncovid.com"; sid:611819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovidtest.com"; sid:611820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annihilatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annihilatecovid19.com"; sid:611821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apandemicrave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apandemicrave.com"; sid:611822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovidday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovidday.com"; sid:611823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birthdaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birthdaycovid.com"; sid:611824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dashboard.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dashboard.app"; sid:611825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dachienthangcovid2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dachienthangcovid2020.club"; sid:611826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gam-covid-vac.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gam-covid-vac.blog"; sid:611827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamcovidvac.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamcovidvac.blog"; sid:611828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidbusinessloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidbusinessloans.com"; sid:611829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidfunding.com"; sid:611830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidscrapbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidscrapbook.com"; sid:611831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 208covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"208covid.com"; sid:611832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agecovid.com"; sid:611833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aphroditepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aphroditepandemic.com"; sid:611834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arccovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arccovidcare.com"; sid:611835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspencovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspencovidtest.com"; sid:611836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcovid.com"; sid:611837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovid.com"; sid:611838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovidmasks.com"; sid:611839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bluezone-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bluezone-covid19.com"; sid:611840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcorona.com"; sid:611841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovid-19.com"; sid:611842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovid19.com"; sid:611843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecheck.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecheck.business"; sid:611844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafely.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafely.business"; sid:611845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.black"; sid:611846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-covid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-covid.center"; sid:611847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid19.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid19.best"; sid:611848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovidtesting.com"; sid:611849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovidtracking.com"; sid:611850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alexcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alexcoronado.com"; sid:611851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcostcovid.com"; sid:611852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avalon-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avalon-covid.com"; sid:611853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avanacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avanacoronado.com"; sid:611854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomeacovidtestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomeacovidtestingsite.com"; sid:611855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brittanycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brittanycorona.com"; sid:611856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronaviruscases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronaviruscases.com"; sid:611857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centercovidanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centercovidanalytics.com"; sid:611858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childrencovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childrencovid19vaccine.com"; sid:611859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contactecovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contactecovid.cat"; sid:611860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisaster.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisaster.club"; sid:611861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.ceo - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.ceo"; sid:611862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivaccinatecovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivaccinatecovid19.app"; sid:611863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfilm.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfilm.club"; sid:611864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecoronatest.com"; sid:611865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidtracetrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidtracetrack.com"; sid:611866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5secondcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5secondcovid.com"; sid:611867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5secondcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5secondcovidtest.com"; sid:611868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 777coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"777coronado.com"; sid:611869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accioncivilcoronavirus.abogado - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accioncivilcoronavirus.abogado"; sid:611870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancedcovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancedcovidcare.com"; sid:611871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afbcovid19viz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afbcovid19viz.com"; sid:611872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovidbriefings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovidbriefings.com"; sid:611873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-covid-thailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-covid-thailand.com"; sid:611874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bicyclepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bicyclepandemic.com"; sid:611875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.club"; sid:611876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycusvcovid911foreignaerialvirusvsnycworldtrade.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycusvcovid911foreignaerialvirusvsnycworldtrade.center"; sid:611877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14covid19.com"; sid:611878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2mincovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2mincovidtest.com"; sid:611879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2minutecovidtest.com"; sid:611880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronajoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronajoke.com"; sid:611881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acoronawedding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acoronawedding.com"; sid:611882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aid-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aid-pandemic.com"; sid:611883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19supplies.com"; sid:611884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19suppliestn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19suppliestn.com"; sid:611885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidsupplies.com"; sid:611886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibodycovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibodycovid19testkit.com"; sid:611887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidcare.com"; sid:611888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocovidbolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocovidbolivia.com"; sid:611889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcovidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcovidbook.com"; sid:611890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinaanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinaanticovid.com"; sid:611891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondoz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondoz.com"; sid:611892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-exosom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-exosom.com"; sid:611893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakurs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakurs.com"; sid:611894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuredrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuredrug.com"; sid:611895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuredrugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuredrugs.com"; sid:611896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusessential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusessential.com"; sid:611897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslonghauler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslonghauler.com"; sid:611898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aftercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aftercare.com"; sid:611899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ceu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ceu.com"; sid:611900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ctrisklevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ctrisklevel.com"; sid:611901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19curedrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19curedrug.com"; sid:611902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ei.com"; sid:611903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerresource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerresource.com"; sid:611904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employerresources.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employerresources.com"; sid:611905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employertest.com"; sid:611906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rehabilitation.com"; sid:611907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19saliva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19saliva.com"; sid:611908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-saliva-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-saliva-test.com"; sid:611909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19schoolalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19schoolalert.com"; sid:611910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19schoolalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19schoolalert.com"; sid:611911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineindia.com"; sid:611912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.auction - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.auction"; sid:611913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbilitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbilitigation.com"; sid:611914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathingrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathingrehab.com"; sid:611915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathrehab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathrehab.com"; sid:611916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapstore.com"; sid:611917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashflowrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashflowrelief.com"; sid:611918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristians.com"; sid:611919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.blog"; sid:611920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanner.com"; sid:611921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollegefeet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollegefeet.com"; sid:611922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconservatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconservatives.com"; sid:611923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoppercoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoppercoin.com"; sid:611924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuredrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuredrug.com"; sid:611925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoover.com"; sid:611926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-drivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-drivethru.com"; sid:611927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidei.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidei.com"; sid:611928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeentertainment.com"; sid:611929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersnj.com"; sid:611930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyersny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyersny.com"; sid:611931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-logopedist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-logopedist.com"; sid:611932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplug.com"; sid:611933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-speechcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-speechcoach.com"; sid:611934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-speechtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-speechtherapy.com"; sid:611935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuppliestn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuppliestn.com"; sid:611936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest813.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest813.com"; sid:611937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttampafl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttampafl.com"; sid:611938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduvcdisinfectantlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduvcdisinfectantlight.com"; sid:611939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusbellcurve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusbellcurve.com"; sid:611940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crownsforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crownsforcorona.com"; sid:611941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19coviders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19coviders.com"; sid:611942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1hrcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1hrcovidtest.com"; sid:611943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 305covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"305covidtest.com"; sid:611944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acvacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acvacovid19.com"; sid:611945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aterescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aterescorona.com"; sid:611946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for auroracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"auroracovid.com"; sid:611947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for back2workcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"back2workcovid.com"; sid:611948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantaicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantaicovid.com"; sid:611949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baricovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baricovidfree.com"; sid:611950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bolognacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bolognacovidfree.com"; sid:611951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bresciacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bresciacovidfree.com"; sid:611952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brianzacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brianzacovidfree.com"; sid:611953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bringcovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bringcovidhome.com"; sid:611954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessesthathavebenefittedbycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessesthathavebenefittedbycovid19.com"; sid:611955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessesthathavebenefittedbycovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessesthathavebenefittedbycovidvirus.com"; sid:611956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessesthathavebenefittedfromcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessesthathavebenefittedfromcovidvirus.com"; sid:611957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessnotaffectedbycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessnotaffectedbycovid.com"; sid:611958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancerundercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancerundercovid.com"; sid:611959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cataniacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cataniacovidfree.com"; sid:611960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidvirus.com"; sid:611961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegiatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegiatecoronavirus.com"; sid:611962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy-club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy-club.com"; sid:611963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachub.com"; sid:611964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachubfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachubfitness.com"; sid:611965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaequals666.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaequals666.com"; sid:611966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-flights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-flights.com"; sid:611967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-homeoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-homeoffice.com"; sid:611968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-iptv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-iptv.com"; sid:611969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajourneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajourneys.com"; sid:611970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakahar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakahar.com"; sid:611971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamimos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamimos.com"; sid:611972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-entertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-entertainment.com"; sid:611973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarmer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarmer.com"; sid:611974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaid.com"; sid:611975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivedatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivedatas.com"; sid:611976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.builders - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.builders"; sid:611977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronatests.com"; sid:611978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavaccine.com"; sid:611979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavaccines.com"; sid:611980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hasnotaffectedus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hasnotaffectedus.com"; sid:611981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19informationandselfcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19informationandselfcare.com"; sid:611982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19salivatestdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19salivatestdirect.com"; sid:611983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shopsomalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shopsomalia.com"; sid:611984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalchemy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalchemy.com"; sid:611985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandmemes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandmemes.com"; sid:611986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidattestation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidattestation.com"; sid:611987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.bike - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.bike"; sid:611988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbike.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbike.com"; sid:611989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbmx.com"; sid:611990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooklet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooklet.com"; sid:611991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcannotcancelchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcannotcancelchristmas.com"; sid:611992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-classroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-classroom.com"; sid:611993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleaningkits.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleaningkits.biz"; sid:611994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleaningkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleaningkits.com"; sid:611995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomesalong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomesalong.com"; sid:611996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cone.com"; sid:611997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoes.com"; sid:611998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddontsleep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddontsleep.com"; sid:611999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexperttweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexperttweets.com"; sid:612000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreshman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreshman.com"; sid:612001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoestocollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoestocollege.com"; sid:612002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgoestoschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgoestoschool.com"; sid:612003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhates.com"; sid:612004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhatesmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhatesmasks.com"; sid:612005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhatesyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhatesyou.com"; sid:612006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisascoividoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisascoividoes.com"; sid:612007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiswithstupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiswithstupid.com"; sid:612008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledyou.com"; sid:612009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillsall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillsall.com"; sid:612010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillshumansdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillshumansdead.com"; sid:612011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillskaren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillskaren.com"; sid:612012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillskarens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillskarens.com"; sid:612013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillsyoudead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillsyoudead.com"; sid:612014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlessonslearned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlessonslearned.com"; sid:612015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlims.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlims.app"; sid:612016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloves.com"; sid:612017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovesyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovesyou.com"; sid:612018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmic.com"; sid:612019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneedsyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneedsyou.com"; sid:612020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnih.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnih.com"; sid:612021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnofear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnofear.com"; sid:612022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpartieshard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpartieshard.com"; sid:612023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppe19stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppe19stat.com"; sid:612024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidppestat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidppestat.com"; sid:612025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidranchomirage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidranchomirage.com"; sid:612026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefplan.com"; sid:612027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecleaners.com"; sid:612028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetours.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetours.app"; sid:612029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stick.com"; sid:612030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstracking.com"; sid:612031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorfoundation.com"; sid:612032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsfoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsfoundations.com"; sid:612033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorsintexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorsintexas.com"; sid:612034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtech.com"; sid:612035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracksb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracksb.com"; sid:612036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineupdates.com"; sid:612037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwantsyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwantsyou.com"; sid:612038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontbringcovidhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontbringcovidhome.com"; sid:612039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebc-covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebc-covidtesting.com"; sid:612040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fluorcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fluorcovid19.com"; sid:612041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.blog"; sid:612042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scientiacoronat.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scientiacoronat.biz"; sid:612043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accovidly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accovidly.com"; sid:612044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alternuseneecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alternuseneecovid19.com"; sid:612045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ambientesemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ambientesemcovid.com"; sid:612046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19serum.com"; sid:612047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.academy"; sid:612048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidserum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidserum.com"; sid:612049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for back2schoolincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"back2schoolincovid19.com"; sid:612050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestflooringstorecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestflooringstorecorona.com"; sid:612051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercovidvaccine.com"; sid:612052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bouncebackfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bouncebackfromcovid.com"; sid:612053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathablecovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathablecovidmasks.com"; sid:612054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiarapidcovidtestin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiarapidcovidtestin.com"; sid:612055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19officers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19officers.com"; sid:612056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona7.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona7.club"; sid:612057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-app.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-app.app"; sid:612058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapp.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapp.app"; sid:612059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warn-app.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warn-app.app"; sid:612060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-warnapp.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-warnapp.app"; sid:612061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarnapp.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarnapp.app"; sid:612062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamdanhbaicovid2020.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamdanhbaicovid2020.buzz"; sid:612063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1checkcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1checkcovid.app"; sid:612064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africorona.org"; sid:612065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19serum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19serum.net"; sid:612066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidserum.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidserum.net"; sid:612067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entschuldung.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entschuldung.info"; sid:612068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaentschuldung.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaentschuldung.info"; sid:612069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-entschuldungsgesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-entschuldungsgesetz.info"; sid:612070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaentschuldungsgesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaentschuldungsgesetz.info"; sid:612071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-insolvenz.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-insolvenz.org"; sid:612072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-moratorium-gesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-moratorium-gesetz.info"; sid:612073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoratorium-gesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoratorium-gesetz.info"; sid:612074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-neustart-gesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-neustart-gesetz.info"; sid:612075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneustartgesetz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneustartgesetz.info"; sid:612076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-neustart.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-neustart.info"; sid:612077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneustart.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneustart.info"; sid:612078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-pseudonym.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-pseudonym.app"; sid:612079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapseudonym.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapseudonym.app"; sid:612080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.computer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.computer"; sid:612081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslive.consulting - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslive.consulting"; sid:612082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fake.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fake.info"; sid:612083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19japan.money - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19japan.money"; sid:612084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcle.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcle.org"; sid:612085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideas20reu.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideas20reu.org"; sid:612086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelba.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelba.online"; sid:612087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pseudonym.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pseudonym.app"; sid:612088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpseudonym.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpseudonym.app"; sid:612089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskposture.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskposture.org"; sid:612090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-screen.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-screen.org"; sid:612091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesti.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesti.org"; sid:612092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatment.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatment.center"; sid:612093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvax.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvax.center"; sid:612094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxcenter.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxcenter.info"; sid:612095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxcenter.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxcenter.org"; sid:612096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatcharizona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatcharizona.info"; sid:612097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatcharizona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatcharizona.org"; sid:612098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchaz.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchaz.info"; sid:612099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchaz.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchaz.org"; sid:612100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovid19.org"; sid:612101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indouscovidcare.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indouscovidcare.org"; sid:612102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidtherapy.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidtherapy.org"; sid:612103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidtreatment.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidtreatment.org"; sid:612104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicphotography.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicphotography.net"; sid:612105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.madrid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.madrid"; sid:612106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidu.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidu.online"; sid:612107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinaanticovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinaanticovid19.net"; sid:612108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacinaanticovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacinaanticovid.net"; sid:612109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for verbundenheitincorona.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"verbundenheitincorona.online"; sid:612110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vietnamdanhbaicovid2020.cyou - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vietnamdanhbaicovid2020.cyou"; sid:612111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 23wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"23wuhan.com"; sid:612112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for altiuscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"altiuscovid.com"; sid:612113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19-korea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19-korea.com"; sid:612114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19mask.com"; sid:612115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamascovidtest.com"; sid:612116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b-corona.com"; sid:612117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bettercoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bettercoviddata.com"; sid:612118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buswuhan.com"; sid:612119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19facemask.com"; sid:612120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadian-pandemic-institute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadian-pandemic-institute.com"; sid:612121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadianpandemicinstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadianpandemicinstitute.com"; sid:612122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collectifcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collectifcovid.com"; sid:612123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19facemasks.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19facemasks.biz"; sid:612124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19friendly.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19friendly.app"; sid:612125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnosecondom.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnosecondom.biz"; sid:612126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidwebsites.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidwebsites.blog"; sid:612127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicwebsites.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicwebsites.blog"; sid:612128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 13330greenmountaindrcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"13330greenmountaindrcorona.com"; sid:612129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aberdeencovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aberdeencovid19testing.com"; sid:612130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazon-early-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazon-early-covid.com"; sid:612131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assolombardacovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assolombardacovidfree.com"; sid:612132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bocasanamenoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bocasanamenoscovid.com"; sid:612133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannabisdeliverycoronadelmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannabisdeliverycoronadelmar.com"; sid:612134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleanawaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleanawaycovid.com"; sid:612135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for condaxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"condaxcovidtest.com"; sid:612136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consensus-conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consensus-conference.com"; sid:612137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsensusconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsensusconference.com"; sid:612138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoclan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoclan.com"; sid:612139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecar.com"; sid:612140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoodsca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoodsca.com"; sid:612141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainflu.com"; sid:612142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakontakt.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakontakt.app"; sid:612143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorialpark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorialpark.com"; sid:612144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzschirmverfahren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzschirmverfahren.com"; sid:612145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzschirmverfahren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzschirmverfahren.com"; sid:612146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmelltraining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmelltraining.com"; sid:612147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingfl.com"; sid:612148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingflorida.com"; sid:612149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestinginstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestinginstitute.com"; sid:612150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationr.com"; sid:612151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationregistrars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationregistrars.com"; sid:612152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacinne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacinne.com"; sid:612153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19andlifeinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19andlifeinsurance.com"; sid:612154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19angels.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19angels.club"; sid:612155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chart.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chart.app"; sid:612156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectionhelp.com"; sid:612157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hiperstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hiperstore.com"; sid:612158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moron.com"; sid:612159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrcertificate.com"; sid:612160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventionstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventionstudy.com"; sid:612161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reform.com"; sid:612162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-seoul-publicart-project.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-seoul-publicart-project.com"; sid:612163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shot2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shot2go.com"; sid:612164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19transports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19transports.com"; sid:612165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19treatmentstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19treatmentstudy.com"; sid:612166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedata.com"; sid:612167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20study.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20study.com"; sid:612168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid459.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid459.com"; sid:612169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidacine.com"; sid:612170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodystudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodystudy.com"; sid:612171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaround.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaround.com"; sid:612172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaby.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaby.club"; sid:612173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceny.com"; sid:612174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconvention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconvention.com"; sid:612175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectionhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectionhelp.com"; sid:612176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidessay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidessay.com"; sid:612177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgushers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgushers.com"; sid:612178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpwanted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpwanted.com"; sid:612179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiccine.com"; sid:612180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkimmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkimmy.com"; sid:612181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmakeover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmakeover.com"; sid:612182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmassage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmassage.com"; sid:612183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonologues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonologues.com"; sid:612184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoron.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoron.com"; sid:612185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprecheck.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprecheck.app"; sid:612186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionstudy.com"; sid:612187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprompt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprompt.com"; sid:612188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskrating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskrating.com"; sid:612189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsexclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsexclub.com"; sid:612190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshot2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshot2go.com"; sid:612191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstresschallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstresschallenge.com"; sid:612192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtennial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtennial.com"; sid:612193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginstitute.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginstitute.com"; sid:612194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtampabay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtampabay.com"; sid:612195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimemap.com"; sid:612196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransports.com"; sid:612197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-uaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-uaries.com"; sid:612198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinjuryattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinjuryattorney.com"; sid:612199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixsupply.com"; sid:612200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcoholpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcoholpandemic.com"; sid:612201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazingcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazingcoronamask.com"; sid:612202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazingcovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazingcovidmask.com"; sid:612203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronastatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronastatistics.com"; sid:612204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitacoracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitacoracovid.com"; sid:612205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bureaucovid19arrete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bureaucovid19arrete.com"; sid:612206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacoronastatistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacoronastatistics.com"; sid:612207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canitrustthiscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canitrustthiscovidtest.com"; sid:612208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ckeckcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ckeckcovid.com"; sid:612209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clecovidservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clecovidservice.com"; sid:612210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clecovidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clecovidservices.com"; sid:612211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovid.com"; sid:612212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcovidservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcovidservices.com"; sid:612213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congress-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congress-covid19.com"; sid:612214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-culture.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-culture.club"; sid:612215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoemdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoemdr.com"; sid:612216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadolandscapelighting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadolandscapelighting.com"; sid:612217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuseum.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuseum.berlin"; sid:612218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofventilation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofventilation.com"; sid:612219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasteunpunten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasteunpunten.com"; sid:612220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasummer2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasummer2021.com"; sid:612221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmds.com"; sid:612222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19communitystudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19communitystudy.com"; sid:612223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectingnearme.com"; sid:612224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fashionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fashionmasks.com"; sid:612225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fashionwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fashionwear.com"; sid:612226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskwear.com"; sid:612227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskwears.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskwears.com"; sid:612228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizinglongbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizinglongbeach.com"; sid:612229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizingnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizingnearme.com"; sid:612230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19serviceslongbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19serviceslongbeach.com"; sid:612231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usdata.com"; sid:612232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20apparel.com"; sid:612233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20facefashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20facefashion.com"; sid:612234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20facefashions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20facefashions.com"; sid:612235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20maskdesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20maskdesigns.com"; sid:612236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreationsconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreationsconcert.com"; sid:612237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuremalaysia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuremalaysia.com"; sid:612238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacecondoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacecondoms.com"; sid:612239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashionmaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashionmaskshop.com"; sid:612240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfashionwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfashionwear.com"; sid:612241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesafetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesafetravel.com"; sid:612242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-marshals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-marshals.com"; sid:612243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskscanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskscanada.com"; sid:612244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmum.com"; sid:612245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-obit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-obit.com"; sid:612246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatios.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatios.com"; sid:612247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-studies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-studies.com"; sid:612248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtriptest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtriptest.com"; sid:612249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3900coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3900coronado.com"; sid:612250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aforocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aforocovid.com"; sid:612251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronajokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronajokes.com"; sid:612252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19rapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19rapidtest.com"; sid:612253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biolabcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biolabcovid19test.com"; sid:612254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biolabcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biolabcovidtest.com"; sid:612255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bucovid19.com"; sid:612256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buymycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buymycovidtest.com"; sid:612257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codecorona.com"; sid:612258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbiacovidfails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbiacovidfails.com"; sid:612259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantikortestkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantikortestkiti.com"; sid:612260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabustersusvi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabustersusvi.com"; sid:612261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacavalcafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacavalcafe.com"; sid:612262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachillhoodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachillhoodies.com"; sid:612263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoinscommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoinscommunity.com"; sid:612264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado211.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado211.com"; sid:612265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gaesteliste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gaesteliste.com"; sid:612266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaryclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaryclinic.com"; sid:612267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation60124.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation60124.com"; sid:612268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationng.com"; sid:612269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavidades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavidades.com"; sid:612270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavishop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavishop.com"; sid:612271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bitch.com"; sid:612272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inreview.com"; sid:612273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kusagi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kusagi.com"; sid:612274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mommy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mommy.com"; sid:612275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19researchstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19researchstudy.com"; sid:612276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19setofficer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19setofficer.com"; sid:612277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19temple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19temple.com"; sid:612278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid425rich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid425rich.com"; sid:612279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaboration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaboration.com"; sid:612280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbitch.com"; sid:612281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconciergefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconciergefl.com"; sid:612282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfightersgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfightersgroup.com"; sid:612283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardcanadaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardcanadaclub.com"; sid:612284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardcostaricaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardcostaricaclub.com"; sid:612285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardecuadorclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardecuadorclub.com"; sid:612286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardpanamaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardpanamaclub.com"; sid:612287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardperuclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardperuclub.com"; sid:612288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardpuertoricoclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardpuertoricoclub.com"; sid:612289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguatemalaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguatemalaclub.com"; sid:612290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidifghter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidifghter.com"; sid:612291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioxide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioxide.com"; sid:612292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisbad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisbad.com"; sid:612293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisfraud.com"; sid:612294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkerala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkerala.com"; sid:612295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeyshop.com"; sid:612296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkusagi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkusagi.com"; sid:612297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverwatchblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverwatchblog.com"; sid:612298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverwatch.com"; sid:612299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplusstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplusstrong.com"; sid:612300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoems.com"; sid:612301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotest.com"; sid:612302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidratio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidratio.com"; sid:612303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebiznews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebiznews.com"; sid:612304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferestaurants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferestaurants.com"; sid:612305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyapp.com"; sid:612306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysupervisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysupervisor.com"; sid:612307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-smell-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-smell-test.com"; sid:612308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrat.com"; sid:612309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestim.com"; sid:612310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpunt.com"; sid:612311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestpunten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestpunten.com"; sid:612312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestyou.com"; sid:612313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrailer.com"; sid:612314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diycovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diycovid19test.com"; sid:612315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3810coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3810coronado.com"; sid:612316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agricolaecovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agricolaecovida.com"; sid:612317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allbecauseofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allbecauseofcovid.com"; sid:612318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andrescoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andrescoronado.com"; sid:612319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atacacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atacacovid.com"; sid:612320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athletecovidhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athletecovidhealth.com"; sid:612321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becauseofcovidi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becauseofcovidi.com"; sid:612322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigpharmacovidagenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigpharmacovidagenda.com"; sid:612323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultorescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultorescovid.com"; sid:612324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotherapyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotherapyservices.com"; sid:612325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatijd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatijd.com"; sid:612326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreathalyzertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreathalyzertest.com"; sid:612327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdistresssale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdistresssale.com"; sid:612328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusointment.com"; sid:612329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ware.com"; sid:612330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bulksuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bulksuppliers.com"; sid:612331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19combattools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19combattools.com"; sid:612332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ipcgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ipcgrants.com"; sid:612333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ointment.com"; sid:612334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ppesurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ppesurplus.com"; sid:612335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19preventionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19preventionnetwork.com"; sid:612336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19risktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19risktest.com"; sid:612337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safeemployer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safeemployer.com"; sid:612338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sudoku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sudoku.com"; sid:612339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakthrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakthrough.com"; sid:612340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakthroughtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakthroughtherapy.com"; sid:612341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakthru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakthru.com"; sid:612342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreathalysertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreathalysertest.com"; sid:612343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.biz"; sid:612344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddailytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddailytest.com"; sid:612345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthadvice.com"; sid:612346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmotion.com"; sid:612347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidointment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidointment.com"; sid:612348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmacure.com"; sid:612349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpom.com"; sid:612350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickie.com"; sid:612351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrawings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrawings.com"; sid:612352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecollective.com"; sid:612353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetybundle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetybundle.com"; sid:612354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyguard.com"; sid:612355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyguards.com"; sid:612356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshortsales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshortsales.com"; sid:612357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercovid.club"; sid:612358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstrategies.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstrategies.app"; sid:612359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachcovid.app"; sid:612360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 15minutecovid19tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"15minutecovid19tests.com"; sid:612361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20mincovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20mincovid19testkit.com"; sid:612362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20mincovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20mincovidtests.com"; sid:612363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourscovid.com"; sid:612364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 997covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"997covid19.com"; sid:612365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesoscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesoscovid.com"; sid:612366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agrosonics-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agrosonics-covid19.com"; sid:612367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agrosonics-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agrosonics-covid.com"; sid:612368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-folie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-folie.com"; sid:612369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsystem.com"; sid:612370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacovid19tracker.com"; sid:612371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamamadrama.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamamadrama.blog"; sid:612372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller.biz"; sid:612373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20gbdestekweb-covid19trgirisleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20gbdestekweb-covid19trgirisleriniz.com"; sid:612374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.bayern"; sid:612375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaring.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaring.club"; sid:612376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtesting.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtesting.app"; sid:612377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nachcorona.blue - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nachcorona.blue"; sid:612378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.buzz"; sid:612379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stcovidtesting.com"; sid:612380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20gbdestek-webcovid19tr-girisleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20gbdestek-webcovid19tr-girisleriniz.com"; sid:612381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abbottcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abbottcovid.com"; sid:612382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancecovidtest.com"; sid:612383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncoronavirustracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncoronavirustracing.com"; sid:612384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid-19tracker.com"; sid:612385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid19tracker.com"; sid:612386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocoronavirustracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocoronavirustracer.com"; sid:612387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocoronavirustracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocoronavirustracing.com"; sid:612388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocovid19tracer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocovid19tracer.com"; sid:612389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocovid-19tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocovid-19tracing.com"; sid:612390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocovid19tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocovid19tracing.com"; sid:612391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocovid-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocovid-19tracker.com"; sid:612392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazonhalocovid19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazonhalocovid19tracker.com"; sid:612393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaw.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaw.center"; sid:612394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalife.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalife.blog"; sid:612395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milancovidfree.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milancovidfree.biz"; sid:612396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1111covidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1111covidproject.com"; sid:612397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2072corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2072corona.com"; sid:612398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ace-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ace-corona.com"; sid:612399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americafightscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americafightscovid.com"; sid:612400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomeaacovidtestingsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomeaacovidtestingsite.com"; sid:612401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for binaxnowcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"binaxnowcovid19.com"; sid:612402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chillpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chillpandemic.com"; sid:612403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concienciacioncontraelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concienciacioncontraelcovid-19.com"; sid:612404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confidentialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confidentialcovid.com"; sid:612405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocaysquartershare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocaysquartershare.com"; sid:612406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocaysquartershares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocaysquartershares.com"; sid:612407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoquartershare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoquartershare.com"; sid:612408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoquartershares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoquartershares.com"; sid:612409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaname.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaname.app"; sid:612410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-name.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-name.com"; sid:612411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarybypassoperation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarybypassoperation.com"; sid:612412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasdecumpleanos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasdecumpleanos.com"; sid:612413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashieldindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashieldindia.com"; sid:612414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-411.com"; sid:612415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostickit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostickit.com"; sid:612416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinereport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinereport.com"; sid:612417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19frontlinereview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19frontlinereview.com"; sid:612418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesalivacollectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesalivacollectionkit.com"; sid:612419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesalivacollectiontestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesalivacollectiontestkit.com"; sid:612420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lies2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lies2020.com"; sid:612421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19losscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19losscounseling.com"; sid:612422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19productionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19productionservices.com"; sid:612423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingcenters.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingcenters.biz"; sid:612424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingcenters.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingcenters.club"; sid:612425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alabama.com"; sid:612426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidawaytoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidawaytoday.com"; sid:612427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbovid.com"; sid:612428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterpro.com"; sid:612429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterpros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterpros.com"; sid:612430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidca19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidca19.com"; sid:612431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearevents.com"; sid:612432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectioncleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectioncleaners.com"; sid:612433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluspray.com"; sid:612434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhizlitestkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhizlitestkiti.com"; sid:612435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscurable.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscurable.com"; sid:612436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiscured.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiscured.com"; sid:612437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidname.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidname.app"; sid:612438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-name.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-name.com"; sid:612439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidname.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidname.com"; sid:612440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpals.com"; sid:612441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafearrival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafearrival.com"; sid:612442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyofficers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyofficers.com"; sid:612443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetystaffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetystaffing.com"; sid:612444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolfeeding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolfeeding.com"; sid:612445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolfoodprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolfoodprogram.com"; sid:612446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecialisthawaii.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecialisthawaii.com"; sid:612447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucks.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucks.club"; sid:612448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvival4djs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvival4djs.com"; sid:612449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtenantrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtenantrelief.com"; sid:612450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidurinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidurinetest.com"; sid:612451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for meincoronaname.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"meincoronaname.app"; sid:612452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidname.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidname.app"; sid:612453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actuarcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actuarcovid.com"; sid:612454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aradwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aradwuhan.com"; sid:612455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bashcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bashcovid19.com"; sid:612456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovid19frontlinehousing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovid19frontlinehousing.com"; sid:612457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clenstacovidlotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clenstacovidlotion.com"; sid:612458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagaming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagaming.com"; sid:612459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidsmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidsmovie.com"; sid:612460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakes.com"; sid:612461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationherbal.com"; sid:612462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-uncovered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-uncovered.com"; sid:612463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscondom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscondom.com"; sid:612464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskon.com"; sid:612465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayercandles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayercandles.com"; sid:612466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseatbelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseatbelt.com"; sid:612467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coveryourcovidcracks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coveryourcovidcracks.com"; sid:612468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ag.com"; sid:612469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19agtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19agtest.com"; sid:612470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bigdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bigdata.com"; sid:612471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qn.com"; sid:612472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tellme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tellme.com"; sid:612473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test.app"; sid:612474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-5k.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-5k.com"; sid:612475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartonline.com"; sid:612476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck-in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck-in.com"; sid:612477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclusterbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclusterbuster.com"; sid:612478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktail.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktail.club"; sid:612479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultingcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultingcorp.com"; sid:612480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidelectrostatic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidelectrostatic.com"; sid:612481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgunlukleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgunlukleri.com"; sid:612482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidh2o.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidh2o.com"; sid:612483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskauthority.com"; sid:612484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpitracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpitracker.com"; sid:612485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidqn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidqn.com"; sid:612486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesupply.com"; sid:612487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseatbelt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseatbelt.com"; sid:612488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurfacekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurfacekit.com"; sid:612489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingonset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingonset.com"; sid:612490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusof2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusof2020.com"; sid:612491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsups.com"; sid:612492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicliteracy.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicliteracy.academy"; sid:612493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona-plan.com"; sid:612494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anoncovidtext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anoncovidtext.com"; sid:612495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asapcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asapcovidtest.com"; sid:612496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austcovid-19conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austcovid-19conference.com"; sid:612497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babyitscovidoutside.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babyitscovidoutside.com"; sid:612498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid.com"; sid:612499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closedduetocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closedduetocovid-19.com"; sid:612500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19wear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19wear.com"; sid:612501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfectingservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfectingservice.com"; sid:612502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kontaktliste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kontaktliste.com"; sid:612503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakontaktliste.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakontaktliste.com"; sid:612504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-music.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-music.com"; sid:612505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastars2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastars2020.com"; sid:612506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-systems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-systems.com"; sid:612507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinum.com"; sid:612508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawaarheid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawaarheid.com"; sid:612509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthdisparities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthdisparities.com"; sid:612510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-ithaca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-ithaca.com"; sid:612511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testfortlauderdale.com"; sid:612512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-therapeutic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-therapeutic.com"; sid:612513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidciemasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidciemasafe.com"; sid:612514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-deals.com"; sid:612515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreegreece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreegreece.com"; sid:612516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoviesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoviesafe.com"; sid:612517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidantigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidantigen.com"; sid:612518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sign.com"; sid:612519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-systems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-systems.com"; sid:612520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestfortlauderdale.com"; sid:612521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingunit.com"; sid:612522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-miami.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-miami.com"; sid:612523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheatersafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheatersafe.com"; sid:612524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacunaperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacunaperu.com"; sid:612525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweekstation.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweekstation.biz"; sid:612526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweekstation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweekstation.com"; sid:612527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcovid19.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcovid19.clinic"; sid:612528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covid.com"; sid:612529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2022covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2022covid.com"; sid:612530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2023covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2023covid.com"; sid:612531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2ndpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2ndpandemic.com"; sid:612532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 555wuhanjiluyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"555wuhanjiluyi.com"; sid:612533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5wuhanjiluyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5wuhanjiluyi.com"; sid:612534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arturocorona520.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arturocorona520.com"; sid:612535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aseoscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aseoscovid19.com"; sid:612536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badgecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badgecovid19.com"; sid:612537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19treatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19treatment.com"; sid:612538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-aml.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-aml.cloud"; sid:612539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscovid-19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscovid-19.cat"; sid:612540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abreathoffreshaircovid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abreathoffreshaircovid-19cleaning.com"; sid:612541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acsd1-covid-phoenixlearning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acsd1-covid-phoenixlearning.com"; sid:612542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovidsecureapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovidsecureapp.com"; sid:612543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alivioporcovidensacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alivioporcovidensacramento.com"; sid:612544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidsolutions.com"; sid:612545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronaviruscure.com"; sid:612546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirustest.com"; sid:612547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovid19masks.com"; sid:612548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidtreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidtreatment.com"; sid:612549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid.app"; sid:612550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teachinginthetimeofcorona.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teachinginthetimeofcorona.blog"; sid:612551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20mincovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20mincovidresults.com"; sid:612552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20minutecovid19testkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20minutecovid19testkits.com"; sid:612553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20minutecovidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20minutecovidtestkits.com"; sid:612554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 40avenidacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"40avenidacorona.com"; sid:612555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidco.com"; sid:612556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovidonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovidonline.com"; sid:612557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonapandemic.com"; sid:612558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chakracorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chakracorona.com"; sid:612559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine.buzz"; sid:612560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19superfighters.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19superfighters.app"; sid:612561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketing.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketing.agency"; sid:612562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.buzz"; sid:612563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparadise.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparadise.club"; sid:612564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparty.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparty.club"; sid:612565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 543coronationdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"543coronationdrive.com"; sid:612566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bftcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bftcovid.com"; sid:612567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmycovid.com"; sid:612568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmycovidtest.com"; sid:612569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensation.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensation.cloud"; sid:612570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apfightscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apfightscorona.com"; sid:612571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aprendahacercoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aprendahacercoronas.com"; sid:612572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artmcovid.com"; sid:612573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atacaalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atacaalcovid.com"; sid:612574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bryantcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bryantcovid.com"; sid:612575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centromedicovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centromedicovida.com"; sid:612576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colinscovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colinscovidcare.com"; sid:612577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconway.com"; sid:612578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocleaningjanitorialservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocleaningjanitorialservices.com"; sid:612579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clients.com"; sid:612580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensation.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensation.app"; sid:612581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19freetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19freetravel.com"; sid:612582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutionsforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutionsforemployers.com"; sid:612583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sprevention.com"; sid:612584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thegreatreset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thegreatreset.com"; sid:612585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinestudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinestudies.com"; sid:612586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacinestudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacinestudies.com"; sid:612587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20products.com"; sid:612588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamericatheseries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamericatheseries.com"; sid:612589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidater.com"; sid:612590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddater.com"; sid:612591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeadventures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeadventures.com"; sid:612592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreenlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreenlight.com"; sid:612593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomeservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomeservice.com"; sid:612594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidproject.com"; sid:612595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewslive.com"; sid:612596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoso.com"; sid:612597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskmeter.com"; sid:612598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsassassin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsassassin.com"; sid:612599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsperu.com"; sid:612600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuperspreaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuperspreaders.com"; sid:612601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivorgang.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivorgang.com"; sid:612602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmefast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmefast.com"; sid:612603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoyexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoyexchange.com"; sid:612604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidventurer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidventurer.com"; sid:612605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for culturacontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"culturacontracovid.com"; sid:612606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for didcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"didcovid.com"; sid:612607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dotcovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dotcovideos.com"; sid:612608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 520wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"520wuhan.com"; sid:612609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpillow.com"; sid:612610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for askcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"askcovid19now.com"; sid:612611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid-19vaccine.com"; sid:612612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contrecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contrecovid.com"; sid:612613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacock.com"; sid:612614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetucsonroofing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetucsonroofing.com"; sid:612615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskclear.com"; sid:612616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-vaccine.com"; sid:612617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19vaccine.com"; sid:612618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19-vaccine.com"; sid:612619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadness.com"; sid:612620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicblog.com"; sid:612621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuicideepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuicideepidemic.com"; sid:612622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19christmas20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19christmas20.com"; sid:612623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-evictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-evictions.com"; sid:612624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19msc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19msc.com"; sid:612625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supersite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supersite.com"; sid:612626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testimonialsinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testimonialsinternational.com"; sid:612627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineblog.com"; sid:612628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbaskets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbaskets.com"; sid:612629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbooksforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbooksforkids.com"; sid:612630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbush.com"; sid:612631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanon.com"; sid:612632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchanukah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchanukah.com"; sid:612633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgreet.com"; sid:612634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfotravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfotravel.com"; sid:612635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidklere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidklere.com"; sid:612636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnuts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnuts.com"; sid:612637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrestaurante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrestaurante.com"; sid:612638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafepillow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafepillow.com"; sid:612639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsamedayresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsamedayresults.com"; sid:612640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsamedaytexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsamedaytexas.com"; sid:612641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtards.com"; sid:612642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreatmeter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreatmeter.com"; sid:612643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacinationcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacinationcertificate.com"; sid:612644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchscotland.com"; sid:612645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatchuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatchuk.com"; sid:612646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzstore.com"; sid:612647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecovid.com"; sid:612648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for putocovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"putocovid.club"; sid:612649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for robocovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"robocovid.app"; sid:612650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronamasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronamasks.com"; sid:612651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arubacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arubacovid.com"; sid:612652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assesscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assesscovid.com"; sid:612653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovid19vaccine.com"; sid:612654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcovidvaccine.com"; sid:612655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapvp.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapvp.club"; sid:612656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnated.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnated.biz"; sid:612657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ateliercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ateliercorona.com"; sid:612658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacovid.com"; sid:612659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.asia"; sid:612660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation.coffee"; sid:612661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020.cloud"; sid:612662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020.club"; sid:612663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2021.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2021.cloud"; sid:612664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021.cloud"; sid:612665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2021.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2021.club"; sid:612666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021.club"; sid:612667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21.cloud"; sid:612668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.cloud"; sid:612669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21.club"; sid:612670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.club"; sid:612671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecorona.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecorona.asia"; sid:612672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abccoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abccoronatest.com"; sid:612673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abccovidtest.com"; sid:612674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accovid.com"; sid:612675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventuscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventuscovid19.com"; sid:612676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anchoragecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anchoragecovidtest.com"; sid:612677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidstuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidstuff.com"; sid:612678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bkccovidhospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bkccovidhospital.com"; sid:612679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blainecovidstats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blainecovidstats.com"; sid:612680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceibacovidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceibacovidbusters.com"; sid:612681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cincycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cincycovid.com"; sid:612682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkey.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkey.biz"; sid:612683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instacovid.bio - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instacovid.bio"; sid:612684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.app"; sid:612685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wacovideo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wacovideo.club"; sid:612686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidtesting.com"; sid:612687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidlaw.com"; sid:612688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidlawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidlawyer.com"; sid:612689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artemiscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artemiscovidtest.com"; sid:612690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brovid4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brovid4covid.com"; sid:612691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brovidforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brovidforcovid.com"; sid:612692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecubecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecubecovid.com"; sid:612693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carecubescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carecubescovid.com"; sid:612694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caringcovid.com"; sid:612695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdscovid.com"; sid:612696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegeandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegeandcovid.com"; sid:612697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcoronawithbelle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcoronawithbelle.com"; sid:612698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bands.com"; sid:612699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacartellaleyenda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacartellaleyenda.com"; sid:612700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocapitalinvestment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocapitalinvestment.com"; sid:612701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-global.com"; sid:612702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree2021.com"; sid:612703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateambuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateambuilding.com"; sid:612704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingservices.com"; sid:612705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarecube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarecube.com"; sid:612706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarecubes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarecubes.com"; sid:612707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushardshiploan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushardshiploan.com"; sid:612708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushardshiploans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushardshiploans.com"; sid:612709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuhaberleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuhaberleri.com"; sid:612710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15mintests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15mintests.com"; sid:612711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid15minutetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid15minutetests.com"; sid:612712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19captive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19captive.com"; sid:612713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19captives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19captives.com"; sid:612714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carecubes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carecubes.com"; sid:612715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ezhr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ezhr.com"; sid:612716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foreclosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foreclosed.com"; sid:612717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyessentials.com"; sid:612718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19slide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19slide.com"; sid:612719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinehelp.com"; sid:612720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccines.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccines.biz"; sid:612721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatlantic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatlantic.com"; sid:612722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbluesmusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbluesmusic.com"; sid:612723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboi.com"; sid:612724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuttmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuttmask.com"; sid:612725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidciggies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidciggies.com"; sid:612726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombatkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombatkit.com"; sid:612727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsciousentertainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsciousentertainment.com"; sid:612728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcuomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcuomo.com"; sid:612729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideconomistsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideconomistsnetwork.com"; sid:612730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideducatorsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideducatorsnetwork.com"; sid:612731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfartmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfartmask.com"; sid:612732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforclosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforclosed.com"; sid:612733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosed.com"; sid:612734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree2021.com"; sid:612735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetech.com"; sid:612736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgercekleri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgercekleri.com"; sid:612737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgremfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgremfree.com"; sid:612738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcareheros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcareheros.com"; sid:612739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthtalks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthtalks.com"; sid:612740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheartclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheartclinic.com"; sid:612741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhospitalitynetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhospitalitynetwork.com"; sid:612742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidians2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidians2020.com"; sid:612743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjournalistsnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjournalistsnetwork.com"; sid:612744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidssupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidssupplies.com"; sid:612745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidsupplies.com"; sid:612746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawnetwork.com"; sid:612747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlove2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlove2020.com"; sid:612748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnad.com"; sid:612749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplasmamaterial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplasmamaterial.com"; sid:612750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoliticiansnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoliticiansnetwork.com"; sid:612751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpupstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpupstory.com"; sid:612752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponseuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponseuk.com"; sid:612753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureme.com"; sid:612754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportstudy.com"; sid:612755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteoria.com"; sid:612756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtequila.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtequila.com"; sid:612757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestankara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestankara.com"; sid:612758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmobil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmobil.com"; sid:612759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtyranny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtyranny.com"; sid:612760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwhiskey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwhiskey.com"; sid:612761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisispostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisispostcovid.com"; sid:612762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpost.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpost.blog"; sid:612763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3ppandemicprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3ppandemicprotection.com"; sid:612764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 606covidmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"606covidmemorial.com"; sid:612765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 606covidmemorialday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"606covidmemorialday.com"; sid:612766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911covid-19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911covid-19cleaning.com"; sid:612767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acceleratedcovidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acceleratedcovidtracking.com"; sid:612768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alexandercoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alexandercoronado.com"; sid:612769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidlight.com"; sid:612770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcovida.com"; sid:612771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronatreatment.com"; sid:612772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronatreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronatreatments.com"; sid:612773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for call4covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"call4covidtest.com"; sid:612774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callforcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callforcovidtest.com"; sid:612775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020song.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020song.com"; sid:612776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-busters47.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-busters47.com"; sid:612777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakush19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakush19.com"; sid:612778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas-park.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas-park.com"; sid:612779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alclaims.com"; sid:612780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19arclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19arclaims.com"; sid:612781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-basvuru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-basvuru.com"; sid:612782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inclaims.com"; sid:612783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mdclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mdclaims.com"; sid:612784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19moclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19moclaims.com"; sid:612785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ncclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ncclaims.com"; sid:612786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tnclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tnclaims.com"; sid:612787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19txclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19txclaims.com"; sid:612788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaclaims.com"; sid:612789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wiclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wiclaims.com"; sid:612790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothingshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothingshop.com"; sid:612791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconform.com"; sid:612792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoochie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoochie.com"; sid:612793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facile.com"; sid:612794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinerx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinerx.com"; sid:612795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkush19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkush19.com"; sid:612796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkush.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkush.buzz"; sid:612797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmadness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmadness.com"; sid:612798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlyclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlyclaims.com"; sid:612799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidracking.com"; sid:612800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeledger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeledger.com"; sid:612801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafemiddleeast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafemiddleeast.com"; sid:612802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolstickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolstickers.com"; sid:612803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshowmangement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshowmangement.com"; sid:612804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidswabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidswabtests.com"; sid:612805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestaustralia.com"; sid:612806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackng.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackng.com"; sid:612807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crtcovidtesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crtcovidtesti.com"; sid:612808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyclethrucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyclethrucovid19.com"; sid:612809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for economiaysaludcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"economiaysaludcovid19.com"; sid:612810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicound.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicound.com"; sid:612811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsoud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsoud.com"; sid:612812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsoun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsoun.com"; sid:612813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidfoodshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidfoodshow.com"; sid:612814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andthencovidhit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andthencovidhit.com"; sid:612815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anosensecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anosensecovid.com"; sid:612816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centroagricolacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centroagricolacoronado.com"; sid:612817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citadines-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citadines-wuhan.com"; sid:612818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consultacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consultacovid.com"; sid:612819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020espanol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020espanol.com"; sid:612820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjurylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjurylawsuit.com"; sid:612821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainjurylawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainjurylawsuits.com"; sid:612822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-king.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-king.com"; sid:612823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessonsbarcelona.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessonsbarcelona.cat"; sid:612824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalessonsbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalessonsbarcelona.com"; sid:612825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedican.com"; sid:612826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaret.com"; sid:612827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoppe.com"; sid:612828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusome.com"; sid:612829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusomics.com"; sid:612830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusukworldanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusukworldanalysis.com"; sid:612831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldanalysis.com"; sid:612832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-blockchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-blockchain.com"; sid:612833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clearance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clearance.com"; sid:612834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foodbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foodbox.com"; sid:612835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19kensa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19kensa.com"; sid:612836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskshield.com"; sid:612837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testmerkezi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testmerkezi.com"; sid:612838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2021vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2021vaccine.com"; sid:612839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-20-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-20-vaccine.com"; sid:612840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21-vaccine.com"; sid:612841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-3d.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-3d.com"; sid:612842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaerateur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaerateur.com"; sid:612843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaerator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaerator.com"; sid:612844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaeratore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaeratore.com"; sid:612845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaireador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaireador.com"; sid:612846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarejador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarejador.com"; sid:612847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartejovenes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartejovenes.com"; sid:612848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassit.com"; sid:612849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassmask.com"; sid:612850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcafe.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcafe.biz"; sid:612851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-calculator.com"; sid:612852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidental.com"; sid:612853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidentally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidentally.com"; sid:612854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddamagelawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddamagelawyers.com"; sid:612855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefreetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefreetravel.com"; sid:612856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfoodbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfoodbox.com"; sid:612857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootballnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootballnews.com"; sid:612858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreesandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreesandiego.com"; sid:612859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjurylawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjurylawsuit.com"; sid:612860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinschools.com"; sid:612861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisasters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisasters.com"; sid:612862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisstupid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisstupid.com"; sid:612863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovescampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovescampus.com"; sid:612864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovesclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovesclass.com"; sid:612865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlovesgays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlovesgays.com"; sid:612866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskshield.com"; sid:612867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnate.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnate.biz"; sid:612868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnate.com"; sid:612869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnation.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnation.biz"; sid:612870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrealness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrealness.com"; sid:612871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe-travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe-travel.com"; sid:612872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsga.com"; sid:612873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoultionplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoultionplus.com"; sid:612874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstopp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstopp.com"; sid:612875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtagsalong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtagsalong.com"; sid:612876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaser.com"; sid:612877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest-express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest-express.com"; sid:612878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting411.com"; sid:612879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting911.com"; sid:612880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestmerkezi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestmerkezi.com"; sid:612881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidusesyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidusesyou.com"; sid:612882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyardim-trt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyardim-trt.com"; sid:612883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycovidmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycovidmom.com"; sid:612884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for davidcoronadesigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"davidcoronadesigns.com"; sid:612885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fogoffcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fogoffcovid19.com"; sid:612886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10116coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10116coronado.com"; sid:612887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africovid-19.com"; sid:612888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtest.com"; sid:612889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bdlcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bdlcovid.com"; sid:612890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blastercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blastercovid.com"; sid:612891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookcovidvaccine.com"; sid:612892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byepandemic.com"; sid:612893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fittoflycovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fittoflycovid.biz"; sid:612894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 14-710coronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"14-710coronation.com"; sid:612895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovideconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovideconomy.com"; sid:612896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid19cure360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid19cure360.com"; sid:612897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banescovideobanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banescovideobanking.com"; sid:612898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beckettcovidsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beckettcovidsupport.com"; sid:612899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontechcovid19cure360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontechcovid19cure360.com"; sid:612900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidaftermath.com"; sid:612901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for book-covid19-shots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"book-covid19-shots.com"; sid:612902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidconcierge.com"; sid:612903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carloseduardocoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carloseduardocoronado.com"; sid:612904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocovidscreen.com"; sid:612905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocovidtest.com"; sid:612906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casinocovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casinocovidtesting.com"; sid:612907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovidcare.com"; sid:612908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for condaxcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"condaxcovid19test.com"; sid:612909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congeparentalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congeparentalcorona.com"; sid:612910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreaker.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreaker.brussels"; sid:612911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreakers.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreakers.brussels"; sid:612912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreakers.com"; sid:612913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaburgerandeats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaburgerandeats.com"; sid:612914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilochallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilochallenge.com"; sid:612915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamichoacan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamichoacan.com"; sid:612916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaontap360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaontap360.com"; sid:612917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafe7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafe7.com"; sid:612918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzschirm-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzschirm-online.com"; sid:612919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakeawaykwartet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakeawaykwartet.com"; sid:612920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaween.com"; sid:612921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2u.com"; sid:612922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-biz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-biz.com"; sid:612923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19brandambassadors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19brandambassadors.com"; sid:612924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceeventagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceeventagency.com"; sid:612925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cure360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cure360.com"; sid:612926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dentalrequirements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dentalrequirements.com"; sid:612927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experientialagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experientialagency.com"; sid:612928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medical.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medical.center"; sid:612929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reservations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reservations.com"; sid:612930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reservations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reservations.com"; sid:612931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reserve.com"; sid:612932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reserve-shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reserve-shot.com"; sid:612933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-reserve-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-reserve-vaccine.com"; sid:612934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetystaff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetystaff.com"; sid:612935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sng001.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sng001.com"; sid:612936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testing.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testing.center"; sid:612937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19url.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19url.com"; sid:612938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine360.com"; sid:612939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineprice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineprice.com"; sid:612940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine-reservations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine-reservations.com"; sid:612941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacines.com"; sid:612942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxietycbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxietycbd.com"; sid:612943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreaker.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreaker.brussels"; sid:612944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-breakers.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-breakers.brussels"; sid:612945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakers.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakers.brussels"; sid:612946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-breakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-breakers.com"; sid:612947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbreakers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbreakers.com"; sid:612948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbutler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbutler.com"; sid:612949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareinsurance.com"; sid:612950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchant.com"; sid:612951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmasbargainsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmasbargainsuk.com"; sid:612952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningdc.com"; sid:612953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantproductions.com"; sid:612954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcookingwithcortney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcookingwithcortney.com"; sid:612955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddigitaldummy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddigitaldummy.com"; sid:612956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectors.com"; sid:612957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddonald.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddonald.com"; sid:612958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactsource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactsource.com"; sid:612959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigitaldummy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigitaldummy.com"; sid:612960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-injury-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-injury-lawyer.com"; sid:612961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsomnia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsomnia.com"; sid:612962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidites.com"; sid:612963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkai.com"; sid:612964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidleash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidleash.com"; sid:612965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedical.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedical.center"; sid:612966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpearls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpearls.com"; sid:612967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonestickers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonestickers.com"; sid:612968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-reserve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-reserve.com"; sid:612969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcesfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcesfl.com"; sid:612970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisk.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisk.app"; sid:612971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschooltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschooltest.com"; sid:612972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-spray.com"; sid:612973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsremedy.com"; sid:612974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstudiestoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstudiestoday.com"; sid:612975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaubate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaubate.com"; sid:612976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineharm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineharm.com"; sid:612977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetruth.com"; sid:612978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimmemorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimmemorials.com"; sid:612979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvictimsmemorials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvictimsmemorials.com"; sid:612980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwave2fund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwave2fund.com"; sid:612981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwave2responsefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwave2responsefund.com"; sid:612982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidween.com"; sid:612983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 364corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"364corona.com"; sid:612984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for a1rapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"a1rapidcovidtesting.com"; sid:612985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amicovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amicovidsafe.com"; sid:612986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antibody-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antibody-covid19.com"; sid:612987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmart.com"; sid:612988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carmencoronada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carmencoronada.com"; sid:612989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrocoronacolor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrocoronacolor.com"; sid:612990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duetocovid.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duetocovid.art"; sid:612991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronagroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronagroup.com"; sid:612992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoviderial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoviderial.com"; sid:612993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arationalpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arationalpandemic.com"; sid:612994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arecorona.com"; sid:612995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidwise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidwise.com"; sid:612996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabine-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabine-covid.com"; sid:612997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cabinecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cabinecovid.com"; sid:612998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cervezacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cervezacorona.com"; sid:612999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidclinic.com"; sid:613000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidclinics.com"; sid:613001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commandercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commandercovid.com"; sid:613002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeam.com"; sid:613003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopicnics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopicnics.com"; sid:613004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoyachtandhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoyachtandhome.com"; sid:613005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirl.com"; sid:613006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasal.com"; sid:613007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrendy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrendy.com"; sid:613008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnetworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnetworks.com"; sid:613009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalivainstanttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalivainstanttest.com"; sid:613010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthedoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthedoc.com"; sid:613011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthedocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthedocumentary.com"; sid:613012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthestories.com"; sid:613013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clothing.com"; sid:613014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19durham.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19durham.com"; sid:613015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hizlitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hizlitest.com"; sid:613016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19indias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19indias.com"; sid:613017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kitleriniz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kitleriniz.com"; sid:613018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nab.com"; sid:613019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-sensor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-sensor.com"; sid:613020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thedoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thedoc.com"; sid:613021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thedocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thedocumentary.com"; sid:613022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19themotionpicture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19themotionpicture.com"; sid:613023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19theshow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19theshow.com"; sid:613024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thestories.com"; sid:613025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thestories.com"; sid:613026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantikortest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantikortest.com"; sid:613027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappraisal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappraisal.com"; sid:613028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidappraisals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidappraisals.com"; sid:613029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaroundtheworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaroundtheworld.com"; sid:613030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcargoupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcargoupdate.com"; sid:613031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckusa.com"; sid:613032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoldshipping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoldshipping.com"; sid:613033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortbands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortbands.com"; sid:613034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomfortlevels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomfortlevels.com"; sid:613035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidctr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidctr.com"; sid:613036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefaults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefaults.com"; sid:613037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenlever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenlever.com"; sid:613038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventco.com"; sid:613039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhangoutrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhangoutrisk.com"; sid:613040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ice.com"; sid:613041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insuranceclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insuranceclaims.com"; sid:613042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlshop.com"; sid:613043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskandshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskandshield.com"; sid:613044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidminus80.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidminus80.com"; sid:613045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnab.com"; sid:613046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoggi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoggi.com"; sid:613047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphonesticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphonesticker.com"; sid:613048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpiryna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpiryna.com"; sid:613049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplacements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplacements.com"; sid:613050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreengagementprotocal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreengagementprotocal.com"; sid:613051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcost.com"; sid:613052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthb.com"; sid:613053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesthuntingtonbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesthuntingtonbeach.com"; sid:613054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtokens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtokens.com"; sid:613055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelbans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelbans.com"; sid:613056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxperts.com"; sid:613057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidymas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidymas.com"; sid:613058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curativeovercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curativeovercovid.com"; sid:613059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovidnow.com"; sid:613060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdesign.com"; sid:613061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyesoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyesoncorona.com"; sid:613062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fllcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fllcovidtesting.com"; sid:613063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 150coronaroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"150coronaroad.com"; sid:613064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24035vistacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24035vistacorona.com"; sid:613065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covid19testing.com"; sid:613066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourairportcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourairportcovidtesting.com"; sid:613067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourcovidtestingboston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourcovidtestingboston.com"; sid:613068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hourcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hourcovidtesting.com"; sid:613069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agencia-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agencia-corona.com"; sid:613070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovidtesting.com"; sid:613071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthispandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthispandemic.com"; sid:613072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovid19.com"; sid:613073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncovid19testing.com"; sid:613074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brasstapcoronaclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brasstapcoronaclub.com"; sid:613075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbfindcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbfindcovidtests.com"; sid:613076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabewegwijzering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabewegwijzering.com"; sid:613077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakalender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakalender.com"; sid:613078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapremierrhone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapremierrhone.com"; sid:613079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-top-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-top-guide.com"; sid:613080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphotoproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphotoproject.com"; sid:613081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawegbewijzering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawegbewijzering.com"; sid:613082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosasdecovidespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosasdecovidespana.com"; sid:613083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centre.com"; sid:613084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19garglespittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19garglespittest.com"; sid:613085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gargletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gargletest.com"; sid:613086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19interview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19interview.com"; sid:613087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lst.com"; sid:613088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19photoproject.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19photoproject.com"; sid:613089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projectibrahim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projectibrahim.com"; sid:613090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19psicologia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19psicologia.com"; sid:613091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rdt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rdt.com"; sid:613092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testcvs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testcvs.com"; sid:613093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trialtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trialtoday.com"; sid:613094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ushonorquilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ushonorquilt.com"; sid:613095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinationcertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinationcertificate.com"; sid:613096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinationregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinationregistration.com"; sid:613097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecertificate.com"; sid:613098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineregistration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineregistration.com"; sid:613099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2-19.com"; sid:613100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2-19support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2-19support.com"; sid:613101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid219support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid219support.com"; sid:613102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidatest.com"; sid:613103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbillionaire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbillionaire.com"; sid:613104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbillionaires.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbillionaires.com"; sid:613105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterspro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterspro.com"; sid:613106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcandies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcandies.com"; sid:613107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarpool.com"; sid:613108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansefla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansefla.com"; sid:613109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedomkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedomkit.com"; sid:613110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgargletest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgargletest.com"; sid:613111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgb.com"; sid:613112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-id19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-id19.com"; sid:613113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplushie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplushie.com"; sid:613114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresearch4you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresearch4you.com"; sid:613115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrewari.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrewari.com"; sid:613116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidringz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidringz.com"; sid:613117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsaferworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsaferworkplace.com"; sid:613118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysvcs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysvcs.com"; sid:613119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidservicedirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidservicedirect.com"; sid:613120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsourcedirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsourcedirect.com"; sid:613121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspare.com"; sid:613122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tester.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tester.agency"; sid:613123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimes.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimes.biz"; sid:613124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld.cloud"; sid:613125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicking.com"; sid:613126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411oncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411oncovid19.com"; sid:613127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4minutecovidtest.com"; sid:613128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aavcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aavcovid.com"; sid:613129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid20.com"; sid:613130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidmeds.com"; sid:613131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidvaccine.com"; sid:613132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidmedication.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidmedication.com"; sid:613133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidmedications.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidmedications.com"; sid:613134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidtherapy.com"; sid:613135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovidscreens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovidscreens.com"; sid:613136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cityofcoviddeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cityofcoviddeaths.com"; sid:613137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare-kyoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare-kyoto.com"; sid:613138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconstructioncompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconstructioncompany.com"; sid:613139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrouptherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrouptherapy.com"; sid:613140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakans.com"; sid:613141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakliniek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakliniek.com"; sid:613142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakwartetspel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakwartetspel.com"; sid:613143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamenterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamenterprises.com"; sid:613144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaperspectives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaperspectives.com"; sid:613145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroadtrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroadtrip.com"; sid:613146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-services.com"; sid:613147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashopiran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashopiran.com"; sid:613148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastattr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastattr.com"; sid:613149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscebreros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscebreros.com"; sid:613150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatasite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatasite.com"; sid:613151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawnewyork.com"; sid:613152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrdt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrdt.com"; sid:613153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshotny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshotny.com"; sid:613154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinenewyork.com"; sid:613155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vacuna-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vacuna-mexico.com"; sid:613156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vacunas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vacunas.com"; sid:613157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaweg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaweg.com"; sid:613158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aiml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aiml.com"; sid:613159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challengecoins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challengecoins.com"; sid:613160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaninglongisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaninglongisland.com"; sid:613161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19factor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19factor.com"; sid:613162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawnewyork.com"; sid:613163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawny.com"; sid:613164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19less.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19less.com"; sid:613165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ml.com"; sid:613166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prognosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prognosis.com"; sid:613167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prognosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prognosis.com"; sid:613168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prognostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prognostics.com"; sid:613169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prognostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prognostics.com"; sid:613170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskpredictor.com"; sid:613171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shotnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shotnewyork.com"; sid:613172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19shotny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19shotny.com"; sid:613173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19susceptibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19susceptibility.com"; sid:613174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19susceptibilitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19susceptibilitypredictor.com"; sid:613175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinenewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinenewyork.com"; sid:613176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineny.com"; sid:613177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-wold-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-wold-stats.com"; sid:613178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid219.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid219.com"; sid:613179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4ever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4ever.com"; sid:613180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaep.com"; sid:613181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbubbleconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbubbleconsulting.com"; sid:613182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbum.com"; sid:613183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchallengecoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchallengecoin.com"; sid:613184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluandstrep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluandstrep.com"; sid:613185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcareheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcareheroes.com"; sid:613186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivingtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivingtreatments.com"; sid:613187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnating.com"; sid:613188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidovercome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidovercome.com"; sid:613189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquicktestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquicktestkit.com"; sid:613190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredandblue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredandblue.com"; sid:613191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehalloween.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehalloween.com"; sid:613192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecureme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecureme.com"; sid:613193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnoods.com"; sid:613194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories2020.com"; sid:613195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcentre.com"; sid:613196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinghuntingtonbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinghuntingtonbeach.com"; sid:613197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsb.com"; sid:613198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestskits.com"; sid:613199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtexting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtexting.com"; sid:613200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtry.com"; sid:613201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxtesting.com"; sid:613202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europeanunioncovid-19relieffunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europeanunioncovid-19relieffunds.com"; sid:613203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidrecovery.com"; sid:613204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidrelief.com"; sid:613205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridarapidcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridarapidcovidtest.com"; sid:613206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovid19vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovid19vaccinations.com"; sid:613207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacovidvaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacovidvaccinations.com"; sid:613208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gahannacovidchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gahannacovidchristmas.com"; sid:613209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gamobilecovid19vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gamobilecovid19vaccinations.com"; sid:613210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for generaringresostiemposcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"generaringresostiemposcovid-19.com"; sid:613211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for headlandscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"headlandscovid.com"; sid:613212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keyworkercovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keyworkercovidtests.com"; sid:613213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killdacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killdacovid.com"; sid:613214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for laboratorioaynicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"laboratorioaynicovid19.com"; sid:613215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longislandcovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longislandcovid19cleaning.com"; sid:613216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for millicovidtesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"millicovidtesti.com"; sid:613217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1619pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1619pandemic.com"; sid:613218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020andcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020andcovid19.com"; sid:613219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovid19test.com"; sid:613220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amazoncovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amazoncovidtest.com"; sid:613221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anothercovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anothercovid19story.com"; sid:613222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azteccommercialcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azteccommercialcovid.com"; sid:613223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aztecdisinfectscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aztecdisinfectscovid.com"; sid:613224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aztechealthcarecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aztechealthcarecovid.com"; sid:613225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bsmcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bsmcovid.com"; sid:613226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovidtest.com"; sid:613227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caspervcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caspervcovid.com"; sid:613228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caspervscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caspervscovid.com"; sid:613229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centroeducativovillacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centroeducativovillacorona.com"; sid:613230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaware.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaware.app"; sid:613231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidget.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidget.app"; sid:613232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sexcovid.cam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sexcovid.cam"; sid:613233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1001coronado.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1001coronado.net"; sid:613234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1619pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1619pandemic.net"; sid:613235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backup-pantaucoronabatola.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backup-pantaucoronabatola.info"; sid:613236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carpdenbosch-covidedition.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carpdenbosch-covidedition.online"; sid:613237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageldlening.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageldlening.online"; sid:613238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageldleningparticulier.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageldleningparticulier.online"; sid:613239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-services.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-services.info"; sid:613240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavpn.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavpn.net"; sid:613241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.club"; sid:613242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spray.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spray.net"; sid:613243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcues.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcues.blog"; sid:613244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetkileri.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetkileri.info"; sid:613245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemask.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemask.life"; sid:613246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjab.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjab.care"; sid:613247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjab.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjab.health"; sid:613248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanet.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanet.net"; sid:613249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheory.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheory.info"; sid:613250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtip.fun - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtip.fun"; sid:613251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinehunterdon.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinehunterdon.info"; sid:613252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hunterdoncovidvaccine.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hunterdoncovidvaccine.info"; sid:613253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrisk.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrisk.app"; sid:613254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicthrifting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicthrifting.net"; sid:613255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plumbingcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plumbingcorona.biz"; sid:613256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uacovid.info"; sid:613257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhanit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhanit.com"; sid:613258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 28daycovidprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"28daycovidprotection.com"; sid:613259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5oncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5oncovid.com"; sid:613260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliancefunding-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliancefunding-covid19.com"; sid:613261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bailbondscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bailbondscorona.com"; sid:613262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscoronavirusclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscoronavirusclaim.com"; sid:613263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesscovid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesscovid19claim.com"; sid:613264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoconstructiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoconstructiongroup.com"; sid:613265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadostones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadostones.com"; sid:613266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosurflesson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosurflesson.com"; sid:613267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guestlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guestlist.com"; sid:613268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalongtermeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalongtermeffects.com"; sid:613269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-o3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-o3.com"; sid:613270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronao3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronao3.com"; sid:613271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicktests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicktests.com"; sid:613272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzverordnung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzverordnung.com"; sid:613273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltesten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltesten.com"; sid:613274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-symptoms.com"; sid:613275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasyndromes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasyndromes.com"; sid:613276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest4u.com"; sid:613277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestservice.com"; sid:613278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisruptionclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisruptionclaim.com"; sid:613279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawsuitprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawsuitprotection.com"; sid:613280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsexplained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsexplained.com"; sid:613281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusriskmitigationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusriskmitigationusa.com"; sid:613282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustienda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustienda.com"; sid:613283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawillbemycrown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawillbemycrown.com"; sid:613284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-acne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-acne.com"; sid:613285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19acne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19acne.com"; sid:613286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuitprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuitprotection.com"; sid:613287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuitprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuitprotection.com"; sid:613288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longtermeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longtermeffects.com"; sid:613289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19riskmitigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19riskmitigation.com"; sid:613290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19riskmitigationusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19riskmitigationusa.com"; sid:613291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19setsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19setsafety.com"; sid:613292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vax.com"; sid:613293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.blog"; sid:613294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20tees.com"; sid:613295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21tee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21tee.com"; sid:613296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21tees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21tees.com"; sid:613297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanswersnext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanswersnext.com"; sid:613298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaprotect.com"; sid:613299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarticle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarticle.com"; sid:613300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeam.com"; sid:613301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessinterruptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessinterruptions.com"; sid:613302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanandfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanandfree.com"; sid:613303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanclear.com"; sid:613304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearnclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearnclean.com"; sid:613305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomplianceconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomplianceconsultants.com"; sid:613306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-xt1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-xt1.com"; sid:613307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-xt2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-xt2.com"; sid:613308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-xt3.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-xt3.com"; sid:613309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-xt4.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-xt4.com"; sid:613310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidd-xt5.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidd-xt5.com"; sid:613311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetergent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetergent.com"; sid:613312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeandclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeandclean.com"; sid:613313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgenix.com"; sid:613314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstinct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstinct.com"; sid:613315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstincts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstincts.com"; sid:613316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillmonger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillmonger.com"; sid:613317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegality.com"; sid:613318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlongtermeffects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlongtermeffects.com"; sid:613319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirinamax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirinamax.com"; sid:613320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirinaplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirinaplus.com"; sid:613321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirinmax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirinmax.com"; sid:613322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirinplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirinplus.com"; sid:613323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirynamax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirynamax.com"; sid:613324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpirynaplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpirynaplus.com"; sid:613325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpocket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpocket.com"; sid:613326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpocketnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpocketnews.com"; sid:613327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquestionsanswered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquestionsanswered.com"; sid:613328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreadystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreadystore.com"; sid:613329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisklevel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisklevel.com"; sid:613330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisksurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisksurvey.com"; sid:613331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-music.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-music.com"; sid:613332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsanitizingknoxville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsanitizingknoxville.com"; sid:613333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshingles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshingles.com"; sid:613334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshoping.com"; sid:613335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartstudy.com"; sid:613336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedtester.com"; sid:613337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeedtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeedtesting.com"; sid:613338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtergent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtergent.com"; sid:613339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelings.com"; sid:613340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzay.com"; sid:613341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covid.com"; sid:613342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19serum.com"; sid:613343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19vaccine.com"; sid:613344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19vacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19vacina.com"; sid:613345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19vacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19vacina.com"; sid:613346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid.app"; sid:613347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidvacina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidvacina.com"; sid:613348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidshop.com"; sid:613349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bncovid19.com"; sid:613350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claycovid.com"; sid:613351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaestudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaestudio.com"; sid:613352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreeflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreeflights.com"; sid:613353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahamm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahamm.com"; sid:613354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahope247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahope247.com"; sid:613355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakidtest.com"; sid:613356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventor.com"; sid:613357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest24h.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest24h.com"; sid:613358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-zuhause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-zuhause.com"; sid:613359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestzuhause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestzuhause.com"; sid:613360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cosd-covidemergencyrent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cosd-covidemergencyrent.com"; sid:613361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homescreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homescreening.com"; sid:613362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-info-central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-info-central.com"; sid:613363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kliniek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kliniek.com"; sid:613364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lovedones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lovedones.com"; sid:613365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nctest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nctest.com"; sid:613366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testnc.com"; sid:613367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarriersrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarriersrus.com"; sid:613368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-candles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-candles.com"; sid:613369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecklistgo-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecklistgo-box.com"; sid:613370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dev.com"; sid:613371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflirt.com"; sid:613372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhairblows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhairblows.com"; sid:613373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhairsucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhairsucks.com"; sid:613374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-insure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-insure.com"; sid:613375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkillertoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkillertoolkit.com"; sid:613376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkliniek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkliniek.com"; sid:613377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparticles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparticles.com"; sid:613378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-removal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-removal.com"; sid:613379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraces.com"; sid:613380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destekcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destekcovid.com"; sid:613381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebookcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebookcovid.com"; sid:613382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ericacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ericacorona.com"; sid:613383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventionofcoronavirus.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventionofcoronavirus.club"; sid:613384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1covid9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1covid9.com"; sid:613385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afteranotherpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afteranotherpandemic.com"; sid:613386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircleancovid.com"; sid:613387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for animationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"animationcovid19.com"; sid:613388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artforcovidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artforcovidstore.com"; sid:613389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beaumont-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beaumont-covid19.com"; sid:613390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicago-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicago-covid19.com"; sid:613391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for china-novel-coronavirus-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"china-novel-coronavirus-vaccine.com"; sid:613392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinanovelcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinanovelcoronavirusvaccine.com"; sid:613393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinese-novel-coronavirus-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinese-novel-coronavirus-vaccine.com"; sid:613394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesenovelcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesenovelcoronavirusvaccine.com"; sid:613395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovidspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovidspray.com"; sid:613396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarama.com"; sid:613397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-blasen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-blasen.com"; sid:613398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablasen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablasen.com"; sid:613399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bubble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bubble.com"; sid:613400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bubbles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bubbles.com"; sid:613401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuddy.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuddy.app"; sid:613402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.christmas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.christmas"; sid:613403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contact.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contact.app"; sid:613404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakure.com"; sid:613405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorama.com"; sid:613406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspicatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspicatas.com"; sid:613407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadapted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadapted.com"; sid:613408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-adapted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-adapted.com"; sid:613409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aroundworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aroundworld.com"; sid:613410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19artworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19artworks.com"; sid:613411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autopsy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autopsy.com"; sid:613412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19collaboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19collaboratory.com"; sid:613413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19koffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19koffer.com"; sid:613414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pathology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pathology.com"; sid:613415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-posters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-posters.com"; sid:613416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyreview.com"; sid:613417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetyreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetyreviews.com"; sid:613418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkitim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkitim.com"; sid:613419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccination.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccination.biz"; sid:613420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinestability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinestability.com"; sid:613421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinestability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinestability.com"; sid:613422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20vaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20vaccinated.com"; sid:613423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20vaccination.com"; sid:613424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadapted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadapted.com"; sid:613425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmasornament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmasornament.com"; sid:613426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlong.com"; sid:613427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmessiah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmessiah.com"; sid:613428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmindfulness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmindfulness.com"; sid:613429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoi.com"; sid:613430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe-sms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe-sms.com"; sid:613431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsavedmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsavedmylife.com"; sid:613432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschoolreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschoolreports.com"; sid:613433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.asia"; sid:613434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspraystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspraystore.com"; sid:613435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tables.com"; sid:613436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestability.com"; sid:613437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ebooktrumpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ebooktrumpcovid.com"; sid:613438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for encasdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"encasdecovid.com"; sid:613439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mbacovidnomics.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mbacovidnomics.cloud"; sid:613440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceraspeed.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceraspeed.cloud"; sid:613441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for post-covid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"post-covid.app"; sid:613442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19talesofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19talesofcovid19.com"; sid:613443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ab685covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ab685covid.com"; sid:613444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovid19test.com"; sid:613445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovid19testing.com"; sid:613446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajouycdcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajouycdcovid19.com"; sid:613447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amertacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amertacorona.com"; sid:613448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidinhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidinhaler.com"; sid:613449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atquestioningcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atquestioningcovid.com"; sid:613450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitiesagainstcovidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitiesagainstcovidus.com"; sid:613451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1.club"; sid:613452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationinsurance.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationinsurance.agency"; sid:613453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6wuhan.com"; sid:613454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19soro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19soro.com"; sid:613455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19soro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19soro.com"; sid:613456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsoro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsoro.com"; sid:613457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarevax.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarevax.clinic"; sid:613458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycovidbarrett.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycovidbarrett.com"; sid:613459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asuransicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asuransicovid.com"; sid:613460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barbijocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barbijocovid.com"; sid:613461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boscovidtest.com"; sid:613462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtee19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtee19.blog"; sid:613463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycovid19.app"; sid:613464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ezcovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ezcovid19.app"; sid:613465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid19.cloud"; sid:613466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teletamponecovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teletamponecovid19.cloud"; sid:613467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidtesting.com"; sid:613468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allltcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allltcovidtest.com"; sid:613469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for au-covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"au-covid-free.com"; sid:613470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batasanticovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batasanticovid.cat"; sid:613471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batasanticovid.com"; sid:613472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bergencovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bergencovidtesting.com"; sid:613473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncovid.com"; sid:613474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodycovid.com"; sid:613475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcovid2.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcovid2.care"; sid:613476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-chaos.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-chaos.club"; sid:613477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccines.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccines.biz"; sid:613478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswidget.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswidget.app"; sid:613479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.camp - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.camp"; sid:613480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19widget.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19widget.app"; sid:613481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwidget.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwidget.app"; sid:613482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stcovidtesting.com"; sid:613483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtestingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtestingnow.com"; sid:613484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosvacunacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosvacunacovid19.com"; sid:613485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidnews.com"; sid:613486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycovidbarret.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycovidbarret.com"; sid:613487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycovid.com"; sid:613488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaserver.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaserver.cloud"; sid:613489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddi.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddi.club"; sid:613490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for houstoncovid19.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"houstoncovid19.cleaning"; sid:613491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mobilecovidtesting.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mobilecovidtesting.clinic"; sid:613492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpockets.apartments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpockets.apartments"; sid:613493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsourdoughale.beer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsourdoughale.beer"; sid:613494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1036coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1036coronado.com"; sid:613495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5iwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5iwuhan.com"; sid:613496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abc19covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abc19covidtest.com"; sid:613497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirussolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirussolutions.com"; sid:613498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbracelet.com"; sid:613499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beafraidofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beafraidofcovid.com"; sid:613500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betpandemic.com"; sid:613501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boston48hourcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boston48hourcovidtesting.com"; sid:613502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostonairportcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostonairportcovidtesting.com"; sid:613503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidlawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidlawgroup.com"; sid:613504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chocolate-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chocolate-corona.com"; sid:613505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-center.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-center.berlin"; sid:613506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracing.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracing.business"; sid:613507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvey.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvey.app"; sid:613508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhanchuzu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhanchuzu.com"; sid:613509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acbcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acbcovid.com"; sid:613510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancecovid19research.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancecovid19research.com"; sid:613511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analisacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analisacorona.com"; sid:613512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for axethrowingcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"axethrowingcoronado.com"; sid:613513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayearofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayearofcovid.com"; sid:613514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baycovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baycovidcare.com"; sid:613515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbswuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbswuhan.com"; sid:613516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchainforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchainforcovid.com"; sid:613517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blockchainforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blockchainforpandemics.com"; sid:613518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boe-covidresponseunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boe-covidresponseunit.com"; sid:613519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid.club"; sid:613520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontacttracing.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontacttracing.app"; sid:613521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tracing.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tracing.app"; sid:613522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for farmacovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"farmacovid.app"; sid:613523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovidnated.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovidnated.biz"; sid:613524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 108coronationrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"108coronationrd.com"; sid:613525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19pandemicprojects.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19pandemicprojects.com"; sid:613526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2beatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2beatcoronavirus.com"; sid:613527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2beatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2beatcovid.com"; sid:613528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronafree.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronafree.club"; sid:613529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-panik-nein-danke.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-panik-nein-danke.club"; sid:613530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovid.app"; sid:613531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidtesting.com"; sid:613532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allltcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allltcovidtest.com"; sid:613533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for au-covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"au-covid-free.com"; sid:613534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batasanticovid.com"; sid:613535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bergencovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bergencovidtesting.com"; sid:613536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncovid.com"; sid:613537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodycovid.com"; sid:613538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkincorona.com"; sid:613539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidcare.com"; sid:613540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conkercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conkercovid.com"; sid:613541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antigentest.com"; sid:613542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antropoloog.com"; sid:613543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantropoloog.com"; sid:613544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabackyardpatio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabackyardpatio.com"; sid:613545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaper.com"; sid:613546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapers.com"; sid:613547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensediagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensediagnostics.com"; sid:613548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevidany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevidany.com"; sid:613549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagalleryshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagalleryshop.com"; sid:613550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoeroe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoeroe.com"; sid:613551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitubangke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitubangke.com"; sid:613552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitubangsat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitubangsat.com"; sid:613553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamissionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamissionnetwork.com"; sid:613554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectusa.com"; sid:613555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectus.com"; sid:613556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarylab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarylab.com"; sid:613557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trackings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trackings.com"; sid:613558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearinghouse.com"; sid:613559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialsuk.com"; sid:613560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworld.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworld.us"; sid:613561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawunderkind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawunderkind.com"; sid:613562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aiml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aiml.com"; sid:613563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foamingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foamingtest.com"; sid:613564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formcoxenterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formcoxenterprises.com"; sid:613565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-heimtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-heimtest.com"; sid:613566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kojusteat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kojusteat.com"; sid:613567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qt.com"; sid:613568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivity.com"; sid:613569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivitypredictor.com"; sid:613570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivitytest.com"; sid:613571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19susceptibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19susceptibility.com"; sid:613572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19susceptibilitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19susceptibilitypredictor.com"; sid:613573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19technologytaxcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19technologytaxcredits.com"; sid:613574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-volunteers.com"; sid:613575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vshumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vshumanity.com"; sid:613576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020solutions.com"; sid:613577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccutest.com"; sid:613578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertcanada.com"; sid:613579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonkersness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonkersness.com"; sid:613580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapers.com"; sid:613581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearing.com"; sid:613582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddedicated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddedicated.com"; sid:613583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilityattorney.com"; sid:613584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriven.com"; sid:613585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrivethrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrivethrough.com"; sid:613586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesire.com"; sid:613587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-maps.com"; sid:613588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpmilliondollarpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpmilliondollarpage.com"; sid:613589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidipo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidipo.com"; sid:613590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghaulerdisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghaulerdisability.com"; sid:613591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedrx.com"; sid:613592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplustesting.com"; sid:613593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprov.com"; sid:613594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickertest.com"; sid:613595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidry.com"; sid:613596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-scandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-scandal.com"; sid:613597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigorta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigorta.com"; sid:613598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialsecurity.com"; sid:613599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeed.com"; sid:613600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingaustralia.com"; sid:613601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingworkplace.com"; sid:613602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtonverre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtonverre.com"; sid:613603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialsuk.com"; sid:613604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trial-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trial-uk.com"; sid:613605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialuk.com"; sid:613606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetranslation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetranslation.com"; sid:613607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteersuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteersuk.com"; sid:613608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteeruk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteeruk.com"; sid:613609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringcovid19.com"; sid:613610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronaantropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronaantropoloog.com"; sid:613611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronagoeroe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronagoeroe.com"; sid:613612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringpandemic.com"; sid:613613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escolasemcovidcampinas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escolasemcovidcampinas.com"; sid:613614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essexcoviddrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essexcoviddrivethru.com"; sid:613615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastercovid.com"; sid:613616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gbcovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gbcovidreport.com"; sid:613617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hariclitusoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hariclitusoncovid19.com"; sid:613618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heraclitusoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heraclitusoncovid.com"; sid:613619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hericlitusoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hericlitusoncovid.com"; sid:613620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidaycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidaycovidmasks.com"; sid:613621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-covid.com"; sid:613622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivancoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivancoronado.com"; sid:613623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jiwakucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jiwakucorona.com"; sid:613624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leschiavedelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leschiavedelcovid-19.com"; sid:613625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leschiavedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leschiavedelcovid19.com"; sid:613626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livenewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livenewscovid19.com"; sid:613627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malcovidch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malcovidch.com"; sid:613628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memoryofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memoryofcoronavirus.com"; sid:613629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid-19.com"; sid:613630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid19.com"; sid:613631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid.com"; sid:613632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmanagement.com"; sid:613633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrecords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrecords.com"; sid:613634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicholascoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicholascoronado.com"; sid:613635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19sanitizingplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19sanitizingplus.com"; sid:613636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omegacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omegacorona.com"; sid:613637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondernemerstegendecoronamaatregelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondernemerstegendecoronamaatregelen.com"; sid:613638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic360solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic360solutions.com"; sid:613639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemorialawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemorialawareness.com"; sid:613640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpedi.com"; sid:613641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpropertysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpropertysolutions.com"; sid:613642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictotalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictotalsolutions.com"; sid:613643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusarizona.com"; sid:613644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracolitisoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracolitisoncovid19.com"; sid:613645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovid19testing.com"; sid:613646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovidtest.com"; sid:613647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovidtests.com"; sid:613648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovidstories.com"; sid:613649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecoronavirutests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecoronavirutests.com"; sid:613650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purificovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purificovida.com"; sid:613651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickercovid.com"; sid:613652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickestcovid.com"; sid:613653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raquelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raquelcorona.com"; sid:613654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rchcovidreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rchcovidreporting.com"; sid:613655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reboundcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reboundcovid.com"; sid:613656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safesexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safesexcovid.com"; sid:613657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saporicoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saporicoronado.com"; sid:613658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcoronarealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcoronarealestate.com"; sid:613659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selectcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selectcovidtest.com"; sid:613660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for systemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"systemcovid.com"; sid:613661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for termocamera-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"termocamera-covid.com"; sid:613662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testescovid.com"; sid:613663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19trials.com"; sid:613664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid-19volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid-19volunteers.com"; sid:613665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovidvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovidvolunteers.com"; sid:613666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-for-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-for-corona.com"; sid:613667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamindforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamindforpandemic.com"; sid:613668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whcacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whcacovid.com"; sid:613669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemictour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemictour.com"; sid:613670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanajjz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanajjz.com"; sid:613671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancdma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancdma.com"; sid:613672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantst.com"; sid:613673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zekmedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zekmedcovid19.com"; sid:613674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abvaccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abvaccorona.com"; sid:613675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agendacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agendacovid.com"; sid:613676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amincovidlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amincovidlab.com"; sid:613677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andreacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andreacorona.com"; sid:613678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beritacovid019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beritacovid019.com"; sid:613679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for captincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"captincovid.com"; sid:613680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccrcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccrcovid.com"; sid:613681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabs.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabs.center"; sid:613682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid19.cloud"; sid:613683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.cloud"; sid:613684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidjobhunter.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidjobhunter.blog"; sid:613685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covidtesting.com"; sid:613686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allltcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allltcovidtest.com"; sid:613687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for au-covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"au-covid-free.com"; sid:613688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for batasanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"batasanticovid.com"; sid:613689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bergencovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bergencovidtesting.com"; sid:613690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncovid.com"; sid:613691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodycovid.com"; sid:613692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkincorona.com"; sid:613693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovidcare.com"; sid:613694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conkercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conkercovid.com"; sid:613695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antigentest.com"; sid:613696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antropoloog.com"; sid:613697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantropoloog.com"; sid:613698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabackyardpatio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabackyardpatio.com"; sid:613699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaper.com"; sid:613700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapers.com"; sid:613701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefensediagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefensediagnostics.com"; sid:613702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevidany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevidany.com"; sid:613703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagalleryshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagalleryshop.com"; sid:613704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoeroe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoeroe.com"; sid:613705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitubangke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitubangke.com"; sid:613706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaitubangsat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaitubangsat.com"; sid:613707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamissionnetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamissionnetwork.com"; sid:613708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectusa.com"; sid:613709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectus.com"; sid:613710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarylab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarylab.com"; sid:613711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-trackings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-trackings.com"; sid:613712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclearinghouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclearinghouse.com"; sid:613713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrialsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrialsuk.com"; sid:613714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworld.us - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworld.us"; sid:613715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawunderkind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawunderkind.com"; sid:613716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aiml.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aiml.com"; sid:613717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19foamingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19foamingtest.com"; sid:613718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19formcoxenterprises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19formcoxenterprises.com"; sid:613719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-heimtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-heimtest.com"; sid:613720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kojusteat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kojusteat.com"; sid:613721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19qt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19qt.com"; sid:613722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivity.com"; sid:613723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivitypredictor.com"; sid:613724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sensitivitytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sensitivitytest.com"; sid:613725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19susceptibility.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19susceptibility.com"; sid:613726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19susceptibilitypredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19susceptibilitypredictor.com"; sid:613727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19technologytaxcredits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19technologytaxcredits.com"; sid:613728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-volunteers.com"; sid:613729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vshumanity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vshumanity.com"; sid:613730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020solutions.com"; sid:613731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccutest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccutest.com"; sid:613732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertcanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertcanada.com"; sid:613733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbonkersness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbonkersness.com"; sid:613734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapers.com"; sid:613735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclearing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclearing.com"; sid:613736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddedicated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddedicated.com"; sid:613737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilityattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilityattorney.com"; sid:613738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriven.com"; sid:613739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddrivethrough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddrivethrough.com"; sid:613740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidesire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidesire.com"; sid:613741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-maps.com"; sid:613742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelpmilliondollarpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelpmilliondollarpage.com"; sid:613743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidipo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidipo.com"; sid:613744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghaulerdisability.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghaulerdisability.com"; sid:613745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedrx.com"; sid:613746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplustesting.com"; sid:613747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprov.com"; sid:613748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickertest.com"; sid:613749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidry.com"; sid:613750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-scandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-scandal.com"; sid:613751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsigorta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsigorta.com"; sid:613752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsocialsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsocialsecurity.com"; sid:613753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeed.com"; sid:613754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingaustralia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingaustralia.com"; sid:613755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingworkplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingworkplace.com"; sid:613756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtonverre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtonverre.com"; sid:613757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialsuk.com"; sid:613758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-trial-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-trial-uk.com"; sid:613759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrialuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrialuk.com"; sid:613760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetranslation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetranslation.com"; sid:613761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteersuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteersuk.com"; sid:613762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvolunteeruk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvolunteeruk.com"; sid:613763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for datingduringcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"datingduringcovid19.com"; sid:613764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronaantropoloog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronaantropoloog.com"; sid:613765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronagoeroe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronagoeroe.com"; sid:613766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duringpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duringpandemic.com"; sid:613767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escolasemcovidcampinas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escolasemcovidcampinas.com"; sid:613768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for essexcoviddrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"essexcoviddrivethru.com"; sid:613769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastercovid.com"; sid:613770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gbcovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gbcovidreport.com"; sid:613771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hariclitusoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hariclitusoncovid19.com"; sid:613772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heraclitusoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heraclitusoncovid.com"; sid:613773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hericlitusoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hericlitusoncovid.com"; sid:613774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for holidaycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"holidaycovidmasks.com"; sid:613775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infos-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infos-covid.com"; sid:613776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ivancoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ivancoronado.com"; sid:613777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jiwakucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jiwakucorona.com"; sid:613778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leschiavedelcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leschiavedelcovid-19.com"; sid:613779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for leschiavedelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"leschiavedelcovid19.com"; sid:613780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livenewscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livenewscovid19.com"; sid:613781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malcovidch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malcovidch.com"; sid:613782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memoryofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memoryofcoronavirus.com"; sid:613783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid-19.com"; sid:613784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid19.com"; sid:613785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mrscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mrscovid.com"; sid:613786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmanagement.com"; sid:613787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrecords.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrecords.com"; sid:613788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nicholascoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nicholascoronado.com"; sid:613789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nyccovid19sanitizingplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nyccovid19sanitizingplus.com"; sid:613790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omegacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omegacorona.com"; sid:613791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ondernemerstegendecoronamaatregelen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ondernemerstegendecoronamaatregelen.com"; sid:613792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic360solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic360solutions.com"; sid:613793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmemorialawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmemorialawareness.com"; sid:613794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpedi.com"; sid:613795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpropertysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpropertysolutions.com"; sid:613796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictotalsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictotalsolutions.com"; sid:613797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvirusarizona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvirusarizona.com"; sid:613798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paracolitisoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paracolitisoncovid19.com"; sid:613799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovid19testing.com"; sid:613800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovidtest.com"; sid:613801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pooledcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pooledcovidtests.com"; sid:613802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precovidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precovidstories.com"; sid:613803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for privatecoronavirutests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"privatecoronavirutests.com"; sid:613804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purificovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purificovida.com"; sid:613805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickercovid.com"; sid:613806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for quickestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"quickestcovid.com"; sid:613807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for raquelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"raquelcorona.com"; sid:613808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rchcovidreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rchcovidreporting.com"; sid:613809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reboundcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reboundcovid.com"; sid:613810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safesexcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safesexcovid.com"; sid:613811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for saporicoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"saporicoronado.com"; sid:613812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for searchcoronarealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"searchcoronarealestate.com"; sid:613813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for selectcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"selectcovidtest.com"; sid:613814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for systemcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"systemcovid.com"; sid:613815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for termocamera-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"termocamera-covid.com"; sid:613816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testescovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testescovid.com"; sid:613817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid19trials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid19trials.com"; sid:613818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid-19volunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid-19volunteers.com"; sid:613819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovidvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovidvolunteers.com"; sid:613820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-for-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-for-corona.com"; sid:613821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitamindforpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitamindforpandemic.com"; sid:613822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whcacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whcacovid.com"; sid:613823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemictour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemictour.com"; sid:613824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanajjz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanajjz.com"; sid:613825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancdma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancdma.com"; sid:613826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantst.com"; sid:613827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zekmedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zekmedcovid19.com"; sid:613828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 180coronavaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"180coronavaccines.com"; sid:613829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoronavaccine.com"; sid:613830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcoronavirusvaccine.com"; sid:613831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid-19vaccine.com"; sid:613832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovid19vaccine.com"; sid:613833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for charliethepandemicpuppy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"charliethepandemicpuppy.com"; sid:613834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona28hotmail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona28hotmail.com"; sid:613835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacolada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacolada.com"; sid:613836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheadsup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheadsup.com"; sid:613837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationart.com"; sid:613838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaverserp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaverserp.com"; sid:613839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19360vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19360vaccine.com"; sid:613840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19defensesystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19defensesystem.com"; sid:613841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fanvents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fanvents.com"; sid:613842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedomkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedomkit.com"; sid:613843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedomtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedomtest.com"; sid:613844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthandcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthandcare.com"; sid:613845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shameful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shameful.com"; sid:613846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine-centre.com"; sid:613847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecentre.com"; sid:613848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecentres.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecentres.com"; sid:613849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vents.com"; sid:613850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalternatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalternatives.com"; sid:613851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.amsterdam"; sid:613852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandislamicspiritualcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandislamicspiritualcare.com"; sid:613853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.brussels"; sid:613854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningservicesuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningservicesuk.com"; sid:613855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideosearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideosearch.com"; sid:613856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexchanges.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexchanges.com"; sid:613857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidframework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidframework.com"; sid:613858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedomtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedomtest.com"; sid:613859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlanka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlanka.com"; sid:613860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestimonial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestimonial.com"; sid:613861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthemepark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthemepark.com"; sid:613862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidummies.com"; sid:613863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxps.com"; sid:613864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dracovid.com"; sid:613865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epaapprovedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epaapprovedcovid19.com"; sid:613866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afforableautorepaircorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afforableautorepaircorona.com"; sid:613867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alexandracoronadesign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alexandracoronadesign.com"; sid:613868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americapandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americapandemicmemorial.com"; sid:613869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaproduct.com"; sid:613870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidhijab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidhijab.com"; sid:613871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidscarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidscarf.com"; sid:613872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamaswithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamaswithcovid.com"; sid:613873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefend.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefend.app"; sid:613874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovid.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovid.clinic"; sid:613875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nationalpandemicmemorial.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nationalpandemicmemorial.center"; sid:613876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan.cafe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan.cafe"; sid:613877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 226coronationdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"226coronationdrive.com"; sid:613878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adncovid.com"; sid:613879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidcontacttracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidcontacttracing.com"; sid:613880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidtracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidtracing.com"; sid:613881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apsignin-covid19futureauth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apsignin-covid19futureauth.com"; sid:613882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arecovid19vaccinessafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arecovid19vaccinessafe.com"; sid:613883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bantuancovidskripsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bantuancovidskripsi.com"; sid:613884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bmwcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bmwcovid.com"; sid:613885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamdx.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamdx.app"; sid:613886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastest24.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastest24.app"; sid:613887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs.app"; sid:613888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telecovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telecovid.app"; sid:613889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanniji.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanniji.club"; sid:613890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accessbiocovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accessbiocovidtest.com"; sid:613891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alamedacountyvotingandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alamedacountyvotingandcovid.com"; sid:613892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americannationalpandemicmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americannationalpandemicmemorial.com"; sid:613893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-france.com"; sid:613894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidfrance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidfrance.com"; sid:613895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidrobot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidrobot.com"; sid:613896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ateenduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ateenduringapandemic.com"; sid:613897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autotestcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autotestcovid-19.com"; sid:613898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bchdcovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bchdcovidscreen.com"; sid:613899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bio-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bio-covid.com"; sid:613900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackhousecovid19cleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackhousecovid19cleaning.com"; sid:613901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwealth.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwealth.club"; sid:613902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3xcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3xcovid19.com"; sid:613903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3xcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3xcovid.com"; sid:613904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 520pandemicreturns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"520pandemicreturns.com"; sid:613905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronabrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronabrush.com"; sid:613906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronabrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronabrush.com"; sid:613907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronabrushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronabrushforgums.com"; sid:613908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronabrushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronabrushforgums.com"; sid:613909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronatoothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronatoothbrush.com"; sid:613910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronatoothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronatoothbrush.com"; sid:613911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19brush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19brush.com"; sid:613912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19brush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19brush.com"; sid:613913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19brush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19brush.com"; sid:613914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19brush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19brush.com"; sid:613915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19brushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19brushforgums.com"; sid:613916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19brushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19brushforgums.com"; sid:613917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19brushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19brushforgums.com"; sid:613918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19brushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19brushforgums.com"; sid:613919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-19toothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-19toothbrush.com"; sid:613920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19toothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19toothbrush.com"; sid:613921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-19toothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-19toothbrush.com"; sid:613922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19toothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19toothbrush.com"; sid:613923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidbrush.com"; sid:613924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbrush.com"; sid:613925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidbrushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidbrushforgums.com"; sid:613926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidbrushforgums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidbrushforgums.com"; sid:613927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid.cat"; sid:613928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidpaint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidpaint.com"; sid:613929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covidtoothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covidtoothbrush.com"; sid:613930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtoothbrush.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtoothbrush.com"; sid:613931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviralcovid.com"; sid:613932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bahamasrapidcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bahamasrapidcovidtest.com"; sid:613933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.college - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.college"; sid:613934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamapp.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamapp.app"; sid:613935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltest.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltest.amsterdam"; sid:613936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.apartments - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.apartments"; sid:613937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiensales.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiensales.buzz"; sid:613938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus.care"; sid:613939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healthhycoronacare.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healthhycoronacare.club"; sid:613940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tousanticovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tousanticovid.app"; sid:613941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 281covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"281covidtest.com"; sid:613942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adacovidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adacovidcard.com"; sid:613943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-air.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-air.app"; sid:613944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaampel.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaampel.bayern"; sid:613945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.bayern"; sid:613946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covided.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covided.club"; sid:613947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaps.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaps.app"; sid:613948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bhmcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bhmcovid19.com"; sid:613949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackhealthmatterscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackhealthmatterscovid19.com"; sid:613950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causeofcovid.com"; sid:613951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagate.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagate.blog"; sid:613952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaholidaycards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaholidaycards.com"; sid:613953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeinfusions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeinfusions.com"; sid:613954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-it-services.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-it-services.com"; sid:613955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeedcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeedcheck.com"; sid:613956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatchristmas.com"; sid:613957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeinfusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeinfusion.com"; sid:613958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavr.com"; sid:613959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaznation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaznation.com"; sid:613960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1921.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1921.com"; sid:613961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antigen-rapdid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antigen-rapdid-test.com"; sid:613962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antigen-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antigen-test.com"; sid:613963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigen-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigen-test.com"; sid:613964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19guild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19guild.com"; sid:613965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeinfusions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeinfusions.com"; sid:613966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-malta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-malta.com"; sid:613967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinesssolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinesssolution.com"; sid:613968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchaoscalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchaoscalm.com"; sid:613969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchemist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchemist.com"; sid:613970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclient.com"; sid:613971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfinancialsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfinancialsolution.com"; sid:613972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidia.city - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidia.city"; sid:613973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfusions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfusions.com"; sid:613974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjourney.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjourney.blog"; sid:613975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledsanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledsanta.com"; sid:613976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalsolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalsolution.com"; sid:613977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedgroup.com"; sid:613978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-medtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-medtech.com"; sid:613979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmed-tech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmed-tech.com"; sid:613980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgagesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgagesolution.com"; sid:613981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmouthrinse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmouthrinse.com"; sid:613982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteeninfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteeninfo.com"; sid:613983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutfitters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutfitters.com"; sid:613984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventionprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventionprogram.com"; sid:613985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrewards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrewards.com"; sid:613986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeactivities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeactivities.com"; sid:613987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshotathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshotathome.com"; sid:613988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginc.com"; sid:613989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwpg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwpg.com"; sid:613990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curatedbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curatedbycorona.com"; sid:613991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascherine-coronavirus.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascherine-coronavirus.click"; sid:613992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemictravel.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemictravel.app"; sid:613993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1108coronadoterrace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1108coronadoterrace.com"; sid:613994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 12daysofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"12daysofcovid.com"; sid:613995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ambercovidjourney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ambercovidjourney.com"; sid:613996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidshield.com"; sid:613997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcovid19.com"; sid:613998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bgcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bgcovid.com"; sid:613999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biscoes-covid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biscoes-covid.app"; sid:614000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancercovidandcompassion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancercovidandcompassion.com"; sid:614001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-checkpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-checkpoint.com"; sid:614002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahorserace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahorserace.com"; sid:614003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalismus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalismus.com"; sid:614004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivers.com"; sid:614005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairpurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairpurification.com"; sid:614006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuties.com"; sid:614007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19overparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19overparty.com"; sid:614008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testinglondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testinglondon.com"; sid:614009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersearch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersearch.com"; sid:614010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddangers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddangers.com"; sid:614011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidearlytreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidearlytreatment.com"; sid:614012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinconcert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinconcert.com"; sid:614013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstant.com"; sid:614014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisntover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisntover.com"; sid:614015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjamaica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjamaica.com"; sid:614016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketdepo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketdepo.com"; sid:614017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketistanbul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketistanbul.com"; sid:614018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnets.com"; sid:614019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoverparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoverparty.com"; sid:614020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidparty.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidparty.app"; sid:614021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-printing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-printing.com"; sid:614022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremodels.com"; sid:614023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoverparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoverparty.com"; sid:614024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesteventos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesteventos.com"; sid:614025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvijeta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvijeta.com"; sid:614026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for depocovidmarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"depocovidmarket.com"; sid:614027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dirtycovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dirtycovidmasks.com"; sid:614028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivor.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivor.app"; sid:614029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicpeople.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicpeople.club"; sid:614030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123covidtest.com"; sid:614031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidnation.com"; sid:614032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beaumontcovidscreener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beaumontcovidscreener.com"; sid:614033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovidplan.com"; sid:614034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-center.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-center.berlin"; sid:614035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21testsites.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21testsites.biz"; sid:614036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddash.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddash.app"; sid:614037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidrecovery.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidrecovery.blog"; sid:614038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stcovidcabin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stcovidcabin.com"; sid:614039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidclean.com"; sid:614040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudepesquisacorona-br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudepesquisacorona-br.com"; sid:614041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ajudepesquisacovid-br.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ajudepesquisacovid-br.com"; sid:614042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anytime911covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anytime911covidtesting.com"; sid:614043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayincovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayincovidready.com"; sid:614044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudeainvestigarelcorona-mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudeainvestigarelcorona-mx.com"; sid:614045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayudeainvestigarelcovid-mx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayudeainvestigarelcovid-mx.com"; sid:614046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcp-covid19edwardjones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcp-covid19edwardjones.com"; sid:614047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloc-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloc-covid.com"; sid:614048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmania.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmania.blog"; sid:614049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fckcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fckcovid.club"; sid:614050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mipandemicstory.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mipandemicstory.blog"; sid:614051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3dscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3dscorona.com"; sid:614052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidsafe.com"; sid:614053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alllexhuwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alllexhuwuhan.com"; sid:614054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anycovidtestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anycovidtestnow.com"; sid:614055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aventiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aventiscovid19.com"; sid:614056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babymamaduringapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babymamaduringapandemic.com"; sid:614057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baiducoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baiducoronavirus.com"; sid:614058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bell-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bell-covid19.com"; sid:614059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bigdatacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bigdatacovid19.com"; sid:614060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicines.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicines.asia"; sid:614061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreener.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreener.app"; sid:614062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstories.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstories.blog"; sid:614063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicins.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicins.agency"; sid:614064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aahpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aahpcovid.com"; sid:614065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronaparty.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronaparty.amsterdam"; sid:614066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreepass.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreepass.app"; sid:614067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatheater.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatheater.asia"; sid:614068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19iq.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19iq.app"; sid:614069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.bayern"; sid:614070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfund.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfund.cloud"; sid:614071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic101.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic101.app"; sid:614072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tous-anti-covid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tous-anti-covid.app"; sid:614073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abovecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abovecorona.com"; sid:614074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accusciencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accusciencovid.com"; sid:614075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aircovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aircovidtest.com"; sid:614076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amccovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amccovidcare.com"; sid:614077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aventusbiolabscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aventusbiolabscovid19.com"; sid:614078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovidapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovidapp.com"; sid:614079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovid19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovid19plan.com"; sid:614080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestachterhoek.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestachterhoek.care"; sid:614081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canada.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canada.blog"; sid:614082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mi-pandemic-story.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mi-pandemic-story.blog"; sid:614083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicproof.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicproof.app"; sid:614084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkoutcovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkoutcovid19.info"; sid:614085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovid.net"; sid:614086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfen.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfen.info"; sid:614087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-meter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-meter.net"; sid:614088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-salzburg.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-salzburg.net"; sid:614089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19buster.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19buster.net"; sid:614090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19endemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19endemic.info"; sid:614091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-predictions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-predictions.net"; sid:614092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vax.net"; sid:614093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-no-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-no-19.net"; sid:614094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstandardsinstitute.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstandardsinstitute.net"; sid:614095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daticoronavirus.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daticoronavirus.info"; sid:614096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howcovidmademehealthy.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howcovidmademehealthy.blog"; sid:614097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanping.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanping.icu"; sid:614098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2covid.com"; sid:614099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancedcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancedcovidtesting.com"; sid:614100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstthepandemic.com"; sid:614101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aguacoronaimperial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aguacoronaimperial.com"; sid:614102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apericovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apericovid.com"; sid:614103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovid19disinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovid19disinfection.com"; sid:614104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoviddisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoviddisinfection.com"; sid:614105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bashcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bashcovid.com"; sid:614106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bcncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bcncovid19.com"; sid:614107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidecovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidecovidplan.com"; sid:614108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenpandemicplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenpandemicplan.com"; sid:614109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenscovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenscovidplan.com"; sid:614110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rapid-test.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rapid-test.biz"; sid:614111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacts.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacts.app"; sid:614112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-held.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-held.berlin"; sid:614113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jgh-covid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jgh-covid19.club"; sid:614114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2020.club"; sid:614115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 48hrcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"48hrcovidtest.com"; sid:614116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 99covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"99covidtest.com"; sid:614117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adventistcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adventistcovid19.com"; sid:614118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amorinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amorinthetimeofcovid.com"; sid:614119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anilloscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anilloscovid.com"; sid:614120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtestnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtestnyc.com"; sid:614121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atryscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atryscovid.com"; sid:614122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avellinacoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avellinacoronatest.com"; sid:614123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for banjac-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"banjac-covid-19.com"; sid:614124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brightsideofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brightsideofcovid.com"; sid:614125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ol.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ol.blog"; sid:614126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreations.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreations.art"; sid:614127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscore.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscore.app"; sid:614128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstats.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstats.cloud"; sid:614129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1minutecovidtest.com"; sid:614130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3minutecovidtest.com"; sid:614131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 60secondcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"60secondcovidtest.com"; sid:614132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaslcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaslcovid.com"; sid:614133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aaslcovidguidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aaslcovidguidelines.com"; sid:614134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovidtech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovidtech.com"; sid:614135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airesincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airesincovid.com"; sid:614136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anatrace-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anatrace-covid.com"; sid:614137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmarketing.com"; sid:614138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b2bcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b2bcorona.com"; sid:614139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buypandemicpackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buypandemicpackage.com"; sid:614140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bvicovidtracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bvicovidtracing.com"; sid:614141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadacovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadacovid19testing.com"; sid:614142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaausweis.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaausweis.app"; sid:614143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest.amsterdam"; sid:614144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for qrcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"qrcovid.app"; sid:614145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona-festival.com"; sid:614146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amarentiemposdecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amarentiemposdecovid.com"; sid:614147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americascovidtest.com"; sid:614148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amycovidbitch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amycovidbitch.com"; sid:614149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anytimecovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anytimecovidcompliance.com"; sid:614150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspicovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspicovid.com"; sid:614151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidrapidtest.com"; sid:614152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attestation-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attestation-covid.com"; sid:614153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b10covidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b10covidtests.com"; sid:614154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafefromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafefromcovid.com"; sid:614155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for big10covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"big10covidtest.com"; sid:614156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for birthinginapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"birthinginapandemic.com"; sid:614157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovidmedicalproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovidmedicalproducts.com"; sid:614158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cascoronavirus.com"; sid:614159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for classroomcovidradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"classroomcovidradar.com"; sid:614160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.click"; sid:614161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.blog"; sid:614162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-rtt.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-rtt.asia"; sid:614163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covids.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covids.app"; sid:614164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.asia"; sid:614165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.best"; sid:614166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.care"; sid:614167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovid.app"; sid:614168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30mincovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30mincovid19test.com"; sid:614169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analiticascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analiticascovid.com"; sid:614170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-serum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-serum.com"; sid:614171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidvac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidvac.com"; sid:614172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atxcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atxcovidtesting.com"; sid:614173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bddk-pandemicumhuronlineerisim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bddk-pandemicumhuronlineerisim.com"; sid:614174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidgame.com"; sid:614175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatnovelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatnovelcoronavirus.com"; sid:614176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beencovidtested.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beencovidtested.com"; sid:614177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cienciadafelicidadeaposcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cienciadafelicidadeaposcovid19.com"; sid:614178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clear19covidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clear19covidtesting.com"; sid:614179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clear19rapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clear19rapidcovidtesting.com"; sid:614180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickandstopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickandstopcovid.com"; sid:614181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combattingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combattingcovid.com"; sid:614182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabogados.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabogados.com"; sid:614183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillvisor.com"; sid:614184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-luftreinigung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-luftreinigung.com"; sid:614185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-luftreinigungsanlage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-luftreinigungsanlage.com"; sid:614186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews247.com"; sid:614187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoldurucusiperlik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoldurucusiperlik.com"; sid:614188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.berlin"; sid:614189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltest.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltest.berlin"; sid:614190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftester.com"; sid:614191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservers.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservers.cloud"; sid:614192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasiperlik.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasiperlik.com"; sid:614193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxi.com"; sid:614194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test.berlin"; sid:614195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-teststation.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-teststation.berlin"; sid:614196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationparkpomo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationparkpomo.com"; sid:614197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-united.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-united.art"; sid:614198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-vaccination.com"; sid:614199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alertband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alertband.com"; sid:614200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19and.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19and.art"; sid:614201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19autotest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19autotest.com"; sid:614202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19casestudyatau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19casestudyatau.com"; sid:614203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cdc-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cdc-alerts.com"; sid:614204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lockdown.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lockdown.club"; sid:614205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-therapeutic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-therapeutic.com"; sid:614206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-therapeutic-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-therapeutic-vaccine.com"; sid:614207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinenj.com"; sid:614208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusinhometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusinhometest.com"; sid:614209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusinhometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusinhometests.com"; sid:614210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusvaccines.com"; sid:614211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wellhealthdfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wellhealthdfw.com"; sid:614212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2ndwavestart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2ndwavestart.com"; sid:614213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid451.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid451.com"; sid:614214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertband.com"; sid:614215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmasmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmasmasks.com"; sid:614216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cleansing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cleansing.com"; sid:614217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-controle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-controle.com"; sid:614218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrackheads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrackheads.com"; sid:614219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreeper.com"; sid:614220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreepers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreepers.com"; sid:614221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevil.com"; sid:614222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevils.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevils.com"; sid:614223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideskincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideskincare.com"; sid:614224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fogging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fogging.com"; sid:614225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgardens.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgardens.club"; sid:614226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthreport.com"; sid:614227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidian.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidian.club"; sid:614228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincommon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincommon.com"; sid:614229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinconsistancies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinconsistancies.com"; sid:614230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinconsistancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinconsistancy.com"; sid:614231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinconsistencies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinconsistencies.com"; sid:614232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinconsistency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinconsistency.com"; sid:614233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjungle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjungle.com"; sid:614234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjungles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjungles.com"; sid:614235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskfacts.com"; sid:614236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonator.com"; sid:614237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofjobs.com"; sid:614238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofmoney.com"; sid:614239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarterly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarterly.com"; sid:614240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarterlyreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarterlyreport.com"; sid:614241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecertifiedinstitue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecertifiedinstitue.com"; sid:614242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe-france.com"; sid:614243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyaudiograms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyaudiograms.com"; sid:614244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsleeper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsleeper.com"; sid:614245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsleepers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsleepers.com"; sid:614246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ssa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ssa.com"; sid:614247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtx.com"; sid:614248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteting.com"; sid:614249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtheories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtheories.com"; sid:614250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatie.com"; sid:614251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinenj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinenj.com"; sid:614252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyouth2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyouth2020.com"; sid:614253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcovidsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcovidsupplies.com"; sid:614254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid19.blog"; sid:614255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lockdowncovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lockdowncovid19.club"; sid:614256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomascovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomascovid.biz"; sid:614257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualidadcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualidadcovid19.com"; sid:614258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amoreneltiempodecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amoreneltiempodecorona.com"; sid:614259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemic-material.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemic-material.com"; sid:614260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asistenciacovid19cfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asistenciacovid19cfe.com"; sid:614261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babyboomerpandemicsurvivalblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babyboomerpandemicsurvivalblog.com"; sid:614262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovidtoday.com"; sid:614263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniccoviddoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniccoviddoctor.com"; sid:614264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprendrelecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprendrelecovid.com"; sid:614265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablackout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablackout.com"; sid:614266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabusterinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabusterinc.com"; sid:614267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckcenter.com"; sid:614268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorridors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorridors.com"; sid:614269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadc.com"; sid:614270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactory.com"; sid:614271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ggff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ggff.com"; sid:614272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info.app"; sid:614273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamovietrailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamovietrailer.com"; sid:614274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzfolien.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzfolien.com"; sid:614275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestvoorbedrijven.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestvoorbedrijven.com"; sid:614276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoppersmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoppersmd.com"; sid:614277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tuev.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tuev.berlin"; sid:614278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tuev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tuev.com"; sid:614279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccination.com"; sid:614280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspharmacie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspharmacie.com"; sid:614281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebpage.com"; sid:614282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectiontorontobusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectiontorontobusiness.com"; sid:614283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freeworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freeworld.com"; sid:614284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infoalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infoalert.com"; sid:614285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19news.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19news.cat"; sid:614286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-onlinetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-onlinetest.com"; sid:614287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharmacie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharmacie.com"; sid:614288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scoaut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scoaut.com"; sid:614289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scout24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scout24.com"; sid:614290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scout24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scout24.com"; sid:614291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sexsurvey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sexsurvey.com"; sid:614292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test-online.com"; sid:614293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tuev.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tuev.berlin"; sid:614294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tuev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tuev.com"; sid:614295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinestudie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinestudie.com"; sid:614296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whistleblowing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whistleblowing.com"; sid:614297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairprotector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairprotector.com"; sid:614298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairsecurity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairsecurity.com"; sid:614299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandtheclassroom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandtheclassroom.com"; sid:614300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecklab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecklab.com"; sid:614301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditdoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditdoctor.com"; sid:614302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcreditnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcreditnow.com"; sid:614303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddentalblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddentalblog.com"; sid:614304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisabilityarchive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisabilityarchive.com"; sid:614305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeflorida.com"; sid:614306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeeks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeeks.com"; sid:614307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgits.com"; sid:614308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidigits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidigits.com"; sid:614309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfoservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfoservices.com"; sid:614310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviditest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviditest.com"; sid:614311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlakeland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlakeland.com"; sid:614312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnorthtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnorthtexas.com"; sid:614313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpharmacie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpharmacie.com"; sid:614314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelax.com"; sid:614315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrover.com"; sid:614316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidschnelltest24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidschnelltest24.com"; sid:614317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-schutzmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-schutzmasken.com"; sid:614318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscout24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscout24.com"; sid:614319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsnuggles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsnuggles.com"; sid:614320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstpete.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstpete.com"; sid:614321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-szczepionka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-szczepionka.com"; sid:614322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidszczepionka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidszczepionka.com"; sid:614323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbyme.com"; sid:614324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcenternearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcenternearme.com"; sid:614325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsolutionsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsolutionsusa.com"; sid:614326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnearbyme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnearbyme.com"; sid:614327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestresultswaitingtime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestresultswaitingtime.com"; sid:614328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestzenrum.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestzenrum.berlin"; sid:614329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiers.com"; sid:614330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvote.com"; sid:614331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronazelftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronazelftest.com"; sid:614332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhhscovidusagrant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhhscovidusagrant.com"; sid:614333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for digitalpandemicresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"digitalpandemicresponse.com"; sid:614334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doesvitamindprotectagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doesvitamindprotectagainstcovid19.com"; sid:614335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for passaportcovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"passaportcovid.cat"; sid:614336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for truecovidconspiracy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"truecovidconspiracy.club"; sid:614337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-tv-x9a.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-tv-x9a.berlin"; sid:614338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-tv-ieb.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-tv-ieb.berlin"; sid:614339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcoronavirus.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcoronavirus.site"; sid:614340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacijfers.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacijfers.site"; sid:614341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-faq.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-faq.info"; sid:614342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-injectie.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-injectie.online"; sid:614343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarandstad.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarandstad.online"; sid:614344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestbus.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestbus.online"; sid:614345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tuev.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tuev.net"; sid:614346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscchealth.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscchealth.org"; sid:614347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscured.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscured.org"; sid:614348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cured.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cured.org"; sid:614349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fatigue.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fatigue.net"; sid:614350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemichelp.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemichelp.live"; sid:614351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.site"; sid:614352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tuev.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tuev.net"; sid:614353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidballs.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidballs.org"; sid:614354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclarity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclarity.net"; sid:614355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleared.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleared.app"; sid:614356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-clinic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-clinic.org"; sid:614357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjectie.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjectie.online"; sid:614358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquicktest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquicktest.net"; sid:614359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrover.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrover.net"; sid:614360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinglab.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinglab.net"; sid:614361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingnow.net"; sid:614362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnow.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnow.net"; sid:614363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtiers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtiers.net"; sid:614364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dsp2-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dsp2-covid19.info"; sid:614365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dsp2-covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dsp2-covid.info"; sid:614366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isaacovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isaacovid.net"; sid:614367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecovidyourbitch.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecovidyourbitch.org"; sid:614368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reinfocovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reinfocovid.net"; sid:614369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.healthcare"; sid:614370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovidtoday.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovidtoday.net"; sid:614371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--corona-tv-x9a.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--corona-tv-x9a.net"; sid:614372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-tv-ieb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-tv-ieb.net"; sid:614373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stopcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stopcovidtest.com"; sid:614374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amidthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amidthepandemic.com"; sid:614375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencoviddeathclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencoviddeathclock.com"; sid:614376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cats-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cats-coronavirus.com"; sid:614377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitiesfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitiesfightingcovid.com"; sid:614378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ademtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ademtest.com"; sid:614379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaademtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaademtest.com"; sid:614380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-angel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-angel.com"; sid:614381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-centrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-centrum.com"; sid:614382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentrum.com"; sid:614383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoasterkitchens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoasterkitchens.com"; sid:614384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnosetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnosetest.com"; sid:614385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocustomhomes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocustomhomes.com"; sid:614386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadonoodle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadonoodle.com"; sid:614387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-engel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-engel.com"; sid:614388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarketingstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarketingstrategies.com"; sid:614389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapavers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapavers.com"; sid:614390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltest.app"; sid:614391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestkit.com"; sid:614392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlane.com"; sid:614393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedomday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedomday.com"; sid:614394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemija.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemija.com"; sid:614395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supersuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supersuit.com"; sid:614396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21hoax.com"; sid:614397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21reset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21reset.com"; sid:614398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid39.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid39.com"; sid:614399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid41.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid41.com"; sid:614400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagram.com"; sid:614401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-centre.com"; sid:614402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcharitycutouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcharitycutouts.com"; sid:614403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmasbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmasbook.com"; sid:614404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothinitiative.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothinitiative.biz"; sid:614405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothinitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothinitiative.com"; sid:614406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcureall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcureall.com"; sid:614407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenvironmentprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenvironmentprotection.com"; sid:614408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventpass.com"; sid:614409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-exit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-exit.com"; sid:614410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelikeme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelikeme.com"; sid:614411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlydining.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlydining.com"; sid:614412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlyvenues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlyvenues.com"; sid:614413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgentest.com"; sid:614414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidicon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidicon.com"; sid:614415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-next.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-next.com"; sid:614416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnyc19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnyc19.com"; sid:614417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ontario.com"; sid:614418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreliefcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreliefcare.com"; sid:614419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebuilding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebuilding.com"; sid:614420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningservices.com"; sid:614421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidskincare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidskincare.com"; sid:614422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupersuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupersuit.com"; sid:614423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkitservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkitservices.com"; sid:614424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testlane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testlane.com"; sid:614425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestlane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestlane.com"; sid:614426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraders.com"; sid:614427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cozycovidchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cozycovidchristmas.com"; sid:614428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cuvicovideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cuvicovideos.com"; sid:614429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovid19virus.com"; sid:614430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovidhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovidhere.com"; sid:614431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatcovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatcovidvirus.com"; sid:614432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dollarcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dollarcovidtest.com"; sid:614433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofpandemicwhen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofpandemicwhen.com"; sid:614434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidtestingkits.com"; sid:614435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fund-4-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fund-4-covid19.com"; sid:614436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fund4-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fund4-covid-19.com"; sid:614437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fund4-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fund4-covid19.com"; sid:614438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundz-4-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundz-4-covid19.com"; sid:614439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-info-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-info-covid19.com"; sid:614440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-with-ptsd-from-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-with-ptsd-from-covid.com"; sid:614441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howdowinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howdowinpandemic.com"; sid:614442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infoabout-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infoabout-covid19.com"; sid:614443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpostgrad.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpostgrad.blog"; sid:614444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcorona.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcorona.app"; sid:614445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarecallers.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarecallers.care"; sid:614446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-class-action-namibia.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-class-action-namibia.org"; sid:614447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-deutschland.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-deutschland.online"; sid:614448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagame.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagame.org"; sid:614449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaperspektiv.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaperspektiv.info"; sid:614450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.app"; sid:614451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrack.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrack.app"; sid:614452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-maps.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-maps.info"; sid:614453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistic.net"; sid:614454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidax.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidax.org"; sid:614455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcatalunya.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcatalunya.cat"; sid:614456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclothinitiative.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclothinitiative.net"; sid:614457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcocktails.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcocktails.club"; sid:614458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcomments.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcomments.info"; sid:614459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcooking.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcooking.club"; sid:614460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexstrategy.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexstrategy.org"; sid:614461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidianie.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidianie.club"; sid:614462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimpactmohp.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimpactmohp.org"; sid:614463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-in-africa.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-in-africa.org"; sid:614464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincontext.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincontext.org"; sid:614465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidioci.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidioci.club"; sid:614466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneverforget.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneverforget.org"; sid:614467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpilot.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpilot.info"; sid:614468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeschools.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeschools.org"; sid:614469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafesignage.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafesignage.online"; sid:614470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafestickers.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafestickers.online"; sid:614471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecure.events - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecure.events"; sid:614472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.london - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.london"; sid:614473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineproject.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineproject.org"; sid:614474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxproject.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxproject.org"; sid:614475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontinvitecovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontinvitecovid.org"; sid:614476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impots-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impots-coronavirus.net"; sid:614477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillasanticovid.fun - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillasanticovid.fun"; sid:614478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiacovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiacovid19.blog"; sid:614479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-update.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-update.info"; sid:614480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for plasmacovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"plasmacovid.cat"; sid:614481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sickofcorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sickofcorona.org"; sid:614482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soroptimistcorona.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soroptimistcorona.org"; sid:614483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidvirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidvirus.net"; sid:614484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopp-corona.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopp-corona.info"; sid:614485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid19.info"; sid:614486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid.info"; sid:614487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for utahcovidtrials.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"utahcovidtrials.org"; sid:614488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 11coronationroad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"11coronationroad.com"; sid:614489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadoscovidmadrid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadoscovidmadrid.com"; sid:614490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidquicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidquicktest.com"; sid:614491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alsgroupcovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alsgroupcovidshop.com"; sid:614492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ameli-remboursement-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ameli-remboursement-covid19.com"; sid:614493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidsurvivor.com"; sid:614494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidsurvivors.com"; sid:614495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidtools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidtools.com"; sid:614496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for articuloscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"articuloscovid.com"; sid:614497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcovidmanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcovidmanual.com"; sid:614498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangcovidfree.com"; sid:614499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blazecovidstudies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blazecovidstudies.com"; sid:614500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blazecovidtrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blazecovidtrials.com"; sid:614501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingdowncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingdowncovid19.com"; sid:614502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clientsduringcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clientsduringcovid.com"; sid:614503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidresults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidresults.com"; sid:614504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schutzmasken.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schutzmasken.biz"; sid:614505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canada.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canada.blog"; sid:614506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcough.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcough.app"; sid:614507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid.biz"; sid:614508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecovid.club"; sid:614509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccockpit.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccockpit.app"; sid:614510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccockpit.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccockpit.center"; sid:614511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for promotioncovid19support.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"promotioncovid19support.center"; sid:614512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 027wuhanyese.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"027wuhanyese.com"; sid:614513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 517wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"517wuhan.com"; sid:614514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahotellakepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahotellakepandemic.com"; sid:614515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocoronatexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocoronatexas.com"; sid:614516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beautycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beautycovid.com"; sid:614517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clearedcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clearedcovidfree.com"; sid:614518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cluster5covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cluster5covid-19.com"; sid:614519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnelteststraat.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnelteststraat.amsterdam"; sid:614520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateststraat.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateststraat.amsterdam"; sid:614521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerusa.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerusa.app"; sid:614522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackerus.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackerus.app"; sid:614523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19trackingus.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19trackingus.app"; sid:614524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-news.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-news.blog"; sid:614525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for inpandemic.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"inpandemic.art"; sid:614526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemic.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemic.biz"; sid:614527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aacovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aacovidstudy.com"; sid:614528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amdclassifiedscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amdclassifiedscorona.com"; sid:614529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid10.com"; sid:614530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidd.com"; sid:614531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antipandemiccoffeeco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antipandemiccoffeeco.com"; sid:614532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for app-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"app-pandemic.com"; sid:614533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artagainstcovid.com"; sid:614534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becomeacovidtestsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becomeacovidtestsite.com"; sid:614535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beste-corona-maske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beste-corona-maske.com"; sid:614536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bmcovidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bmcovidscreen.com"; sid:614537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careercoachingthrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careercoachingthrucovid.com"; sid:614538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-kontakttagebuch.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-kontakttagebuch.app"; sid:614539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidampel.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidampel.app"; sid:614540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-award.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-award.best"; sid:614541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.christmas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.christmas"; sid:614542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aayucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aayucorona.com"; sid:614543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aayucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aayucovid19.com"; sid:614544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aayucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aayucovid.com"; sid:614545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aayucovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aayucovidtest.com"; sid:614546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidrecovery.com"; sid:614547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusnasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusnasalspray.com"; sid:614548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidnasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidnasalspray.com"; sid:614549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for artincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"artincovid.com"; sid:614550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenekacovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenekacovid-19vaccine.com"; sid:614551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontechcovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontechcovid-19vaccine.com"; sid:614552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biostickercovidstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biostickercovidstudy.com"; sid:614553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capitancoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capitancoronado.com"; sid:614554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carcovidprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carcovidprotect.com"; sid:614555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conquercovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conquercovidcoalition.com"; sid:614556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstats.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstats.cat"; sid:614557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidtest.com"; sid:614558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abdanticovid19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abdanticovid19spray.com"; sid:614559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adrianascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adrianascovidtest.com"; sid:614560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adrianasfreecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adrianasfreecovidtest.com"; sid:614561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amvideoclassifiedscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amvideoclassifiedscorona.com"; sid:614562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19spray.com"; sid:614563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidwipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidwipes.com"; sid:614564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigentest-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigentest-corona.com"; sid:614565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigentestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigentestcorona.com"; sid:614566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigentest-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigentest-covid19.com"; sid:614567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antigentest-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antigentest-covid.com"; sid:614568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidbustersllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidbustersllc.com"; sid:614569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitemecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitemecorona.com"; sid:614570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cameupfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cameupfromcovid.com"; sid:614571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascovidtest.com"; sid:614572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-2021.com"; sid:614573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaanvraagnu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaanvraagnu.com"; sid:614574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafasttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafasttests.com"; sid:614575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalion.com"; sid:614576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnelcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnelcheck.com"; sid:614577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasnelchecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasnelchecker.com"; sid:614578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateinternational.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateinternational.com"; sid:614579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-hamburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-hamburg.com"; sid:614580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hokkaido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hokkaido.com"; sid:614581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liar.com"; sid:614582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboxtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboxtest.com"; sid:614583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidboxtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidboxtests.com"; sid:614584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrct.com"; sid:614585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoggies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoggies.com"; sid:614586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfre.com"; sid:614587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidglobalmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidglobalmap.com"; sid:614588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomecheck.com"; sid:614589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisbusiness.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisbusiness.cloud"; sid:614590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeferries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeferries.com"; sid:614591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatsapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatsapp.com"; sid:614592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestexperts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestexperts.com"; sid:614593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestgratis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestgratis.com"; sid:614594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinggratis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinggratis.com"; sid:614595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusnasalspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusnasalspray.com"; sid:614596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingvideo.com"; sid:614597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopiacovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopiacovid19test.com"; sid:614598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examendecovidgratis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examendecovidgratis.com"; sid:614599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for examendelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"examendelcovid.com"; sid:614600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasttestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasttestcorona.com"; sid:614601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtestingtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtestingtoday.com"; sid:614602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidtesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidtesttoday.com"; sid:614603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getfreecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getfreecovidtest.com"; sid:614604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gotcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gotcovidtest.com"; sid:614605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gratiscovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gratiscovidtest.com"; sid:614606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpussy.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpussy.blog"; sid:614607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ahod2endcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ahod2endcovid19.com"; sid:614608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aide-financiere-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aide-financiere-covid19.com"; sid:614609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovid19memorial.com"; sid:614610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidmemorial.com"; sid:614611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidmemorialfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidmemorialfund.com"; sid:614612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badencovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badencovidplan.com"; sid:614613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidemcovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidemcovidplan.com"; sid:614614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenharriscovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenharriscovidplan.com"; sid:614615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidoncovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidoncovidplan.com"; sid:614616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodencovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodencovidplan.com"; sid:614617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for budencovidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"budencovidplan.com"; sid:614618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambrabcncovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambrabcncovid.cat"; sid:614619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causa-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causa-corona.com"; sid:614620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for causacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"causacorona.com"; sid:614621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkmeforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkmeforcovid.com"; sid:614622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim-covid-ref.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim-covid-ref.com"; sid:614623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collateralcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collateralcovid.com"; sid:614624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comunidadescontracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comunidadescontracovid.com"; sid:614625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafelpudos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafelpudos.com"; sid:614626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infoportal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infoportal.com"; sid:614627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquicktester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquicktester.com"; sid:614628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltester.com"; sid:614629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestkopen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestkopen.com"; sid:614630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestwijzer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestwijzer.com"; sid:614631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoreapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoreapi.com"; sid:614632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoreunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoreunits.com"; sid:614633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-24.com"; sid:614634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestvergelijken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestvergelijken.com"; sid:614635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tribunal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tribunal.com"; sid:614636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscare.com"; sid:614637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19aircleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19aircleaners.com"; sid:614638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19airpurifiers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19airpurifiers.com"; sid:614639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19companions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19companions.com"; sid:614640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cube.com"; sid:614641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gone2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gone2021.com"; sid:614642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hub.com"; sid:614643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19openwoundtherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19openwoundtherapy.com"; sid:614644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadaptedtradeexhibitions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadaptedtradeexhibitions.com"; sid:614645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandconquer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandconquer.com"; sid:614646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchicks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchicks.com"; sid:614647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensesystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensesystems.com"; sid:614648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfalseflag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfalseflag.com"; sid:614649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgone2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgone2021.com"; sid:614650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidifacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidifacts.com"; sid:614651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-itwithumbrellainsuranceandassurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-itwithumbrellainsuranceandassurance.com"; sid:614652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnasal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnasal.com"; sid:614653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickcheque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickcheque.com"; sid:614654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresulttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresulttoday.com"; sid:614655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetytips.com"; sid:614656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreeningsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreeningsite.com"; sid:614657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsperms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsperms.com"; sid:614658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtier.com"; sid:614659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentoptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentoptions.com"; sid:614660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtruthsrevealed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtruthsrevealed.com"; sid:614661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cra-covid19.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cra-covid19.cloud"; sid:614662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duetocovidbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duetocovidbook.com"; sid:614663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for falseflagcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"falseflagcovid.com"; sid:614664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for falseflagpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"falseflagpandemic.com"; sid:614665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covids-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covids-19.com"; sid:614666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covids19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covids19.com"; sid:614667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2353coronaave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2353coronaave.com"; sid:614668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aanvraagcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aanvraagcorona.com"; sid:614669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ageofcovidbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ageofcovidbooks.com"; sid:614670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidsrilanka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidsrilanka.com"; sid:614671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for astrazenecacovid-19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"astrazenecacovid-19vaccine.com"; sid:614672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bathandbodyworkspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bathandbodyworkspandemic.com"; sid:614673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidchecked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidchecked.com"; sid:614674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontechcoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontechcoronavaccine.com"; sid:614675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-den.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-den.club"; sid:614676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safety.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safety.agency"; sid:614677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurated.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurated.blog"; sid:614678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-killer.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-killer.club"; sid:614679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicrealities.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicrealities.blog"; sid:614680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for portail-tresorpublic-covide.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"portail-tresorpublic-covide.cloud"; sid:614681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcsofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcsofcovid.com"; sid:614682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aeratedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aeratedcorona.com"; sid:614683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aeratedcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aeratedcovid19.com"; sid:614684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aeratedcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aeratedcovid.com"; sid:614685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allvscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allvscovid.com"; sid:614686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidal.com"; sid:614687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for axumcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"axumcovidtesting.com"; sid:614688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cfscovidform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cfscovidform.com"; sid:614689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clickpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clickpandemic.com"; sid:614690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitythrucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitythrucovid.com"; sid:614691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabookshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabookshop.com"; sid:614692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-bucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-bucks.com"; sid:614693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-campaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-campaign.com"; sid:614694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrust.com"; sid:614695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpnigeria.com"; sid:614696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-info-tour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-info-tour.com"; sid:614697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarchbasketball202.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarchbasketball202.com"; sid:614698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphilly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphilly.com"; sid:614699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-praat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-praat.com"; sid:614700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofontmoetingen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofontmoetingen.com"; sid:614701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-revalidatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-revalidatie.com"; sid:614702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.app"; sid:614703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.center"; sid:614704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspicatas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspicatas.com"; sid:614705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexodus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexodus.com"; sid:614706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpnigeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpnigeria.com"; sid:614707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccineclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccineclaims.com"; sid:614708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19complianceprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19complianceprogram.com"; sid:614709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19contactalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19contactalert.com"; sid:614710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eliminators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eliminators.com"; sid:614711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19exodus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19exodus.com"; sid:614712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19gum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19gum.com"; sid:614713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inspain.com"; sid:614714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killas.com"; sid:614715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19koruyucu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19koruyucu.com"; sid:614716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicalmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicalmasks.com"; sid:614717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigationprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigationprogram.com"; sid:614718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mitigator.com"; sid:614719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigator.com"; sid:614720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mitigators.com"; sid:614721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mitigators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mitigators.com"; sid:614722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-resourceinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-resourceinfo.com"; sid:614723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resourceinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resourceinfo.com"; sid:614724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19symptomevaluator.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19symptomevaluator.app"; sid:614725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsb.com"; sid:614726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19traxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19traxx.com"; sid:614727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccina.com"; sid:614728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineassistance.com"; sid:614729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vakcina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vakcina.com"; sid:614730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusvaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusvaccination.com"; sid:614731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workerscompclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workerscompclaim.com"; sid:614732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20wave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20wave.com"; sid:614733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4free.com"; sid:614734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactiongroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactiongroup.com"; sid:614735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanthem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanthem.com"; sid:614736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcasemanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcasemanager.com"; sid:614737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcdcq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcdcq.com"; sid:614738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoldstorage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoldstorage.com"; sid:614739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideffectz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideffectz.com"; sid:614740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-freeair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-freeair.com"; sid:614741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheaters.com"; sid:614742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisova.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisova.com"; sid:614743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkoruyucu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkoruyucu.com"; sid:614744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigationcleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigationcleaningservice.com"; sid:614745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigationservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigationservice.com"; sid:614746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigator.com"; sid:614747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneighteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneighteen.com"; sid:614748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnoneteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnoneteen.com"; sid:614749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-outreachwoodriver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-outreachwoodriver.com"; sid:614750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ransom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ransom.com"; sid:614751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskcheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskcheckup.com"; sid:614752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsavers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsavers.com"; sid:614753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreativecafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreativecafe.com"; sid:614754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreativeclub.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreativeclub.biz"; sid:614755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreativeclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreativeclub.com"; sid:614756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsponsible.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsponsible.com"; sid:614757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsransom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsransom.com"; sid:614758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-store.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-store.cloud"; sid:614759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.cloud"; sid:614760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplyindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplyindia.com"; sid:614761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxlocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxlocations.com"; sid:614762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkerscompclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkerscompclaim.com"; sid:614763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworklist.com"; sid:614764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx1xkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx1xkiller.com"; sid:614765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidx1xsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidx1xsolutions.com"; sid:614766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixkiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixkiller.com"; sid:614767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxixkillers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxixkillers.com"; sid:614768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lmpots-covide-public.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lmpots-covide-public.cloud"; sid:614769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidxmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidxmas.com"; sid:614770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcoronavaccins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcoronavaccins.com"; sid:614771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencoviddeathcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencoviddeathcount.com"; sid:614772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesspandemicrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesspandemicrelief.com"; sid:614773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.club"; sid:614774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcourage.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcourage.asia"; sid:614775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpersistent.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpersistent.cat"; sid:614776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pharmacovid.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pharmacovid.click"; sid:614777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testynacovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testynacovid.biz"; sid:614778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 200southcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"200southcorona.com"; sid:614779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accucovid-19.com"; sid:614780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accucovid.com"; sid:614781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accucoviddx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accucoviddx.com"; sid:614782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acucovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acucovid-19.com"; sid:614783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acu-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acu-covid.com"; sid:614784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acucoviddx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acucoviddx.com"; sid:614785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovidcleaning.com"; sid:614786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavaccin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavaccin.com"; sid:614787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buythecovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buythecovidvaccine.com"; sid:614788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chabadcovidchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chabadcovidchallenge.com"; sid:614789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cictwuhan-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cictwuhan-app.com"; sid:614790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconbadbunny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconbadbunny.com"; sid:614791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadelrosario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadelrosario.com"; sid:614792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfung.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfung.bayern"; sid:614793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarycirculation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarycirculation.com"; sid:614794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinaties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinaties.com"; sid:614795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-fatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-fatigue.com"; sid:614796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusluciferrase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusluciferrase.com"; sid:614797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1924hourprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1924hourprotection.com"; sid:614798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19adventuregame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19adventuregame.com"; sid:614799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antibodytoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antibodytoday.com"; sid:614800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19assistenza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19assistenza.com"; sid:614801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronatest.com"; sid:614802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dailylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dailylife.com"; sid:614803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-event-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-event-protection.com"; sid:614804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-event-reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-event-reporting.com"; sid:614805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-event-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-event-tracking.com"; sid:614806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-exposure-event-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-exposure-event-tracking.com"; sid:614807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19fatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19fatigue.com"; sid:614808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kotaikensa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kotaikensa.com"; sid:614809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19livecheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19livecheck.com"; sid:614810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19luciferrase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19luciferrase.com"; sid:614811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-safe-weddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-safe-weddings.com"; sid:614812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkit2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkit2020.com"; sid:614813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkits2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkits2020.com"; sid:614814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.asia"; sid:614815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineplus.com"; sid:614816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxinfo.com"; sid:614817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-weddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-weddings.com"; sid:614818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wedding-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wedding-tracking.com"; sid:614819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2door.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2door.com"; sid:614820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantibodytesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantibodytesttoday.com"; sid:614821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcantillana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcantillana.com"; sid:614822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareline.com"; sid:614823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningnearme.com"; sid:614824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningsquad.com"; sid:614825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoronafatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoronafatigue.com"; sid:614826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-couriers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-couriers.com"; sid:614827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddvax.com"; sid:614828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideochatgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideochatgames.com"; sid:614829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescort.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescort.com"; sid:614830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-events.com"; sid:614831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfearporn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfearporn.com"; sid:614832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-fr.com"; sid:614833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreecoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreecoffee.com"; sid:614834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidghost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidghost.com"; sid:614835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiantech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiantech.com"; sid:614836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvader.com"; sid:614837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkeur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkeur.com"; sid:614838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledtokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledtokyo.com"; sid:614839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidman.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidman.app"; sid:614840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientadvocacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientadvocacy.com"; sid:614841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpatientadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpatientadvocates.com"; sid:614842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofair.com"; sid:614843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pw.com"; sid:614844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-events.com"; sid:614845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-gatherings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-gatherings.com"; sid:614846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafehomesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafehomesales.com"; sid:614847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safe-reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safe-reporting.com"; sid:614848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsecurefestivals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsecurefestivals.com"; sid:614849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsheilds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsheilds.com"; sid:614850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeakeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeakeasy.com"; sid:614851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingguyana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingguyana.com"; sid:614852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedirect.com"; sid:614853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinhaler.com"; sid:614854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinhalers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinhalers.com"; sid:614855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinejab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinejab.com"; sid:614856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineshirt.com"; sid:614857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesupply.com"; sid:614858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaksin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaksin.com"; sid:614859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvalidation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvalidation.com"; sid:614860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxinfo.com"; sid:614861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusfatigue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusfatigue.com"; sid:614862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwoking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwoking.com"; sid:614863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwoman.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwoman.app"; sid:614864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzapit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzapit.com"; sid:614865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montestcovid.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montestcovid.click"; sid:614866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.click"; sid:614867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30secondcovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30secondcovidscreening.com"; sid:614868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 3minutecovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"3minutecovidscreening.com"; sid:614869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingcovid19.com"; sid:614870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthingscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthingscovid-19.com"; sid:614871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidrecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidrecipes.com"; sid:614872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayearinthelifeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayearinthelifeofcovid.com"; sid:614873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ayearinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ayearinthetimeofcovid.com"; sid:614874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bludimetilene-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bludimetilene-covid19.com"; sid:614875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for botanicovida-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"botanicovida-usa.com"; sid:614876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidscreening.com"; sid:614877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cic-desinfection-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cic-desinfection-covid.com"; sid:614878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid.app"; sid:614879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidscreening.com"; sid:614880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovidwebinar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovidwebinar.com"; sid:614881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antigen-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antigen-test.com"; sid:614882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrewingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrewingcompany.com"; sid:614883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomercial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomercial.com"; sid:614884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondo.com"; sid:614885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-contact-tracing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-contact-tracing.com"; sid:614886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-doku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-doku.com"; sid:614887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenleefstijl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenleefstijl.com"; sid:614888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagirlsgonewild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagirlsgonewild.com"; sid:614889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-berlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-berlin.com"; sid:614890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationcoin.com"; sid:614891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19longtail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19longtail.com"; sid:614892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19maskcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19maskcard.com"; sid:614893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19relif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19relif.com"; sid:614894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restaurantaudits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restaurantaudits.com"; sid:614895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-safe-events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-safe-events.com"; sid:614896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safefood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safefood.com"; sid:614897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safefoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safefoods.com"; sid:614898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportfoundation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportfoundation.com"; sid:614899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacanation.com"; sid:614900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccanation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccanation.com"; sid:614901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccinated.com"; sid:614902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinehouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinehouston.com"; sid:614903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacunas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacunas.com"; sid:614904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wontdie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wontdie.com"; sid:614905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid614g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid614g.com"; sid:614906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairborne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairborne.com"; sid:614907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidalertct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidalertct.com"; sid:614908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaviationcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaviationcalculator.com"; sid:614909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcabs.com"; sid:614910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcard.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcard.app"; sid:614911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarefulweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarefulweddings.com"; sid:614912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchaga.com"; sid:614913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleansurfaces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleansurfaces.com"; sid:614914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compare.com"; sid:614915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-contrast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-contrast.com"; sid:614916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecard.com"; sid:614917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefreeevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefreeevents.com"; sid:614918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfarmacia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfarmacia.com"; sid:614919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeevent.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeevent.biz"; sid:614920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreefestival.com"; sid:614921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreelive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreelive.com"; sid:614922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgaggifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgaggifts.com"; sid:614923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgatherings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgatherings.com"; sid:614924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealingrecovery.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealingrecovery.club"; sid:614925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealingrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealingrecovery.com"; sid:614926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheals.com"; sid:614927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-helper-app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-helper-app.com"; sid:614928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-immunization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-immunization.com"; sid:614929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinnovator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinnovator.com"; sid:614930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinromania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinromania.com"; sid:614931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiot101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiot101.com"; sid:614932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlongtail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlongtail.com"; sid:614933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plex.com"; sid:614934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreventor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreventor.com"; sid:614935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquickkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquickkits.com"; sid:614936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafefoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafefoods.com"; sid:614937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstrategie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstrategie.com"; sid:614938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesztpont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesztpont.com"; sid:614939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtroubles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtroubles.com"; sid:614940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationrx.com"; sid:614941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineclinic.com"; sid:614942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineclinics.com"; sid:614943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccinelondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccinelondon.com"; sid:614944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine-london.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine-london.com"; sid:614945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-voyage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-voyage.com"; sid:614946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcovid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcovid2021.com"; sid:614947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid10.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid10.club"; sid:614948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid1.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid1.club"; sid:614949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid2.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid2.club"; sid:614950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid3.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid3.club"; sid:614951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid4.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid4.club"; sid:614952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid5.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid5.club"; sid:614953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid6.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid6.club"; sid:614954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid7.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid7.club"; sid:614955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid8.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid8.club"; sid:614956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid9.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid9.club"; sid:614957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocovid.club"; sid:614958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4packcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4packcovidtest.com"; sid:614959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 6packcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"6packcovidtest.com"; sid:614960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 713covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"713covidtest.com"; sid:614961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 832covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"832covidtest.com"; sid:614962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercoronainvest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercoronainvest.com"; sid:614963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for annocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"annocovid19.com"; sid:614964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcovida.com"; sid:614965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asapcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asapcovidvaccine.com"; sid:614966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for behindcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"behindcorona.com"; sid:614967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blastcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blastcovid.com"; sid:614968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingnewscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingnewscovid.com"; sid:614969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadagovcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadagovcovid.com"; sid:614970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashfornottakingcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashfornottakingcovidtest.com"; sid:614971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocovidtests.com"; sid:614972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for comprar-test-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"comprar-test-coronavirus.com"; sid:614973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confidentialcovidscreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confidentialcovidscreening.com"; sid:614974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19speakeasy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19speakeasy.com"; sid:614975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antitest.com"; sid:614976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafinanzen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafinanzen.com"; sid:614977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakalyanam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakalyanam.com"; sid:614978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakonzept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakonzept.com"; sid:614979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanogo.com"; sid:614980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatastic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatastic.com"; sid:614981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronationmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronationmarketing.com"; sid:614982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaty.com"; sid:614983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxinfo.com"; sid:614984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazubairlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazubairlab.com"; sid:614985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checked.com"; sid:614986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-event-staffing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-event-staffing.com"; sid:614987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gadget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gadget.com"; sid:614988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19gizmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19gizmo.com"; sid:614989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nailed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nailed.com"; sid:614990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-onsite-teams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-onsite-teams.com"; sid:614991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-onsite-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-onsite-testing.com"; sid:614992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19prophecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19prophecy.com"; sid:614993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-reporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-reporting.com"; sid:614994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedelivery.com"; sid:614995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelogistics.com"; sid:614996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetransport.com"; sid:614997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaccess.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaccess.app"; sid:614998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamed.com"; sid:614999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarefulbride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarefulbride.com"; sid:615000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaseattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaseattorney.com"; sid:615001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchangedmylife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchangedmylife.com"; sid:615002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolboutique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolboutique.com"; sid:615003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidda.com"; sid:615004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-dezynfekcja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-dezynfekcja.com"; sid:615005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventtest.com"; sid:615006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideventtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideventtests.com"; sid:615007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexcellencecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexcellencecenters.com"; sid:615008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpresscare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpresscare.com"; sid:615009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfamilythanksgiving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfamilythanksgiving.com"; sid:615010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflujab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflujab.com"; sid:615011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree-21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree-21.com"; sid:615012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree21.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree21.com"; sid:615013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreehugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreehugs.com"; sid:615014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-funds-gov.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-funds-gov.com"; sid:615015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgizmogadget.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgizmogadget.com"; sid:615016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthhelps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthhelps.com"; sid:615017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididplus.com"; sid:615018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisbogus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisbogus.com"; sid:615019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitsdelivered.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitsdelivered.com"; sid:615020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkustoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkustoms.com"; sid:615021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlinkgalway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlinkgalway.com"; sid:615022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlogbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlogbook.com"; sid:615023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmadeusrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmadeusrich.com"; sid:615024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplusid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplusid.com"; sid:615025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpregnancyscotland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpregnancyscotland.com"; sid:615026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafebride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafebride.com"; sid:615027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeweddings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeweddings.com"; sid:615028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentinel.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentinel.app"; sid:615029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsentry.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsentry.app"; sid:615030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidssf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidssf.com"; sid:615031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testapi.com"; sid:615032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.berlin"; sid:615033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testinfo.com"; sid:615034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineco.com"; sid:615035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecompany.com"; sid:615036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedatabase.com"; sid:615037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedistribution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedistribution.com"; sid:615038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelogistics.com"; sid:615039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineoc.com"; sid:615040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesupplychain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesupplychain.com"; sid:615041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetransport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetransport.com"; sid:615042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvswars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvswars.com"; sid:615043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovidtest.com"; sid:615044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercovidtesting.com"; sid:615045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eatcovid.com"; sid:615046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcovidtestingandfundingnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcovidtestingandfundingnow.com"; sid:615047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for familycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"familycovidtest.com"; sid:615048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacovidtests.com"; sid:615049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for filmrapidcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"filmrapidcovidtesting.com"; sid:615050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fourpackcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fourpackcovidtest.com"; sid:615051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acu8covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acu8covid.com"; sid:615052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alexgcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alexgcoronado.com"; sid:615053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andthencovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andthencovid.com"; sid:615054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbucovid19.com"; sid:615055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcovidrapidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcovidrapidtest.com"; sid:615056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovid19advisoryboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovid19advisoryboard.com"; sid:615057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boiteaideecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boiteaideecovid.com"; sid:615058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachingcovid.com"; sid:615059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.app"; sid:615060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacityrun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacityrun.com"; sid:615061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medical24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medical24.com"; sid:615062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyco.com"; sid:615063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartyrental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartyrental.com"; sid:615064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapartys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapartys.com"; sid:615065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconscious.com"; sid:615066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2normality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2normality.com"; sid:615067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19advisoryboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19advisoryboard.com"; sid:615068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breatheclearair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breatheclearair.com"; sid:615069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-christmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-christmas.com"; sid:615070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19isnotreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19isnotreal.com"; sid:615071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medical24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medical24.com"; sid:615072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19promotionsupportcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19promotionsupportcenter.com"; sid:615073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19revoveryblend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19revoveryblend.com"; sid:615074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workathome.com"; sid:615075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1call.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1call.com"; sid:615076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1on1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1on1.com"; sid:615077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2030.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2030.com"; sid:615078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.brussels - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.brussels"; sid:615079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9one1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9one1.com"; sid:615080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairdetoxifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairdetoxifier.com"; sid:615081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxiety.coach - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxiety.coach"; sid:615082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxietycoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxietycoach.com"; sid:615083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaustraliangel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaustraliangel.com"; sid:615084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear15.com"; sid:615085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfessionsplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfessionsplay.com"; sid:615086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconfessionstheplay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconfessionstheplay.com"; sid:615087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcukes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcukes.com"; sid:615088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetoxifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetoxifier.com"; sid:615089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgalaxy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgalaxy.com"; sid:615090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgriefgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgriefgroup.com"; sid:615091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindoorairpurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindoorairpurifier.com"; sid:615092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinfo2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinfo2020.com"; sid:615093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidingthegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidingthegame.com"; sid:615094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlicous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlicous.com"; sid:615095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-longhaulers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-longhaulers.com"; sid:615096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpsywar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpsywar.com"; sid:615097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryrate.com"; sid:615098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoveryrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoveryrates.com"; sid:615099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsche.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsche.com"; sid:615100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshere.com"; sid:615101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmartcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmartcheck.com"; sid:615102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmarttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmarttest.com"; sid:615103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmeasure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmeasure.com"; sid:615104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsuperdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsuperdogs.com"; sid:615105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupportplatform.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupportplatform.com"; sid:615106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivers.com"; sid:615107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsc.com"; sid:615108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatment-westernma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatment-westernma.com"; sid:615109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine8.com"; sid:615110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecentral.com"; sid:615111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvactivegel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvactivegel.com"; sid:615112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwidowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwidowers.com"; sid:615113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elpasocovidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elpasocovidcleaning.com"; sid:615114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exquisitepandemicspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exquisitepandemicspecial.com"; sid:615115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidnews.com"; sid:615116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidsolutions.com"; sid:615117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4covidupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4covidupdates.com"; sid:615118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedhomecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedhomecovidtest.com"; sid:615119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondthecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondthecovid.com"; sid:615120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodcovid.com"; sid:615121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buloscovid19.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buloscovid19.cat"; sid:615122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcovidcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcovidcontrol.com"; sid:615123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chagacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chagacovid.com"; sid:615124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsensecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsensecovidtest.com"; sid:615125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-istisharicare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-istisharicare.com"; sid:615126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antigen-test1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antigen-test1.com"; sid:615127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19idcredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19idcredential.com"; sid:615128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19spraying.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19spraying.com"; sid:615129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verifiedcredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verifiedcredential.com"; sid:615130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verifiedidentitycredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verifiedidentitycredential.com"; sid:615131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanxietyhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanxietyhelp.com"; sid:615132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchrons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchrons.com"; sid:615133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddispenser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddispenser.com"; sid:615134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidedtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidedtesting.com"; sid:615135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididrartesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididrartesti.com"; sid:615136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidissue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidissue.com"; sid:615137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidistan.com"; sid:615138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledchristmas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledchristmas.com"; sid:615139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlisting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlisting.com"; sid:615140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutcome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutcome.com"; sid:615141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivormerch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivormerch.com"; sid:615142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsupport.com"; sid:615143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesales.com"; sid:615144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwashers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwashers.com"; sid:615145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworry.com"; sid:615146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 20444coronast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"20444coronast.com"; sid:615147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aacovid.com"; sid:615148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecovid.com"; sid:615149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurekillscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurekillscovid.com"; sid:615150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adultkidsathomeepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adultkidsathomeepidemic.com"; sid:615151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adultkidsepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adultkidsepidemic.com"; sid:615152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afccovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afccovidtest.com"; sid:615153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for airportcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"airportcovidtests.com"; sid:615154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacovidvaccine.com"; sid:615155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacovidvaccine.com"; sid:615156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovid19live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovid19live.com"; sid:615157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-uvc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-uvc.com"; sid:615158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacovidvaccine.com"; sid:615159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bermudacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bermudacovid.com"; sid:615160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boycottcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boycottcovid.com"; sid:615161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidvaccine.com"; sid:615162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucks.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucks.club"; sid:615163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.cards - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.cards"; sid:615164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecovid.club"; sid:615165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhongwei.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhongwei.club"; sid:615166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10-minutecovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10-minutecovidtest.com"; sid:615167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 72hourcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"72hourcovid19testing.com"; sid:615168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 72hourcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"72hourcovidtesting.com"; sid:615169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid8.com"; sid:615170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-express.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-express.com"; sid:615171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ciaociaocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ciaociaocorona.com"; sid:615172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinicasjvcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinicasjvcovid.com"; sid:615173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coldcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coldcovid.com"; sid:615174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2426tks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2426tks.com"; sid:615175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.biz"; sid:615176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconciergellc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconciergellc.com"; sid:615177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfmobil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfmobil.com"; sid:615178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfstelle-berlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfstelle-berlin.com"; sid:615179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamerchadising.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamerchadising.com"; sid:615180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprooftaxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprooftaxi.com"; sid:615181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastartpagina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastartpagina.com"; sid:615182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxivervoer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxivervoer.com"; sid:615183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestcard.com"; sid:615184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningserviceswa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningserviceswa.com"; sid:615185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covertcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covertcovid19.com"; sid:615186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19breathecleanair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19breathecleanair.com"; sid:615187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19burn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19burn.com"; sid:615188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-buster.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-buster.biz"; sid:615189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pfizervaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pfizervaccine.com"; sid:615190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-quicktest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-quicktest.com"; sid:615191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidantigentest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidantigentest.com"; sid:615192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedating.com"; sid:615193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-9clinicalstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-9clinicalstudy.com"; sid:615194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidapprovedhometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidapprovedhometestkit.com"; sid:615195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidathletics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidathletics.com"; sid:615196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmas.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmas.biz"; sid:615197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmasshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmasshop.com"; sid:615198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitychronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitychronicles.com"; sid:615199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexpertaircleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexpertaircleaning.com"; sid:615200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthed.com"; sid:615201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthneeds.com"; sid:615202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfstelle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfstelle.com"; sid:615203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfstellen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfstellen.com"; sid:615204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidocity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidocity.com"; sid:615205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpenissolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpenissolutions.com"; sid:615206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproofconsulting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproofconsulting.biz"; sid:615207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskreduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskreduction.com"; sid:615208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsexstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsexstories.com"; sid:615209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stop.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stop.biz"; sid:615210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcard.com"; sid:615211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestistanbul.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestistanbul.com"; sid:615212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineclosetome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineclosetome.com"; sid:615213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedistributors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedistributors.com"; sid:615214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineexemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineexemption.com"; sid:615215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwintertest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwintertest.com"; sid:615216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tamponi-covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tamponi-covid.biz"; sid:615217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testrapidcovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testrapidcovid.cloud"; sid:615218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aliviocovid19response.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aliviocovid19response.org"; sid:615219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alliancetobeatcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alliancetobeatcovid.org"; sid:615220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alwayspandemicneverchristmas.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alwayspandemicneverchristmas.org"; sid:615221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtest.biz"; sid:615222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidtest.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidtest.info"; sid:615223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckin.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckin.app"; sid:615224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaqa.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaqa.online"; sid:615225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascams.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascams.org"; sid:615226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatuuu.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatuuu.club"; sid:615227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid01.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid01.club"; sid:615228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaner.london - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaner.london"; sid:615229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eos.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eos.net"; sid:615230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lies.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lies.org"; sid:615231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quote.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quote.org"; sid:615232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sbc.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sbc.info"; sid:615233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tributes.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tributes.biz"; sid:615234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019.memorial - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019.memorial"; sid:615235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.monster - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.monster"; sid:615236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.london - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.london"; sid:615237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombatrx.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombatrx.org"; sid:615238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconnect.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconnect.news"; sid:615239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensesystem.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensesystem.net"; sid:615240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidegree.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidegree.org"; sid:615241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidexemption.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidexemption.org"; sid:615242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkills.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkills.info"; sid:615243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnineteen.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnineteen.biz"; sid:615244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingcenter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingcenter.net"; sid:615245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoolbox.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoolbox.online"; sid:615246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwarrior.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwarrior.info"; sid:615247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcovidvaccination.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcovidvaccination.net"; sid:615248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for incoronado.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"incoronado.net"; sid:615249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spreadlovenotcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spreadlovenotcovid.net"; sid:615250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vakcinacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vakcinacovid.info"; sid:615251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24covidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24covidcare.com"; sid:615252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24lascoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24lascoronas.com"; sid:615253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24lascoronas-lanzarote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24lascoronas-lanzarote.com"; sid:615254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19mattersinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19mattersinc.com"; sid:615255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidcover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidcover.com"; sid:615256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austintexascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austintexascovid.com"; sid:615257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncovids.com"; sid:615258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcovidcurfew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcovidcurfew.com"; sid:615259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for callcovidbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"callcovidbuster.com"; sid:615260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clear-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clear-covid19.com"; sid:615261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-check-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-check-now.com"; sid:615262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadns.com"; sid:615263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-esports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-esports.com"; sid:615264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-global.com"; sid:615265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-outlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-outlet.com"; sid:615266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapediatrician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapediatrician.com"; sid:615267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofylaxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofylaxis.com"; sid:615268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestdrive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestdrive.com"; sid:615269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-frankfurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-frankfurt.com"; sid:615270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-hanau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-hanau.com"; sid:615271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestpad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestpad.com"; sid:615272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatruth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatruth.com"; sid:615273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningatlantaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningatlantaga.com"; sid:615274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningga.com"; sid:615275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesttoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesttoday.com"; sid:615276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningatlantaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningatlantaga.com"; sid:615277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningga.com"; sid:615278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19earlydetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19earlydetection.com"; sid:615279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyfinancialrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyfinancialrelief.com"; sid:615280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19inspection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19inspection.com"; sid:615281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19persistente.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19persistente.com"; sid:615282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tamponi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tamponi.com"; sid:615283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testitalia.com"; sid:615284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usavaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usavaccinations.com"; sid:615285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineforchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineforchildren.com"; sid:615286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineforkids.com"; sid:615287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelocation.com"; sid:615288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesforchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesforchildren.com"; sid:615289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesforkids.com"; sid:615290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine-usa.com"; sid:615291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine-usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine-usa.com"; sid:615292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19viruscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19viruscenter.com"; sid:615293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019vaccinations.com"; sid:615294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019-vaccine.com"; sid:615295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020vaccinations.com"; sid:615296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020vaccine.com"; sid:615297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020vaccine.com"; sid:615298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-vaccine.com"; sid:615299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid22info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid22info.com"; sid:615300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid49.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid49.com"; sid:615301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-aanvraag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-aanvraag.com"; sid:615302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantivax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantivax.com"; sid:615303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarrest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarrest.com"; sid:615304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbustersflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbustersflorida.com"; sid:615305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcardshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcardshop.com"; sid:615306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidce.com"; sid:615307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombatrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombatrx.com"; sid:615308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-compensatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-compensatie.com"; sid:615309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefensebox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefensebox.com"; sid:615310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiariesnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiariesnyc.com"; sid:615311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidendatos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidendatos.com"; sid:615312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidenezlobme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidenezlobme.com"; sid:615313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidethnographies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidethnographies.com"; sid:615314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreearoundme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreearoundme.com"; sid:615315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreenetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreenetwork.com"; sid:615316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfuneralonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfuneralonline.com"; sid:615317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgamathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgamathon.com"; sid:615318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardz.com"; sid:615319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterference.com"; sid:615320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjuices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjuices.com"; sid:615321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnum.com"; sid:615322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonthehiline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonthehiline.com"; sid:615323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepaper.com"; sid:615324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-ringling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-ringling.com"; sid:615325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutionsuk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutionsuk.com"; sid:615326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestoplocatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestoplocatie.com"; sid:615327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthurston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthurston.com"; sid:615328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackerinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackerinfo.com"; sid:615329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatmentguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatmentguide.com"; sid:615330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine360.com"; sid:615331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineforchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineforchildren.com"; sid:615332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineforkids.com"; sid:615333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinelocation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinelocation.com"; sid:615334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemedicine.com"; sid:615335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesforchildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesforchildren.com"; sid:615336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesforkids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesforkids.com"; sid:615337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxwear.com"; sid:615338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidviruscenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidviruscenter.com"; sid:615339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidshirt.com"; sid:615340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessheroesofthepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessheroesofthepandemic.com"; sid:615341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for calautocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"calautocorona.com"; sid:615342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childofcorona.com"; sid:615343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for childofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"childofcovid.com"; sid:615344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collectifanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collectifanticovid.com"; sid:615345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collegecovid19impactstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collegecovid19impactstudy.com"; sid:615346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for commonsensecoviddr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"commonsensecoviddr.com"; sid:615347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarnaval.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarnaval.club"; sid:615348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadowellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadowellness.com"; sid:615349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfo.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfo.blog"; sid:615350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakartel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakartel.com"; sid:615351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaknowwhos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaknowwhos.com"; sid:615352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplandemie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplandemie.com"; sid:615353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatowers.com"; sid:615354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-vaccinations.com"; sid:615355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinefaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinefaqs.com"; sid:615356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayardcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayardcards.com"; sid:615357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19false.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19false.com"; sid:615358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nursingjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nursingjobs.com"; sid:615359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protectivemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protectivemask.com"; sid:615360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reporter.com"; sid:615361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutionsllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutionsllc.com"; sid:615362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccinatie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccinatie.com"; sid:615363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-vaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-vaccinations.com"; sid:615364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinefaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinefaqs.com"; sid:615365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacfinder.com"; sid:615366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21trace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21trace.com"; sid:615367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21track.com"; sid:615368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadr.com"; sid:615369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchristmas.church - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchristmas.church"; sid:615370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcivics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcivics.com"; sid:615371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrol.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrol.center"; sid:615372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidds.com"; sid:615373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreechicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreechicago.com"; sid:615374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgameathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgameathon.com"; sid:615375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeotrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeotrack.com"; sid:615376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgeotraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgeotraq.com"; sid:615377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincomesolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincomesolution.com"; sid:615378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinmemorial.com"; sid:615379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisacunt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisacunt.com"; sid:615380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidornotcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidornotcovid.com"; sid:615381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoversight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoversight.com"; sid:615382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpenissolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpenissolution.com"; sid:615383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafecleaningco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafecleaningco.com"; sid:615384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscuses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscuses.com"; sid:615385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsting.com"; sid:615386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsweden.com"; sid:615387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthots.com"; sid:615388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraceme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraceme.com"; sid:615389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrackme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrackme.com"; sid:615390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtraq.com"; sid:615391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidulose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidulose.com"; sid:615392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacfinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacfinder.com"; sid:615393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworldcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworldcontrol.com"; sid:615394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidyoulose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidyoulose.com"; sid:615395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for csscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"csscovid.com"; sid:615396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcovidtestsnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcovidtestsnearme.com"; sid:615397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flmobilecovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flmobilecovidtests.com"; sid:615398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovidtests.com"; sid:615399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacartecovid.bar - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacartecovid.bar"; sid:615400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1000masksofcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1000masksofcovid-19.com"; sid:615401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2ndcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2ndcovid19.com"; sid:615402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidvacations.com"; sid:615403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athometestscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athometestscovid-19.com"; sid:615404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for babycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"babycovid19.com"; sid:615405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidtoday.com"; sid:615406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cannycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cannycovid.com"; sid:615407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chartcovid2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chartcovid2021.com"; sid:615408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cisforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cisforcovid.com"; sid:615409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidtestingnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidtestingnyc.com"; sid:615410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaishistory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaishistory.com"; sid:615411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoice.com"; sid:615412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19athometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19athometests.com"; sid:615413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19beaters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19beaters.com"; sid:615414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-hokkaido.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-hokkaido.com"; sid:615415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homerapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homerapidtests.com"; sid:615416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homesellerplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homesellerplan.com"; sid:615417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19provaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19provaccine.com"; sid:615418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinedistributionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinedistributionplan.com"; sid:615419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-21quebec.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-21quebec.com"; sid:615420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidabatementllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidabatementllc.com"; sid:615421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbeater19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbeater19.com"; sid:615422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuff.com"; sid:615423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanz.com"; sid:615424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsumables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsumables.com"; sid:615425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrushchallenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrushchallenge.com"; sid:615426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatadispatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatadispatch.com"; sid:615427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free-christmas-tree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free-christmas-tree.com"; sid:615428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedompass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedompass.com"; sid:615429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreetraveltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreetraveltest.com"; sid:615430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitchenchronicle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitchenchronicle.com"; sid:615431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkitdefenser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkitdefenser.com"; sid:615432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlegalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlegalgroup.com"; sid:615433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlotion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlotion.com"; sid:615434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmade.com"; sid:615435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedce.com"; sid:615436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmentalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmentalcare.com"; sid:615437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmongolia.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmongolia.app"; sid:615438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprovaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprovaccine.com"; sid:615439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrich.com"; sid:615440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetysurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetysurplus.com"; sid:615441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshieldkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshieldkit.com"; sid:615442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingadvisor.com"; sid:615443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingadvisormd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingadvisormd.com"; sid:615444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmdadvisor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmdadvisor.com"; sid:615445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineshipper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineshipper.com"; sid:615446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinstudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinstudy.com"; sid:615447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvacinestudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvacinestudy.com"; sid:615448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwontbreakme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwontbreakme.com"; sid:615449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristwatcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristwatcher.com"; sid:615450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisecovid.com"; sid:615451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoviddata.com"; sid:615452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dayzepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dayzepidemic.com"; sid:615453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denetim-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denetim-covid19.com"; sid:615454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidvaccineshipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidvaccineshipment.com"; sid:615455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fastcovidvaccineshipper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fastcovidvaccineshipper.com"; sid:615456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flemingtoncovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flemingtoncovidcheck.com"; sid:615457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forum-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forum-covid.com"; sid:615458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fund-4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fund-4covid-19.com"; sid:615459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fund-4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fund-4covid19.com"; sid:615460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundz4-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundz4-covid-19.com"; sid:615461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fundz4-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fundz4-covid19.com"; sid:615462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19protection.com"; sid:615463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getprotectionfromcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getprotectionfromcovid19.com"; sid:615464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ggdcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ggdcoronatest.com"; sid:615465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.ist - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.ist"; sid:615466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bar-covid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bar-covid19.online"; sid:615467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for barcovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"barcovid19.online"; sid:615468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogcovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogcovid.online"; sid:615469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compensatie-covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compensatie-covid.online"; sid:615470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabewijs.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabewijs.online"; sid:615471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-compensatie.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-compensatie.icu"; sid:615472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-demo.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-demo.berlin"; sid:615473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademo.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademo.berlin"; sid:615474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-demo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-demo.info"; sid:615475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademo.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademo.info"; sid:615476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-demo.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-demo.online"; sid:615477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronademo.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronademo.online"; sid:615478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-existenzhilfe.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-existenzhilfe.org"; sid:615479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreencard.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreencard.online"; sid:615480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapas.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapas.online"; sid:615481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaspoort.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaspoort.online"; sid:615482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarebound.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarebound.net"; sid:615483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecovery.courses - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecovery.courses"; sid:615484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltest.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltest.app"; sid:615485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesten.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesten.app"; sid:615486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-frankfurt.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-frankfurt.info"; sid:615487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-hanau.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-hanau.info"; sid:615488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinetruth.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinetruth.info"; sid:615489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-demo.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-demo.online"; sid:615490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19muyum.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19muyum.biz"; sid:615491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19muyum.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19muyum.info"; sid:615492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19muyum.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19muyum.org"; sid:615493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.nyc - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.nyc"; sid:615494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaqs.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaqs.live"; sid:615495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgame.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgame.online"; sid:615496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoaxalert.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoaxalert.org"; sid:615497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghaulers.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghaulers.info"; sid:615498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarketing.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarketing.net"; sid:615499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedce.net"; sid:615500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepaper.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepaper.info"; sid:615501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresponsepaper.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresponsepaper.org"; sid:615502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplies.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplies.biz"; sid:615503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtech.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtech.info"; sid:615504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest4kids.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest4kids.org"; sid:615505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransplant.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransplant.org"; sid:615506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtransplants.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtransplants.org"; sid:615507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.earth - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.earth"; sid:615508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curingcovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curingcovid.info"; sid:615509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dealingwithcovidfatigue.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dealingwithcovidfatigue.org"; sid:615510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic.buzz"; sid:615511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemics-larkspur-lexo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemics-larkspur-lexo.club"; sid:615512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nucovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nucovid.info"; sid:615513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmadness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmadness.net"; sid:615514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresistance.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresistance.art"; sid:615515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidtravel.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidtravel.agency"; sid:615516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productoscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productoscovid.net"; sid:615517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid-19.net"; sid:615518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinerentegencovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinerentegencovid.online"; sid:615519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 10-minute-covid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"10-minute-covid-test.com"; sid:615520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covid19guidelines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covid19guidelines.com"; sid:615521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covidvaccine.com"; sid:615522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aldocoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aldocoronado.com"; sid:615523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arekmalangwaspadacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arekmalangwaspadacovid.com"; sid:615524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beepidemic.com"; sid:615525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for btccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"btccovid.com"; sid:615526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafcovid.com"; sid:615527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catholiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catholiccovid.com"; sid:615528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for celebratecoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"celebratecoronado.com"; sid:615529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondo.com"; sid:615530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocreates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocreates.com"; sid:615531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadogratitude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadogratitude.com"; sid:615532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoheritage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoheritage.com"; sid:615533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadolegacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadolegacy.com"; sid:615534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomedia.com"; sid:615535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagc.com"; sid:615536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageschaedigte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageschaedigte.com"; sid:615537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawpa.com"; sid:615538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalegalpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalegalpa.com"; sid:615539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-shop.com"; sid:615540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestzentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestzentrum.com"; sid:615541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-transfer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-transfer.com"; sid:615542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatutoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatutoring.com"; sid:615543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinestatus.com"; sid:615544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxxed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxxed.com"; sid:615545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningfortcollins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningfortcollins.com"; sid:615546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningokc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningokc.com"; sid:615547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningtulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningtulsa.com"; sid:615548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronayakarsi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronayakarsi.com"; sid:615549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid192017.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid192017.com"; sid:615550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningfortcollins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningfortcollins.com"; sid:615551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disposables.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disposables.com"; sid:615552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emailwriting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emailwriting.com"; sid:615553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19etest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19etest.com"; sid:615554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrtestingkits.com"; sid:615555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcrtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcrtestkits.com"; sid:615556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reactions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reactions.com"; sid:615557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safevaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safevaccines.com"; sid:615558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telehealthvisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telehealthvisit.com"; sid:615559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelperu.com"; sid:615560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineautism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineautism.com"; sid:615561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesafe.com"; sid:615562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1stdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1stdate.com"; sid:615563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4now.com"; sid:615564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaidga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaidga.com"; sid:615565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairlinepass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairlinepass.com"; sid:615566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandsociety.com"; sid:615567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaruba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaruba.com"; sid:615568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbankruptcycenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbankruptcycenter.com"; sid:615569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbitsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbitsin.com"; sid:615570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbnt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbnt.com"; sid:615571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessideas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessideas.com"; sid:615572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningokc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningokc.com"; sid:615573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaningtulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaningtulsa.com"; sid:615574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrestrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrestrooms.com"; sid:615575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrestroomservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrestroomservices.com"; sid:615576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcompliantrestroomtrailers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcompliantrestroomtrailers.com"; sid:615577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoms.com"; sid:615578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcruisetest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcruisetest.com"; sid:615579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfirstdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfirstdate.com"; sid:615580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflightpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflightpass.com"; sid:615581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidflighttests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidflighttests.com"; sid:615582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreeservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreeservices.com"; sid:615583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidimmuneeventplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidimmuneeventplanner.com"; sid:615584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloveseveryone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloveseveryone.com"; sid:615585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidloveseverything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidloveseverything.com"; sid:615586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidluxuryrestrooms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidluxuryrestrooms.com"; sid:615587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasstesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasstesting.com"; sid:615588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidoutbreakdisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidoutbreakdisinfect.com"; sid:615589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresourcecentercny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresourcecentercny.com"; sid:615590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskpredictor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskpredictor.com"; sid:615591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoclean.com"; sid:615592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspreadlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspreadlove.com"; sid:615593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestemployees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestemployees.com"; sid:615594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestil.com"; sid:615595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestspace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestspace.com"; sid:615596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesttexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesttexas.com"; sid:615597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtripplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtripplanning.com"; sid:615598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviduber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviduber.com"; sid:615599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationcertificates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationcertificates.com"; sid:615600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationpriority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationpriority.com"; sid:615601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccine.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccine.biz"; sid:615602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecertificate.com"; sid:615603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedoctor.com"; sid:615604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineflorida.com"; sid:615605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinepriority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinepriority.com"; sid:615606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineproof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineproof.com"; sid:615607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinereaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinereaction.com"; sid:615608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesupport.com"; sid:615609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxxed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxxed.com"; sid:615610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidweddingphotographer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidweddingphotographer.com"; sid:615611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwt.com"; sid:615612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzeroclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzeroclothing.com"; sid:615613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyclingthroughapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyclingthroughapandemic.com"; sid:615614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for definecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"definecoronavirus.com"; sid:615615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for definecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"definecovid.com"; sid:615616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidoutbreak.com"; sid:615617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectcovidviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectcovidviruses.com"; sid:615618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disruptcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disruptcovid19.com"; sid:615619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dohcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dohcorona.com"; sid:615620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid.biz"; sid:615621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovidtest.com"; sid:615622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmolecularchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmolecularchain.com"; sid:615623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidconcierge.com"; sid:615624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for at-home-covid-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"at-home-covid-testing.com"; sid:615625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidencovidcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidencovidcount.com"; sid:615626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestzentrum.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestzentrum.berlin"; sid:615627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.christmas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.christmas"; sid:615628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreening.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreening.app"; sid:615629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurgrisk.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurgrisk.app"; sid:615630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtocode.academy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtocode.academy"; sid:615631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemica.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemica.club"; sid:615632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123coronaquiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123coronaquiz.com"; sid:615633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 247covidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"247covidtests.com"; sid:615634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecellskillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecellskillscovid19.com"; sid:615635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurekillscovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurekillscovid19.biz"; sid:615636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurekillscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurekillscovid19.com"; sid:615637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurekillscovidvirus.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurekillscovidvirus.biz"; sid:615638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurekillscovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurekillscovidvirus.com"; sid:615639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-corona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-corona24.com"; sid:615640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidrapidtesting.com"; sid:615641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid-centrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid-centrum.com"; sid:615642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovidcentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovidcentrum.com"; sid:615643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovidne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovidne.com"; sid:615644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthecovidblues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthecovidblues.com"; sid:615645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businesssuccesspostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businesssuccesspostcovid.com"; sid:615646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centro-de-vacunacion-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centro-de-vacunacion-covid19.com"; sid:615647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrum-antycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrum-antycovid.com"; sid:615648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centrumantycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centrumantycovid.com"; sid:615649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovidrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovidrapidtesting.com"; sid:615650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-centro-de-vacunacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-centro-de-vacunacion.com"; sid:615651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-centrodevacunacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-centrodevacunacion.com"; sid:615652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomade.com"; sid:615653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoseasidemagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoseasidemagazine.com"; sid:615654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadotoursperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadotoursperu.com"; sid:615655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagarden.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagarden.club"; sid:615656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagardenclub.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagardenclub.club"; sid:615657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagardenclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagardenclub.com"; sid:615658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryconcept.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryconcept.com"; sid:615659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecoveryforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecoveryforum.com"; sid:615660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzbedarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzbedarf.com"; sid:615661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccination-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccination-center.com"; sid:615662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinationcenter.com"; sid:615663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccination-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccination-centre.com"; sid:615664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinationcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinationcentre.com"; sid:615665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-watcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-watcher.com"; sid:615666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19activepurefilters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19activepurefilters.com"; sid:615667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19blast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19blast.com"; sid:615668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-centro-de-vacunacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-centro-de-vacunacion.com"; sid:615669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-centrodevacunacion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-centrodevacunacion.com"; sid:615670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corporatepanel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corporatepanel.com"; sid:615671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-desinfeccion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-desinfeccion.com"; sid:615672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filtrationforhome.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filtrationforhome.biz"; sid:615673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19filtrationforhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19filtrationforhome.com"; sid:615674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homepurifier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homepurifier.com"; sid:615675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-impfzentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-impfzentrum.com"; sid:615676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killedbyactivepuretechnology.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killedbyactivepuretechnology.biz"; sid:615677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maskandaccessoriesshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maskandaccessoriesshop.com"; sid:615678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preforeclosure.com"; sid:615679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivortshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivortshirt.com"; sid:615680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-universal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-universal.com"; sid:615681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccination-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccination-center.com"; sid:615682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccinationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccinationcenter.com"; sid:615683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinationcenter.com"; sid:615684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccination-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccination-centre.com"; sid:615685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccine-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccine-centre.com"; sid:615686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinetrucking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinetrucking.com"; sid:615687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19yesterday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19yesterday.com"; sid:615688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactivepure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactivepure.com"; sid:615689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidand.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidand.coffee"; sid:615690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareclinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareclinics.com"; sid:615691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaredeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaredeliveries.com"; sid:615692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrew20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrew20.com"; sid:615693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddefenseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddefenseplan.com"; sid:615694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddropbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddropbox.com"; sid:615695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidegardens.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidegardens.club"; sid:615696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidense.com"; sid:615697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaithful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaithful.com"; sid:615698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiltrationforbusiness.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiltrationforbusiness.biz"; sid:615699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfiltrationforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfiltrationforbusiness.com"; sid:615700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-haber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-haber.com"; sid:615701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhomework.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhomework.com"; sid:615702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledbyactivepure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledbyactivepure.biz"; sid:615703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkilledbyactivepure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkilledbyactivepure.com"; sid:615704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-king.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-king.com"; sid:615705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlizer.com"; sid:615706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn.coffee - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn.coffee"; sid:615707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidncoffee.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidncoffee.biz"; sid:615708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidncoffee.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidncoffee.club"; sid:615709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidncoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidncoffee.com"; sid:615710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreforeclosure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreforeclosure.com"; sid:615711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidredbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidredbox.com"; sid:615712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscoreboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscoreboard.com"; sid:615713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestguildford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestguildford.com"; sid:615714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testing19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testing19.com"; sid:615715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtesting2you.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtesting2you.com"; sid:615716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingfla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingfla.com"; sid:615717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingincincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingincincinnati.com"; sid:615718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingincolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingincolumbus.com"; sid:615719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginkentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginkentucky.com"; sid:615720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginlexington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginlexington.com"; sid:615721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginlouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginlouisville.com"; sid:615722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginohio.com"; sid:615723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingintoledo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingintoledo.com"; sid:615724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingohio.com"; sid:615725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtwoyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtwoyou.com"; sid:615726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestsurrey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestsurrey.com"; sid:615727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccination-center.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccination-center.com"; sid:615728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccinationcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccinationcenter.com"; sid:615729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccination-centre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccination-centre.com"; sid:615730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationcentre.com"; sid:615731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinetrucking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinetrucking.com"; sid:615732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid.club"; sid:615733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidpassport.com"; sid:615734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtravelpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtravelpass.com"; sid:615735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidtravelpassport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidtravelpassport.com"; sid:615736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2swuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2swuhan.com"; sid:615737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bergencountycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bergencountycovidtest.com"; sid:615738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bremen-corona-impfzentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bremen-corona-impfzentrum.com"; sid:615739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for castcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"castcovid.com"; sid:615740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cast-covid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cast-covid-test.com"; sid:615741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for castcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"castcovidtest.com"; sid:615742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centraldeajudacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centraldeajudacovid.com"; sid:615743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centre-de-vaccination-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centre-de-vaccination-corona.com"; sid:615744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centre-de-vaccination-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centre-de-vaccination-covid19.com"; sid:615745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centro-vaccinale-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centro-vaccinale-covid19.com"; sid:615746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centro-vaccinazione-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centro-vaccinazione-corona.com"; sid:615747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centro-vaccinazione-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centro-vaccinazione-covid19.com"; sid:615748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcoronavirusvaccine.com"; sid:615749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-centre-de-vaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-centre-de-vaccination.com"; sid:615750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagutscheine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagutscheine.com"; sid:615751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahulp.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahulp.amsterdam"; sid:615752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfcentrum-hamburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfcentrum-hamburg.com"; sid:615753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-berlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-berlin.com"; sid:615754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-brandenburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-brandenburg.com"; sid:615755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-bremen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-bremen.com"; sid:615756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfzentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfzentrum.com"; sid:615757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-hessen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-hessen.com"; sid:615758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-mecklenburg-vorpommern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-mecklenburg-vorpommern.com"; sid:615759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-mv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-mv.com"; sid:615760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-ni.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-ni.com"; sid:615761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-nrw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-nrw.com"; sid:615762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-sachsenanhalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-sachsenanhalt.com"; sid:615763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-sachsen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-sachsen.com"; sid:615764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-sh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-sh.com"; sid:615765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-th.com"; sid:615766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum-tuehringen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum-tuehringen.com"; sid:615767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatientcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatientcare.com"; sid:615768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinatiecentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinatiecentrum.com"; sid:615769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine.cloud"; sid:615770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineefficacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineefficacy.com"; sid:615771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairscrubber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairscrubber.com"; sid:615772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allsafe.com"; sid:615773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-benefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-benefit.com"; sid:615774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.bid"; sid:615775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccinatiecentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccinatiecentrum.com"; sid:615776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccine.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccine.cloud"; sid:615777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinepin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinepin.com"; sid:615778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfactcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfactcentral.com"; sid:615779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhealthcareforwomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhealthcareforwomen.com"; sid:615780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmarket.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmarket.biz"; sid:615781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidneindanke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidneindanke.com"; sid:615782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprivatejet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprivatejet.com"; sid:615783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingedison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingedison.com"; sid:615784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinaties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinaties.com"; sid:615785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineguide.com"; sid:615786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinescheduling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinescheduling.com"; sid:615787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 805coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"805coronado.com"; sid:615788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for andrewcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"andrewcovid.com"; sid:615789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-denmark.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-denmark.com"; sid:615790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafecovid.com"; sid:615791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacovidvaccine.com"; sid:615792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changeyourcovidsmind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changeyourcovidsmind.com"; sid:615793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chpcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chpcovidtesting.com"; sid:615794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cirta-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cirta-covid.com"; sid:615795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cmvillacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cmvillacorona.com"; sid:615796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collectcovid19aerosol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collectcovid19aerosol.com"; sid:615797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coloradocovid.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coloradocovid.app"; sid:615798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocostalcoffee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocostalcoffee.com"; sid:615799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoheadshots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoheadshots.com"; sid:615800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfcentrum-nrw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfcentrum-nrw.com"; sid:615801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfpass.com"; sid:615802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestamsterdam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestamsterdam.com"; sid:615803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestdenhaag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestdenhaag.com"; sid:615804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-chance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-chance.com"; sid:615805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antikortestkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antikortestkiti.com"; sid:615806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bestmedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bestmedicine.com"; sid:615807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comments.com"; sid:615808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datatrack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datatrack.com"; sid:615809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19spikeshot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19spikeshot.com"; sid:615810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidadpads.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidadpads.com"; sid:615811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasisi.com"; sid:615812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrideguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrideguide.com"; sid:615813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaseslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaseslive.com"; sid:615814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcidences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcidences.com"; sid:615815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddralbuja.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddralbuja.com"; sid:615816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforeclosureassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforeclosureassistance.com"; sid:615817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidheroesawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidheroesawards.com"; sid:615818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-impfzentrum-bremen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-impfzentrum-bremen.com"; sid:615819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinstantimmunitywizard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinstantimmunitywizard.com"; sid:615820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlivedhere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlivedhere.com"; sid:615821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmanners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmanners.com"; sid:615822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpedialabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpedialabs.com"; sid:615823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectiondeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectiondeals.com"; sid:615824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsitetests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsitetests.com"; sid:615825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtemperaturemonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtemperaturemonitoring.com"; sid:615826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestcompare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestcompare.com"; sid:615827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestct.com"; sid:615828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingu.com"; sid:615829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtripping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtripping.com"; sid:615830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineca.com"; sid:615831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineri.com"; sid:615832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.center"; sid:615833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decorona.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decorona.best"; sid:615834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emergenzacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emergenzacovid-19.com"; sid:615835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsolutions.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsolutions.center"; sid:615836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021covidupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021covidupdate.com"; sid:615837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30gbcovidpaketiyukle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30gbcovidpaketiyukle.com"; sid:615838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepuretechnologykillscovidinindiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepuretechnologykillscovidinindiana.com"; sid:615839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aishangwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aishangwuhan.com"; sid:615840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for app-covid19care-amazonservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"app-covid19care-amazonservices.com"; sid:615841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for assistenzapostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"assistenzapostcovid.com"; sid:615842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptcyfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptcyfromcovid.com"; sid:615843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bankruptedfromcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bankruptedfromcovid.com"; sid:615844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovidshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovidshop.com"; sid:615845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for changingthecovidconversation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"changingthecovidconversation.com"; sid:615846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cheapcovidtestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cheapcovidtestingkits.com"; sid:615847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chocovida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chocovida.com"; sid:615848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for compensationcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"compensationcovid.com"; sid:615849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovidsolutions.com"; sid:615850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conchcovidout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conchcovidout.com"; sid:615851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrywall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrywall.com"; sid:615852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafamilyattorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafamilyattorney.com"; sid:615853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamuebles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamuebles.com"; sid:615854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapati.com"; sid:615855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasheroes.com"; sid:615856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastoplicht.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastoplicht.com"; sid:615857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrongheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrongheroes.com"; sid:615858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinepin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinepin.com"; sid:615859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinepins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinepins.com"; sid:615860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinepin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinepin.com"; sid:615861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinepins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinepins.com"; sid:615862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19betas.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19betas.app"; sid:615863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-diagnostics.com"; sid:615864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19independence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19independence.com"; sid:615865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19independence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19independence.com"; sid:615866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19philanthropy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19philanthropy.com"; sid:615867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-planet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-planet.com"; sid:615868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tricks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tricks.com"; sid:615869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinemalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinemalpractice.com"; sid:615870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineslogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineslogistics.com"; sid:615871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-view.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-view.com"; sid:615872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2020usa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2020usa.com"; sid:615873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidasxquant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidasxquant.com"; sid:615874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblaster1.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblaster1.com"; sid:615875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcertifiedtx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcertifiedtx.com"; sid:615876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchecktoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchecktoday.com"; sid:615877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollectivecookbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollectivecookbook.com"; sid:615878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcollusion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcollusion.com"; sid:615879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredentialstx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredentialstx.com"; sid:615880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatadonor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatadonor.com"; sid:615881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindependence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindependence.com"; sid:615882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidindependenceday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidindependenceday.com"; sid:615883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmundial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmundial.com"; sid:615884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpruf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpruf.com"; sid:615885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarterback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarterback.com"; sid:615886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-risk-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-risk-free.com"; sid:615887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsangels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsangels.com"; sid:615888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslasher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslasher.com"; sid:615889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestllc.com"; sid:615890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelamsterdam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelamsterdam.com"; sid:615891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelbarcelona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelbarcelona.com"; sid:615892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelbrisbane.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelbrisbane.com"; sid:615893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelbyronbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelbyronbay.com"; sid:615894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelcairns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelcairns.com"; sid:615895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravellondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravellondon.com"; sid:615896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravellosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravellosangeles.com"; sid:615897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelmelbourne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelmelbourne.com"; sid:615898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelnewyork.com"; sid:615899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelnewzealand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelnewzealand.com"; sid:615900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelparis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelparis.com"; sid:615901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelperth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelperth.com"; sid:615902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsanfrancisco.com"; sid:615903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelsydney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelsydney.com"; sid:615904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecare.com"; sid:615905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemalpractice.com"; sid:615906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineslogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineslogistics.com"; sid:615907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dispositivi-anti-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dispositivi-anti-covid-19.com"; sid:615908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employercovidsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employercovidsuit.com"; sid:615909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for evdencovidtesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"evdencovidtesti.com"; sid:615910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for rationalmeasuresover2k20pandemic.careers - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"rationalmeasuresover2k20pandemic.careers"; sid:615911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidstories.com"; sid:615912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidclinic.com"; sid:615913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avellinocoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avellinocoronavirustest.com"; sid:615914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breadpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breadpandemic.com"; sid:615915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breathetostopcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breathetostopcovid.com"; sid:615916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ceciliahenriquezcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ceciliahenriquezcoronado.com"; sid:615917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aid-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aid-covid.com"; sid:615918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beencovidvaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beencovidvaccinated.com"; sid:615919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grants.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grants.biz"; sid:615920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.cards - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.cards"; sid:615921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for samedaycovidtest.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"samedaycovidtest.clinic"; sid:615922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vanguardcovidcompliancegroup.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vanguardcovidcompliancegroup.biz"; sid:615923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4corona.com"; sid:615924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecleanscovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecleanscovid.biz"; sid:615925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecleanscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecleanscovid.com"; sid:615926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepuregetsridofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepuregetsridofcovid.com"; sid:615927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestservice.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestservice.amsterdam"; sid:615928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblows.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblows.blog"; sid:615929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplus.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplus.care"; sid:615930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest.amsterdam"; sid:615931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidya.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidya.care"; sid:615932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecleanscovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecleanscovid.club"; sid:615933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurecleanscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurecleanscovid.net"; sid:615934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-impfzentrum.hamburg - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-impfzentrum.hamburg"; sid:615935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-point.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-point.berlin"; sid:615936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapacity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapacity.net"; sid:615937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcierge.health - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcierge.health"; sid:615938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescape.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescape.club"; sid:615939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapehotel.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapehotel.club"; sid:615940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapehotels.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapehotels.club"; sid:615941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapeitalia.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapeitalia.club"; sid:615942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmitigation.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmitigation.net"; sid:615943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtime.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtime.info"; sid:615944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.guru"; sid:615945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyacovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyacovid.biz"; sid:615946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cyacovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cyacovid.info"; sid:615947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfeccionescovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfeccionescovid.net"; sid:615948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test4covid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test4covid.biz"; sid:615949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2treatcovidwithlight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2treatcovidwithlight.com"; sid:615950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for agourahillscovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"agourahillscovidtesting.com"; sid:615951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidvax.com"; sid:615952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcovid.camp - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcovid.camp"; sid:615953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabears.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabears.art"; sid:615954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984.art"; sid:615955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nutsack.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nutsack.club"; sid:615956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinationrecord.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinationrecord.app"; sid:615957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinationrecordcard.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinationrecordcard.app"; sid:615958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.club"; sid:615959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-begone.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-begone.biz"; sid:615960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.care"; sid:615961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovid.clinic - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovid.clinic"; sid:615962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 100x100businessvscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"100x100businessvscoronavirus.com"; sid:615963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for analyzecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"analyzecovid19.com"; sid:615964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiahotel-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiahotel-wuhan.com"; sid:615965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiapandemicsummit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiapandemicsummit.com"; sid:615966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caribbeancovidescape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caribbeancovidescape.com"; sid:615967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coffeeincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coffeeincovid.com"; sid:615968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for collincountycoviddashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"collincountycoviddashboard.com"; sid:615969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for constanzacoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"constanzacoronado.com"; sid:615970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcovidcoalition.com"; sid:615971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-dental.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-dental.com"; sid:615972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-digitalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-digitalhelp.com"; sid:615973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafm.com"; sid:615974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hospital.com"; sid:615975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-luege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-luege.com"; sid:615976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapraxis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapraxis.com"; sid:615977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofhotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofhotels.com"; sid:615978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproofhustle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproofhustle.com"; sid:615979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapups.com"; sid:615980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alez.com"; sid:615981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calender.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calender.com"; sid:615982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mattresscover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mattresscover.com"; sid:615983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mmp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mmp.com"; sid:615984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19necessitiesinc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19necessitiesinc.com"; sid:615985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pastpresentfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pastpresentfuture.com"; sid:615986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19peru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19peru.com"; sid:615987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testrelief.com"; sid:615988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thegame2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thegame2020.com"; sid:615989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19thegame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19thegame.com"; sid:615990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccinecredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccinecredential.com"; sid:615991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecredential.com"; sid:615992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineguideline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineguideline.com"; sid:615993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19verifiablecredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19verifiablecredential.com"; sid:615994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19verifiablecredential.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19verifiablecredential.com"; sid:615995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcanned.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcanned.com"; sid:615996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcareme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcareme.com"; sid:615997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcraftfair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcraftfair.com"; sid:615998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcupcake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcupcake.com"; sid:615999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddeconpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddeconpro.com"; sid:616000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidestinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidestinations.com"; sid:616001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidforchrist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidforchrist.com"; sid:616002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfriendlychokeholds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfriendlychokeholds.com"; sid:616003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunandgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunandgames.com"; sid:616004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjabbed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjabbed.com"; sid:616005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmmp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmmp.com"; sid:616006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpcrsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpcrsolutions.com"; sid:616007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrandevu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrandevu.com"; sid:616008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationcardonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationcardonline.com"; sid:616009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinebracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinebracelet.com"; sid:616010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinellc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinellc.com"; sid:616011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemap.com"; sid:616012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinemaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinemaps.com"; sid:616013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestories.com"; sid:616014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxcards.com"; sid:616015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxtracker.com"; sid:616016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-virus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-virus19.com"; sid:616017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvrc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvrc.com"; sid:616018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19vaccine.com"; sid:616019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovidvaccine.com"; sid:616020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for expresscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"expresscovid.com"; sid:616021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidalerts.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidalerts.app"; sid:616022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan.cash - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan.cash"; sid:616023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30minutecovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30minutecovidclear.com"; sid:616024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30minutescovidclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30minutescovidclear.com"; sid:616025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 30minutescovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"30minutescovidtest.com"; sid:616026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allsafecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allsafecovid19.com"; sid:616027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angelsfightingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angelsfightingcovid.com"; sid:616028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid-nature.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid-nature.com"; sid:616029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apexrapidcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apexrapidcovid.com"; sid:616030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aretecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aretecovid.com"; sid:616031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforeandaftercovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforeandaftercovid.com"; sid:616032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beneficioscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beneficioscovid19.com"; sid:616033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buenasnuevascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buenasnuevascovid19.com"; sid:616034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkyourcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkyourcovid.com"; sid:616035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocovidsafeset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocovidsafeset.com"; sid:616036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ckjrapidcovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ckjrapidcovidtests.com"; sid:616037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovidptsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovidptsd.com"; sid:616038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarbuyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarbuyers.com"; sid:616039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-conscious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-conscious.com"; sid:616040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsciousness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsciousness.com"; sid:616041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagreenpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagreenpass.com"; sid:616042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicalusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicalusa.com"; sid:616043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamedicineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamedicineusa.com"; sid:616044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamoshe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamoshe.com"; sid:616045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamri.com"; sid:616046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestjetzt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestjetzt.com"; sid:616047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxresistance.com"; sid:616048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfohere.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfohere.com"; sid:616049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pinbadge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pinbadge.com"; sid:616050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanmycar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanmycar.com"; sid:616051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisinfectingteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisinfectingteam.com"; sid:616052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddriveuplab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddriveuplab.com"; sid:616053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfollowup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfollowup.com"; sid:616054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpinbadge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpinbadge.com"; sid:616055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpokertour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpokertour.com"; sid:616056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrevolt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrevolt.com"; sid:616057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetees.com"; sid:616058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestinginla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestinginla.com"; sid:616059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.center"; sid:616060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvax.asia - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvax.asia"; sid:616061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemiczombiemom.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemiczombiemom.blog"; sid:616062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2022covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2022covid19.com"; sid:616063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21covid19.com"; sid:616064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 666corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"666corona.com"; sid:616065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 666covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"666covid.com"; sid:616066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1st2treatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1st2treatcoronavirus.com"; sid:616067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1stdevice4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1stdevice4covid.com"; sid:616068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2403-2423corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2403-2423corona.com"; sid:616069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2treatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2treatcovid.com"; sid:616070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5126coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5126coronado.com"; sid:616071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adoorintothepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adoorintothepandemic.com"; sid:616072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for advancedcovidcompliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"advancedcovidcompliance.com"; sid:616073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allthecovidnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allthecovidnews.com"; sid:616074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid-peinture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid-peinture.com"; sid:616075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspencovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspencovidtesting.com"; sid:616076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bayareapandemicproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bayareapandemicproductions.com"; sid:616077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for canadiancovidleaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"canadiancovidleaks.com"; sid:616078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiesta.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiesta.club"; sid:616079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfung.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfung.bayern"; sid:616080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpfzentrum.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpfzentrum.bayern"; sid:616081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for scovid.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"scovid.cloud"; sid:616082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicinrealestate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicinrealestate.com"; sid:616083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicshutdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicshutdown.com"; sid:616084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemicsurvival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemicsurvival.com"; sid:616085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hourcovidtestingla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hourcovidtestingla.com"; sid:616086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 24hrcovidpcrtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"24hrcovidpcrtest.com"; sid:616087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovid.biz"; sid:616088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovid-19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovid-19.blog"; sid:616089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcovid19.blog"; sid:616090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpf.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpf.app"; sid:616091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavac.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavac.app"; sid:616092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.bond - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.bond"; sid:616093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.bond - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.bond"; sid:616094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.bond - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.bond"; sid:616095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwatch.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwatch.center"; sid:616096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinedagainstcovid-19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinedagainstcovid-19.blog"; sid:616097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019beforecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019beforecovid.com"; sid:616098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidshirts.com"; sid:616099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-regeln.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-regeln.app"; sid:616100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protection.biz"; sid:616101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidncoffee.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidncoffee.app"; sid:616102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspecialforces.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspecialforces.care"; sid:616103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccine.claims - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccine.claims"; sid:616104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vacunas-covid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vacunas-covid19.blog"; sid:616105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019beforecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019beforecorona.com"; sid:616106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antecovidian19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antecovidian19.com"; sid:616107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antecovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antecovidian.com"; sid:616108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidian19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidian19.com"; sid:616109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidian.com"; sid:616110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aspencovidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aspencovidtests.com"; sid:616111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b2bcovidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b2bcovidcheck.com"; sid:616112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoschoolcovid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoschoolcovid19hometestkit.com"; sid:616113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for backtoworkcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"backtoworkcovid19test.com"; sid:616114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecorona2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecorona2019.com"; sid:616115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovid19testi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovid19testi.com"; sid:616116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovid.com"; sid:616117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bodrumcovidtesti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bodrumcovidtesti.com"; sid:616118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brightstarcarecovidtest.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brightstarcarecovidtest.biz"; sid:616119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcovidprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcovidprogram.com"; sid:616120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for casscovideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"casscovideo.com"; sid:616121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connercoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connercoronation.com"; sid:616122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-expresstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-expresstest.com"; sid:616123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-gin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-gin.com"; sid:616124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalashesbyhnc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalashesbyhnc.com"; sid:616125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataxplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataxplan.com"; sid:616126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestrapid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestrapid.com"; sid:616127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-zentrum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-zentrum.com"; sid:616128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinefinder.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinefinder.com"; sid:616129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscur.com"; sid:616130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazubairlap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazubairlap.com"; sid:616131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cur.com"; sid:616132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datamodels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datamodels.com"; sid:616133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tagebuch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tagebuch.com"; sid:616134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taxplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taxplan.com"; sid:616135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19test.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19test.club"; sid:616136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine4all.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine4all.com"; sid:616137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine4everyone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine4everyone.com"; sid:616138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinecompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinecompensation.com"; sid:616139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2022.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2022.best"; sid:616140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaisle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaisle.com"; sid:616141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbracelet.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbracelet.care"; sid:616142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbrewing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbrewing.com"; sid:616143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusinessmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusinessmemorial.com"; sid:616144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-carol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-carol.com"; sid:616145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarol.com"; sid:616146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-carols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-carols.com"; sid:616147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarols.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarols.com"; sid:616148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenter-rheinmain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenter-rheinmain.com"; sid:616149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleargear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleargear.com"; sid:616150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcountworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcountworld.com"; sid:616151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddevotional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddevotional.com"; sid:616152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfootmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfootmask.com"; sid:616153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfourthreich.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfourthreich.com"; sid:616154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfreedomproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfreedomproducts.com"; sid:616155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometeszt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometeszt.com"; sid:616156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-inde-mnisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-inde-mnisation.com"; sid:616157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisle.com"; sid:616158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkidquotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkidquotes.com"; sid:616159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkontrol.com"; sid:616160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmakebelieve.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmakebelieve.com"; sid:616161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmapdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmapdata.com"; sid:616162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmask-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmask-shop.com"; sid:616163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidonlydeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidonlydeaths.com"; sid:616164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycenterofamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycenterofamerica.com"; sid:616165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycenterofcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycenterofcalifornia.com"; sid:616166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycentersofamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycentersofamerica.com"; sid:616167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverycentersofcalifornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverycentersofcalifornia.com"; sid:616168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-selbsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-selbsttest.com"; sid:616169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestarea.com"; sid:616170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbestellen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbestellen.com"; sid:616171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingkc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingkc.com"; sid:616172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingmi.com"; sid:616173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestnederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestnederland.com"; sid:616174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestordering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestordering.com"; sid:616175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestrapid15.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestrapid15.com"; sid:616176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelpasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelpasses.com"; sid:616177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinecompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinecompensation.com"; sid:616178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-vaccine-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-vaccine-lawyer.com"; sid:616179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesyndrome.com"; sid:616180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwristbandsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwristbandsusa.com"; sid:616181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dedhamcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dedhamcovidtest.com"; sid:616182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dentist-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dentist-corona.com"; sid:616183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dynastypandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dynastypandemic.com"; sid:616184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epei-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epei-covid-19.com"; sid:616185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepurewipesoutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepurewipesoutcovid.com"; sid:616186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afueracovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afueracovid.com"; sid:616187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid8.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid8.com"; sid:616188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidsmarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidsmarter.com"; sid:616189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chroniclesofacoronabride.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chroniclesofacoronabride.com"; sid:616190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for citycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"citycovidtesting.com"; sid:616191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19-vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19-vaccine.com"; sid:616192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashcows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashcows.com"; sid:616193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-check-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-check-online.com"; sid:616194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrow.com"; sid:616195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamericausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamericausa.com"; sid:616196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraus.com"; sid:616197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxmd.com"; sid:616198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusems.com"; sid:616199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirtualworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirtualworkshops.com"; sid:616200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkshops.com"; sid:616201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseasecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseasecenter.com"; sid:616202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19familymagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19familymagazine.com"; sid:616203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19medicalmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19medicalmagazine.com"; sid:616204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobilevaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobilevaccinations.com"; sid:616205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobilevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobilevaccine.com"; sid:616206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mobilevaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mobilevaccines.com"; sid:616207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shotmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shotmaps.com"; sid:616208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vaccineday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vaccineday.com"; sid:616209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineday.com"; sid:616210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinemap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinemap.com"; sid:616211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinesyndrome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinesyndrome.com"; sid:616212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualseminars.com"; sid:616213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualseminars.com"; sid:616214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virtualworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virtualworkshops.com"; sid:616215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virtualworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virtualworkshops.com"; sid:616216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workshops.com"; sid:616217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19workshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19workshops.com"; sid:616218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldmagazine.com"; sid:616219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidairprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidairprogram.com"; sid:616220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcashcows.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcashcows.com"; sid:616221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcopywriter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcopywriter.com"; sid:616222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-frankfurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-frankfurt.com"; sid:616223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgutcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgutcure.com"; sid:616224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguthealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguthealth.com"; sid:616225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covididband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covididband.com"; sid:616226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidismusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidismusa.com"; sid:616227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlawyerfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlawyerfl.com"; sid:616228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicalheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicalheroes.com"; sid:616229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilevaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilevaccination.com"; sid:616230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilevaccinations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilevaccinations.com"; sid:616231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilevaccine.com"; sid:616232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmobilevaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmobilevaccines.com"; sid:616233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpresafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpresafe.com"; sid:616234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidslave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidslave.com"; sid:616235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucked.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucked.com"; sid:616236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingsameday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingsameday.com"; sid:616237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests4u.com"; sid:616238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeshare.com"; sid:616239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravelclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravelclinic.com"; sid:616240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationbracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationbracelet.com"; sid:616241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineband.com"; sid:616242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinedanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinedanger.com"; sid:616243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineidband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineidband.com"; sid:616244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineproblems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineproblems.com"; sid:616245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesfree.com"; sid:616246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinesny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinesny.com"; sid:616247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestory.com"; sid:616248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworkshops.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworkshops.com"; sid:616249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dangersofcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dangersofcovidvaccine.com"; sid:616250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djepidemic.com"; sid:616251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elsecretodesveladodelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elsecretodesveladodelcoronavirus.com"; sid:616252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdaapprovesactivepureforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdaapprovesactivepureforcovid.com"; sid:616253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nasaactivepurewipesoutcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nasaactivepurewipesoutcovid.club"; sid:616254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 21corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"21corona.com"; sid:616255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 32247coronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"32247coronation.com"; sid:616256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accuratecovidtestchicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accuratecovidtestchicago.com"; sid:616257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afectadosvacunacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afectadosvacunacoronavirus.com"; sid:616258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allcovidfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allcovidfree.com"; sid:616259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testcenter.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testcenter.berlin"; sid:616260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disease.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disease.center"; sid:616261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddisease.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddisease.center"; sid:616262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpal.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpal.biz"; sid:616263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for primulecovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"primulecovid.blog"; sid:616264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1hrcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1hrcovidtesting.com"; sid:616265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acunitedagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acunitedagainstcovid.com"; sid:616266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alkesccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alkesccovid19.com"; sid:616267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleghenyagainstcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleghenyagainstcovid19.com"; sid:616268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleghenyagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleghenyagainstcovid.com"; sid:616269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alleghenyunitedagainstcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alleghenyunitedagainstcovid.com"; sid:616270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkcovidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkcovidclean.com"; sid:616271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcovidtest.com"; sid:616272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bclawandcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bclawandcovid.com"; sid:616273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafecovidcheckin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafecovidcheckin.com"; sid:616274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biontechcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biontechcovid.com"; sid:616275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biotechcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biotechcovid.com"; sid:616276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bloodwithoutcovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bloodwithoutcovid19vaccine.com"; sid:616277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brightstarcarecovidtest-bedfordnh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brightstarcarecovidtest-bedfordnh.com"; sid:616278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for caregiversofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"caregiversofcovid.com"; sid:616279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clarksvillecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clarksvillecovidtesting.com"; sid:616280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachingpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachingpostcorona.com"; sid:616281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachpostcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachpostcorona.com"; sid:616282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovidtest.com"; sid:616283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for communitycovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"communitycovidtesting.com"; sid:616284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for confessionsinapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"confessionsinapandemic.com"; sid:616285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpresafe.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpresafe.app"; sid:616286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsalut.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsalut.cat"; sid:616287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwinner.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwinner.club"; sid:616288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcorona.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcorona.blog"; sid:616289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcofcovid19.com"; sid:616290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcovid19testing.com"; sid:616291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abcovidtesting.com"; sid:616292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for actualcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"actualcovid.com"; sid:616293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for after-corona-club.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"after-corona-club.com"; sid:616294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19wc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19wc.com"; sid:616295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidvaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidvaccination.com"; sid:616296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antyszczepionkowcycovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antyszczepionkowcycovid19.club"; sid:616297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apnacovidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apnacovidresponse.com"; sid:616298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arccovid.com"; sid:616299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arccovidfaqs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arccovidfaqs.com"; sid:616300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for autocoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"autocoronatest.com"; sid:616301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avellinocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avellinocovid.com"; sid:616302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bjucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bjucovid.com"; sid:616303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bleepingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bleepingcovid.com"; sid:616304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bootcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bootcovid19.com"; sid:616305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccin.amsterdam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccin.amsterdam"; sid:616306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidkiller.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidkiller.club"; sid:616307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrenassance.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrenassance.blog"; sid:616308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lavitadopoilcovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lavitadopoilcovid.blog"; sid:616309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 26storiesonepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"26storiesonepandemic.com"; sid:616310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 27wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"27wuhan.com"; sid:616311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 360covideos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"360covideos.com"; sid:616312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anythingcoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anythingcoronado.com"; sid:616313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bailbondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bailbondcorona.com"; sid:616314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bccovid-19.com"; sid:616315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitkiselcoronatedavisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitkiselcoronatedavisi.com"; sid:616316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitkiselcovid19tedavisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitkiselcovid19tedavisi.com"; sid:616317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitkiselcovidtedavisi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitkiselcovidtedavisi.com"; sid:616318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cafenocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cafenocovid.com"; sid:616319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvax.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvax.app"; sid:616320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for studiovaccinocovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"studiovaccinocovid19.blog"; sid:616321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinocovid19.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinocovid19.blog"; sid:616322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americandreampandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americandreampandemic.net"; sid:616323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid19.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid19.club"; sid:616324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovidowcy.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovidowcy.club"; sid:616325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcoronavirus.net"; sid:616326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinawuhan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinawuhan.net"; sid:616327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaca457.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaca457.net"; sid:616328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacation.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacation.blog"; sid:616329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-proever.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-proever.info"; sid:616330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-solidarity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-solidarity.net"; sid:616331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1919.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1919.net"; sid:616332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19freedom.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19freedom.club"; sid:616333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawsuit.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawsuit.info"; sid:616334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine-lawsuit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine-lawsuit.net"; sid:616335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleanersusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleanersusa.net"; sid:616336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinn.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinn.info"; sid:616337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidliving.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidliving.info"; sid:616338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghauler.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghauler.info"; sid:616339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlonghauler.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlonghauler.live"; sid:616340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnil.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnil.net"; sid:616341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidochum.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidochum.info"; sid:616342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebound.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebound.info"; sid:616343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrebound.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrebound.live"; sid:616344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstory.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstory.info"; sid:616345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor.live"; sid:616346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid.cat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid.cat"; sid:616347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lrwuhan.link - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lrwuhan.link"; sid:616348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidinn.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidinn.biz"; sid:616349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zerocovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zerocovid.club"; sid:616350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abccovid.com"; sid:616351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepuredestroyscovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepuredestroyscovid.biz"; sid:616352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepuredestroyscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepuredestroyscovid.com"; sid:616353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bidenpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bidenpandemic.com"; sid:616354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarol.com"; sid:616355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-speicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-speicheltest.com"; sid:616356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeicheltest.com"; sid:616357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-testcenters.com"; sid:616358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinationcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinationcenters.com"; sid:616359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccination-centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccination-centers.com"; sid:616360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinationcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinationcenters.com"; sid:616361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-vaccinecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-vaccinecenters.com"; sid:616362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccine-centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccine-centers.com"; sid:616363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinecenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinecenters.com"; sid:616364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus80.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus80.com"; sid:616365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshotclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshotclaim.com"; sid:616366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccine19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccine19.com"; sid:616367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19amplify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19amplify.com"; sid:616368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19antigensalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19antigensalivatest.com"; sid:616369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antigensalivatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antigensalivatest.com"; sid:616370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleanedbyactivepure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleanedbyactivepure.com"; sid:616371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometreatment.com"; sid:616372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killedbyactivepure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killedbyactivepure.com"; sid:616373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lifenavigator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lifenavigator.com"; sid:616374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pcr-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pcr-diagnostics.com"; sid:616375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shotclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shotclaim.com"; sid:616376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19speicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19speicheltest.com"; sid:616377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19speicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19speicheltest.com"; sid:616378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpassers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpassers.biz"; sid:616379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpassers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpassers.com"; sid:616380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testcenters.com"; sid:616381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineclaim.com"; sid:616382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinestivus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinestivus.com"; sid:616383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19v.com"; sid:616384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid202x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid202x.com"; sid:616385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20xx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20xx.com"; sid:616386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21cleaner.com"; sid:616387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21management.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21management.com"; sid:616388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21policy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21policy.com"; sid:616389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2g.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2g.com"; sid:616390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid4cluster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid4cluster.com"; sid:616391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid80.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid80.com"; sid:616392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidactivityrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidactivityrisk.com"; sid:616393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidandanxieyblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidandanxieyblog.com"; sid:616394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidassassination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidassassination.com"; sid:616395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclininc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclininc.com"; sid:616396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclinin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclinin.com"; sid:616397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrolcentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrolcentre.com"; sid:616398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcronic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcronic.com"; sid:616399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatanerds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatanerds.com"; sid:616400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfluvax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfluvax.com"; sid:616401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidg2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidg2.com"; sid:616402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidosauraus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidosauraus.com"; sid:616403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidosaurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidosaurus.com"; sid:616404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpd.com"; sid:616405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprophecypreview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprophecypreview.com"; sid:616406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestingsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestingsd.com"; sid:616407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidtestsd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidtestsd.com"; sid:616408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidreunion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidreunion.com"; sid:616409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidriskavoidanceprofile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidriskavoidanceprofile.com"; sid:616410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshotclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshotclaim.com"; sid:616411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-speicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-speicheltest.com"; sid:616412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidspeicheltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidspeicheltest.com"; sid:616413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurpassers.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurpassers.biz"; sid:616414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurpassers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurpassers.com"; sid:616415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest4me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest4me.com"; sid:616416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtester24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtester24.com"; sid:616417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationrecordcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationrecordcard.com"; sid:616418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinepharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinepharmacy.com"; sid:616419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinestivus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinestivus.com"; sid:616420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzenessentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzenessentials.com"; sid:616421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diamantescorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diamantescorona.com"; sid:616422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for duelocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"duelocovid.com"; sid:616423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicarchive.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicarchive.blog"; sid:616424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nofearcovid.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nofearcovid.blog"; sid:616425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surpasscovid19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surpasscovid19.biz"; sid:616426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surpasscovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surpasscovid.biz"; sid:616427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for activepuredestroyscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"activepuredestroyscovid.net"; sid:616428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronavirusmemorial.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronavirusmemorial.info"; sid:616429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancoronavirusmemorial.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancoronavirusmemorial.org"; sid:616430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovidalert.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovidalert.org"; sid:616431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathiscoutgroup.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathiscoutgroup.info"; sid:616432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatmax.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatmax.org"; sid:616433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatrealty.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatrealty.online"; sid:616434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidcoalition.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidcoalition.org"; sid:616435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2021.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2021.online"; sid:616436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-datensammlung.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-datensammlung.info"; sid:616437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronageneration.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronageneration.info"; sid:616438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasks.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasks.buzz"; sid:616439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask.shop"; sid:616440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasks.icu - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasks.icu"; sid:616441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarental.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarental.net"; sid:616442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest.bayern"; sid:616443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest24.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest24.berlin"; sid:616444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-1984.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-1984.blog"; sid:616445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid1984.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid1984.blog"; sid:616446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19live.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19live.club"; sid:616447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mutation.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mutation.org"; sid:616448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pal.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pal.online"; sid:616449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19shots.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19shots.info"; sid:616450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19surpassers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19surpassers.net"; sid:616451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.net"; sid:616452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccineclassaction.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccineclassaction.net"; sid:616453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidarmor.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidarmor.biz"; sid:616454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenter.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenter.online"; sid:616455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcredentialing.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcredentialing.online"; sid:616456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covided.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covided.org"; sid:616457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvaders.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvaders.net"; sid:616458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidotest.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidotest.info"; sid:616459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidotest.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidotest.org"; sid:616460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidotest.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidotest.shop"; sid:616461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprophecy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprophecy.net"; sid:616462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshottrojan.news - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshottrojan.news"; sid:616463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurpassers.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurpassers.net"; sid:616464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvakcina.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvakcina.online"; sid:616465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-covid.online"; sid:616466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-vaccination.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-vaccination.online"; sid:616467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for e-vaccine.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"e-vaccine.online"; sid:616468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for immune2covid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"immune2covid.net"; sid:616469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insight-covid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insight-covid19.org"; sid:616470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latinos4covid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latinos4covid.online"; sid:616471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latinoscovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latinoscovid.org"; sid:616472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid19.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid19.online"; sid:616473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidinfo.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidinfo.net"; sid:616474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longcovidrelief.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longcovidrelief.org"; sid:616475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacovid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacovid19.info"; sid:616476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernacovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernacovid19.org"; sid:616477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidalert.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidalert.org"; sid:616478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postpandemicera.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postpandemicera.online"; sid:616479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schnelltest-corona.bayern - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schnelltest-corona.bayern"; sid:616480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovidclub.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovidclub.org"; sid:616481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surpasscovid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surpasscovid19.net"; sid:616482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for surpasscovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"surpasscovid.net"; sid:616483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecovid19vaccine.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecovid19vaccine.live"; sid:616484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecovid19vaccine.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecovid19vaccine.online"; sid:616485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecovid19vaccine.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecovid19vaccine.org"; sid:616486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethecovid19vaccine.live - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethecovid19vaccine.live"; sid:616487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethecovid19vaccine.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethecovid19vaccine.online"; sid:616488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takethecovid19vaccine.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takethecovid19vaccine.org"; sid:616489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tallaalkacovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tallaalkacovid19.org"; sid:616490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testcovid.moscow - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testcovid.moscow"; sid:616491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnow-covid-19-antigen.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnow-covid-19-antigen.net"; sid:616492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnow-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnow-covid-19.net"; sid:616493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testnow-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testnow-covid19.net"; sid:616494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for umassfight-covid-diningjobs.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"umassfight-covid-diningjobs.online"; sid:616495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscovidtesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscovidtesting.net"; sid:616496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinefaq.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinefaq.org"; sid:616497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covid19-prver-knb.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covid19-prver-knb.info"; sid:616498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidokovn-04a9l0q.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidokovn-04a9l0q.online"; sid:616499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--covidvakcna-wcb.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--covidvakcna-wcb.online"; sid:616500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--vacunacin-d7a.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--vacunacin-d7a.org"; sid:616501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123bharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123bharat.com"; sid:616502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covidvaccine.com"; sid:616503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercovidtestingguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercovidtestingguide.com"; sid:616504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecovidrapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecovidrapidtests.com"; sid:616505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awesomevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awesomevaccine.com"; sid:616506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b117vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b117vaccine.com"; sid:616507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcangaram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcangaram.com"; sid:616508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathienterprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathienterprise.com"; sid:616509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatkissanmandi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatkissanmandi.com"; sid:616510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatrupees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatrupees.com"; sid:616511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blackcovidcoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blackcovidcoalition.com"; sid:616512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bycovid19vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bycovid19vaccine.com"; sid:616513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bycovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bycovidvaccine.com"; sid:616514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid19vaccinelocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid19vaccinelocations.com"; sid:616515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20.click"; sid:616516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.click"; sid:616517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidescapeitalia.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidescapeitalia.club"; sid:616518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtest19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtest19.biz"; sid:616519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.biz"; sid:616520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcovid19.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcovid19.app"; sid:616521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 51vaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"51vaccine.com"; sid:616522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 834coronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"834coronado.com"; sid:616523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav.click - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav.click"; sid:616524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid21.africa - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid21.africa"; sid:616525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getthevaccine.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getthevaccine.app"; sid:616526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mentalvaccine.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mentalvaccine.best"; sid:616527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinejobsny.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinejobsny.biz"; sid:616528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 9bharatsamachar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"9bharatsamachar.com"; sid:616529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aawobharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aawobharat.com"; sid:616530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aides-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aides-covid.com"; sid:616531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancovidcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancovidcare.com"; sid:616532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidjobs.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidjobs.club"; sid:616533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidwork.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidwork.club"; sid:616534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for apnabharatdarshan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"apnabharatdarshan.com"; sid:616535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awarecovids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awarecovids.com"; sid:616536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharata-indonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharata-indonesia.com"; sid:616537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatammusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatammusic.com"; sid:616538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharataqua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharataqua.com"; sid:616539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharateez.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharateez.com"; sid:616540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathinaturals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathinaturals.com"; sid:616541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatikisan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatikisan.com"; sid:616542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookbizpostcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookbizpostcovid.com"; sid:616543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdcvaccine-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdcvaccine-us.com"; sid:616544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for christmascorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"christmascorona2020.com"; sid:616545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocoastalrentals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocoastalrentals.com"; sid:616546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalformulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalformulations.com"; sid:616547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalshield.com"; sid:616548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclear.band - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclear.band"; sid:616549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.art"; sid:616550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.baby - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.baby"; sid:616551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.beer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.beer"; sid:616552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.best - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.best"; sid:616553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.bond - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.bond"; sid:616554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.buzz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.buzz"; sid:616555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirus.cam - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirus.cam"; sid:616556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.christmas - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.christmas"; sid:616557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidjobs.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidjobs.club"; sid:616558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for postcovidwork.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"postcovidwork.club"; sid:616559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2021vaccinated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2021vaccinated.com"; sid:616560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adcovidfighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adcovidfighters.com"; sid:616561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akhandbharatlive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akhandbharatlive.com"; sid:616562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asapcovidantibodytest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asapcovidantibodytest.com"; sid:616563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asapcovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asapcovidtesting.com"; sid:616564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atmikbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atmikbharat.com"; sid:616565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atmikbharatengineering.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atmikbharatengineering.com"; sid:616566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beeremovalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beeremovalcorona.com"; sid:616567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for befreevaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"befreevaccination.com"; sid:616568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatdeliveries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatdeliveries.com"; sid:616569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathijyotish.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathijyotish.app"; sid:616570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathijyotish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathijyotish.com"; sid:616571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatshilp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatshilp.com"; sid:616572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharattradition.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharattradition.club"; sid:616573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for browardcovidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"browardcovidvaccine.com"; sid:616574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcovid.com"; sid:616575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkvaccine.com"; sid:616576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinadragoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinadragoncorona.com"; sid:616577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for claim-pandemicfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"claim-pandemicfund.com"; sid:616578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnncovidmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnncovidmap.com"; sid:616579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coachinginacovidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coachinginacovidworld.com"; sid:616580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for codependentincovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"codependentincovid19.com"; sid:616581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for conciergecovidclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"conciergecovidclinic.com"; sid:616582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawork.com"; sid:616583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillnow.com"; sid:616584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest-frankfurt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest-frankfurt.com"; sid:616585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest-hamburg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest-hamburg.com"; sid:616586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltests.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltests.berlin"; sid:616587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-schnelltest-stuttgart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-schnelltest-stuttgart.com"; sid:616588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateam.black - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateam.black"; sid:616589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controled.com"; sid:616590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19controlproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19controlproducts.com"; sid:616591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthpass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthpass.com"; sid:616592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homeproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homeproducts.com"; sid:616593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nanoedcontroled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nanoedcontroled.com"; sid:616594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19resultstoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19resultstoday.com"; sid:616595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testedtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testedtoday.com"; sid:616596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testingculvercity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testingculvercity.com"; sid:616597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingnearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingnearyou.com"; sid:616598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20-pcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20-pcr.com"; sid:616599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20victims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20victims.com"; sid:616600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidangelwings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidangelwings.com"; sid:616601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarding.com"; sid:616602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoward.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoward.com"; sid:616603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddatatosee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddatatosee.com"; sid:616604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddouceur.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddouceur.com"; sid:616605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidecodisinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidecodisinfection.com"; sid:616606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinvisiblemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinvisiblemask.com"; sid:616607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmonuments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmonuments.com"; sid:616608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnaturalremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnaturalremedy.com"; sid:616609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecording.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecording.com"; sid:616610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrelieflowermybillsprogram.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrelieflowermybillsprogram.com"; sid:616611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresetresolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresetresolution.com"; sid:616612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetyfirst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetyfirst.com"; sid:616613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstand.com"; sid:616614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstatues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstatues.com"; sid:616615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestbook.com"; sid:616616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-testcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-testcenter.com"; sid:616617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinationid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinationid.com"; sid:616618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxidcard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxidcard.com"; sid:616619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxid.com"; sid:616620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusrecovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusrecovery.com"; sid:616621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhakarecoronatreater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhakarecoronatreater.com"; sid:616622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyond-corona-nausicaa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyond-corona-nausicaa.com"; sid:616623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatanatyamcostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatanatyamcostumes.com"; sid:616624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatanatyampracticesaree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatanatyampracticesaree.com"; sid:616625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatdecorater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatdecorater.com"; sid:616626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatstainless.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatstainless.com"; sid:616627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bradentoncovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bradentoncovid.com"; sid:616628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for businessonholdincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"businessonholdincorona.com"; sid:616629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovidclassaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovidclassaction.com"; sid:616630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clinics4covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clinics4covid.com"; sid:616631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-istishericare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-istishericare.com"; sid:616632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavoids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavoids.com"; sid:616633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hastabakim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hastabakim.com"; sid:616634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20india.com"; sid:616635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidartworks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidartworks.com"; sid:616636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusterscalgary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusterscalgary.com"; sid:616637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaredfw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaredfw.com"; sid:616638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcommunitycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcommunitycare.com"; sid:616639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmemorabilia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmemorabilia.com"; sid:616640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmomclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmomclub.com"; sid:616641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmomcollective.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmomcollective.com"; sid:616642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmomentos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmomentos.com"; sid:616643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutate.com"; sid:616644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutated.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutated.com"; sid:616645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutates.com"; sid:616646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmutating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmutating.com"; sid:616647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecordings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecordings.com"; sid:616648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrecoverygames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrecoverygames.com"; sid:616649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidremedykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidremedykit.com"; sid:616650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscorecards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscorecards.com"; sid:616651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestingtruck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestingtruck.com"; sid:616652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvdvaccination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvdvaccination.com"; sid:616653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dodgecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dodgecovidtesting.com"; sid:616654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for febharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"febharat.com"; sid:616655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccines.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccines.center"; sid:616656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020thecovidmusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020thecovidmusical.com"; sid:616657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 58wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"58wuhan.com"; sid:616658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for accesstocovid19vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"accesstocovid19vaccines.com"; sid:616659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for addwithbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"addwithbharat.com"; sid:616660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatdigi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatdigi.com"; sid:616661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatmehra.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatmehra.com"; sid:616662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharattoyhouse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharattoyhouse.com"; sid:616663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bottleforvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bottleforvaccine.com"; sid:616664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bottlevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bottlevaccine.com"; sid:616665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buywansfordvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buywansfordvaccine.com"; sid:616666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for capecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"capecovidtesting.com"; sid:616667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cloudvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cloudvaccines.com"; sid:616668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronab117.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronab117.com"; sid:616669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacafeaustin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacafeaustin.com"; sid:616670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocay.com"; sid:616671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadosouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadosouth.com"; sid:616672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafalsealarm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafalsealarm.com"; sid:616673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagargilingtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagargilingtest.com"; sid:616674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagorgeltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagorgeltest.com"; sid:616675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschnelltestberlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschnelltestberlin.com"; sid:616676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasneltestloket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasneltestloket.com"; sid:616677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-089.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-089.com"; sid:616678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatest-bayern.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatest-bayern.com"; sid:616679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatransports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatransports.com"; sid:616680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusb117.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusb117.com"; sid:616681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiis.com"; sid:616682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19b117.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19b117.com"; sid:616683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19condolences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19condolences.com"; sid:616684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19craft.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19craft.com"; sid:616685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingtravel.com"; sid:616686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinatedyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinatedyes.com"; sid:616687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccinelosangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccinelosangeles.com"; sid:616688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19variants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19variants.com"; sid:616689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaxxedyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaxxedyes.com"; sid:616690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbuddyteddybear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbuddyteddybear.com"; sid:616691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhunnies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhunnies.com"; sid:616692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidiis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidiis.com"; sid:616693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinterventionfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinterventionfund.com"; sid:616694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidisdanger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidisdanger.com"; sid:616695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewssex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewssex.com"; sid:616696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnurselife.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnurselife.com"; sid:616697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrobe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrobe.com"; sid:616698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsneltestloket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsneltestloket.com"; sid:616699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsomnia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsomnia.com"; sid:616700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstapo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstapo.com"; sid:616701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstorage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstorage.com"; sid:616702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteatingtoyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteatingtoyou.com"; sid:616703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccinatedyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccinatedyes.com"; sid:616704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for co-vidvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"co-vidvaccine.com"; sid:616705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineinjurylaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineinjurylaw.com"; sid:616706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaccineonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaccineonline.com"; sid:616707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaks.com"; sid:616708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvariante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvariante.com"; sid:616709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvaxxedyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvaxxedyes.com"; sid:616710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dhanwanbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dhanwanbharat.com"; sid:616711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easytestcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easytestcovid.com"; sid:616712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fincorona.com"; sid:616713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freetestingforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freetestingforcovid.com"; sid:616714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myvaccines.app - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myvaccines.app"; sid:616715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparspandemic.cloud - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparspandemic.cloud"; sid:616716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aftercorona.rocks - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aftercorona.rocks"; sid:616717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baatbharatki.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baatbharatki.org"; sid:616718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatnatyam.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatnatyam.net"; sid:616719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bookmyvaccine.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bookmyvaccine.org"; sid:616720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.broker - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.broker"; sid:616721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.business"; sid:616722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinatieschema.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinatieschema.online"; sid:616723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccinatiewijzer.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccinatiewijzer.online"; sid:616724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.accountants - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.accountants"; sid:616725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analysis.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analysis.info"; sid:616726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-icrc.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-icrc.org"; sid:616727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixes.expert - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixes.expert"; sid:616728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixes.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixes.guru"; sid:616729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19phoenixes.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19phoenixes.photography"; sid:616730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccine.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccine.healthcare"; sid:616731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020-2021.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020-2021.info"; sid:616732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2020-2021.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2020-2021.org"; sid:616733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-22.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-22.info"; sid:616734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-22.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-22.org"; sid:616735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagenda.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagenda.info"; sid:616736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhometest.shop - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhometest.shop"; sid:616737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphoenixes.guru - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphoenixes.guru"; sid:616738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidphoenixes.photography - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidphoenixes.photography"; sid:616739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproever.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproever.info"; sid:616740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsucks.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsucks.life"; sid:616741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summary.site - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summary.site"; sid:616742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrack.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrack.life"; sid:616743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvariante.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvariante.net"; sid:616744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvariants.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvariants.org"; sid:616745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for exposecovid.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"exposecovid.info"; sid:616746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecovidcare.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecovidcare.org"; sid:616747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckcovid.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckcovid.biz"; sid:616748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.art - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.art"; sid:616749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.beer - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.beer"; sid:616750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.dating - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.dating"; sid:616751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.online"; sid:616752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goodbyecovid.party - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goodbyecovid.party"; sid:616753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for havesurvivedthepandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"havesurvivedthepandemic.info"; sid:616754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for havesurvivedthepandemic.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"havesurvivedthepandemic.org"; sid:616755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jwapandemicoutreach.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jwapandemicoutreach.org"; sid:616756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mijnvaccinatiebewijs.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mijnvaccinatiebewijs.online"; sid:616757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nckupandemic.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nckupandemic.info"; sid:616758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiceverything.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiceverything.org"; sid:616759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-proof-income.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-proof-income.online"; sid:616760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventnetcovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventnetcovid19.org"; sid:616761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezzavaccinocovid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezzavaccinocovid19.org"; sid:616762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sicurezzavaccinocovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sicurezzavaccinocovid.org"; sid:616763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sparspandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sparspandemic.net"; sid:616764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for station-anticovid.online - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"station-anticovid.online"; sid:616765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-covid19.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-covid19.info"; sid:616766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testing-covid19.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testing-covid19.org"; sid:616767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thevaccinated.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thevaccinated.club"; sid:616768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uclacovidinfo.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uclacovidinfo.org"; sid:616769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinatedand.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinatedand.org"; sid:616770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinationwatch.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinationwatch.org"; sid:616771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinemate.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinemate.org"; sid:616772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccine-passport.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccine-passport.org"; sid:616773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinepassports.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinepassports.org"; sid:616774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoacasa.info - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoacasa.info"; sid:616775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wwwessexcovid.org - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wwwessexcovid.org"; sid:616776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abhyudaybharatindustries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abhyudaybharatindustries.com"; sid:616777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for approvedcovidmouthwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"approvedcovidmouthwash.com"; sid:616778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arewevaccinatedyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arewevaccinatedyet.com"; sid:616779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for badcoviddrug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"badcoviddrug.com"; sid:616780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecovidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecovidtesting.com"; sid:616781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatgour.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatgour.com"; sid:616782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharathrshastry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharathrshastry.com"; sid:616783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatlightindustries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatlightindustries.com"; sid:616784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatoverseasedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatoverseasedu.com"; sid:616785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatrefrigeration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatrefrigeration.com"; sid:616786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatstories.com"; sid:616787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatvartman.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatvartman.com"; sid:616788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatvivah.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatvivah.com"; sid:616789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for binaxcovidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"binaxcovidtest.com"; sid:616790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashbackbharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashbackbharat.com"; sid:616791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.accountants - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.accountants"; sid:616792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.actor - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.actor"; sid:616793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.airforce - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.airforce"; sid:616794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19health.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19health.club"; sid:616795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.accountant - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.accountant"; sid:616796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.accountants - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.accountants"; sid:616797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.actor - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.actor"; sid:616798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.associates - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.associates"; sid:616799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.bargains - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.bargains"; sid:616800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.builders - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.builders"; sid:616801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.cab - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.cab"; sid:616802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.camera - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.camera"; sid:616803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.catering - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.catering"; sid:616804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.berlin - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.berlin"; sid:616805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidcompiler.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidcompiler.club"; sid:616806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccineday.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccineday.blog"; sid:616807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaccinoday.blog - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaccinoday.blog"; sid:616808; )